--- /dev/null
+From c86cb9bbb724a34ad3d7f8668c86a02d697ceb92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 20:08:13 +0200
+Subject: ACPI / LPSS: Exclude I2C busses shared with PUNIT from
+ pmc_atom_d3_mask
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 86b62e5cd8965d3056f9e9ccdec51631c37add81 ]
+
+lpss_iosf_enter_d3_state() checks if all hw-blocks using the DMA
+controllers are in d3 before powering down the DMA controllers.
+
+But on devices, where the I2C bus connected to the PMIC is shared by
+the PUNIT, the controller for that bus will never reach d3 since it has
+an effectively empty _PS3 method. Instead it appears to automatically
+power-down during S0i3 and we never see it as being in d3.
+
+This causes the DMA controllers to never be powered-down on these devices,
+causing them to never reach S0i3. This commit uses the ACPI _SEM method
+to detect if an I2C bus is shared with the PUNIT and if it is, it removes
+it from the mask of devices which lpss_iosf_enter_d3_state() checks for.
+
+This fixes these devices never reaching any S0ix states.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index c651e206d7960..7eda27d43b482 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -99,6 +99,9 @@ struct lpss_private_data {
+ u32 prv_reg_ctx[LPSS_PRV_REG_COUNT];
+ };
+
++/* Devices which need to be in D3 before lpss_iosf_enter_d3_state() proceeds */
++static u32 pmc_atom_d3_mask = 0xfe000ffe;
++
+ /* LPSS run time quirks */
+ static unsigned int lpss_quirks;
+
+@@ -175,6 +178,21 @@ static void byt_pwm_setup(struct lpss_private_data *pdata)
+
+ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ {
++ const char *uid_str = acpi_device_uid(pdata->adev);
++ acpi_handle handle = pdata->adev->handle;
++ unsigned long long shared_host = 0;
++ acpi_status status;
++ long uid = 0;
++
++ /* Expected to always be true, but better safe then sorry */
++ if (uid_str)
++ uid = simple_strtol(uid_str, NULL, 10);
++
++ /* Detect I2C bus shared with PUNIT and ignore its d3 status */
++ status = acpi_evaluate_integer(handle, "_SEM", NULL, &shared_host);
++ if (ACPI_SUCCESS(status) && shared_host && uid)
++ pmc_atom_d3_mask &= ~(BIT_LPSS2_F1_I2C1 << (uid - 1));
++
+ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+@@ -894,7 +912,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Here we read the values related to LPSS power island, i.e. LPSS
+ * devices, excluding both LPSS DMA controllers, along with SCC domain.
+ */
+- u32 func_dis, d3_sts_0, pmc_status, pmc_mask = 0xfe000ffe;
++ u32 func_dis, d3_sts_0, pmc_status;
+ int ret;
+
+ ret = pmc_atom_read(PMC_FUNC_DIS, &func_dis);
+@@ -912,7 +930,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Shutdown both LPSS DMA controllers if and only if all other devices
+ * are already in D3hot.
+ */
+- pmc_status = (~(d3_sts_0 | func_dis)) & pmc_mask;
++ pmc_status = (~(d3_sts_0 | func_dis)) & pmc_atom_d3_mask;
+ if (pmc_status)
+ goto exit;
+
+--
+2.20.1
+
--- /dev/null
+From 0575453770cbbd216a0e326ea8afbcf6bc572c0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 12:31:32 +0100
+Subject: ALSA: hda: Fix implicit definition of pci_iomap() on SH
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit d9b84a15892c02334ac8a5c28865ae54168d9b22 ]
+
+Include asm/io.h directly so we've got a definition of pci_iomap(), the
+current set of includes do this implicitly on most architectures but not
+on SH.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_ca0132.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 3e978b75be9ac..f2cabfdced05c 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -31,6 +31,7 @@
+ #include <linux/types.h>
+ #include <linux/io.h>
+ #include <linux/pci.h>
++#include <asm/io.h>
+ #include <sound/core.h>
+ #include "hda_codec.h"
+ #include "hda_local.h"
+--
+2.20.1
+
--- /dev/null
+From e3744214729a81c71b1f3bba945d2e0a9f85c700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 16:39:10 +0200
+Subject: ALSA: intel8x0m: Register irq handler after register initializations
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ]
+
+The interrupt handler has to be acquired after the other resource
+initialization when allocated with IRQF_SHARED. Otherwise it's
+triggered before the resource gets ready, and may lead to unpleasant
+behavior.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/intel8x0m.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 943a726b1c1b0..c84629190cbaf 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ }
+
+ port_inited:
+- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
+- KBUILD_MODNAME, chip)) {
+- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
+- snd_intel8x0m_free(chip);
+- return -EBUSY;
+- }
+- chip->irq = pci->irq;
+- pci_set_master(pci);
+- synchronize_irq(chip->irq);
+-
+ /* initialize offsets */
+ chip->bdbars_count = 2;
+ tbl = intel_regs;
+@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ chip->int_sta_reg = ICH_REG_GLOB_STA;
+ chip->int_sta_mask = int_sta_masks;
+
++ pci_set_master(pci);
++
+ if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+ }
+
++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, chip)) {
++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
++ snd_intel8x0m_free(chip);
++ return -EBUSY;
++ }
++ chip->irq = pci->irq;
++
+ if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From e4b3b898652fca12c9041374ff1e6aefeb9fb0a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 12:21:45 +0300
+Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ]
+
+The "frames" variable is unsigned so the error handling doesn't work
+properly.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/pcm_plugin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 71571d9921598..31cb2acf8afcc 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+--
+2.20.1
+
--- /dev/null
+From 109ebf35fca718de41ba1635c072a33973b00c05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 12:49:43 +0200
+Subject: ALSA: seq: Do error checks at creating system ports
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ]
+
+snd_seq_system_client_init() doesn't check the errors returned from
+its port creations. Let's do it properly and handle the error paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_system.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
+index 8ce1d0b40dce1..ce1f1e4727ab1 100644
+--- a/sound/core/seq/seq_system.c
++++ b/sound/core/seq/seq_system.c
+@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void)
+ {
+ struct snd_seq_port_callback pcallbacks;
+ struct snd_seq_port_info *port;
++ int err;
+
+ port = kzalloc(sizeof(*port), GFP_KERNEL);
+ if (!port)
+@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+
+ /* register announcement port */
+ strcpy(port->name, "Announce");
+@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+ announce_port = port->addr.port;
+
+ kfree(port);
+ return 0;
++
++ error_port:
++ snd_seq_system_client_done();
++ kfree(port);
++ return err;
+ }
+
+
+ /* unregister our internal client */
+-void __exit snd_seq_system_client_done(void)
++void snd_seq_system_client_done(void)
+ {
+ int oldsysclient = sysclient;
+
+--
+2.20.1
+
--- /dev/null
+From 18ee2fab93dccc4266c7b368281cc9ba78e5db16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Aug 2018 17:28:53 -0700
+Subject: android: binder: no outgoing transaction when thread todo has
+ transaction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sherry Yang <sherryy@android.com>
+
+[ Upstream commit 44b73962cb25f1c8170ea695c4564b05a75e1fd4 ]
+
+When a process dies, failed reply is sent to the sender of any transaction
+queued on a dead thread's todo list. The sender asserts that the
+received failed reply corresponds to the head of the transaction stack.
+This assert can fail if the dead thread is allowed to send outgoing
+transactions when there is already a transaction on its todo list,
+because this new transaction can end up on the transaction stack of the
+original sender. The following steps illustrate how this assertion can
+fail.
+
+1. Thread1 sends txn19 to Thread2
+ (T1->transaction_stack=txn19, T2->todo+=txn19)
+2. Without processing todo list, Thread2 sends txn20 to Thread1
+ (T1->todo+=txn20, T2->transaction_stack=txn20)
+3. T1 processes txn20 on its todo list
+ (T1->transaction_stack=txn20->txn19, T1->todo=<empty>)
+4. T2 dies, T2->todo cleanup attempts to send failed reply for txn19, but
+ T1->transaction_stack points to txn20 -- assertion failes
+
+Step 2. is the incorrect behavior. When there is a transaction on a
+thread's todo list, this thread should not be able to send any outgoing
+synchronous transactions. Only the head of the todo list needs to be
+checked because only threads that are waiting for proc work can directly
+receive work from another thread, and no work is allowed to be queued
+on such a thread without waking up the thread. This patch also enforces
+that a thread is not waiting for proc work when a work is directly
+enqueued to its todo list.
+
+Acked-by: Arve Hjønnevåg <arve@android.com>
+Signed-off-by: Sherry Yang <sherryy@android.com>
+Reviewed-by: Martijn Coenen <maco@android.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 44 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 32 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 6e04e7a707a12..cf4367135a00b 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -822,6 +822,7 @@ static void
+ binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
+ struct binder_work *work)
+ {
++ WARN_ON(!list_empty(&thread->waiting_thread_node));
+ binder_enqueue_work_ilocked(work, &thread->todo);
+ }
+
+@@ -839,6 +840,7 @@ static void
+ binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
+ struct binder_work *work)
+ {
++ WARN_ON(!list_empty(&thread->waiting_thread_node));
+ binder_enqueue_work_ilocked(work, &thread->todo);
+ thread->process_todo = true;
+ }
+@@ -1270,19 +1272,12 @@ static int binder_inc_node_nilocked(struct binder_node *node, int strong,
+ } else
+ node->local_strong_refs++;
+ if (!node->has_strong_ref && target_list) {
++ struct binder_thread *thread = container_of(target_list,
++ struct binder_thread, todo);
+ binder_dequeue_work_ilocked(&node->work);
+- /*
+- * Note: this function is the only place where we queue
+- * directly to a thread->todo without using the
+- * corresponding binder_enqueue_thread_work() helper
+- * functions; in this case it's ok to not set the
+- * process_todo flag, since we know this node work will
+- * always be followed by other work that starts queue
+- * processing: in case of synchronous transactions, a
+- * BR_REPLY or BR_ERROR; in case of oneway
+- * transactions, a BR_TRANSACTION_COMPLETE.
+- */
+- binder_enqueue_work_ilocked(&node->work, target_list);
++ BUG_ON(&thread->todo != target_list);
++ binder_enqueue_deferred_thread_work_ilocked(thread,
++ &node->work);
+ }
+ } else {
+ if (!internal)
+@@ -2733,6 +2728,7 @@ static void binder_transaction(struct binder_proc *proc,
+ {
+ int ret;
+ struct binder_transaction *t;
++ struct binder_work *w;
+ struct binder_work *tcomplete;
+ binder_size_t *offp, *off_end, *off_start;
+ binder_size_t off_min;
+@@ -2874,6 +2870,29 @@ static void binder_transaction(struct binder_proc *proc,
+ goto err_invalid_target_handle;
+ }
+ binder_inner_proc_lock(proc);
++
++ w = list_first_entry_or_null(&thread->todo,
++ struct binder_work, entry);
++ if (!(tr->flags & TF_ONE_WAY) && w &&
++ w->type == BINDER_WORK_TRANSACTION) {
++ /*
++ * Do not allow new outgoing transaction from a
++ * thread that has a transaction at the head of
++ * its todo list. Only need to check the head
++ * because binder_select_thread_ilocked picks a
++ * thread from proc->waiting_threads to enqueue
++ * the transaction, and nothing is queued to the
++ * todo list while the thread is on waiting_threads.
++ */
++ binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
++ proc->pid, thread->pid);
++ binder_inner_proc_unlock(proc);
++ return_error = BR_FAILED_REPLY;
++ return_error_param = -EPROTO;
++ return_error_line = __LINE__;
++ goto err_bad_todo_list;
++ }
++
+ if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
+ struct binder_transaction *tmp;
+
+@@ -3256,6 +3275,7 @@ err_alloc_tcomplete_failed:
+ kfree(t);
+ binder_stats_deleted(BINDER_STAT_TRANSACTION);
+ err_alloc_t_failed:
++err_bad_todo_list:
+ err_bad_call_stack:
+ err_empty_call_stack:
+ err_dead_binder:
+--
+2.20.1
+
--- /dev/null
+From 40f51a111641262476181d1121ea08bd41794ff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 18:26:22 +0800
+Subject: ARM: at91: pm: call put_device instead of of_node_put in
+ at91_pm_config_ws
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 95590a6286c547b7287d01c55515fb96b904aa03 ]
+
+of_find_device_by_node takes a reference to the struct device when it
+finds a match via get_device. but it fails to put_device in
+at91_pm_config_ws, for_each_matching_node_and_match will get and put
+the node properly, there is no need to call the of_put_node. Therefore,
+just call put_device instead of of_node_put in at91_pm_config_ws.
+
+Fixes: d7484f5c6b3b ("ARM: at91: pm: configure wakeup sources for ULP1 mode")
+Suggested-by: Claudiu Beznea <Claudiu.Beznea@microchip.com>
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 0921e2c10edfd..e2e4df3d11e53 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -143,15 +143,15 @@ static int at91_pm_config_ws(unsigned int pm_mode, bool set)
+
+ /* Check if enabled on SHDWC. */
+ if (wsi->shdwc_mr_bit && !(val & wsi->shdwc_mr_bit))
+- goto put_node;
++ goto put_device;
+
+ mode |= wsi->pmc_fsmr_bit;
+ if (wsi->set_polarity)
+ polarity |= wsi->pmc_fsmr_bit;
+ }
+
+-put_node:
+- of_node_put(np);
++put_device:
++ put_device(&pdev->dev);
+ }
+
+ if (mode) {
+--
+2.20.1
+
--- /dev/null
+From 33c7604ab1f3143ab335a25aa0bd63a8931cdfe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 17:33:40 -0500
+Subject: ARM: dts: am335x-evm: fix number of cpsw
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ]
+
+am335x-evm has only one CPSW external port physically wired, but DT defines
+2 ext. ports. As result, PHY connection failure reported for the second
+ext. port.
+
+Update DT to reflect am335x-evm board HW configuration, and, while here,
+switch to use phy-handle instead of phy_id.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index 20bbb899b3b76..cc59e42c91342 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -731,6 +731,7 @@
+ pinctrl-0 = <&cpsw_default>;
+ pinctrl-1 = <&cpsw_sleep>;
+ status = "okay";
++ slaves = <1>;
+ };
+
+ &davinci_mdio {
+@@ -738,15 +739,14 @@
+ pinctrl-0 = <&davinci_mdio_default>;
+ pinctrl-1 = <&davinci_mdio_sleep>;
+ status = "okay";
+-};
+
+-&cpsw_emac0 {
+- phy_id = <&davinci_mdio>, <0>;
+- phy-mode = "rgmii-txid";
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
+ };
+
+-&cpsw_emac1 {
+- phy_id = <&davinci_mdio>, <1>;
++&cpsw_emac0 {
++ phy-handle = <ðphy0>;
+ phy-mode = "rgmii-txid";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 904b5f10bb24c65ee80d2228a06526fd6caa0990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:27 -0500
+Subject: ARM: dts: aspeed: Fix I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 1426d40e11f730e0c0fd3700a7048082f87b0e6e ]
+
+dtc has new checks for I2C buses. The ASpeed dts files have a node named
+'i2c' which causes a false positive warning. As the node is a 'simple-bus',
+correct the node name to be 'bus' to fix the warnings.
+
+arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-opp-romulus.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-ast2500-evb.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-opp-palmetto.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-opp-witherspoon.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-opp-zaius.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+arch/arm/boot/dts/aspeed-bmc-quanta-q71l.dtb: Warning (i2c_bus_bridge): /ahb/apb/i2c@1e78a000: incorrect #size-cells for I2C bus
+
+Cc: Joel Stanley <joel@jms.id.au>
+Cc: Andrew Jeffery <andrew@aj.id.au>
+Cc: linux-aspeed@lists.ozlabs.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g4.dtsi | 2 +-
+ arch/arm/boot/dts/aspeed-g5.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
+index b23a983f95a53..69f6b9d2e7e7d 100644
+--- a/arch/arm/boot/dts/aspeed-g4.dtsi
++++ b/arch/arm/boot/dts/aspeed-g4.dtsi
+@@ -350,7 +350,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c@1e78a000 {
++ i2c: bus@1e78a000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
+index 87fdc146ff525..d107459fc0f89 100644
+--- a/arch/arm/boot/dts/aspeed-g5.dtsi
++++ b/arch/arm/boot/dts/aspeed-g5.dtsi
+@@ -410,7 +410,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c@1e78a000 {
++ i2c: bus@1e78a000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+--
+2.20.1
+
--- /dev/null
+From 54dc3a2fccde2908c5328993f8267cc458718855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:42:01 +0200
+Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
+
+From: Jay Foster <jayfoster@ieee.org>
+
+[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ]
+
+Fix a typo. No functional change made by this patch.
+
+Signed-off-by: Jay Foster <jayfoster@ieee.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index 1ee25a475be87..d16db1fa7e15c 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -570,7 +570,7 @@
+ };
+ };
+
+- uart1 {
++ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
+--
+2.20.1
+
--- /dev/null
+From 77ab2c166e5dbfc980f625a44805b1df12151cc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:28 -0500
+Subject: ARM: dts: atmel: Fix I2C and SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit c890ecdbe93d482512a911b299bfb009780a29c2 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/at91-dvk_som60.dtb: Warning (i2c_bus_reg): /ahb/apb/i2c@f0018000/eeprom@87: I2C bus unit address format error, expected "57"
+arch/arm/boot/dts/at91-dvk_som60.dtb: Warning (i2c_bus_reg): /ahb/apb/i2c@f0018000/ft5426@56: I2C bus unit address format error, expected "38"
+arch/arm/boot/dts/at91-vinco.dtb: Warning (i2c_bus_reg): /ahb/apb/i2c@f8024000/rtc@64: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/at91sam9260ek.dtb: Warning (spi_bus_reg): /ahb/apb/spi@fffc8000/mtd_dataflash@0: SPI bus unit address format error, expected "1"
+arch/arm/boot/dts/at91sam9g20ek_2mmc.dtb: Warning (spi_bus_reg): /ahb/apb/spi@fffc8000/mtd_dataflash@0: SPI bus unit address format error, expected "1"
+arch/arm/boot/dts/at91sam9g20ek.dtb: Warning (spi_bus_reg): /ahb/apb/spi@fffc8000/mtd_dataflash@0: SPI bus unit address format error, expected "1"
+arch/arm/boot/dts/at91sam9261ek.dtb: Warning (spi_bus_reg): /ahb/apb/spi@fffc8000/tsc2046@0: SPI bus unit address format error, expected "2"
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-dvk_su60_somc.dtsi | 4 ++--
+ arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi | 4 ++--
+ arch/arm/boot/dts/at91-vinco.dts | 2 +-
+ arch/arm/boot/dts/at91sam9260ek.dts | 2 +-
+ arch/arm/boot/dts/at91sam9261ek.dts | 2 +-
+ arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 2 +-
+ 6 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi b/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
+index bb86f17ed5ed1..21876da7c4425 100644
+--- a/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
++++ b/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
+@@ -70,9 +70,9 @@
+ &i2c1 {
+ status = "okay";
+
+- eeprom@87 {
++ eeprom@57 {
+ compatible = "giantec,gt24c32a", "atmel,24c32";
+- reg = <87>;
++ reg = <0x57>;
+ pagesize = <32>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi b/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
+index 4b9176dc5d029..df0f0cc575c18 100644
+--- a/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
++++ b/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
+@@ -59,9 +59,9 @@
+ &i2c1 {
+ status = "okay";
+
+- ft5426@56 {
++ ft5426@38 {
+ compatible = "focaltech,ft5426", "edt,edt-ft5406";
+- reg = <56>;
++ reg = <0x38>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_lcd_ctp_int>;
+
+diff --git a/arch/arm/boot/dts/at91-vinco.dts b/arch/arm/boot/dts/at91-vinco.dts
+index 1be9889a2b3a1..430277291e025 100644
+--- a/arch/arm/boot/dts/at91-vinco.dts
++++ b/arch/arm/boot/dts/at91-vinco.dts
+@@ -128,7 +128,7 @@
+ i2c2: i2c@f8024000 {
+ status = "okay";
+
+- rtc1: rtc@64 {
++ rtc1: rtc@32 {
+ compatible = "epson,rx8900";
+ reg = <0x32>;
+ };
+diff --git a/arch/arm/boot/dts/at91sam9260ek.dts b/arch/arm/boot/dts/at91sam9260ek.dts
+index d2b865f602932..07d1b571e6017 100644
+--- a/arch/arm/boot/dts/at91sam9260ek.dts
++++ b/arch/arm/boot/dts/at91sam9260ek.dts
+@@ -127,7 +127,7 @@
+
+ spi0: spi@fffc8000 {
+ cs-gpios = <0>, <&pioC 11 0>, <0>, <0>;
+- mtd_dataflash@0 {
++ mtd_dataflash@1 {
+ compatible = "atmel,at45", "atmel,dataflash";
+ spi-max-frequency = <50000000>;
+ reg = <1>;
+diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
+index a29fc04940762..a57f2d435dcae 100644
+--- a/arch/arm/boot/dts/at91sam9261ek.dts
++++ b/arch/arm/boot/dts/at91sam9261ek.dts
+@@ -160,7 +160,7 @@
+ spi-max-frequency = <15000000>;
+ };
+
+- tsc2046@0 {
++ tsc2046@2 {
+ reg = <2>;
+ compatible = "ti,ads7843";
+ interrupts-extended = <&pioC 2 IRQ_TYPE_EDGE_BOTH>;
+diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+index 71df3adfc7ca1..ec1f17ab6753b 100644
+--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+@@ -109,7 +109,7 @@
+
+ spi0: spi@fffc8000 {
+ cs-gpios = <0>, <&pioC 11 0>, <0>, <0>;
+- mtd_dataflash@0 {
++ mtd_dataflash@1 {
+ compatible = "atmel,at45", "atmel,dataflash";
+ spi-max-frequency = <50000000>;
+ reg = <1>;
+--
+2.20.1
+
--- /dev/null
+From c8cd19f0a2a959f18d2485e3b4999206cb3ffed9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:30 -0500
+Subject: ARM: dts: bcm: Fix SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit ab0b47d2eff413d60b0a1fc0c1f87f87f0d7f375 ]
+
+dtc has new checks for SPI buses. Fix the warnings in node names.
+
+arch/arm/boot/dts/bcm53340-ubnt-unifi-switch8.dtb: Warning (spi_bus_bridge): /axi@18000000/qspi@27200: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/bcm958525er.dtb: Warning (spi_bus_bridge): /axi/qspi@27200: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/bcm958525xmc.dtb: Warning (spi_bus_bridge): /axi/qspi@27200: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/bcm958622hr.dtb: Warning (spi_bus_bridge): /axi/qspi@27200: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/bcm958625hr.dtb: Warning (spi_bus_bridge): /axi/qspi@27200: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/bcm988312hr.dtb: Warning (spi_bus_bridge): /axi/qspi@27200: node name for SPI buses should be 'spi'
+
+Cc: Ray Jui <rjui@broadcom.com>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Jon Mason <jonmason@broadcom.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 2 +-
+ arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index 3084a7c957339..e4d49731287f6 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -216,7 +216,7 @@
+ reg = <0x33000 0x14>;
+ };
+
+- qspi: qspi@27200 {
++ qspi: spi@27200 {
+ compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 09ba850463228..2b219addeb449 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -273,7 +273,7 @@
+ brcm,nand-has-wp;
+ };
+
+- qspi: qspi@27200 {
++ qspi: spi@27200 {
+ compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+--
+2.20.1
+
--- /dev/null
+From af199b6d293191475df3550530b06a2216549971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 22:12:33 +0300
+Subject: ARM: dts: clearfog: fix sdhci supply property name
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit e807f0298144c06740022a2f900d86b7f115595e ]
+
+The vmmc phandle, like all power supply property names, must have the
+'-supply' suffix.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-clearfog.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-clearfog.dtsi b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+index 7c6ad2afb0947..1b0d0680c8b62 100644
+--- a/arch/arm/boot/dts/armada-388-clearfog.dtsi
++++ b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+@@ -48,7 +48,7 @@
+ &clearfog_sdhci_cd_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+- vmmc = <®_3p3v>;
++ vmmc-supply = <®_3p3v>;
+ wp-inverted;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 03528595c775ba213b4b377b2181c5ad10a856c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 08:55:03 +0200
+Subject: ARM: dts: exynos: Correct audio subsystem parent clock on Peach
+ Chromebooks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ff1e37c6809daab75f7b2dea1efe69330e8eb65b ]
+
+The proper parent clock for audio subsystem for Exynos5420 and Exynos5800
+SoCs is CLK_MAU_EPLL. This fixes following warning:
+
+ clk: failed to reparent mout_audss to fout_epll: -22
+
+Fixes: ed7d1307077e: ARM: dts: exynos: Enable HDMI audio support on Peach Pit
+Fixes: bae0f445c1e7: ARM: dts: exynos: Enable HDMI audio support on Peach Pi
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-peach-pit.dts | 2 +-
+ arch/arm/boot/dts/exynos5800-peach-pi.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 769d60d6c9006..9eb48cabcca45 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -153,7 +153,7 @@
+
+ &clock_audss {
+ assigned-clocks = <&clock_audss EXYNOS_MOUT_AUDSS>;
+- assigned-clock-parents = <&clock CLK_FOUT_EPLL>;
++ assigned-clock-parents = <&clock CLK_MAU_EPLL>;
+ };
+
+ &cpu0 {
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index 492e2cd2e559e..4398f2d1fe881 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -153,7 +153,7 @@
+
+ &clock_audss {
+ assigned-clocks = <&clock_audss EXYNOS_MOUT_AUDSS>;
+- assigned-clock-parents = <&clock CLK_FOUT_EPLL>;
++ assigned-clock-parents = <&clock CLK_MAU_EPLL>;
+ };
+
+ &cpu0 {
+--
+2.20.1
+
--- /dev/null
+From 8b8a1908d261e041fc06dc0b1deac316a19eb672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 09:46:59 +0200
+Subject: ARM: dts: exynos: Disable pull control for PMIC IRQ line on Artik5
+ board
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 62623718fd31d08b26ebea6c8b40f24924153ab7 ]
+
+S2MPS14 PMIC interrupt line on Exynos3250-based Artik5 evaluation board
+has external pull-up resistors, so disable any pull control for it in
+controller node. This fixes support for S2MPS14 PMIC interrupts and
+enables operation of wakeup from S2MPS14 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-artik5.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+index 620b50c19ead9..7c22cbf6f3d41 100644
+--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+@@ -69,6 +69,8 @@
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx3>;
+ interrupts = <5 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s2mps14_irq>;
+ reg = <0x66>;
+
+ s2mps14_osc: clocks {
+@@ -350,6 +352,11 @@
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV3>;
+ samsung,pin-val = <1>;
+ };
++
++ s2mps14_irq: s2mps14-irq {
++ samsung,pins = "gpx3-5";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
+ };
+
+ &rtc {
+--
+2.20.1
+
--- /dev/null
+From c02380992142385639482af906b4a37481ca9e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:41:35 +0200
+Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ]
+
+S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has
+external pull-up resistors, so disable any pull control for it in
+in controller node. This fixes support for S5M8767 interrupts and
+enables operation of wakeup from S5M8767 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index 9c8ab4b7fb2cf..4ab1f1c66c27f 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -170,6 +170,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s5m8767_irq>;
+
+ vinb1-supply = <&main_dc_reg>;
+ vinb2-supply = <&main_dc_reg>;
+@@ -530,6 +532,13 @@
+ cap-sd-highspeed;
+ };
+
++&pinctrl_0 {
++ s5m8767_irq: s5m8767-irq {
++ samsung,pins = "gpx3-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &rtc {
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 9169b890cc314ac601d369364fea89a5546a3511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jul 2018 12:12:28 +0200
+Subject: ARM: dts: exynos: Fix HDMI-HPD line handling on Arndale
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 21cb5a27483a3cfdbcb7508a06a30c0a485e1211 ]
+
+HDMI-HPD was set active low, moreover by default pincontrol chip sets
+pull-down on the pin. As a result HDMI driver assumes TV is always
+connected regardless of actual state. The patch fixes it.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 4 +++-
+ arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 5 +++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index bb3fcd652b5d7..9c8ab4b7fb2cf 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -149,9 +149,11 @@
+ };
+
+ &hdmi {
++ pinctrl-names = "default";
++ pinctrl-0 = <&hdmi_hpd>;
+ status = "okay";
+ ddc = <&i2c_ddc>;
+- hpd-gpios = <&gpx3 7 GPIO_ACTIVE_LOW>;
++ hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>;
+ vdd_osc-supply = <&ldo10_reg>;
+ vdd_pll-supply = <&ldo8_reg>;
+ vdd-supply = <&ldo8_reg>;
+diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+index b25d520393b8b..d31a68672bfac 100644
+--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+@@ -599,6 +599,11 @@
+ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+ };
++
++ hdmi_hpd: hdmi-hpd {
++ samsung,pins = "gpx3-7";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
+ };
+
+ &pinctrl_1 {
+--
+2.20.1
+
--- /dev/null
+From 80f26315944a3ef38cf7f714a918d58dbfb806f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 10:04:25 +0200
+Subject: ARM: dts: exynos: Fix regulators configuration on Peach Pi/Pit
+ Chromebooks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit f8f3b7fc21b1cb59385b780acd9b9a26d04cb7b2 ]
+
+Regulators, which are marked as 'on-in-suspend' seems to be critical for
+board operation, thus they must not be disabled anytime. This can be
+only assured by marking them as 'always-on', because otherwise some
+actions of their clients might result in turning them off. This patch
+restores suspend/resume operation on Peach-Pit Chromebook board. It
+partially reverts 'always-on' property removal done by the commit
+mentioned in the Fixes tag.
+
+Fixes: 665c441eea3d ("ARM: dts: exynos: Remove unneded always-on for regulators on Peach boards")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-peach-pit.dts | 3 +++
+ arch/arm/boot/dts/exynos5800-peach-pi.dts | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 25bdc9d97a4df..769d60d6c9006 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -312,6 +312,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +334,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -343,6 +345,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index 7989631b39ccf..492e2cd2e559e 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -312,6 +312,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +334,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -343,6 +345,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+--
+2.20.1
+
--- /dev/null
+From 2a1e8650206518b987a97793d4f1023bc576fa22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 12:55:32 +0200
+Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ]
+
+This patch adds missing properties to the CODEC and sound nodes, so the
+audio will work also on Snow rev5 Chromebook. This patch is an extension
+to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and
+DAI properties to the max98095 node in Snow Chromebook")
+and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow
+Chromebook"). It has been reported that such changes work fine on the
+rev5 board too.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+[krzk: Fixed typo in phandle to &max98090]
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+index 0348b1c49a691..7cbfc6f1f4b8f 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts
++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+@@ -20,6 +20,14 @@
+
+ samsung,model = "Snow-I2S-MAX98090";
+ samsung,audio-codec = <&max98090>;
++
++ cpu {
++ sound-dai = <&i2s0 0>;
++ };
++
++ codec {
++ sound-dai = <&max98090 0>, <&hdmi>;
++ };
+ };
+ };
+
+@@ -31,6 +39,9 @@
+ interrupt-parent = <&gpx0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max98090_irq>;
++ clocks = <&pmu_system_controller 0>;
++ clock-names = "mclk";
++ #sound-dai-cells = <1>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 7f089685ba50a9648b1bde38b1a8522ecf8d5e98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jul 2018 15:22:09 +0200
+Subject: ARM: dts: exynos: Use i2c-gpio for HDMI-DDC on Arndale
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 620375c8fdf2f9f5110ed48d6c407cc4b7554f86 ]
+
+HDMI-DDC for unknown reasons doesn't work with Exynos I2C controllers.
+Fortunately i2c-gpio comes to the rescue.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 28 ++++++++++++++++-------
+ arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 6 +++++
+ 2 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index 7a8a5c55701a8..bb3fcd652b5d7 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -150,7 +150,7 @@
+
+ &hdmi {
+ status = "okay";
+- ddc = <&i2c_2>;
++ ddc = <&i2c_ddc>;
+ hpd-gpios = <&gpx3 7 GPIO_ACTIVE_LOW>;
+ vdd_osc-supply = <&ldo10_reg>;
+ vdd_pll-supply = <&ldo8_reg>;
+@@ -452,13 +452,6 @@
+ };
+ };
+
+-&i2c_2 {
+- status = "okay";
+- /* used by HDMI DDC */
+- samsung,i2c-sda-delay = <100>;
+- samsung,i2c-max-bus-freq = <66000>;
+-};
+-
+ &i2c_3 {
+ status = "okay";
+
+@@ -547,3 +540,22 @@
+ status = "okay";
+ samsung,exynos-sataphy-i2c-phandle = <&sata_phy_i2c>;
+ };
++
++&soc {
++ /*
++ * For unknown reasons HDMI-DDC does not work with Exynos I2C
++ * controllers. Lets use software I2C over GPIO pins as a workaround.
++ */
++ i2c_ddc: i2c-gpio {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2c2_gpio_bus>;
++ status = "okay";
++ compatible = "i2c-gpio";
++ gpios = <&gpa0 6 0 /* sda */
++ &gpa0 7 0 /* scl */
++ >;
++ i2c-gpio,delay-us = <2>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++};
+diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+index 6ff6dea29d449..b25d520393b8b 100644
+--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+@@ -225,6 +225,12 @@
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+ };
+
++ i2c2_gpio_bus: i2c2-gpio-bus {
++ samsung,pins = "gpa0-6", "gpa0-7";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
++ };
++
+ uart2_data: uart2-data {
+ samsung,pins = "gpa1-0", "gpa1-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+--
+2.20.1
+
--- /dev/null
+From f63022752bb93c756bc1c5adb2d58869a359b76e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 08:43:31 -0300
+Subject: ARM: dts: imx51-zii-rdu1: Fix the rtc compatible string
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 1c5f335f61ffb838fc3cc1cec9464067663eb8c8 ]
+
+According to Documentation/devicetree/bindings/rtc/rtc-ds1307.txt the
+original compatible "maxim,ds1341" is not a valid entry.
+
+Switch to the documented "dallas,ds1341" compatible.
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Tested-by: Chris Healy <cphealy@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx51-zii-rdu1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 6e80254c4562a..3fb66ddfe93a5 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -514,7 +514,7 @@
+ };
+
+ ds1341: rtc@68 {
+- compatible = "maxim,ds1341";
++ compatible = "dallas,ds1341";
+ reg = <0x68>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 5873f94f98c1679b7ab618ce959fc541895d1260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 16:13:29 +0800
+Subject: ARM: dts: imx6ull: update vdd_soc voltage for 900MHz operating point
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 245f880c25dbd8927af0f33aa5d1404370013957 ]
+
+Update VDD_SOC voltage to 1.25V for 900MHz operating point
+according to datasheet Rev. 1.3, 08/2018, 25mV is added to
+the minimum allowed values to cover power supply ripple.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6ull.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6ull.dtsi b/arch/arm/boot/dts/imx6ull.dtsi
+index cd1776a7015ac..796ed35d4ac9a 100644
+--- a/arch/arm/boot/dts/imx6ull.dtsi
++++ b/arch/arm/boot/dts/imx6ull.dtsi
+@@ -22,7 +22,7 @@
+ >;
+ fsl,soc-operating-points = <
+ /* KHz uV */
+- 900000 1175000
++ 900000 1250000
+ 792000 1175000
+ 528000 1175000
+ 396000 1175000
+--
+2.20.1
+
--- /dev/null
+From c7bd366ffb43af827eacce9841a93e75b18af1a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:33 -0500
+Subject: ARM: dts: lpc32xx: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 11236ef582b8d66290bb3b3710e03ca1d85d8ad8 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Vladimir Zapolskiy <vz@mleia.com>
+Cc: Sylvain Lemieux <slemieux.tyco@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 4981741377f3a..ed0d6fb20122a 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -179,7 +179,7 @@
+ * ssp0 and spi1 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp0: ssp@20084000 {
++ ssp0: spi@20084000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x20084000 0x1000>;
+ interrupts = <20 IRQ_TYPE_LEVEL_HIGH>;
+@@ -199,7 +199,7 @@
+ * ssp1 and spi2 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp1: ssp@2008c000 {
++ ssp1: spi@2008c000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x2008c000 0x1000>;
+ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 91aacff9f40461acd269ccef8da9983e126eb849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:31 -0500
+Subject: ARM: dts: marvell: Fix SPI and I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit cf680cc5251487b9a39919c3cda31a108af19cf8 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/dove-cubox.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-dove-db.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@14600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/orion5x-kuroboxpro.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lschl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lsgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lswtgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Cc: Gregory Clement <gregory.clement@bootlin.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dove-cubox.dts | 2 +-
+ arch/arm/boot/dts/dove.dtsi | 6 +++---
+ arch/arm/boot/dts/orion5x-linkstation.dtsi | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dove-cubox.dts b/arch/arm/boot/dts/dove-cubox.dts
+index 580e3cbcfbf7c..3e1584e787aec 100644
+--- a/arch/arm/boot/dts/dove-cubox.dts
++++ b/arch/arm/boot/dts/dove-cubox.dts
+@@ -87,7 +87,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- si5351: clock-generator {
++ si5351: clock-generator@60 {
+ compatible = "silabs,si5351a-msop";
+ reg = <0x60>;
+ #address-cells = <1>;
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index 4a0a5115b2984..250ad0535e8cc 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -155,7 +155,7 @@
+ 0xffffe000 MBUS_ID(0x03, 0x01) 0 0x0000800 /* CESA SRAM 2k */
+ 0xfffff000 MBUS_ID(0x0d, 0x00) 0 0x0000800>; /* PMU SRAM 2k */
+
+- spi0: spi-ctrl@10600 {
++ spi0: spi@10600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -168,7 +168,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c-ctrl@11000 {
++ i2c: i2c@11000 {
+ compatible = "marvell,mv64xxx-i2c";
+ reg = <0x11000 0x20>;
+ #address-cells = <1>;
+@@ -218,7 +218,7 @@
+ status = "disabled";
+ };
+
+- spi1: spi-ctrl@14600 {
++ spi1: spi@14600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/orion5x-linkstation.dtsi b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+index ebd93df5d07a8..b6c9b85951ea6 100644
+--- a/arch/arm/boot/dts/orion5x-linkstation.dtsi
++++ b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+@@ -156,7 +156,7 @@
+ &i2c {
+ status = "okay";
+
+- rtc {
++ rtc@32 {
+ compatible = "ricoh,rs5c372a";
+ reg = <0x32>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 2e8b705298ab443dafeb66c25fa523727587c3df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jul 2018 21:05:52 +0200
+Subject: ARM: dts: meson8: fix the clock controller register size
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f7f9da89bc4f61e33f7b9f5c75c4efdc1f0455d8 ]
+
+The clock controller registers are not 0x460 wide because the reset
+controller starts at CBUS 0x4404. This currently overlaps with the
+clock controller (which is at CBUS 0x4000).
+
+There is no public documentation available on the actual size of the
+clock controller's register area (also called "HHI"). However, in
+Amlogic's GPL kernel sources the last "HHI" register is
+HHI_HDMI_PHY_CNTL2 at CBUS + 0x43a8. 0x400 was chosen because that size
+doesn't seem unlikely.
+
+Fixes: 2c323c43a3d619 ("ARM: dts: meson8: add and use the real clock controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index d77dcf890cfc8..7162e0ca05b0a 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -194,7 +194,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ reset: reset-controller@4404 {
+--
+2.20.1
+
--- /dev/null
+From db201620f4c96b9e3849647d69b3afa70f075a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jul 2018 21:05:53 +0200
+Subject: ARM: dts: meson8b: fix the clock controller register size
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f31094fe8c16fbd2ca47921acf93b744b045aace ]
+
+The clock controller registers are not 0x460 wide because the reset
+controller starts at CBUS 0x4404. This currently overlaps with the
+clock controller (which is at CBUS 0x4000).
+
+There is no public documentation available on the actual size of the
+clock controller's register area (also called "HHI"). However, in
+Amlogic's GPL kernel sources the last "HHI" register is
+HHI_HDMI_PHY_CNTL2 at CBUS + 0x43a8. 0x400 was chosen because that size
+doesn't seem unlikely.
+
+Fixes: 4a69fcd3a10803 ("ARM: meson: Add DTS for Odroid-C1 and Tronfy MXQ boards")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
+index 5b3e5c50c72f7..4293047a4b76b 100644
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -163,7 +163,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8b-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ reset: reset-controller@4404 {
+--
+2.20.1
+
--- /dev/null
+From 2705114c0f9f992ec8f98296e279de856f793996 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 22:29:18 +0200
+Subject: ARM: dts: meson8b: odroidc1: enable the SAR ADC
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit fd6643142a0c5ab4d423ed7173a0be414d509214 ]
+
+Odroid-C1 exposes ADC channels 0 and 1 on the GPIO headers. NOTE: Due
+to the SoC design these are limited to 1.8V (instead of 3.3V like all
+other pins).
+Enable the SAR ADC to enable voltage measurements on these pins.
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b-odroidc1.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
+index 8fdeeffecbdbc..8a09071d712a5 100644
+--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
+@@ -153,6 +153,11 @@
+ pinctrl-names = "default";
+ };
+
++&saradc {
++ status = "okay";
++ vref-supply = <&vcc_1v8>;
++};
++
+ &sdio {
+ status = "okay";
+
+--
+2.20.1
+
--- /dev/null
+From 0e97fd6a67102709c85b03f93985edb434e09610 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:10 +0200
+Subject: ARM: dts: omap3-gta04: fix touchscreen tsc2007
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 7384a24248eda140a234d356b6c840701ee9f055 ]
+
+we fix penirq polarity, add penirq pinmux and touchscreen
+properties.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 79d708ce3a93f..de873e395c05d 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -283,6 +283,13 @@
+ OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */
+ >;
+ };
++
++ penirq_pins: pinmux_penirq_pins {
++ pinctrl-single,pins = <
++ /* here we could enable to wakeup the cpu from suspend by a pen touch */
++ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
+@@ -423,10 +430,19 @@
+ tsc2007@48 {
+ compatible = "ti,tsc2007";
+ reg = <0x48>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&penirq_pins>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <0 IRQ_TYPE_EDGE_FALLING>; /* GPIO_160 */
+- gpios = <&gpio6 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* GPIO_160 */
+ ti,x-plate-ohms = <600>;
++ touchscreen-size-x = <480>;
++ touchscreen-size-y = <640>;
++ touchscreen-max-pressure = <1000>;
++ touchscreen-fuzz-x = <3>;
++ touchscreen-fuzz-y = <8>;
++ touchscreen-fuzz-pressure = <10>;
++ touchscreen-inverted-y;
+ };
+
+ /* RFID EEPROM */
+--
+2.20.1
+
--- /dev/null
+From e87c4952fbfd5ecdb61861454f4c7c29d5a7b3a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:07 +0200
+Subject: ARM: dts: omap3-gta04: fixes for tvout / venc
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit f6591391373dbff2c0200e1055d4ff86191578d2 ]
+
+* fix connector compatibility (composite)
+* add comment for gpio1 23
+* add proper #address-cells
+* we use only one venc_out channel for composite
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index ae33e0e0f1d2c..eee5fa0035071 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -131,7 +131,7 @@
+ };
+
+ tv0: connector {
+- compatible = "svideo-connector";
++ compatible = "composite-video-connector";
+ label = "tv";
+
+ port {
+@@ -143,7 +143,7 @@
+
+ tv_amp: opa362 {
+ compatible = "ti,opa362";
+- enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
++ enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; /* GPIO_23 to enable video out amplifier */
+
+ ports {
+ #address-cells = <1>;
+@@ -551,10 +551,14 @@
+
+ vdda-supply = <&vdac>;
+
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port {
++ reg = <0>;
+ venc_out: endpoint {
+ remote-endpoint = <&opa_in>;
+- ti,channels = <2>;
++ ti,channels = <1>;
+ ti,invert-polarity;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 464409e409f2d12d0f74eca66a2a44dbdb5271c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:06 +0200
+Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can
+ overwrite in other DTS files
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ]
+
+needed for device variants based on GTA04 board but with
+different display panel (driver).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index ac830b9177763..ae33e0e0f1d2c 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -78,7 +78,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- spi_lcd {
++ spi_lcd: spi_lcd {
+ compatible = "spi-gpio";
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 91efe085b9563efc6501a55c8b9cc2bc54136777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:14 +0200
+Subject: ARM: dts: omap3-gta04: keep vpll2 always on
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ]
+
+This is needed to make the display and venc work properly.
+Compare to omap3-beagle.dts.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index bb435684500fc..0c39a2340030b 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -548,6 +548,12 @@
+ regulator-max-microvolt = <3150000>;
+ };
+
++/* Needed to power the DPI pins */
++
++&vpll2 {
++ regulator-always-on;
++};
++
+ &dss {
+ pinctrl-names = "default";
+ pinctrl-0 = < &dss_dpi_pins >;
+--
+2.20.1
+
--- /dev/null
+From c04f35b8f8489a9f9fc3c3f03e0f1f446565fadf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:12 +0200
+Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent
+ U-Boot
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ]
+
+Vendor defined U-Boot has changed the partition scheme a while ago:
+
+* kernel partition 6MB
+* file system partition uses the remainder up to end of the NAND
+* increased size of the environment partition (to get an OneNAND compatible base address)
+* shrink the U-Boot partition
+
+Let's be compatible (e.g. Debian kernel built from upstream).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index de873e395c05d..bb435684500fc 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -619,22 +619,22 @@
+
+ bootloaders@80000 {
+ label = "U-Boot";
+- reg = <0x80000 0x1e0000>;
++ reg = <0x80000 0x1c0000>;
+ };
+
+- bootloaders_env@260000 {
++ bootloaders_env@240000 {
+ label = "U-Boot Env";
+- reg = <0x260000 0x20000>;
++ reg = <0x240000 0x40000>;
+ };
+
+ kernel@280000 {
+ label = "Kernel";
+- reg = <0x280000 0x400000>;
++ reg = <0x280000 0x600000>;
+ };
+
+- filesystem@680000 {
++ filesystem@880000 {
+ label = "File System";
+- reg = <0x680000 0xf980000>;
++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From a6fc8287d82553753ca3f7802fe252d6f97183b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:09 +0200
+Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ]
+
+The omap dss susbystem takes the display aliases to find
+out which displays exist. To enable tv-out we must define
+an alias.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index eee5fa0035071..79d708ce3a93f 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -28,6 +28,7 @@
+
+ aliases {
+ display0 = &lcd;
++ display1 = &tv0;
+ };
+
+ /* fixed 26MHz oscillator */
+--
+2.20.1
+
--- /dev/null
+From 4be0bcc001f7d5898aa62bb85aa63a322f43c065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 10:45:40 +0200
+Subject: ARM: dts: paz00: fix wakeup gpio keycode
+
+From: Marc Dietrich <marvin24@gmx.de>
+
+[ Upstream commit ebea2a43fdafdbce918bd7e200b709d6c33b9f3b ]
+
+The power key is controlled solely by the EC, which only tiggeres this
+gpio after wakeup.
+Fixes immediately return to suspend after wake from LP1.
+
+Signed-off-by: Marc Dietrich <marvin24@gmx.de>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-paz00.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
+index ef245291924f0..4f9b4a889febe 100644
+--- a/arch/arm/boot/dts/tegra20-paz00.dts
++++ b/arch/arm/boot/dts/tegra20-paz00.dts
+@@ -524,10 +524,10 @@
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- power {
+- label = "Power";
++ wakeup {
++ label = "Wakeup";
+ gpios = <&gpio TEGRA_GPIO(J, 7) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_POWER>;
++ linux,code = <KEY_WAKEUP>;
+ wakeup-source;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From e5e12b676d64de1247f585ba4965abdb0dddb02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:03:09 +0200
+Subject: ARM: dts: pxa: fix power i2c base address
+
+From: Marcel Ziswiler <marcel@ziswiler.com>
+
+[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ]
+
+There is one too many zeroes in the Power I2C base address. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 2ab6986433c82..3228ad5fb725f 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -71,7 +71,7 @@
+ clocks = <&clks CLK_PWM1>;
+ };
+
+- pwri2c: i2c@40f000180 {
++ pwri2c: i2c@40f00180 {
+ compatible = "mrvl,pxa-i2c";
+ reg = <0x40f00180 0x24>;
+ interrupts = <6>;
+--
+2.20.1
+
--- /dev/null
+From 167632782d7463295b8a8758c7a6f186826b1367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jun 2018 18:44:01 +0200
+Subject: ARM: dts: pxa: fix the rtc controller
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+[ Upstream commit 24a610eba32a80ed778ea79680b600c3fe73d7de ]
+
+The RTC controller is fed by an external fixed 32kHz clock. Yet the
+driver wants to acquire this clock, even though it doesn't make any use
+of it, ie. doesn't get the rate to make calculation.
+
+Therefore, use the exported 32.768kHz clock in the PXA clock tree to
+make the driver happy and working.
+
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa25x.dtsi | 4 ++++
+ arch/arm/boot/dts/pxa27x.dtsi | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/pxa25x.dtsi b/arch/arm/boot/dts/pxa25x.dtsi
+index 95d59be97213e..8494b57871709 100644
+--- a/arch/arm/boot/dts/pxa25x.dtsi
++++ b/arch/arm/boot/dts/pxa25x.dtsi
+@@ -80,6 +80,10 @@
+ #pwm-cells = <1>;
+ clocks = <&clks CLK_PWM1>;
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ timer@40a00000 {
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 747f750f675d9..2ab6986433c82 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -113,6 +113,10 @@
+
+ status = "disabled";
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ clocks {
+--
+2.20.1
+
--- /dev/null
+From 2200bba6be36e83ca56bfbe111175458e38f42b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jul 2018 10:37:47 +0200
+Subject: ARM: dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit bd73a3dd257fb838bd456a18eeee0ef0224b7a40 ]
+
+while compiling an ipq4019 target, dtc will complain:
+regulator@b089000 unit address format error, expected "2089000"
+
+The saw0 regulator reg value seems to be
+copied and pasted from qcom-ipq8064.dtsi.
+
+This patch fixes the reg value to match that of the
+unit address which in turn silences the warning.
+(There is no driver for qcom,saw2 right now.
+So this went unnoticed)
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 54d056b01bb51..8328ad589e2ba 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -313,7 +313,7 @@
+
+ saw0: regulator@b089000 {
+ compatible = "qcom,saw2";
+- reg = <0x02089000 0x1000>, <0x0b009000 0x1000>;
++ reg = <0x0b089000 0x1000>, <0x0b009000 0x1000>;
+ regulator;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 2156f92470bcb6d64ef3d9b25d20b2e79271227b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jul 2018 14:28:57 +0200
+Subject: ARM: dts: rcar: Correct SATA device sizes to 2 MiB
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 441f61e3aa9e7386731ce1405044d484bd81f911 ]
+
+Update the SATA device nodes on R-Car H1, H2, and M2-W to use a 2 MiB
+I/O space, as specified in Rev.1.0 of the R-Car H1 and R-Car Gen2
+hardware user manuals.
+
+See also commit e9f0089b2d8a3d45 ("arm64: dts: r8a7795: Correct SATA
+device size to 2MiB").
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7779.dtsi | 2 +-
+ arch/arm/boot/dts/r8a7790.dtsi | 4 ++--
+ arch/arm/boot/dts/r8a7791.dtsi | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index 6b997bc016ee8..03919714645ae 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -344,7 +344,7 @@
+
+ sata: sata@fc600000 {
+ compatible = "renesas,sata-r8a7779", "renesas,rcar-sata";
+- reg = <0xfc600000 0x2000>;
++ reg = <0xfc600000 0x200000>;
+ interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp1_clks R8A7779_CLK_SATA>;
+ power-domains = <&sysc R8A7779_PD_ALWAYS_ON>;
+diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
+index 0925bdca438fe..52a757f47bf08 100644
+--- a/arch/arm/boot/dts/r8a7790.dtsi
++++ b/arch/arm/boot/dts/r8a7790.dtsi
+@@ -1559,7 +1559,7 @@
+ sata0: sata@ee300000 {
+ compatible = "renesas,sata-r8a7790",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee300000 0 0x2000>;
++ reg = <0 0xee300000 0 0x200000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 815>;
+ power-domains = <&sysc R8A7790_PD_ALWAYS_ON>;
+@@ -1570,7 +1570,7 @@
+ sata1: sata@ee500000 {
+ compatible = "renesas,sata-r8a7790",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee500000 0 0x2000>;
++ reg = <0 0xee500000 0 0x200000>;
+ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 814>;
+ power-domains = <&sysc R8A7790_PD_ALWAYS_ON>;
+diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi
+index 991ac6feedd5b..25b6a99dd87a2 100644
+--- a/arch/arm/boot/dts/r8a7791.dtsi
++++ b/arch/arm/boot/dts/r8a7791.dtsi
+@@ -1543,7 +1543,7 @@
+ sata0: sata@ee300000 {
+ compatible = "renesas,sata-r8a7791",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee300000 0 0x2000>;
++ reg = <0 0xee300000 0 0x200000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 815>;
+ power-domains = <&sysc R8A7791_PD_ALWAYS_ON>;
+@@ -1554,7 +1554,7 @@
+ sata1: sata@ee500000 {
+ compatible = "renesas,sata-r8a7791",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee500000 0 0x2000>;
++ reg = <0 0xee500000 0 0x200000>;
+ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 814>;
+ power-domains = <&sysc R8A7791_PD_ALWAYS_ON>;
+--
+2.20.1
+
--- /dev/null
+From d3b2b35bfdf3c157bd1d5b3269c82fa311f12a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:26 -0500
+Subject: ARM: dts: realview: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 016add12977bcc30f77d7e48fc9a3a024cb46645 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-eb.dtsi | 2 +-
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pb11mp.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pbx.dtsi | 2 +-
+ arch/arm/boot/dts/versatile-ab.dts | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
+index a917cf8825ca8..0e4c7c4c8c093 100644
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -371,7 +371,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index f935b72d3d964..f2a1d25eb6cf3 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -380,7 +380,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- pb1176_ssp: ssp@1010b000 {
++ pb1176_ssp: spi@1010b000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1010b000 0x1000>;
+ interrupt-parent = <&intc_dc1176>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 36203288de426..7f9cbdf33a510 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -523,7 +523,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp@1000d000 {
++ spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ interrupt-parent = <&intc_pb11mp>;
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index 10868ba3277f5..a5676697ff3b7 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -362,7 +362,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
+index 5f61d36090270..6f4f60ba5429c 100644
+--- a/arch/arm/boot/dts/versatile-ab.dts
++++ b/arch/arm/boot/dts/versatile-ab.dts
+@@ -373,7 +373,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- ssp@101f4000 {
++ spi@101f4000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x101f4000 0x1000>;
+ interrupts = <11>;
+--
+2.20.1
+
--- /dev/null
+From dfa71efca5942738c8175d8a3ec82682080ae546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:34:36 +0200
+Subject: ARM: dts: rockchip: explicitly set vcc_sd0 pin to gpio on
+ rk3188-radxarock
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit a2df0984e73fd9e1dad5fc3f1c307ec3de395e30 ]
+
+It is good practice to make the setting of gpio-pinctrls explicitly in the
+devicetree, and in this case even necessary.
+Rockchip boards start with iomux settings set to gpio for most pins and
+while the linux pinctrl driver also implicitly sets the gpio function if
+a pin is requested as gpio that is not necessarily true for other drivers.
+
+The issue in question stems from uboot, where the sdmmc_pwr pin is set
+to function 1 (sdmmc-power) by the bootrom when reading the 1st-stage
+loader. The regulator controlled by the pin is active-low though, so
+when the dwmmc hw-block sets its enabled bit, it actually disables the
+regulator. By changing the pin back to gpio we fix that behaviour.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-radxarock.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
+index 45fd2b302dda1..4a2890618f6fc 100644
+--- a/arch/arm/boot/dts/rk3188-radxarock.dts
++++ b/arch/arm/boot/dts/rk3188-radxarock.dts
+@@ -93,6 +93,8 @@
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc_pwr>;
+ startup-delay-us = <100000>;
+ vin-supply = <&vcc_io>;
+ };
+@@ -315,6 +317,12 @@
+ };
+ };
+
++ sd0 {
++ sdmmc_pwr: sdmmc-pwr {
++ rockchip,pins = <RK_GPIO3 1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb {
+ host_vbus_drv: host-vbus-drv {
+ rockchip,pins = <0 3 RK_FUNC_GPIO &pcfg_pull_none>;
+--
+2.20.1
+
--- /dev/null
+From 7bb1cd8458705c00e36557801f6eb3c5209a78dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:36 -0500
+Subject: ARM: dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 131c3eb428ccd5f0c784b9edb4f72ec296a045d2 ]
+
+dtc has new checks for SPI buses. The rk3036 dts file has a node named
+spi' which causes false positive warnings. As the node is a pinctrl child
+node, change the node name to be 'spi-pins' to fix the warnings.
+
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: linux-rockchip@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 67f57200d9a06..d560fc4051c5f 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -733,7 +733,7 @@
+ /* no rts / cts for uart2 */
+ };
+
+- spi {
++ spi-pins {
+ spi_txd:spi-txd {
+ rockchip,pins = <1 29 RK_FUNC_3 &pcfg_pull_default>;
+ };
+--
+2.20.1
+
--- /dev/null
+From bba03debc088bfa038c631940eb13ba67f3ed81f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 23:52:49 -0500
+Subject: ARM: dts: socfpga: Fix I2C bus unit-address error
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53"
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+index b280e64941938..31b01a998b2ed 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+@@ -88,7 +88,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- adxl345: adxl345@0 {
++ adxl345: adxl345@53 {
+ compatible = "adi,adxl345";
+ reg = <0x53>;
+
+--
+2.20.1
+
--- /dev/null
+From 5997a197243322be6b5db3a2cb9320f42c024cad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:34 -0500
+Subject: ARM: dts: ste: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++--
+ arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +-
+ arch/arm/boot/dts/ste-snowball.dts | 2 +-
+ arch/arm/boot/dts/ste-u300.dts | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 3dc0028e108b3..986767735e249 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -878,7 +878,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80002000 0x1000>;
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+@@ -892,7 +892,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80003000 {
++ spi@80003000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80003000 0x1000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+index 3f14b4df69b4e..94eeb7f1c9478 100644
+--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+@@ -57,7 +57,7 @@
+ };
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ /*
+ * On the first generation boards, this SSP/SPI port was connected
+ * to the AB8500.
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index b0b94d0530985..603890461ae0f 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -376,7 +376,7 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ssp0_snowball_mode>;
+ };
+diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts
+index 62ecb6a2fa39e..1bd1aba3322f1 100644
+--- a/arch/arm/boot/dts/ste-u300.dts
++++ b/arch/arm/boot/dts/ste-u300.dts
+@@ -442,7 +442,7 @@
+ dma-names = "rx";
+ };
+
+- spi: ssp@c0006000 {
++ spi: spi@c0006000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0xc0006000 0x1000>;
+ interrupt-parent = <&vica>;
+--
+2.20.1
+
--- /dev/null
+From b24783c18f026c8e94fd090c29ff183ca1340367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:33:52 +0200
+Subject: ARM: dts: stm32: enable display on stm32mp157c-ev1 board
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yannick Fertré <yannick.fertre@st.com>
+
+[ Upstream commit 67330599f93672bd351123c729e2591a460fd24c ]
+
+Enable panel raydium RM68200, DSI bridge & display controller.
+
+Signed-off-by: Yannick Fertré <yannick.fertre@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp157c-ev1.dts | 73 ++++++++++++++++++++++++---
+ 1 file changed, 67 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp157c-ev1.dts b/arch/arm/boot/dts/stm32mp157c-ev1.dts
+index 372bc2ea6b921..063ee8ac5dcbd 100644
+--- a/arch/arm/boot/dts/stm32mp157c-ev1.dts
++++ b/arch/arm/boot/dts/stm32mp157c-ev1.dts
+@@ -6,6 +6,7 @@
+ /dts-v1/;
+
+ #include "stm32mp157c-ed1.dts"
++#include <dt-bindings/gpio/gpio.h>
+
+ / {
+ model = "STMicroelectronics STM32MP157C eval daughter on eval mother";
+@@ -19,6 +20,58 @@
+ serial0 = &uart4;
+ ethernet0 = ðernet0;
+ };
++
++ panel_backlight: panel-backlight {
++ compatible = "gpio-backlight";
++ gpios = <&gpiod 13 GPIO_ACTIVE_LOW>;
++ default-on;
++ status = "okay";
++ };
++};
++
++&cec {
++ pinctrl-names = "default";
++ pinctrl-0 = <&cec_pins_a>;
++ status = "okay";
++};
++
++&dsi {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++ dsi_in: endpoint {
++ remote-endpoint = <<dc_ep0_out>;
++ };
++ };
++
++ port@1 {
++ reg = <1>;
++ dsi_out: endpoint {
++ remote-endpoint = <&dsi_panel_in>;
++ };
++ };
++ };
++
++ panel-dsi@0 {
++ compatible = "raydium,rm68200";
++ reg = <0>;
++ reset-gpios = <&gpiof 15 GPIO_ACTIVE_LOW>;
++ backlight = <&panel_backlight>;
++ status = "okay";
++
++ port {
++ dsi_panel_in: endpoint {
++ remote-endpoint = <&dsi_out>;
++ };
++ };
++ };
+ };
+
+ ðernet0 {
+@@ -40,12 +93,6 @@
+ };
+ };
+
+-&cec {
+- pinctrl-names = "default";
+- pinctrl-0 = <&cec_pins_a>;
+- status = "okay";
+-};
+-
+ &i2c2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2_pins_a>;
+@@ -62,6 +109,20 @@
+ status = "okay";
+ };
+
++<dc {
++ status = "okay";
++
++ port {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ ltdc_ep0_out: endpoint@0 {
++ reg = <0>;
++ remote-endpoint = <&dsi_in>;
++ };
++ };
++};
++
+ &m_can1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&m_can1_pins_a>;
+--
+2.20.1
+
--- /dev/null
+From 3feb4e1d5d6640d2bfe00f59a3e739ef8a711ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 14:25:41 +0200
+Subject: ARM: dts: stm32: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 1ba23b1df0bb6eec430408614c3a11280941e112 ]
+
+SPI controller nodes should be named 'spi' rather than 'qspi'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp157c.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
+index 185541a5b69fb..c50c36baba758 100644
+--- a/arch/arm/boot/dts/stm32mp157c.dtsi
++++ b/arch/arm/boot/dts/stm32mp157c.dtsi
+@@ -947,7 +947,7 @@
+ dma-requests = <48>;
+ };
+
+- qspi: qspi@58003000 {
++ qspi: spi@58003000 {
+ compatible = "st,stm32f469-qspi";
+ reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
+ reg-names = "qspi", "qspi_mm";
+--
+2.20.1
+
--- /dev/null
+From 17b4aaf712cb1d4a80db6ea5ad8fd4c6a921947c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:38 -0500
+Subject: ARM: dts: sun9i: Fix I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 57a83c5222c1b5e7b3acc72c6e60fce00a38991a ]
+
+dtc has new checks for I2C buses. The sun9i-a80 dts file has a node named
+'i2c' which causes a false positive warning. As the node is a RSB bus,
+correct the node name to be 'rsb' to fix the warnings.
+
+arch/arm/boot/dts/sun9i-a80-cubieboard4.dtb: Warning (i2c_bus_reg): /soc/i2c@8003400/codec@e89:reg: I2C address must be less than 10-bits, got "0xe89"
+arch/arm/boot/dts/sun9i-a80-cubieboard4.dtb: Warning (i2c_bus_reg): /soc/i2c@8003400/pmic@745:reg: I2C address must be less than 10-bits, got "0x745"
+arch/arm/boot/dts/sun9i-a80-optimus.dtb: Warning (i2c_bus_reg): /soc/i2c@8003400/codec@e89:reg: I2C address must be less than 10-bits, got "0xe89"
+arch/arm/boot/dts/sun9i-a80-optimus.dtb: Warning (i2c_bus_reg): /soc/i2c@8003400/pmic@745:reg: I2C address must be less than 10-bits, got "0x745"
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun9i-a80.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
+index 25591d6883ef2..d9532fb1ef650 100644
+--- a/arch/arm/boot/dts/sun9i-a80.dtsi
++++ b/arch/arm/boot/dts/sun9i-a80.dtsi
+@@ -1196,7 +1196,7 @@
+ };
+ };
+
+- r_rsb: i2c@8003400 {
++ r_rsb: rsb@8003400 {
+ compatible = "allwinner,sun8i-a23-rsb";
+ reg = <0x08003400 0x400>;
+ interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 3508a956fc569b3ef99fcce58f1fb0102dd32581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:32 -0500
+Subject: ARM: dts: sunxi: Fix I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 0729b4af5753b65aa031f58c435da53dbbf56d19 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/sun8i-a23-gt90h-v4.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-inet86dz.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-polaroid-mid2407pxe03.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-polaroid-mid2809pxe04.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a33-ga10h-v1.1.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a33-inet-d978-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun8i-a33-ippo-q8h-v1.2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun8i-a33-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-utoo-p66.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun5i-a13-difrnce-dit4350.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-empire-electronix-m712.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-inet-98v-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi | 3 ++-
+ arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi | 3 ++-
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
+index 8acbaab14fe51..d2a2eb8b3f262 100644
+--- a/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
++++ b/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
+@@ -92,7 +92,8 @@
+ */
+ clock-frequency = <400000>;
+
+- touchscreen: touchscreen {
++ touchscreen: touchscreen@40 {
++ reg = <0x40>;
+ interrupt-parent = <&pio>;
+ interrupts = <6 11 IRQ_TYPE_EDGE_FALLING>; /* EINT11 (PG11) */
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+index 880096c7e2523..5e8a95af89b8c 100644
+--- a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
++++ b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+@@ -69,7 +69,8 @@
+ */
+ clock-frequency = <400000>;
+
+- touchscreen: touchscreen@0 {
++ touchscreen: touchscreen@40 {
++ reg = <0x40>;
+ interrupt-parent = <&pio>;
+ interrupts = <1 5 IRQ_TYPE_EDGE_FALLING>; /* PB5 */
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 35859d8f3267f..bf97f6244c233 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -95,7 +95,7 @@
+ &i2c0 {
+ status = "okay";
+
+- axp22x: pmic@68 {
++ axp22x: pmic@34 {
+ compatible = "x-powers,axp221";
+ reg = <0x34>;
+ interrupt-parent = <&nmi_intc>;
+--
+2.20.1
+
--- /dev/null
+From bff0a764bdc7e8c6705f19722cf1d07dae4b31fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 10:06:03 +0200
+Subject: ARM: dts: tegra20: restore address order
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 8188391c127ea34d66f37eda6755d0acb51dc600 ]
+
+Commit 6c468f109884 ("ARM: dts: tegra: add Tegra20 NAND flash
+controller node") introduced the nand-controller node. However, it got
+added at the wrong spot not honoring the address order. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Reviewed-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20.dtsi | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
+index 15b73bd377f04..80854f7de765c 100644
+--- a/arch/arm/boot/dts/tegra20.dtsi
++++ b/arch/arm/boot/dts/tegra20.dtsi
+@@ -419,19 +419,6 @@
+ status = "disabled";
+ };
+
+- gmi@70009000 {
+- compatible = "nvidia,tegra20-gmi";
+- reg = <0x70009000 0x1000>;
+- #address-cells = <2>;
+- #size-cells = <1>;
+- ranges = <0 0 0xd0000000 0xfffffff>;
+- clocks = <&tegra_car TEGRA20_CLK_NOR>;
+- clock-names = "gmi";
+- resets = <&tegra_car 42>;
+- reset-names = "gmi";
+- status = "disabled";
+- };
+-
+ nand-controller@70008000 {
+ compatible = "nvidia,tegra20-nand";
+ reg = <0x70008000 0x100>;
+@@ -447,6 +434,19 @@
+ status = "disabled";
+ };
+
++ gmi@70009000 {
++ compatible = "nvidia,tegra20-gmi";
++ reg = <0x70009000 0x1000>;
++ #address-cells = <2>;
++ #size-cells = <1>;
++ ranges = <0 0 0xd0000000 0xfffffff>;
++ clocks = <&tegra_car TEGRA20_CLK_NOR>;
++ clock-names = "gmi";
++ resets = <&tegra_car 42>;
++ reset-names = "gmi";
++ status = "disabled";
++ };
++
+ pwm: pwm@7000a000 {
+ compatible = "nvidia,tegra20-pwm";
+ reg = <0x7000a000 0x100>;
+--
+2.20.1
+
--- /dev/null
+From 813f3ead490dab06441f756e290d19ff2590f520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:42:33 +0200
+Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ]
+
+There was a dot instead of a comma. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
+index a6781f6533105..5a04ddefb71f6 100644
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -896,7 +896,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <1>;
+ nvidia,xcvr-lsrslew = <1>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -933,7 +933,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -969,7 +969,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+--
+2.20.1
+
--- /dev/null
+From ba39b49bc1f7417619eb88e89e405444dfd0a355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:25 -0500
+Subject: ARM: dts: ti: Fix SPI and I2C bus warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit cc893871f092be9ac1184a78f9ae1e76b85d5317 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/am437x-idk-evm.dtb: Warning (spi_bus_bridge): /ocp@44000000/qspi@47900000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am437x-sk-evm.dtb: Warning (spi_bus_bridge): /ocp@44000000/qspi@47900000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am43x-epos-evm.dtb: Warning (spi_bus_bridge): /ocp@44000000/qspi@47900000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/omap3-n9.dtb: Warning (i2c_bus_reg): /ocp@68000000/i2c@48060000/ak8975@0f: I2C bus unit address format error, expected "f"
+arch/arm/boot/dts/am335x-osd3358-sm-red.dtb: Warning (i2c_bus_reg): /ocp/i2c@44e0b000/pressure@78: I2C bus unit address format error, expected "76"
+arch/arm/boot/dts/am335x-boneblack.dtb: Warning (i2c_bus_reg): /ocp/i2c@44e0b000/tda19988: I2C bus unit address format error, expected "70"
+arch/arm/boot/dts/am335x-boneblack-wireless.dtb: Warning (i2c_bus_reg): /ocp/i2c@44e0b000/tda19988: I2C bus unit address format error, expected "70"
+arch/arm/boot/dts/am335x-sancloud-bbe.dtb: Warning (i2c_bus_reg): /ocp/i2c@44e0b000/tda19988: I2C bus unit address format error, expected "70"
+arch/arm/boot/dts/am571x-idk.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am572x-idk.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am574x-idk.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am57xx-cl-som-am57x.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am57xx-sbc-am57x.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dra72-evm.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dra72-evm-revc.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dra76-evm.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dra7-evm.dtb: Warning (spi_bus_bridge): /ocp/qspi@4b300000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/am335x-pdu001.dtb: Warning (spi_bus_reg): /ocp/spi@481a0000/cfaf240320a032t: SPI bus unit address format error, expected "0"
+arch/arm/boot/dts/keystone-k2g-evm.dtb: Warning (spi_bus_bridge): /soc@0/qspi@2940000: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/keystone-k2g-ice.dtb: Warning (spi_bus_bridge): /soc@0/qspi@2940000: node name for SPI buses should be 'spi'
+
+Cc: "Benoît Cousson" <bcousson@baylibre.com>
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Santosh Shilimkar <ssantosh@kernel.org>
+Cc: linux-omap@vger.kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+[tony@atomide.com: fixed mode to 644 for am335x-osd3358-sm-red.dts while at it]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-boneblack-common.dtsi | 2 +-
+ arch/arm/boot/dts/am335x-osd3358-sm-red.dts | 2 +-
+ arch/arm/boot/dts/am335x-pdu001.dts | 2 +-
+ arch/arm/boot/dts/am4372.dtsi | 2 +-
+ arch/arm/boot/dts/am57xx-cl-som-am57x.dts | 2 +-
+ arch/arm/boot/dts/dra7.dtsi | 2 +-
+ arch/arm/boot/dts/keystone-k2g.dtsi | 2 +-
+ arch/arm/boot/dts/omap2.dtsi | 4 ++--
+ arch/arm/boot/dts/omap2430.dtsi | 2 +-
+ arch/arm/boot/dts/omap3-n9.dts | 2 +-
+ 10 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-common.dtsi b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+index 325daae40278a..21bc1173fa6b9 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-common.dtsi
++++ b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+@@ -88,7 +88,7 @@
+ };
+
+ &i2c0 {
+- tda19988: tda19988 {
++ tda19988: tda19988@70 {
+ compatible = "nxp,tda998x";
+ reg = <0x70>;
+
+diff --git a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
+index 4d969013f99a6..d9e92671055bd 100644
+--- a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
++++ b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
+@@ -161,7 +161,7 @@
+ invensense,key = [4e cc 7e eb f6 1e 35 22 00 34 0d 65 32 e9 94 89];*/
+ };
+
+- bmp280: pressure@78 {
++ bmp280: pressure@76 {
+ compatible = "bosch,bmp280";
+ reg = <0x76>;
+ };
+diff --git a/arch/arm/boot/dts/am335x-pdu001.dts b/arch/arm/boot/dts/am335x-pdu001.dts
+index 1ad530a39a957..34fb63ef420f5 100644
+--- a/arch/arm/boot/dts/am335x-pdu001.dts
++++ b/arch/arm/boot/dts/am335x-pdu001.dts
+@@ -373,7 +373,7 @@
+ ti,pindir-d0-out-d1-in;
+ status = "okay";
+
+- cfaf240320a032t {
++ display-controller@0 {
+ compatible = "orisetech,otm3225a";
+ reg = <0>;
+ spi-max-frequency = <1000000>;
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index cf1e4f747242f..09e58fb810d95 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -1101,7 +1101,7 @@
+ };
+ };
+
+- qspi: qspi@47900000 {
++ qspi: spi@47900000 {
+ compatible = "ti,am4372-qspi";
+ reg = <0x47900000 0x100>,
+ <0x30000000 0x4000000>;
+diff --git a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
+index 203266f884807..52ae8eef60fc3 100644
+--- a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
++++ b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
+@@ -518,7 +518,7 @@
+ };
+
+ /* touch controller */
+- ads7846@0 {
++ touchscreen@1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ads7846_pins>;
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 2cb45ddd2ae3b..9136b3cf9a2ce 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -1369,7 +1369,7 @@
+ status = "disabled";
+ };
+
+- qspi: qspi@4b300000 {
++ qspi: spi@4b300000 {
+ compatible = "ti,dra7xxx-qspi";
+ reg = <0x4b300000 0x100>,
+ <0x5c000000 0x4000000>;
+diff --git a/arch/arm/boot/dts/keystone-k2g.dtsi b/arch/arm/boot/dts/keystone-k2g.dtsi
+index 738b44cf2b0bb..1c833105d6c54 100644
+--- a/arch/arm/boot/dts/keystone-k2g.dtsi
++++ b/arch/arm/boot/dts/keystone-k2g.dtsi
+@@ -416,7 +416,7 @@
+ clock-names = "fck", "mmchsdb_fck";
+ };
+
+- qspi: qspi@2940000 {
++ qspi: spi@2940000 {
+ compatible = "ti,k2g-qspi", "cdns,qspi-nor";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
+index f1d6de8b3c193..000bf16de6517 100644
+--- a/arch/arm/boot/dts/omap2.dtsi
++++ b/arch/arm/boot/dts/omap2.dtsi
+@@ -114,7 +114,7 @@
+ dma-names = "tx", "rx";
+ };
+
+- mcspi1: mcspi@48098000 {
++ mcspi1: spi@48098000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi1";
+ reg = <0x48098000 0x100>;
+@@ -125,7 +125,7 @@
+ "tx2", "rx2", "tx3", "rx3";
+ };
+
+- mcspi2: mcspi@4809a000 {
++ mcspi2: spi@4809a000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi2";
+ reg = <0x4809a000 0x100>;
+diff --git a/arch/arm/boot/dts/omap2430.dtsi b/arch/arm/boot/dts/omap2430.dtsi
+index 84635eeb99cd4..7f57af2f10acb 100644
+--- a/arch/arm/boot/dts/omap2430.dtsi
++++ b/arch/arm/boot/dts/omap2430.dtsi
+@@ -285,7 +285,7 @@
+ ti,timer-alwon;
+ };
+
+- mcspi3: mcspi@480b8000 {
++ mcspi3: spi@480b8000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi3";
+ reg = <0x480b8000 0x100>;
+diff --git a/arch/arm/boot/dts/omap3-n9.dts b/arch/arm/boot/dts/omap3-n9.dts
+index ded5fcf084eb7..1f91646b89516 100644
+--- a/arch/arm/boot/dts/omap3-n9.dts
++++ b/arch/arm/boot/dts/omap3-n9.dts
+@@ -40,7 +40,7 @@
+ };
+
+ &i2c3 {
+- ak8975@0f {
++ ak8975@f {
+ compatible = "asahi-kasei,ak8975";
+ reg = <0x0f>;
+ };
+--
+2.20.1
+
--- /dev/null
+From d26b381dc5ef3e6dac320551f22cf6c22eb0c33c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jun 2018 09:50:09 +0200
+Subject: ARM: dts: ux500: Correct SCU unit address
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ]
+
+The unit address of the Cortex-A9 SCU device node contains one zero too
+many. Remove it.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 2310a4e97768c..3dc0028e108b3 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -197,7 +197,7 @@
+ <0xa0410100 0x100>;
+ };
+
+- scu@a04100000 {
++ scu@a0410000 {
+ compatible = "arm,cortex-a9-scu";
+ reg = <0xa0410000 0x100>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 7f85e0827607d213c1ca13db0e34c212a39a2bc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jul 2018 10:30:03 +0200
+Subject: ARM: dts: ux500: Fix LCDA clock line muxing
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ]
+
+The "lcdaclk_b_1" group is muxed with the function "lcd"
+but needs a separate entry to be muxed in with "lcda"
+rather than "lcd".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+index 5c5cea232743d..1ec193b0c5065 100644
+--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+@@ -607,16 +607,20 @@
+
+ mcde {
+ lcd_default_mode: lcd_default {
+- default_mux {
++ default_mux1 {
+ /* Mux in VSI0 and all the data lines */
+ function = "lcd";
+ groups =
+ "lcdvsi0_a_1", /* VSI0 for LCD */
+ "lcd_d0_d7_a_1", /* Data lines */
+ "lcd_d8_d11_a_1", /* TV-out */
+- "lcdaclk_b_1", /* Clock line for TV-out */
+ "lcdvsi1_a_1"; /* VSI1 for HDMI */
+ };
++ default_mux2 {
++ function = "lcda";
++ groups =
++ "lcdaclk_b_1"; /* Clock line for TV-out */
++ };
+ default_cfg1 {
+ pins =
+ "GPIO68_E1", /* VSI0 */
+--
+2.20.1
+
--- /dev/null
+From b5c44c43281d9da149a0161a054eec7074e9e9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:39 -0500
+Subject: ARM: dts: xilinx: Fix I2C and SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f5054ceed420b1f38d37920a4c65446fcc5d6b90 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/zynq-zc702.dtb: Warning (i2c_bus_reg): /amba/i2c@e0004000/i2c-mux@74/i2c@7/hwmon@52: I2C bus unit address format error, expected "34"
+arch/arm/boot/dts/zynq-zc702.dtb: Warning (i2c_bus_reg): /amba/i2c@e0004000/i2c-mux@74/i2c@7/hwmon@53: I2C bus unit address format error, expected "35"
+arch/arm/boot/dts/zynq-zc702.dtb: Warning (i2c_bus_reg): /amba/i2c@e0004000/i2c-mux@74/i2c@7/hwmon@54: I2C bus unit address format error, expected "36"
+arch/arm/boot/dts/zynq-zc770-xm013.dtb: Warning (spi_bus_reg): /amba/spi@e0006000/eeprom@0: SPI bus unit address format error, expected "2"
+arch/arm/boot/dts/zynq-zc770-xm010.dtb: Warning (spi_bus_reg): /amba/spi@e0007000/flash@0: SPI bus unit address format error, expected "1"
+
+Cc: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/zynq-zc702.dts | 12 ++++++------
+ arch/arm/boot/dts/zynq-zc770-xm010.dts | 2 +-
+ arch/arm/boot/dts/zynq-zc770-xm013.dts | 2 +-
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/zynq-zc702.dts b/arch/arm/boot/dts/zynq-zc702.dts
+index cc5a3dc2b4a08..27cd6cb52f1ba 100644
+--- a/arch/arm/boot/dts/zynq-zc702.dts
++++ b/arch/arm/boot/dts/zynq-zc702.dts
+@@ -174,17 +174,17 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <7>;
+- hwmon@52 {
++ hwmon@34 {
+ compatible = "ti,ucd9248";
+- reg = <52>;
++ reg = <0x34>;
+ };
+- hwmon@53 {
++ hwmon@35 {
+ compatible = "ti,ucd9248";
+- reg = <53>;
++ reg = <0x35>;
+ };
+- hwmon@54 {
++ hwmon@36 {
+ compatible = "ti,ucd9248";
+- reg = <54>;
++ reg = <0x36>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/zynq-zc770-xm010.dts b/arch/arm/boot/dts/zynq-zc770-xm010.dts
+index 0e1bfdd3421ff..0dd352289a45e 100644
+--- a/arch/arm/boot/dts/zynq-zc770-xm010.dts
++++ b/arch/arm/boot/dts/zynq-zc770-xm010.dts
+@@ -68,7 +68,7 @@
+ status = "okay";
+ num-cs = <4>;
+ is-decoded-cs = <0>;
+- flash@0 {
++ flash@1 {
+ compatible = "sst25wf080", "jedec,spi-nor";
+ reg = <1>;
+ spi-max-frequency = <1000000>;
+diff --git a/arch/arm/boot/dts/zynq-zc770-xm013.dts b/arch/arm/boot/dts/zynq-zc770-xm013.dts
+index 651913f1afa2a..4ae2c85df3a00 100644
+--- a/arch/arm/boot/dts/zynq-zc770-xm013.dts
++++ b/arch/arm/boot/dts/zynq-zc770-xm013.dts
+@@ -62,7 +62,7 @@
+ status = "okay";
+ num-cs = <4>;
+ is-decoded-cs = <0>;
+- eeprom: eeprom@0 {
++ eeprom: eeprom@2 {
+ at25,byte-len = <8192>;
+ at25,addr-mode = <2>;
+ at25,page-size = <32>;
+--
+2.20.1
+
--- /dev/null
+From 496afe51ba67a2ee8b194612e498ec5ae2a16e4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 12:34:21 +0200
+Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff"
+ is set
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ]
+
+One of the Freescale recommended sequences for power off with external
+PMIC is the following:
+...
+3. SoC is programming PMIC for power off when standby is asserted.
+4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies.
+
+See:
+http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf
+page 5083
+
+This patch implements step 4. of this sequence.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index b08e407d8d96f..529f4b5bbd3a7 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -618,6 +618,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+ IMX6Q_GPR1_GINT);
+ }
+
++static void imx6_pm_stby_poweroff(void)
++{
++ imx6_set_lpm(STOP_POWER_OFF);
++ imx6q_suspend_finish(0);
++
++ mdelay(1000);
++
++ pr_emerg("Unable to poweroff system\n");
++}
++
++static int imx6_pm_stby_poweroff_probe(void)
++{
++ if (pm_power_off) {
++ pr_warn("%s: pm_power_off already claimed %p %pf!\n",
++ __func__, pm_power_off, pm_power_off);
++ return -EBUSY;
++ }
++
++ pm_power_off = imx6_pm_stby_poweroff;
++ return 0;
++}
++
+ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ {
+ struct device_node *np;
+@@ -634,6 +656,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ val = readl_relaxed(ccm_base + CLPCR);
+ val &= ~BM_CLPCR_LPM;
+ writel_relaxed(val, ccm_base + CLPCR);
++
++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff"))
++ imx6_pm_stby_poweroff_probe();
+ }
+
+ void __init imx6q_pm_init(void)
+--
+2.20.1
+
--- /dev/null
+From 2a19eee4426a0843e3f80fdece57f8f9d81845de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 18:38:14 +0200
+Subject: ARM: tegra: apalis_t30: fix mcp2515 can controller interrupt polarity
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit b38f6aa4b60a1fcc41f5c469981f8f62d6070ee3 ]
+
+Fix the MCP2515 SPI CAN controller interrupt polarity which according
+to its datasheet defaults to low-active aka falling edge.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-apalis.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index e749e047db7ab..f810bbf8212bd 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -659,7 +659,7 @@
+ reg = <1>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(W, 3) IRQ_TYPE_EDGE_RISING>;
++ interrupts = <TEGRA_GPIO(W, 3) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ };
+@@ -674,7 +674,7 @@
+ reg = <0>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(W, 2) IRQ_TYPE_EDGE_RISING>;
++ interrupts = <TEGRA_GPIO(W, 2) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From f55c1c002a0c49dcff5f668e3fe5a474a4967752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 18:37:43 +0200
+Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ]
+
+Fix MMC1 cmd pin pull-up causing issues on carrier boards without
+external pull-up.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index 2f807d40c1b79..e749e047db7ab 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -171,14 +171,14 @@
+
+ /* Apalis MMC1 */
+ sdmmc3_clk_pa6 {
+- nvidia,pins = "sdmmc3_clk_pa6",
+- "sdmmc3_cmd_pa7";
++ nvidia,pins = "sdmmc3_clk_pa6";
+ nvidia,function = "sdmmc3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+ sdmmc3_dat0_pb7 {
+- nvidia,pins = "sdmmc3_dat0_pb7",
++ nvidia,pins = "sdmmc3_cmd_pa7",
++ "sdmmc3_dat0_pb7",
+ "sdmmc3_dat1_pb6",
+ "sdmmc3_dat2_pb5",
+ "sdmmc3_dat3_pb4",
+--
+2.20.1
+
--- /dev/null
+From 7962f41a63661469912371df097075f2e9cb3073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 10:12:44 +0200
+Subject: ARM: tegra: colibri_t30: fix mcp2515 can controller interrupt
+ polarity
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 503fcd8464fb6cd18073e97dec59b933930655d6 ]
+
+Fix the MCP2515 SPI CAN controller interrupt polarity which according
+to its datasheet defaults to low-active aka falling edge.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-colibri-eval-v3.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+index 16e1f387aa6db..a0c550e26738f 100644
+--- a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
++++ b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+@@ -79,7 +79,8 @@
+ reg = <0>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(S, 0) IRQ_TYPE_EDGE_RISING>;
++ /* CAN_INT */
++ interrupts = <TEGRA_GPIO(S, 0) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ spidev0: spi@1 {
+--
+2.20.1
+
--- /dev/null
+From 42368ad512e5b25aeb742e6317d628a741922db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 13:31:34 +0100
+Subject: arm64: dts: allwinner: a64: NanoPi-A64: Fix DCDC1 voltage
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 480f58cdbe392d4387a2193b6131a277e0111dd0 ]
+
+According to the NanoPi-A64 schematics, DCDC1 is connected to a voltage
+rail named "VDD_SYS_3.3V". All users seem to expect 3.3V here: the
+Ethernet PHY, the uSD card slot, the camera interface and the GPIO pins
+on the headers.
+Fix up the voltage on the regulator to lift it up to 3.3V.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+index 98dbff19f5ccc..5caba225b4f78 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+@@ -125,9 +125,9 @@
+
+ ®_dcdc1 {
+ regulator-always-on;
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+- regulator-name = "vcc-3v";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-name = "vcc-3v3";
+ };
+
+ ®_dcdc2 {
+--
+2.20.1
+
--- /dev/null
+From fe9ee4d99e9e7145c57d5b997afb0450054a1673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 13:31:31 +0100
+Subject: arm64: dts: allwinner: a64: Olinuxino: fix DRAM voltage
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 93366b49a35f3a190052734b3f32c8fe2535b53f ]
+
+The Olinuxino board uses DDR3L chips which are supposed to be driven
+with 1.35V. The reset default of the AXP is properly set to 1.36V.
+
+While technically the chips can also run at 1.5 volts, changing the
+voltage on the fly while booting Linux is asking for trouble. Also
+running at a lower voltage saves power.
+
+So fix the DCDC5 value to match the actual board design.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Tested-by: Martin Lucina <martin@lucina.net>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+index 3f531393eaee9..b3f186434f363 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+@@ -142,10 +142,14 @@
+
+ /* DCDC3 is polyphased with DCDC2 */
+
++/*
++ * The board uses DDR3L DRAM chips. 1.36V is the closest to the nominal
++ * 1.35V that the PMIC can drive.
++ */
+ ®_dcdc5 {
+ regulator-always-on;
+- regulator-min-microvolt = <1500000>;
+- regulator-max-microvolt = <1500000>;
++ regulator-min-microvolt = <1360000>;
++ regulator-max-microvolt = <1360000>;
+ regulator-name = "vcc-ddr3";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0bb0d6d093eb14dfa421212cc55a60561037982b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 13:31:21 +0100
+Subject: arm64: dts: allwinner: a64: Orange Pi Win: Fix SD card node
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 09b964afca14d0594b2b2f265df3d987e2f43867 ]
+
+The Orange Pi Win has a microSD card slot which is connected via all
+four SD data lines. As the DT was not mentioning this fact, we got the
+default single bit transfers, losing out on performance.
+Also, as microSD does not have a write protect switch, we disable this
+feature in the DT node.
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+index 1221764f5719c..667016815cf32 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+@@ -67,7 +67,9 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc0_pins>;
+ vmmc-supply = <®_dcdc1>;
+- cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>;
++ cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
++ disable-wp;
++ bus-width = <4>;
+ status = "okay";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From bdf8e7efff9685ff32071f2987fb3cc17336f945 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:40 -0500
+Subject: arm64: dts: amd: Fix SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ]
+
+dtc has new checks for SPI buses. Fix the warnings in node names.
+
+arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+
+Cc: Brijesh Singh <brijeshkumar.singh@amd.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+index 125f4deb52fe9..b664e7af74eb3 100644
+--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+@@ -107,7 +107,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- spi0: ssp@e1020000 {
++ spi0: spi@e1020000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1020000 0 0x1000>;
+@@ -117,7 +117,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- spi1: ssp@e1030000 {
++ spi1: spi@e1030000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1030000 0 0x1000>;
+--
+2.20.1
+
--- /dev/null
+From 52a52ae00188d0a19ab27e3752b308b73dab44bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:42 -0500
+Subject: arm64: dts: broadcom: Fix I2C and SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 7cdbe45da1a189e744e6801aebb462ee47235580 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dtb: Warning (i2c_bus_reg): /hsls/i2c@e0000/pcf8574@20: I2C bus unit address format error, expected "27"
+arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dtb: Warning (i2c_bus_reg): /hsls/i2c@e0000/pcf8574@20: I2C bus unit address format error, expected "27"
+arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dtb: Warning (spi_bus_bridge): /hsls/ssp@180000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dtb: Warning (spi_bus_bridge): /hsls/ssp@190000: node name for SPI buses should be 'spi'
+
+Cc: Ray Jui <rjui@broadcom.com>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Jon Mason <jonmason@broadcom.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Scott Branden <sbranden@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++--
+ arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi | 2 +-
+ arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 1a406a76c86a2..ea854f689fda8 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -639,7 +639,7 @@
+ status = "disabled";
+ };
+
+- ssp0: ssp@66180000 {
++ ssp0: spi@66180000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x66180000 0x1000>;
+ interrupts = <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>;
+@@ -650,7 +650,7 @@
+ status = "disabled";
+ };
+
+- ssp1: ssp@66190000 {
++ ssp1: spi@66190000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x66190000 0x1000>;
+ interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi b/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
+index bc299c3d90683..a9b92e52d50e8 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
+@@ -138,7 +138,7 @@
+ &i2c1 {
+ status = "okay";
+
+- pcf8574: pcf8574@20 {
++ pcf8574: pcf8574@27 {
+ compatible = "nxp,pcf8574a";
+ gpio-controller;
+ #gpio-cells = <2>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+index 84101ea1fd2cb..ff714fcbac68d 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -520,7 +520,7 @@
+ status = "disabled";
+ };
+
+- ssp0: ssp@180000 {
++ ssp0: spi@180000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x00180000 0x1000>;
+ interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
+@@ -532,7 +532,7 @@
+ status = "disabled";
+ };
+
+- ssp1: ssp@190000 {
++ ssp1: spi@190000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x00190000 0x1000>;
+ interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From a790b93c764728045916b2de5bedf88e1bf7d189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:43 -0500
+Subject: arm64: dts: fsl: Fix I2C and SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit b739c177e1aeab532f355493439a1901b85be38c ]
+
+dtc has new checks for I2C and SPI buses. Fix the SPI bus node names
+and warnings in unit-addresses.
+
+arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dtb: Warning (i2c_bus_reg): /soc/i2c@2180000/eeprom@57: I2C bus unit address format error, expected "53"
+arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dtb: Warning (i2c_bus_reg): /soc/i2c@2180000/eeprom@56: I2C bus unit address format error, expected "52"
+
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi | 2 +-
+ arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 6 +++---
+ arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 4 ++--
+ arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 4 ++--
+ arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 4 ++--
+ 5 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+index 68ac78c4564dc..5da732f82fa0c 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+@@ -337,7 +337,7 @@
+ status = "disabled";
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ compatible = "fsl,ls1012a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+index 7881e3d81a9ab..b9c0f2de8f12c 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+@@ -284,7 +284,7 @@
+ interrupts = <0 43 0x4>;
+ };
+
+- qspi: quadspi@1550000 {
++ qspi: spi@1550000 {
+ compatible = "fsl,ls1043a-qspi", "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -382,7 +382,7 @@
+ ranges = <0x0 0x5 0x00000000 0x8000000>;
+ };
+
+- dspi0: dspi@2100000 {
++ dspi0: spi@2100000 {
+ compatible = "fsl,ls1043a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -395,7 +395,7 @@
+ status = "disabled";
+ };
+
+- dspi1: dspi@2110000 {
++ dspi1: spi@2110000 {
+ compatible = "fsl,ls1043a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+index 440e111651d53..a59b48203688a 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+@@ -57,12 +57,12 @@
+ reg = <0x4c>;
+ };
+
+- eeprom@56 {
++ eeprom@52 {
+ compatible = "atmel,24c512";
+ reg = <0x52>;
+ };
+
+- eeprom@57 {
++ eeprom@53 {
+ compatible = "atmel,24c512";
+ reg = <0x53>;
+ };
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+index ef83786b8b905..de6af453a6e16 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+@@ -202,7 +202,7 @@
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+- qspi: quadspi@1550000 {
++ qspi: spi@1550000 {
+ compatible = "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -361,7 +361,7 @@
+ #thermal-sensor-cells = <1>;
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ compatible = "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+index 8cb78dd996728..ebe0cd4bf2b7e 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+@@ -469,7 +469,7 @@
+ mmu-masters = <&fsl_mc 0x300 0>;
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ status = "disabled";
+ compatible = "fsl,ls2080a-dspi", "fsl,ls2085a-dspi";
+ #address-cells = <1>;
+@@ -595,7 +595,7 @@
+ 3 0 0x5 0x20000000 0x00010000>;
+ };
+
+- qspi: quadspi@20c0000 {
++ qspi: spi@20c0000 {
+ status = "disabled";
+ compatible = "fsl,ls2080a-qspi", "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+--
+2.20.1
+
--- /dev/null
+From 0c85323b92da5c00763f860f16c85772a4d73e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:44 -0500
+Subject: arm64: dts: lg: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 09bae3b64cb580c95329bd8d16f08f0a5cb81ec9 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/lg/lg1312.dtsi | 4 ++--
+ arch/arm64/boot/dts/lg/lg1313.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi
+index 860c8fb107950..4bde7b6f2b113 100644
+--- a/arch/arm64/boot/dts/lg/lg1312.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi
+index 1887af654a7db..16ced1ff1ad36 100644
+--- a/arch/arm64/boot/dts/lg/lg1313.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 481ccf381e0ea064fc1b05370262a776331b9a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 20:39:10 +0200
+Subject: arm64: dts: meson-axg: use the proper compatible for ethmac
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit eaf8f57c0bf5451132932616ab62f9481adefb55 ]
+
+Use the correct compatible for the AXG ethernet mac node.
+
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index c518130e5ce73..3c34f14fa5086 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -458,7 +458,7 @@
+ };
+
+ ethmac: ethernet@ff3f0000 {
+- compatible = "amlogic,meson-gxbb-dwmac", "snps,dwmac";
++ compatible = "amlogic,meson-axg-dwmac", "snps,dwmac";
+ reg = <0x0 0xff3f0000 0x0 0x10000
+ 0x0 0xff634540 0x0 0x8>;
+ interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+--
+2.20.1
+
--- /dev/null
+From bdc8eaf2871b31028e84fec072976b603da2ea86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:41 -0500
+Subject: arm64: dts: meson: Fix erroneous SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 68ecb5c1920c5b98b1e717fd2349fba2ee5d4031 ]
+
+dtc has new checks for SPI buses. The meson dts files have a node named
+spi' which causes false positive warnings. As the node is a pinctrl child
+node, change the node name to be 'spi-pins' to fix the warnings.
+
+arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dtb: Warning (spi_bus_bridge): /soc/periphs@c8834000/pinctrl@4b0/spi: incorrect #address-cells for SPI bus
+
+Cc: Carlo Caione <carlo@caione.org>
+Cc: Kevin Hilman <khilman@baylibre.com>
+Cc: linux-amlogic@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+index 98cbba6809caa..1ade7e486828c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+@@ -390,7 +390,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index c87a80e9bcc6a..8f0bb3c44bd6d 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -337,7 +337,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+--
+2.20.1
+
--- /dev/null
+From f82fe0ab219011638ef6abebbfce055998b0f1b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 12:53:17 +0200
+Subject: arm64: dts: meson: libretech: update board model
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit b7eb0e26cc4a212fde09144cd49d4103170d2b9e ]
+
+There is actually several different libretech board with the CC suffix
+so the model name is not appropriate here. Update to something more
+specific
+
+Reported-by: Da Xue <da@lessconfused.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index f63bceb88caaf..90a56af967a7f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -13,7 +13,7 @@
+
+ / {
+ compatible = "libretech,cc", "amlogic,s905x", "amlogic,meson-gxl";
+- model = "Libre Technology CC";
++ model = "Libre Computer Board AML-S905X-CC";
+
+ aliases {
+ serial0 = &uart_AO;
+--
+2.20.1
+
--- /dev/null
+From 257d4cc76a6a326a1d71020b961c527671a2889a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 23:17:56 +0900
+Subject: arm64: dts: renesas: r8a77965: Attach the SYS-DMAC to the IPMMU
+
+From: Magnus Damm <damm+renesas@opensource.se>
+
+[ Upstream commit 4d76ad7d9de05506f1ee9a7b22416440468be090 ]
+
+For R-Car M3-N hook up SYS-DMAC0, SYS-DMAC1 and SYS-DMAC2 to
+IPMMU-DS0 and IPMMU-DS1 in same way as for R-Car M3-W.
+This follows the R-Car Gen3 Rev.1.00 (April 2018) datasheet.
+
+Signed-off-by: Magnus Damm <damm+renesas@opensource.se>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77965.dtsi | 24 +++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index f60f08ba1a6f9..0da4841162610 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -634,6 +634,14 @@
+ resets = <&cpg 219>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds0 0>, <&ipmmu_ds0 1>,
++ <&ipmmu_ds0 2>, <&ipmmu_ds0 3>,
++ <&ipmmu_ds0 4>, <&ipmmu_ds0 5>,
++ <&ipmmu_ds0 6>, <&ipmmu_ds0 7>,
++ <&ipmmu_ds0 8>, <&ipmmu_ds0 9>,
++ <&ipmmu_ds0 10>, <&ipmmu_ds0 11>,
++ <&ipmmu_ds0 12>, <&ipmmu_ds0 13>,
++ <&ipmmu_ds0 14>, <&ipmmu_ds0 15>;
+ };
+
+ dmac1: dma-controller@e7300000 {
+@@ -668,6 +676,14 @@
+ resets = <&cpg 218>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds1 0>, <&ipmmu_ds1 1>,
++ <&ipmmu_ds1 2>, <&ipmmu_ds1 3>,
++ <&ipmmu_ds1 4>, <&ipmmu_ds1 5>,
++ <&ipmmu_ds1 6>, <&ipmmu_ds1 7>,
++ <&ipmmu_ds1 8>, <&ipmmu_ds1 9>,
++ <&ipmmu_ds1 10>, <&ipmmu_ds1 11>,
++ <&ipmmu_ds1 12>, <&ipmmu_ds1 13>,
++ <&ipmmu_ds1 14>, <&ipmmu_ds1 15>;
+ };
+
+ dmac2: dma-controller@e7310000 {
+@@ -702,6 +718,14 @@
+ resets = <&cpg 217>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds1 16>, <&ipmmu_ds1 17>,
++ <&ipmmu_ds1 18>, <&ipmmu_ds1 19>,
++ <&ipmmu_ds1 20>, <&ipmmu_ds1 21>,
++ <&ipmmu_ds1 22>, <&ipmmu_ds1 23>,
++ <&ipmmu_ds1 24>, <&ipmmu_ds1 25>,
++ <&ipmmu_ds1 26>, <&ipmmu_ds1 27>,
++ <&ipmmu_ds1 28>, <&ipmmu_ds1 29>,
++ <&ipmmu_ds1 30>, <&ipmmu_ds1 31>;
+ };
+
+ ipmmu_ds0: mmu@e6740000 {
+--
+2.20.1
+
--- /dev/null
+From c0906d7564615cdc6ef9af4dc28cbc374e62bea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 16:13:27 +0200
+Subject: arm64: dts: renesas: r8a77965: Fix clock/reset for usb2_phy1
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7a590fe317488783a229e5a80e91868942e8463f ]
+
+usb2_phy1 accidentally uses the same clock/reset as usb2_phy0.
+
+Fixes: b5857630a829a8d5 ("arm64: dts: renesas: r8a77965: add usb2_phy nodes")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77965.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index 2ccb1138cdf0c..f1dfd17413b9e 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -1479,9 +1479,9 @@
+ compatible = "renesas,usb2-phy-r8a77965",
+ "renesas,rcar-gen3-usb2-phy";
+ reg = <0 0xee0a0200 0 0x700>;
+- clocks = <&cpg CPG_MOD 703>;
++ clocks = <&cpg CPG_MOD 702>;
+ power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
+- resets = <&cpg 703>;
++ resets = <&cpg 702>;
+ #phy-cells = <0>;
+ status = "disabled";
+ };
+--
+2.20.1
+
--- /dev/null
+From fadc5caa00a881e71f85381a67a5d40ef003dfd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 15:57:02 +0200
+Subject: arm64: dts: renesas: r8a77965: Fix HS-USB compatible
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 99584d93e301d820d817bba2eb77b9152e13009c ]
+
+Should be "renesas,usbhs-r8a77965", not "renesas,usbhs-r8a7796".
+
+Fixes: a06e8af801760a98 ("arm64: dts: renesas: r8a77965: add HS-USB node")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77965.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index 0da4841162610..2ccb1138cdf0c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -545,7 +545,7 @@
+ };
+
+ hsusb: usb@e6590000 {
+- compatible = "renesas,usbhs-r8a7796",
++ compatible = "renesas,usbhs-r8a77965",
+ "renesas,rcar-gen3-usbhs";
+ reg = <0 0xe6590000 0 0x100>;
+ interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From d522b319c298fa9ebe355b8945e83ddfb60906ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 16:59:33 +0100
+Subject: arm64: dts: renesas: salvator-common: adv748x: Override secondary
+ addresses
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+[ Upstream commit e3da41a6c28f9b61ea03df987f1c9ffffc8b8e60 ]
+
+Ensure that the ADV748x device addresses do not conflict, and group them
+together (visually in i2cdetect)
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/salvator-common.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+index 7d3d866a00635..3b90f816dfefc 100644
+--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+@@ -420,7 +420,10 @@
+
+ video-receiver@70 {
+ compatible = "adi,adv7482";
+- reg = <0x70>;
++ reg = <0x70 0x71 0x72 0x73 0x74 0x75
++ 0x60 0x61 0x62 0x63 0x64 0x65>;
++ reg-names = "main", "dpll", "cp", "hdmi", "edid", "repeater",
++ "infoframe", "cbus", "cec", "sdp", "txa", "txb" ;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.20.1
+
--- /dev/null
+From 2279871f93bebb96e8b5a7792ba03fccfbeb5ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:45 -0500
+Subject: arm64: dts: rockchip: Fix I2C bus unit-address error on
+ rk3399-puma-haikou
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 501500e65fa96f899230d66153fefd780f08dd34 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dtb: Warning (i2c_bus_reg): /i2c@ff3d0000/codec@0a: I2C bus unit address format error, expected "a"
+
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: linux-rockchip@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+index 8ce4a79d9360f..1e6a71066c163 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+@@ -131,7 +131,7 @@
+ status = "okay";
+ clock-frequency = <400000>;
+
+- sgtl5000: codec@0a {
++ sgtl5000: codec@a {
+ compatible = "fsl,sgtl5000";
+ reg = <0x0a>;
+ clocks = <&sgtl5000_clk>;
+--
+2.20.1
+
--- /dev/null
+From fa9c48545b2395ba96856ffe3602144009e7cd87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 15:47:14 +0200
+Subject: arm64: dts: rockchip: Fix microSD in rk3399 sapphire board
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+[ Upstream commit 88a20edf76091ee7f1bb459b89d714d53f0f8940 ]
+
+The microSD card slot in the Sapphire board is not working because of
+several issues:
+ 1.- The vmmc power supply is missing in the DTS. It is capable of 3.0V
+ and has a GPIO-based enable control.
+ 2.- The vqmmc power supply can provide up to 3.3V, but it is capped in
+ the DTS to just 3.0V because of the vmmc capability. This results in a
+ conflict from the mmc driver requesting an unsupportable voltage range
+ from 3.3V to 3.0V (min > max) as reported in dmesg. So, extend the
+ range up to 3.3V. The hw should be able to stand this 0.3V tolerance.
+ See mmc_regulator_set_vqmmc in drivers/mmc/core/core.c.
+ 3.- The card detect signal is non-working. There is a known conflict
+ with jtag, but the workaround in drivers/soc/rockchip/grf.c does not
+ work. Adding the broken-cd attribute to the DTS fixes the issue.
+
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3399-sapphire.dtsi | 24 ++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+index 8b33ef3306820..6062cc8250b11 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+@@ -93,6 +93,19 @@
+ vin-supply = <&vcc_1v8>;
+ };
+
++ vcc3v0_sd: vcc3v0-sd {
++ compatible = "regulator-fixed";
++ enable-active-high;
++ gpio = <&gpio0 RK_PA1 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc0_pwr_h>;
++ regulator-always-on;
++ regulator-max-microvolt = <3000000>;
++ regulator-min-microvolt = <3000000>;
++ regulator-name = "vcc3v0_sd";
++ vin-supply = <&vcc3v3_sys>;
++ };
++
+ vcc3v3_sys: vcc3v3-sys {
+ compatible = "regulator-fixed";
+ regulator-name = "vcc3v3_sys";
+@@ -310,7 +323,7 @@
+ regulator-always-on;
+ regulator-boot-on;
+ regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3000000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+ regulator-suspend-microvolt = <3000000>;
+@@ -469,6 +482,13 @@
+ };
+ };
+
++ sd {
++ sdmmc0_pwr_h: sdmmc0-pwr-h {
++ rockchip,pins =
++ <RK_GPIO0 RK_PA1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb2 {
+ vcc5v0_host_en: vcc5v0-host-en {
+ rockchip,pins =
+@@ -499,6 +519,7 @@
+ };
+
+ &sdmmc {
++ broken-cd;
+ bus-width = <4>;
+ cap-mmc-highspeed;
+ cap-sd-highspeed;
+@@ -507,6 +528,7 @@
+ max-frequency = <150000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
++ vmmc-supply = <&vcc3v0_sd>;
+ vqmmc-supply = <&vcc_sdio>;
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 30ae5240bff01e947fb4f1880765b6cd95eaad71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 21:00:46 +0200
+Subject: arm64: dts: rockchip: Fix VCC5V0_HOST_EN on rk3399-sapphire
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+[ Upstream commit bcdb578a5f5b4aea79441606ab7f0a2e076b4474 ]
+
+The pin is GPIO4-D1 not GPIO1-D1, see schematic, page 15 for reference.
+
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+index 36b60791c156d..8b33ef3306820 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+@@ -116,7 +116,7 @@
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+ enable-active-high;
+- gpio = <&gpio1 RK_PD1 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PD1 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+ regulator-name = "vcc5v0_host";
+--
+2.20.1
+
--- /dev/null
+From 8576e3b867d87df05e2d0eb68015b91251b04c06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Aug 2018 10:42:41 -0500
+Subject: arm64: dts: stratix10: i2c clock running out of spec
+
+From: Alan Tull <atull@kernel.org>
+
+[ Upstream commit c8da1d15b8a4957f105ad77bb1404d72e304566f ]
+
+DesignWare I2C controller was observed running at 105.93kHz rather
+than the specified 100kHz. Adjust device tree settings to bring it
+within spec (a slightly conservative 98 MHz).
+
+Signed-off-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index 7c661753bfaf4..faa017d4cd56b 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -124,6 +124,8 @@
+ &i2c1 {
+ status = "okay";
+ clock-frequency = <100000>;
++ i2c-sda-falling-time-ns = <890>; /* hcnt */
++ i2c-sdl-falling-time-ns = <890>; /* lcnt */
+
+ adc@14 {
+ compatible = "lltc,ltc2497";
+--
+2.20.1
+
--- /dev/null
+From ef6772f17cee87f21e3c42253c2ec8bd989d48a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 21:08:35 +0300
+Subject: arm64: dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply
+
+From: Aapo Vienamo <avienamo@nvidia.com>
+
+[ Upstream commit 6ff7705da8806de45ca1490194f0b4eb07725804 ]
+
+On p2180 sdmmc4 is powered from a fixed 1.8 V regulator.
+
+Signed-off-by: Aapo Vienamo <avienamo@nvidia.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 7398ae8856dc0..ccaa555180dc0 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -282,6 +282,7 @@
+ status = "okay";
+ bus-width = <8>;
+ non-removable;
++ vqmmc-supply = <&vdd_1v8>;
+ };
+
+ clocks {
+--
+2.20.1
+
--- /dev/null
+From 8b5cf820637f0b575e9de62b4f13d4fe49c1fd2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 16:47:38 +0530
+Subject: arm64: dts: ti: k3-am65: Change #address-cells and #size-cells of
+ interconnect to 2
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 3bc1572068e3896b60d86f9c0fb56d1cef28201c ]
+
+AM65 has two PCIe controllers and each PCIe controller has '2' address
+spaces one within the 4GB address space of the SoC and the other above
+the 4GB address space of the SoC (cbass_main) in addition to the
+register space. The size of the address space above the 4GB SoC address
+space is 4GB. These address ranges will be used by CPU/DMA to access
+the PCIe address space. In order to represent the address space above
+the 4GB SoC address space and to represent the size of this address
+space as 4GB, change address-cells and size-cells of interconnect to 2.
+
+Since OSPI has similar need in MCU Domain Memory Map, change
+address-cells and size-cells of cbass_mcu interconnect also to 2.
+
+Fixes: ea47eed33a3fe3d919 ("arm64: dts: ti: Add Support for AM654 SoC")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Vignesh R <vigneshr@ti.com>
+Acked-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 10 +++---
+ arch/arm64/boot/dts/ti/k3-am65.dtsi | 44 ++++++++++++------------
+ 2 files changed, 27 insertions(+), 27 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index e23c5762355d0..2e3917171b17f 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -8,13 +8,13 @@
+ &cbass_main {
+ gic500: interrupt-controller@1800000 {
+ compatible = "arm,gic-v3";
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
+ ranges;
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x01800000 0x10000>, /* GICD */
+- <0x01880000 0x90000>; /* GICR */
++ reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */
++ <0x00 0x01880000 0x00 0x90000>; /* GICR */
+ /*
+ * vcpumntirq:
+ * virtual CPU interface maintenance interrupt
+@@ -23,7 +23,7 @@
+
+ gic_its: gic-its@1820000 {
+ compatible = "arm,gic-v3-its";
+- reg = <0x01820000 0x10000>;
++ reg = <0x00 0x01820000 0x00 0x10000>;
+ msi-controller;
+ #msi-cells = <1>;
+ };
+diff --git a/arch/arm64/boot/dts/ti/k3-am65.dtsi b/arch/arm64/boot/dts/ti/k3-am65.dtsi
+index cede1fa0983c9..ded364d208351 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65.dtsi
+@@ -46,38 +46,38 @@
+
+ cbass_main: interconnect@100000 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x00100000 0x00 0x00100000 0x00020000>, /* ctrl mmr */
+- <0x00600000 0x00 0x00600000 0x00001100>, /* GPIO */
+- <0x00900000 0x00 0x00900000 0x00012000>, /* serdes */
+- <0x01000000 0x00 0x01000000 0x0af02400>, /* Most peripherals */
+- <0x30800000 0x00 0x30800000 0x0bc00000>, /* MAIN NAVSS */
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x00 0x00100000 0x00 0x00100000 0x00 0x00020000>, /* ctrl mmr */
++ <0x00 0x00600000 0x00 0x00600000 0x00 0x00001100>, /* GPIO */
++ <0x00 0x00900000 0x00 0x00900000 0x00 0x00012000>, /* serdes */
++ <0x00 0x01000000 0x00 0x01000000 0x00 0x0af02400>, /* Most peripherals */
++ <0x00 0x30800000 0x00 0x30800000 0x00 0x0bc00000>, /* MAIN NAVSS */
+ /* MCUSS Range */
+- <0x28380000 0x00 0x28380000 0x03880000>,
+- <0x40200000 0x00 0x40200000 0x00900100>,
+- <0x42040000 0x00 0x42040000 0x03ac2400>,
+- <0x45100000 0x00 0x45100000 0x00c24000>,
+- <0x46000000 0x00 0x46000000 0x00200000>,
+- <0x47000000 0x00 0x47000000 0x00068400>;
++ <0x00 0x28380000 0x00 0x28380000 0x00 0x03880000>,
++ <0x00 0x40200000 0x00 0x40200000 0x00 0x00900100>,
++ <0x00 0x42040000 0x00 0x42040000 0x00 0x03ac2400>,
++ <0x00 0x45100000 0x00 0x45100000 0x00 0x00c24000>,
++ <0x00 0x46000000 0x00 0x46000000 0x00 0x00200000>,
++ <0x00 0x47000000 0x00 0x47000000 0x00 0x00068400>;
+
+ cbass_mcu: interconnect@28380000 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x28380000 0x28380000 0x03880000>, /* MCU NAVSS*/
+- <0x40200000 0x40200000 0x00900100>, /* First peripheral window */
+- <0x42040000 0x42040000 0x03ac2400>, /* WKUP */
+- <0x45100000 0x45100000 0x00c24000>, /* MMRs, remaining NAVSS */
+- <0x46000000 0x46000000 0x00200000>, /* CPSW */
+- <0x47000000 0x47000000 0x00068400>; /* OSPI space 1 */
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x00 0x28380000 0x00 0x28380000 0x00 0x03880000>, /* MCU NAVSS*/
++ <0x00 0x40200000 0x00 0x40200000 0x00 0x00900100>, /* First peripheral window */
++ <0x00 0x42040000 0x00 0x42040000 0x00 0x03ac2400>, /* WKUP */
++ <0x00 0x45100000 0x00 0x45100000 0x00 0x00c24000>, /* MMRs, remaining NAVSS */
++ <0x00 0x46000000 0x00 0x46000000 0x00 0x00200000>, /* CPSW */
++ <0x00 0x47000000 0x00 0x47000000 0x00 0x00068400>; /* OSPI space 1 */
+
+ cbass_wakeup: interconnect@42040000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ /* WKUP Basic peripherals */
+- ranges = <0x42040000 0x42040000 0x03ac2400>;
++ ranges = <0x42040000 0x00 0x42040000 0x03ac2400>;
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From cdfb7c224a9287ac9f2ef8a11cde5cadd098f6fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 16:33:48 +0530
+Subject: arm64: fix for bad_mode() handler to always result in panic
+
+From: Hari Vyas <hari.vyas@broadcom.com>
+
+[ Upstream commit e4ba15debcfd27f60d43da940a58108783bff2a6 ]
+
+The bad_mode() handler is called if we encounter an uunknown exception,
+with the expectation that the subsequent call to panic() will halt the
+system. Unfortunately, if the exception calling bad_mode() is taken from
+EL0, then the call to die() can end up killing the current user task and
+calling schedule() instead of falling through to panic().
+
+Remove the die() call altogether, since we really want to bring down the
+machine in this "impossible" case.
+
+Signed-off-by: Hari Vyas <hari.vyas@broadcom.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/traps.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index a0099be4311ae..c8dc3a3640e7e 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -611,7 +611,6 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
+ handler[reason], smp_processor_id(), esr,
+ esr_get_class_string(esr));
+
+- die("Oops - bad mode", regs, 0);
+ local_daif_mask();
+ panic("bad mode");
+ }
+--
+2.20.1
+
--- /dev/null
+From 45f10d24cf6048201ab0c6e0842457148c1337c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 12:14:46 +0200
+Subject: arm64: tegra: I2C on Tegra194 is not compatible with Tegra114
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit d9fd22447ba59a9b53a202fade977e82bfba8d8d ]
+
+Tegra194 contains a version of the I2C controller that is no longer
+compatible with the version found in Tegra114.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index a4dfcd19b9e88..9fc14bb9a0aff 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -118,7 +118,7 @@
+ };
+
+ gen1_i2c: i2c@3160000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03160000 0x10000>;
+ interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -143,7 +143,7 @@
+ };
+
+ cam_i2c: i2c@3180000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03180000 0x10000>;
+ interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -157,7 +157,7 @@
+
+ /* shares pads with dpaux1 */
+ dp_aux_ch1_i2c: i2c@3190000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03190000 0x10000>;
+ interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -171,7 +171,7 @@
+
+ /* shares pads with dpaux0 */
+ dp_aux_ch0_i2c: i2c@31b0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031b0000 0x10000>;
+ interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -184,7 +184,7 @@
+ };
+
+ gen7_i2c: i2c@31c0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031c0000 0x10000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -197,7 +197,7 @@
+ };
+
+ gen9_i2c: i2c@31e0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031e0000 0x10000>;
+ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -264,7 +264,7 @@
+ };
+
+ gen2_i2c: i2c@c240000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x0c240000 0x10000>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -277,7 +277,7 @@
+ };
+
+ gen8_i2c: i2c@c250000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x0c250000 0x10000>;
+ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+--
+2.20.1
+
--- /dev/null
+From ac7805cbf727231ce254abfd2afcca63bacf2e8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 12:29:43 +0530
+Subject: ASoC: AMD: Change MCLK to 48Mhz
+
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+
+[ Upstream commit a1b1e9880f0c2754a5ac416a546d9f295f72eabc ]
+
+25Mhz MCLK which was earlier used was of spread type.
+Thus, we were not getting accurate rate. The 48Mhz system
+clk is of non-spread type and we are changing to it to get
+accurate rate.
+
+Signed-off-by: Akshu Agrawal <akshu.agrawal@amd.com>
+Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp-da7219-max98357a.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
+index 8e3275a96a821..e53b54d77692e 100644
+--- a/sound/soc/amd/acp-da7219-max98357a.c
++++ b/sound/soc/amd/acp-da7219-max98357a.c
+@@ -42,7 +42,7 @@
+ #include "../codecs/da7219.h"
+ #include "../codecs/da7219-aad.h"
+
+-#define CZ_PLAT_CLK 25000000
++#define CZ_PLAT_CLK 48000000
+ #define DUAL_CHANNEL 2
+
+ static struct snd_soc_jack cz_jack;
+--
+2.20.1
+
--- /dev/null
+From e71bcf166c20734d57f6212b2b8d175e18bbeffd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:41:55 +0100
+Subject: ASoC: dapm: Avoid uninitialised variable warning
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit fc269c0396448cabe1afd648c0b335669aa347b7 ]
+
+Commit 4a75aae17b2a ("ASoC: dapm: Add support for multi-CODEC
+CODEC to CODEC links") adds loops that iterate over multiple
+CODECs in snd_soc_dai_link_event. This also introduced a compiler
+warning for a potentially uninitialised variable in the case
+no CODECs are present. This should never be the case as the
+DAI link must by definition contain at least 1 CODEC however
+probably best to avoid the compiler warning by initialising ret
+to zero.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index ff31d9f9ecd64..7f0b48b363809 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3684,7 +3684,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
+ struct snd_pcm_hw_params *params = NULL;
+ struct snd_pcm_runtime *runtime = NULL;
+ unsigned int fmt;
+- int ret;
++ int ret = 0;
+
+ if (WARN_ON(!config) ||
+ WARN_ON(list_empty(&w->edges[SND_SOC_DAPM_DIR_OUT]) ||
+--
+2.20.1
+
--- /dev/null
+From 3c9803270cbf918f849934c731b7ed29b82ba7b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:35:03 +0100
+Subject: ASoC: dapm: Don't fail creating new DAPM control on NULL pinctrl
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit a5cd7e9cf587f51a84b86c828b4e1c7b392f448e ]
+
+devm_pinctrl_get will only return NULL in the case that pinctrl
+is not built into the kernel and all the pinctrl functions used
+by the DAPM core are appropriately stubbed for that case. There
+is no need to error out of snd_soc_dapm_new_control_unlocked
+if pinctrl isn't built into the kernel, so change the
+IS_ERR_OR_NULL to just an IS_ERR.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 4ce57510b6236..ff31d9f9ecd64 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3514,7 +3514,7 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
+ break;
+ case snd_soc_dapm_pinctrl:
+ w->pinctrl = devm_pinctrl_get(dapm->dev);
+- if (IS_ERR_OR_NULL(w->pinctrl)) {
++ if (IS_ERR(w->pinctrl)) {
+ ret = PTR_ERR(w->pinctrl);
+ if (ret == -EPROBE_DEFER)
+ return ERR_PTR(ret);
+--
+2.20.1
+
--- /dev/null
+From efad63e9365545401006bf57b93b1c672432a6e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 14:26:47 +0100
+Subject: ASoC: dpcm: Properly initialise hw->rate_max
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ]
+
+If the CPU DAI does not initialise rate_max, say if using
+using KNOT or CONTINUOUS, then the rate_max field will be
+initialised to 0. A value of zero in the rate_max field of
+the hardware runtime will cause the sound card to support no
+sample rates at all. Obviously this is not desired, just a
+different mechanism is being used to apply the constraints. As
+such update the setting of rate_max in dpcm_init_runtime_hw
+to be consistent with the non-DPCM cases and set rate_max to
+UINT_MAX if nothing is defined on the CPU DAI.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 6566c8831a965..551bfc581fc12 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1683,7 +1683,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
+ struct snd_soc_pcm_stream *stream)
+ {
+ runtime->hw.rate_min = stream->rate_min;
+- runtime->hw.rate_max = stream->rate_max;
++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX);
+ runtime->hw.channels_min = stream->channels_min;
+ runtime->hw.channels_max = stream->channels_max;
+ if (runtime->hw.formats)
+--
+2.20.1
+
--- /dev/null
+From fd85e50ce5f2b97782451f80f212e97b3f8ae681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 12:19:16 -0500
+Subject: ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation
+
+From: Yong Zhi <yong.zhi@intel.com>
+
+[ Upstream commit 3b857472f34faa7d11001afa5e158833812c98d7 ]
+
+Playback of 44.1Khz contents with HDMI plugged returns
+"Invalid pipe config" because HDMI paths in the FW
+topology are configured to operate at 48Khz.
+
+This patch filters out sampling rates not supported
+at hdac_hdmi_create_dais() to let user space SRC
+to do the converting.
+
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hdmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 098196610542a..be2473166bfaf 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1410,6 +1410,12 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdev,
+ if (ret)
+ return ret;
+
++ /* Filter out 44.1, 88.2 and 176.4Khz */
++ rates &= ~(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_88200 |
++ SNDRV_PCM_RATE_176400);
++ if (!rates)
++ return -EINVAL;
++
+ sprintf(dai_name, "intel-hdmi-hifi%d", i+1);
+ hdmi_dais[i].name = devm_kstrdup(&hdev->dev,
+ dai_name, GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 8de0a345a560291ac7270082b5480a42feea8b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 16:15:29 +0200
+Subject: ASoC: meson: axg-fifo: report interrupt request failure
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit dadfab7272b13ca441efdb9aa9117bc669680b05 ]
+
+Return value of request_irq() was irgnored. Fix this and report
+the failure if any
+
+Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-fifo.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/meson/axg-fifo.c b/sound/soc/meson/axg-fifo.c
+index 30262550e37b1..0e4f65e654c4b 100644
+--- a/sound/soc/meson/axg-fifo.c
++++ b/sound/soc/meson/axg-fifo.c
+@@ -203,6 +203,8 @@ static int axg_fifo_pcm_open(struct snd_pcm_substream *ss)
+
+ ret = request_irq(fifo->irq, axg_fifo_pcm_irq_block, 0,
+ dev_name(dev), ss);
++ if (ret)
++ return ret;
+
+ /* Enable pclk to access registers and clock the fifo ip */
+ ret = clk_prepare_enable(fifo->pclk);
+--
+2.20.1
+
--- /dev/null
+From f32480afc71fc72773a263b05ecb21ef29de7a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 07:07:07 +0000
+Subject: ASoC: rsnd: ssi: Fix issue in dma data address assignment
+
+From: Jiada Wang <jiada_wang@mentor.com>
+
+[ Upstream commit 0e289012b47a2de1f029a6b61c75998e2f159dd9 ]
+
+Same SSI device may be used in different dai links,
+by only having one dma struct in rsnd_ssi, after the first
+instance's dma config be initilized, the following instances
+can no longer configure dma, this causes issue, when their
+dma data address are different from the first instance.
+
+Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
+Signed-off-by: Timo Wischer <twischer@de.adit-jv.com>
+[Kuninori: tidyup for upstream]
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/rsnd.h | 1 +
+ sound/soc/sh/rcar/ssi.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index 8f7a0abfa751e..f64c7058b258b 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -438,6 +438,7 @@ struct rsnd_dai_stream {
+ char name[RSND_DAI_NAME_SIZE];
+ struct snd_pcm_substream *substream;
+ struct rsnd_mod *mod[RSND_MOD_MAX];
++ struct rsnd_mod *dma;
+ struct rsnd_dai *rdai;
+ struct device *dmac_dev; /* for IPMMU */
+ u32 parent_ssi_status;
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 9410e0a9b14b7..33dc8d6ad35b2 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -72,7 +72,6 @@
+
+ struct rsnd_ssi {
+ struct rsnd_mod mod;
+- struct rsnd_mod *dma;
+
+ u32 flags;
+ u32 cr_own;
+@@ -873,7 +872,6 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ struct rsnd_dai_stream *io,
+ struct rsnd_priv *priv)
+ {
+- struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+ int ret;
+
+ /*
+@@ -888,7 +886,7 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ return ret;
+
+ /* SSI probe might be called many times in MUX multi path */
+- ret = rsnd_dma_attach(io, mod, &ssi->dma);
++ ret = rsnd_dma_attach(io, mod, &io->dma);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 32dc642cc327e9a6feca69acdc445e9b6b7695d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 19:51:38 +0800
+Subject: ASoC: rt5682: Fix the boost volume at the begining of playback
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit 28b20dde5e1c943ab899549a655ac4935cffccbb ]
+
+This patch fixed the boost volume at the begining of playback
+while DAC volume set to lower level.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 21e7c430baf7f..7a78bb00f874d 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -68,6 +68,7 @@ struct rt5682_priv {
+
+ static const struct reg_sequence patch_list[] = {
+ {0x01c1, 0x1000},
++ {RT5682_DAC_ADC_DIG_VOL1, 0xa020},
+ };
+
+ static const struct reg_default rt5682_reg[] = {
+@@ -1457,6 +1458,8 @@ static int rt5682_hp_event(struct snd_soc_dapm_widget *w,
+ RT5682_NG2_EN_MASK, RT5682_NG2_EN);
+ snd_soc_component_update_bits(component,
+ RT5682_DEPOP_1, 0x60, 0x60);
++ snd_soc_component_update_bits(component,
++ RT5682_DAC_ADC_DIG_VOL1, 0x00c0, 0x0080);
+ break;
+
+ case SND_SOC_DAPM_POST_PMD:
+@@ -1464,6 +1467,8 @@ static int rt5682_hp_event(struct snd_soc_dapm_widget *w,
+ RT5682_DEPOP_1, 0x60, 0x0);
+ snd_soc_component_write(component,
+ RT5682_HP_CTRL_2, 0x0000);
++ snd_soc_component_update_bits(component,
++ RT5682_DAC_ADC_DIG_VOL1, 0x00c0, 0x0000);
+ break;
+
+ default:
+--
+2.20.1
+
--- /dev/null
+From 3b6947dd9359eb39d7c76045a8f1383cf0e7ddd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 11:41:52 +0100
+Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ]
+
+In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag
+is set to zero and later vol_quot is computed by dividing by
+lo_vag causing a division by zero error. Fix this by avoiding
+a zero division and set vol_quot to zero in this specific case
+so that the lowest setting for i is correctly set.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 64a52d495b1f5..896412d11a31c 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1387,7 +1387,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_component *component)
+ * Searching for a suitable index solving this formula:
+ * idx = 40 * log10(vag_val / lo_cagcntrl) + 15
+ */
+- vol_quot = (vag * 100) / lo_vag;
++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0;
+ lo_vol = 0;
+ for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) {
+ if (vol_quot >= vol_quot_table[i])
+--
+2.20.1
+
--- /dev/null
+From abf386621b1fcad020842eb9391bb9fcb0135d9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 08:32:17 -0600
+Subject: ata: Disable AHCI ALPM feature for Ampere Computing eMAG SATA
+
+From: Suman Tripathi <stripathi@amperecomputing.com>
+
+[ Upstream commit 20bdc376b427cb420836f39ee8f281ea85dbaeef ]
+
+Due to hardware errata, Ampere Computing eMAG SATA can't support
+AHCI ALPM feature. This patch disables the AHCI ALPM feature for
+eMAG SATA.
+
+Signed-off-by: Suman Trpathi <stripathi@amperecomputing.com>
+Signed-off-by: Rameshwar Prasad Sahu <rameshwar.sahu@amperecomputing.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_platform.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
+index 46f0bd75eff79..cf1e0e18a7a98 100644
+--- a/drivers/ata/ahci_platform.c
++++ b/drivers/ata/ahci_platform.c
+@@ -33,6 +33,13 @@ static const struct ata_port_info ahci_port_info = {
+ .port_ops = &ahci_platform_ops,
+ };
+
++static const struct ata_port_info ahci_port_info_nolpm = {
++ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NO_LPM,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_platform_ops,
++};
++
+ static struct scsi_host_template ahci_platform_sht = {
+ AHCI_SHT(DRV_NAME),
+ };
+@@ -41,6 +48,7 @@ static int ahci_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct ahci_host_priv *hpriv;
++ const struct ata_port_info *port;
+ int rc;
+
+ hpriv = ahci_platform_get_resources(pdev,
+@@ -58,7 +66,11 @@ static int ahci_probe(struct platform_device *pdev)
+ if (of_device_is_compatible(dev->of_node, "hisilicon,hisi-ahci"))
+ hpriv->flags |= AHCI_HFLAG_NO_FBS | AHCI_HFLAG_NO_NCQ;
+
+- rc = ahci_platform_init_host(pdev, hpriv, &ahci_port_info,
++ port = acpi_device_get_match_data(dev);
++ if (!port)
++ port = &ahci_port_info;
++
++ rc = ahci_platform_init_host(pdev, hpriv, port,
+ &ahci_platform_sht);
+ if (rc)
+ goto disable_resources;
+@@ -85,6 +97,7 @@ static const struct of_device_id ahci_of_match[] = {
+ MODULE_DEVICE_TABLE(of, ahci_of_match);
+
+ static const struct acpi_device_id ahci_acpi_match[] = {
++ { "APMC0D33", (unsigned long)&ahci_port_info_nolpm },
+ { ACPI_DEVICE_CLASS(PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff) },
+ {},
+ };
+--
+2.20.1
+
--- /dev/null
+From 0fa9391ab317d4899dffc81e8ddf55a5aeaf4e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 20:07:44 +0300
+Subject: ath10k: avoid possible memory access violation
+
+From: K.T.VIJAYAKUMAAR <vijay.bvb@samsung.com>
+
+[ Upstream commit 97c69a70dc2cecb2c3b96a66529e0082dabc2d2c ]
+
+array "ctl_power_table" access index "pream" is initialized with -1 and
+is raised as a static analysis tool issue.
+[drivers\net\wireless\ath\ath10k\wmi.c:4719] ->
+[drivers\net\wireless\ath\ath10k\wmi.c:4730]: (error) Array index -1 is
+out of bounds.
+
+Since the "pream" index for accessing ctl_power_table array is initialized
+with -1, there is a chance of memory access violation for the cases below.
+1) wmi_pdev_tpc_final_table_event change frequency is between 2483 and 5180
+2) pream_idx is out of the enumeration ranges of wmi_tpc_pream_2ghz,
+wmi_tpc_pream_5ghz
+
+Signed-off-by: K.T.VIJAYAKUMAAR <vijay.bvb@samsung.com>
+[kvalo@codeaurora.org: clean up the warning message]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 9f31b9a108507..583147f00fa4e 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -4785,6 +4785,13 @@ ath10k_wmi_tpc_final_get_rate(struct ath10k *ar,
+ }
+ }
+
++ if (pream == -1) {
++ ath10k_warn(ar, "unknown wmi tpc final index and frequency: %u, %u\n",
++ pream_idx, __le32_to_cpu(ev->chan_freq));
++ tpc = 0;
++ goto out;
++ }
++
+ if (pream == 4)
+ tpc = min_t(u8, ev->rates_array[rate_idx],
+ ev->max_reg_allow_pow[ch]);
+--
+2.20.1
+
--- /dev/null
+From e9426ecc5f952581ac9e14188abde99a23d28731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 12:39:01 +0300
+Subject: ath10k: fix kernel panic by moving pci flush after napi_disable
+
+From: Tamizh chelvam <tamizhr@codeaurora.org>
+
+[ Upstream commit bd1d395070cca4f42a93e520b0597274789274a4 ]
+
+When continuously running wifi up/down sequence, the napi poll
+can be scheduled after the CE buffers being freed by ath10k_pci_flush
+
+Steps:
+ In a certain condition, during wifi down below scenario might occur.
+
+ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize).
+
+In the above scenario, CE buffer entries will be freed up and become NULL in
+ath10k_pci_flush. And the napi_poll has been invoked after the flush process
+and it will try to get the skb from the CE buffer entry and perform some action on that.
+Since the CE buffer already cleaned by pci flush this action will create NULL
+pointer dereference and trigger below kernel panic.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000005c
+PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci]
+ath10k_pci_htt_rx_cb [ath10k_pci]
+ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci]
+ath10k_ce_per_engine_service [ath10k_pci]
+ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci]
+ath10k_ce_per_engine_service_any [ath10k_pci]
+ath10k_pci_napi_poll+0x48/0xec [ath10k_pci]
+ath10k_pci_napi_poll [ath10k_pci]
+net_rx_action+0xac/0x160
+net_rx_action
+__do_softirq+0xdc/0x208
+__do_softirq
+irq_exit+0x84/0xe0
+irq_exit
+__handle_domain_irq+0x80/0xa0
+__handle_domain_irq
+gic_handle_irq+0x38/0x5c
+gic_handle_irq
+__irq_usr+0x44/0x60
+
+Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010
+
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/ahb.c | 4 ++--
+ drivers/net/wireless/ath/ath10k/pci.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
+index c9bd0e2b5db7e..be90c9e9e5bc1 100644
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -655,10 +655,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar)
+ ath10k_ahb_irq_disable(ar);
+ synchronize_irq(ar_ahb->irq);
+
+- ath10k_pci_flush(ar);
+-
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++
++ ath10k_pci_flush(ar);
+ }
+
+ static int ath10k_ahb_hif_power_up(struct ath10k *ar)
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index af2cf55c4c1e6..97fa5c74f2fe7 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -2068,9 +2068,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_pci_irq_disable(ar);
+ ath10k_pci_irq_sync(ar);
+- ath10k_pci_flush(ar);
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+ WARN_ON(ar_pci->ps_wake_refcount > 0);
+--
+2.20.1
+
--- /dev/null
+From 0c926820d91c86009480d1f1bb9320fe2946d027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 15:04:59 +0300
+Subject: ath10k: limit available channels via DT ieee80211-freq-limit
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 34d5629d2ca89d847b7040762b87964c696c14da ]
+
+Tri-band devices (1x 2.4GHz + 2x 5GHz) often incorporate special filters in
+the RX and TX path. These filtered channel can in theory still be used by
+the hardware but the signal strength is reduced so much that it makes no
+sense.
+
+There is already a DT property to limit the available channels but ath10k
+has to manually call this functionality to limit the currrently set wiphy
+channels further.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 1419f9d1505fe..9d033da46ec2e 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -18,6 +18,7 @@
+
+ #include "mac.h"
+
++#include <net/cfg80211.h>
+ #include <net/mac80211.h>
+ #include <linux/etherdevice.h>
+ #include <linux/acpi.h>
+@@ -8363,6 +8364,7 @@ int ath10k_mac_register(struct ath10k *ar)
+ ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
+ }
+
++ wiphy_read_of_freq_limits(ar->hw->wiphy);
+ ath10k_mac_setup_ht_vht_cap(ar);
+
+ ar->hw->wiphy->interface_modes =
+--
+2.20.1
+
--- /dev/null
+From 6457c2ff48f1c1bf0a6b5ca533ce562ac474baaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 20:18:08 +0530
+Subject: ath10k: skip resetting rx filter for WCN3990
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 58da3b42307061b71f2dcce2bd1185d578a3aa53 ]
+
+WCN3990 has the MAC_PCU_ADDR1 configured properly
+and hence it will not send spurious ack frames
+during boot up.
+
+Hence the reset_rx_filter workaround is not needed
+for WCN3990. Add a hw_param to indicate if hardware rx
+filter reset is needed and skip the reset_rx_filter for
+WCN3990.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1
+
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 17 ++++++++++++++++-
+ drivers/net/wireless/ath/ath10k/hw.h | 5 +++++
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 2791ef2fd716c..436eac342b622 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -91,6 +91,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .rx_ring_fill_level = HTT_RX_RING_FILL_LEVEL,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA988X_HW_2_0_VERSION,
+@@ -124,6 +125,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9887_HW_1_0_VERSION,
+@@ -157,6 +159,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_2_1_VERSION,
+@@ -189,6 +192,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_2_1_VERSION,
+@@ -221,6 +225,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_3_0_VERSION,
+@@ -253,6 +258,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_3_2_VERSION,
+@@ -288,6 +294,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA99X0_HW_2_0_DEV_VERSION,
+@@ -326,6 +333,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9984_HW_1_0_DEV_VERSION,
+@@ -369,6 +377,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9888_HW_2_0_DEV_VERSION,
+@@ -411,6 +420,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9377_HW_1_0_DEV_VERSION,
+@@ -443,6 +453,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9377_HW_1_1_DEV_VERSION,
+@@ -477,6 +488,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA4019_HW_1_0_DEV_VERSION,
+@@ -516,6 +528,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = WCN3990_HW_1_0_DEV_VERSION,
+@@ -540,6 +553,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = true,
+ .shadow_reg_support = true,
+ .rri_on_ddr = true,
++ .hw_filter_reset_required = false,
+ },
+ };
+
+@@ -2406,7 +2420,8 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
+ * possible to implicitly make it correct by creating a dummy vdev and
+ * then deleting it.
+ */
+- if (mode == ATH10K_FIRMWARE_MODE_NORMAL) {
++ if (ar->hw_params.hw_filter_reset_required &&
++ mode == ATH10K_FIRMWARE_MODE_NORMAL) {
+ status = ath10k_core_reset_rx_filter(ar);
+ if (status) {
+ ath10k_err(ar,
+diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
+index 977f79ebb4fd5..fac58c3c576a2 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.h
++++ b/drivers/net/wireless/ath/ath10k/hw.h
+@@ -589,6 +589,11 @@ struct ath10k_hw_params {
+
+ /* Number of bytes to be the offset for each FFT sample */
+ int spectral_bin_offset;
++
++ /* targets which require hw filter reset during boot up,
++ * to avoid it sending spurious acks.
++ */
++ bool hw_filter_reset_required;
+ };
+
+ struct htt_rx_desc;
+--
+2.20.1
+
--- /dev/null
+From 1223c8e0d726649322c4d68404914bc26a8c2578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 15:07:07 +0300
+Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx
+
+From: Erik Stromdahl <erik.stromdahl@gmail.com>
+
+[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ]
+
+This is done in order not to trig the below warning in
+ieee80211_rx_napi:
+
+WARN_ON_ONCE(softirq_count() == 0);
+
+ieee80211_rx_napi requires that softirq's are disabled during
+execution.
+
+The High latency bus drivers (SDIO and USB) sometimes call the wmi
+ep_rx_complete callback from non softirq context, resulting in a trigger
+of the above warning.
+
+Calling ieee80211_rx_ni with softirq's already disabled (e.g., from
+softirq context) should be safe as the local_bh_disable and
+local_bh_enable functions (called from ieee80211_rx_ni) are fully
+reentrant.
+
+Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 583147f00fa4e..40b36e73bb48c 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2487,7 +2487,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+ status->freq, status->band, status->signal,
+ status->rate_idx);
+
+- ieee80211_rx(ar->hw, skb);
++ ieee80211_rx_ni(ar->hw, skb);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0e8bf2ba1013d603529a37336963848667c274ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 18:49:05 +0200
+Subject: ath9k: add back support for using active monitor interfaces for tx99
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 6df0580be8bc30803c4d8b2ed9c2230a2740c795 ]
+
+Various documented examples on how to set up tx99 with ath9k rely
+on setting up a regular monitor interface for setting the channel.
+My previous patch "ath9k: fix tx99 with monitor mode interface" made
+it possible to set it up this way again. However, it was removing support
+for using an active monitor interface, which is required for controlling
+the bitrate as well, since the bitrate is not passed down with a regular
+monitor interface.
+
+This patch partially reverts the previous one, but keeps support for using
+a regular monitor interface to keep documented steps working in cases
+where the bitrate does not matter
+
+Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 10 ++++++++--
+ drivers/net/wireless/ath/ath9k/tx99.c | 7 +++++++
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 50206a6d8a850..0fca44e91a712 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,6 +1074,7 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
++ struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 6ce4b9f1dcb44..c85f613e8ceb5 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,8 +1251,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99))
+- return -EOPNOTSUPP;
++ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
++ if (sc->cur_chan->nvifs >= 1) {
++ mutex_unlock(&sc->mutex);
++ return -EOPNOTSUPP;
++ }
++ sc->tx99_vif = vif;
++ }
+
+ mutex_lock(&sc->mutex);
+
+@@ -1337,6 +1342,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
++ sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index 9b05ffb68c34a..95544ce05acf9 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
++ struct ath_vif *avp;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
++ if (sc->tx99_vif) {
++ avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++ hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++ }
++
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
++ tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 3ae8d0585b6f3..4b7a7fc2a0fe0 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(NULL, NULL, bf);
++ ath_set_rates(sc->tx99_vif, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From b4e9c3ec67fe430aa0d163e2e76d11360683520a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 23:08:43 +0300
+Subject: ath9k: Fix a locking bug in ath9k_add_interface()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 461cf036057477805a8a391e5fd0f5264a5e56a8 ]
+
+We tried to revert commit d9c52fd17cb4 ("ath9k: fix tx99 with monitor
+mode interface") but accidentally missed part of the locking change.
+
+The lock has to be held earlier so that we're holding it when we do
+"sc->tx99_vif = vif;" and also there in the current code there is a
+stray unlock before we have taken the lock.
+
+Fixes: 6df0580be8bc ("ath9k: add back support for using active monitor interfaces for tx99")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index c85f613e8ceb5..74f98bbaea889 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,6 +1251,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
++ mutex_lock(&sc->mutex);
+ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+ if (sc->cur_chan->nvifs >= 1) {
+ mutex_unlock(&sc->mutex);
+@@ -1259,8 +1260,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ sc->tx99_vif = vif;
+ }
+
+- mutex_lock(&sc->mutex);
+-
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+
+--
+2.20.1
+
--- /dev/null
+From e6eb4a9fd7395112e3e886f38da205286b8d9a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:37:51 +0200
+Subject: ath9k: fix tx99 with monitor mode interface
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit d9c52fd17cb483bd8a470398afcb79f86c1b77c8 ]
+
+Tx99 is typically configured via a monitor mode interface, which does
+not get added to the driver as a vif. Since the code currently expects
+a configured virtual interface for tx99, enabling tx99 via debugfs fails.
+Since the vif is not needed anyway, remove all checks for it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+[kvalo@codeaurora.org: s/CPTCFG/CONFIG/]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 -
+ drivers/net/wireless/ath/ath9k/main.c | 12 +++---------
+ drivers/net/wireless/ath/ath9k/tx99.c | 9 ---------
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 4 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 0fca44e91a712..50206a6d8a850 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,7 +1074,6 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
+- struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 1049773378f27..6ce4b9f1dcb44 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,15 +1251,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- mutex_lock(&sc->mutex);
++ if (IS_ENABLED(CONFIG_ATH9K_TX99))
++ return -EOPNOTSUPP;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+- if (sc->cur_chan->nvifs >= 1) {
+- mutex_unlock(&sc->mutex);
+- return -EOPNOTSUPP;
+- }
+- sc->tx99_vif = vif;
+- }
++ mutex_lock(&sc->mutex);
+
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+@@ -1342,7 +1337,6 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
+- sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index ce50d8f5835e0..9b05ffb68c34a 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,12 +54,6 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
+- struct ath_vif *avp;
+-
+- if (!sc->tx99_vif)
+- return NULL;
+-
+- avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -77,14 +71,11 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+- hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
+-
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
+- tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 4b7a7fc2a0fe0..3ae8d0585b6f3 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(sc->tx99_vif, NULL, bf);
++ ath_set_rates(NULL, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From c9884dc9aab7d7fb9dc95abb865e1f043af5c899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 16:23:08 +0200
+Subject: block, bfq: inject other-queue I/O into seeky idle queues on NCQ
+ flash
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit d0edc2473be9d70f999282e1ca7863ad6ae704dc ]
+
+The Achilles' heel of BFQ is its failing to reach a high throughput
+with sync random I/O on flash storage with internal queueing, in case
+the processes doing I/O have differentiated weights.
+
+The cause of this failure is as follows. If at least two processes do
+sync I/O, and have a different weight from each other, then BFQ plugs
+I/O dispatching every time one of these processes, while it is being
+served, remains temporarily without pending I/O requests. This
+plugging is necessary to guarantee that every process enjoys a
+bandwidth proportional to its weight; but it empties the internal
+queue(s) of the drive. And this kills throughput with random I/O. So,
+if some processes have differentiated weights and do both sync and
+random I/O, the end result is a throughput collapse.
+
+This commit tries to counter this problem by injecting the service of
+other processes, in a controlled way, while the process in service
+happens to have no I/O. This injection is performed only if the medium
+is non rotational and performs internal queueing, and the process in
+service does random I/O (service injection might be beneficial for
+sequential I/O too, we'll work on that).
+
+As an example of the benefits of this commit, on a PLEXTOR PX-256M5S
+SSD, and with five processes having differentiated weights and doing
+sync random 4KB I/O, this commit makes the throughput with bfq grow by
+400%, from 25 to 100MB/s. This higher throughput is 10MB/s lower than
+that reached with none. As some less random I/O is added to the mix,
+the throughput becomes equal to or higher than that with none.
+
+This commit is a very first attempt to recover throughput without
+losing control, and certainly has many limitations. One is, e.g., that
+the processes whose service is injected are not chosen so as to
+distribute the extra bandwidth they receive in accordance to their
+weights. Thus there might be loss of weighted fairness in some
+cases. Anyway, this loss concerns extra service, which would not have
+been received at all without this commit. Other limitations and issues
+will probably show up with usage.
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 68 +++++++++++++++++++++++++++++++++++++++++----
+ block/bfq-iosched.h | 26 +++++++++++++++++
+ 2 files changed, 88 insertions(+), 6 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index d8d2ac294b0c0..35ddaa820737c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3195,6 +3195,13 @@ static unsigned long bfq_bfqq_softrt_next_start(struct bfq_data *bfqd,
+ jiffies + nsecs_to_jiffies(bfqq->bfqd->bfq_slice_idle) + 4);
+ }
+
++static bool bfq_bfqq_injectable(struct bfq_queue *bfqq)
++{
++ return BFQQ_SEEKY(bfqq) && bfqq->wr_coeff == 1 &&
++ blk_queue_nonrot(bfqq->bfqd->queue) &&
++ bfqq->bfqd->hw_tag;
++}
++
+ /**
+ * bfq_bfqq_expire - expire a queue.
+ * @bfqd: device owning the queue.
+@@ -3304,6 +3311,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
+ if (ref == 1) /* bfqq is gone, no more actions on it */
+ return;
+
++ bfqq->injected_service = 0;
++
+ /* mark bfqq as waiting a request only if a bic still points to it */
+ if (!bfq_bfqq_busy(bfqq) &&
+ reason != BFQQE_BUDGET_TIMEOUT &&
+@@ -3642,6 +3651,30 @@ static bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
+ return RB_EMPTY_ROOT(&bfqq->sort_list) && bfq_better_to_idle(bfqq);
+ }
+
++static struct bfq_queue *bfq_choose_bfqq_for_injection(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq;
++
++ /*
++ * A linear search; but, with a high probability, very few
++ * steps are needed to find a candidate queue, i.e., a queue
++ * with enough budget left for its next request. In fact:
++ * - BFQ dynamically updates the budget of every queue so as
++ * to accommodate the expected backlog of the queue;
++ * - if a queue gets all its requests dispatched as injected
++ * service, then the queue is removed from the active list
++ * (and re-added only if it gets new requests, but with
++ * enough budget for its new backlog).
++ */
++ list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list)
++ if (!RB_EMPTY_ROOT(&bfqq->sort_list) &&
++ bfq_serv_to_charge(bfqq->next_rq, bfqq) <=
++ bfq_bfqq_budget_left(bfqq))
++ return bfqq;
++
++ return NULL;
++}
++
+ /*
+ * Select a queue for service. If we have a current queue in service,
+ * check whether to continue servicing it, or retrieve and set a new one.
+@@ -3723,10 +3756,19 @@ check_queue:
+ * No requests pending. However, if the in-service queue is idling
+ * for a new request, or has requests waiting for a completion and
+ * may idle after their completion, then keep it anyway.
++ *
++ * Yet, to boost throughput, inject service from other queues if
++ * possible.
+ */
+ if (bfq_bfqq_wait_request(bfqq) ||
+ (bfqq->dispatched != 0 && bfq_better_to_idle(bfqq))) {
+- bfqq = NULL;
++ if (bfq_bfqq_injectable(bfqq) &&
++ bfqq->injected_service * bfqq->inject_coeff <
++ bfqq->entity.service * 10)
++ bfqq = bfq_choose_bfqq_for_injection(bfqd);
++ else
++ bfqq = NULL;
++
+ goto keep_queue;
+ }
+
+@@ -3816,6 +3858,14 @@ static struct request *bfq_dispatch_rq_from_bfqq(struct bfq_data *bfqd,
+
+ bfq_dispatch_remove(bfqd->queue, rq);
+
++ if (bfqq != bfqd->in_service_queue) {
++ if (likely(bfqd->in_service_queue))
++ bfqd->in_service_queue->injected_service +=
++ bfq_serv_to_charge(rq, bfqq);
++
++ goto return_rq;
++ }
++
+ /*
+ * If weight raising has to terminate for bfqq, then next
+ * function causes an immediate update of bfqq's weight,
+@@ -3834,13 +3884,12 @@ static struct request *bfq_dispatch_rq_from_bfqq(struct bfq_data *bfqd,
+ * belongs to CLASS_IDLE and other queues are waiting for
+ * service.
+ */
+- if (bfqd->busy_queues > 1 && bfq_class_idle(bfqq))
+- goto expire;
+-
+- return rq;
++ if (!(bfqd->busy_queues > 1 && bfq_class_idle(bfqq)))
++ goto return_rq;
+
+-expire:
+ bfq_bfqq_expire(bfqd, bfqq, false, BFQQE_BUDGET_EXHAUSTED);
++
++return_rq:
+ return rq;
+ }
+
+@@ -4246,6 +4295,13 @@ static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ bfq_mark_bfqq_has_short_ttime(bfqq);
+ bfq_mark_bfqq_sync(bfqq);
+ bfq_mark_bfqq_just_created(bfqq);
++ /*
++ * Aggressively inject a lot of service: up to 90%.
++ * This coefficient remains constant during bfqq life,
++ * but this behavior might be changed, after enough
++ * testing and tuning.
++ */
++ bfqq->inject_coeff = 1;
+ } else
+ bfq_clear_bfqq_sync(bfqq);
+
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index d5e9e60cb1a5f..a41e9884f2dd2 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -351,6 +351,32 @@ struct bfq_queue {
+ unsigned long split_time; /* time of last split */
+
+ unsigned long first_IO_time; /* time of first I/O for this queue */
++
++ /* max service rate measured so far */
++ u32 max_service_rate;
++ /*
++ * Ratio between the service received by bfqq while it is in
++ * service, and the cumulative service (of requests of other
++ * queues) that may be injected while bfqq is empty but still
++ * in service. To increase precision, the coefficient is
++ * measured in tenths of unit. Here are some example of (1)
++ * ratios, (2) resulting percentages of service injected
++ * w.r.t. to the total service dispatched while bfqq is in
++ * service, and (3) corresponding values of the coefficient:
++ * 1 (50%) -> 10
++ * 2 (33%) -> 20
++ * 10 (9%) -> 100
++ * 9.9 (9%) -> 99
++ * 1.5 (40%) -> 15
++ * 0.5 (66%) -> 5
++ * 0.1 (90%) -> 1
++ *
++ * So, if the coefficient is lower than 10, then
++ * injected service is more than bfqq service.
++ */
++ unsigned int inject_coeff;
++ /* amount of service injected in current service slot */
++ unsigned int injected_service;
+ };
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From c3a84c1f6985798d2d0b11a8265a5f5592ec4b42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 16:23:09 +0200
+Subject: blok, bfq: do not plug I/O if all queues are weight-raised
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit c8765de0adfcaaf4ffb2d951e07444f00ffa9453 ]
+
+To reduce latency for interactive and soft real-time applications, bfq
+privileges the bfq_queues containing the I/O of these
+applications. These privileged queues, referred-to as weight-raised
+queues, get a much higher share of the device throughput
+w.r.t. non-privileged queues. To preserve this higher share, the I/O
+of any non-weight-raised queue must be plugged whenever a sync
+weight-raised queue, while being served, remains temporarily empty. To
+attain this goal, bfq simply plugs any I/O (from any queue), if a sync
+weight-raised queue remains empty while in service.
+
+Unfortunately, this plugging typically lowers throughput with random
+I/O, on devices with internal queueing (because it reduces the filling
+level of the internal queues of the device).
+
+This commit addresses this issue by restricting the cases where
+plugging is performed: if a sync weight-raised queue remains empty
+while in service, then I/O plugging is performed only if some of the
+active bfq_queues are *not* weight-raised (which is actually the only
+circumstance where plugging is needed to preserve the higher share of
+the throughput of weight-raised queues). This restriction proved able
+to boost throughput in really many use cases needing only maximum
+throughput.
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 35ddaa820737c..66b1ebc21ce4f 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3593,7 +3593,12 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * whether bfqq is being weight-raised, because
+ * bfq_symmetric_scenario() does not take into account also
+ * weight-raised queues (see comments on
+- * bfq_weights_tree_add()).
++ * bfq_weights_tree_add()). In particular, if bfqq is being
++ * weight-raised, it is important to idle only if there are
++ * other, non-weight-raised queues that may steal throughput
++ * to bfqq. Actually, we should be even more precise, and
++ * differentiate between interactive weight raising and
++ * soft real-time weight raising.
+ *
+ * As a side note, it is worth considering that the above
+ * device-idling countermeasures may however fail in the
+@@ -3605,7 +3610,8 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * to let requests be served in the desired order until all
+ * the requests already queued in the device have been served.
+ */
+- asymmetric_scenario = bfqq->wr_coeff > 1 ||
++ asymmetric_scenario = (bfqq->wr_coeff > 1 &&
++ bfqd->wr_busy_queues < bfqd->busy_queues) ||
+ !bfq_symmetric_scenario(bfqd);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 5d5988e3a3bf3db72132d0991d736f396d3b6955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 11:27:46 +0530
+Subject: Bluetooth: btrsi: fix bt tx timeout issue
+
+From: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
+
+[ Upstream commit 7cbfd1e2aad410d96fa6162aeb3f9cff1fecfc58 ]
+
+observed sometimes data is coming with unaligned address from kernel
+BT stack. If unaligned address is passed, some data in payload is
+stripped when packet is loading to firmware and this results, BT
+connection timeout is happening.
+
+sh# hciconfig hci0 up
+Can't init device hci0: hci0 command 0x0c03 tx timeout
+
+Fixed this by moving the data to aligned address.
+
+Signed-off-by: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
+Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btrsi.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btrsi.c b/drivers/bluetooth/btrsi.c
+index 60d1419590bab..3951f7b238404 100644
+--- a/drivers/bluetooth/btrsi.c
++++ b/drivers/bluetooth/btrsi.c
+@@ -21,8 +21,9 @@
+ #include <net/rsi_91x.h>
+ #include <net/genetlink.h>
+
+-#define RSI_HEADROOM_FOR_BT_HAL 16
++#define RSI_DMA_ALIGN 8
+ #define RSI_FRAME_DESC_SIZE 16
++#define RSI_HEADROOM_FOR_BT_HAL (RSI_FRAME_DESC_SIZE + RSI_DMA_ALIGN)
+
+ struct rsi_hci_adapter {
+ void *priv;
+@@ -70,6 +71,16 @@ static int rsi_hci_send_pkt(struct hci_dev *hdev, struct sk_buff *skb)
+ bt_cb(new_skb)->pkt_type = hci_skb_pkt_type(skb);
+ kfree_skb(skb);
+ skb = new_skb;
++ if (!IS_ALIGNED((unsigned long)skb->data, RSI_DMA_ALIGN)) {
++ u8 *skb_data = skb->data;
++ int skb_len = skb->len;
++
++ skb_push(skb, RSI_DMA_ALIGN);
++ skb_pull(skb, PTR_ALIGN(skb->data,
++ RSI_DMA_ALIGN) - skb->data);
++ memmove(skb->data, skb_data, skb_len);
++ skb_trim(skb, skb_len);
++ }
+ }
+
+ return h_adapter->proto_ops->coex_send_pkt(h_adapter->priv, skb,
+--
+2.20.1
+
--- /dev/null
+From 99dfbadf0d2cca5b837e14027520924deb01aead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Aug 2018 17:34:11 +0530
+Subject: Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing
+ proto races
+
+From: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+
+[ Upstream commit 7cf7846d27bfc9731e449857db3eec5e0e9701ba ]
+
+Clearing HCI_UART_PROTO_READY will avoid usage of proto function pointers
+before running the proto close function pointer. There is chance of kernel
+crash, due to usage of non proto close function pointers after proto close.
+
+Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_serdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index aa2543b3c2869..46e20444ba19b 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -368,6 +368,7 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ {
+ struct hci_dev *hdev = hu->hdev;
+
++ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+
+--
+2.20.1
+
--- /dev/null
+From e76a8b550df6ccca4a248f02383d3e5e9635962d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 13:39:22 +0300
+Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ]
+
+If the remote is not able to fully utilize the MPS choosen recalculate
+the credits based on the actual amount it is sending that way it can
+still send packets of MTU size without credits dropping to 0.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 260ef5426e0ca..974c1b8a689c1 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6819,6 +6819,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ chan->sdu_len = sdu_len;
+ chan->sdu_last_frag = skb;
+
++ /* Detect if remote is not able to use the selected MPS */
++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
++
++ /* Adjust the number of credits */
++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
++ chan->mps = mps_len;
++ l2cap_chan_le_send_credits(chan);
++ }
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6d3ee00ef0491ad33ce57812d7f203e679f03c2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:22:51 -0700
+Subject: bnx2x: Ignore bandwidth attention in single function mode
+
+From: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+
+[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ]
+
+This is a workaround for FW bug -
+MFW generates bandwidth attention in single function mode, which
+is only expected to be generated in multi function mode.
+This undesired attention in SF mode results in incorrect HW
+configuration and resulting into Tx timeout.
+
+Signed-off-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 68c62e32e8820..af57568c922eb 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3540,6 +3540,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp)
+ */
+ static void bnx2x_config_mf_bw(struct bnx2x *bp)
+ {
++ /* Workaround for MFW bug.
++ * MFW is not supposed to generate BW attention in
++ * single function mode.
++ */
++ if (!IS_MF(bp)) {
++ DP(BNX2X_MSG_MCP,
++ "Ignoring MF BW config in single function mode\n");
++ return;
++ }
++
+ if (bp->link_vars.link_up) {
+ bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+ bnx2x_link_sync_notify(bp);
+--
+2.20.1
+
--- /dev/null
+From 333fde48cc2388b4fd97259cac0d976f55730f5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Aug 2018 15:22:15 +0200
+Subject: brcmfmac: fix wrong strnchr usage
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit cb18e2e9ec71d42409a51b83546686c609780dde ]
+
+strnchr takes arguments in the order of its name: string, max bytes to
+read, character to search for. Here we're passing '\n' aka 10 as the
+buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka
+256 (aka '\0', since it's implicitly converted to char) within those 10
+bytes.
+
+Just interchanging the last two arguments would still leave a bug,
+because if we've been successful once, there are not sizeof(buf)
+characters left after the new value of p.
+
+Since clmver is immediately afterwards passed as a %s argument, I assume
+that it is actually a properly nul-terminated string. For that case, we
+have strreplace().
+
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index 27893af63ebc3..8510d207ee87d 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ /* Replace all newline/linefeed characters with space
+ * character
+ */
+- ptr = clmver;
+- while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
+- *ptr = ' ';
++ strreplace(clmver, '\n', ' ');
+
+ brcmf_dbg(INFO, "CLM version = %s\n", clmver);
+ }
+--
+2.20.1
+
--- /dev/null
+From 04edc374a690189b0f5ebe1530a33b2bb6aef1e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 09:48:59 +0200
+Subject: brcmfmac: increase buffer for obtaining firmware capabilities
+
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+
+[ Upstream commit 59c2a30d36c8ae430d26a902c4c9665ea33ccee5 ]
+
+When obtaining the firmware capability a buffer is provided of 512
+bytes. However, if all features in firmware are supported the buffer
+needs to be 565 bytes as otherwise truncated information is retrieved
+from firmware. Increasing the buffer to 768 bytes on stack.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+index 8347da632a5b0..4c5a3995dc352 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -178,7 +178,7 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
+ ifp->fwil_fwerr = false;
+ }
+
+-#define MAX_CAPS_BUFFER_SIZE 512
++#define MAX_CAPS_BUFFER_SIZE 768
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+ char caps[MAX_CAPS_BUFFER_SIZE];
+--
+2.20.1
+
--- /dev/null
+From be35df0b2fa0a4e73b4a431fe14a9cf614b3e992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 08:15:17 +0200
+Subject: brcmsmac: Use kvmalloc() for ucode allocations
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 6c3efbe77bc78bf49db851aec7f385be475afca6 ]
+
+The ucode chunk might be relatively large and the allocation with
+kmalloc() may fail occasionally. Since the data isn't DMA-transferred
+but by manual loops, we can use vmalloc instead of kmalloc.
+For a better performance, though, kvmalloc() would be the best choice
+in such a case, so let's replace with it.
+
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1103431
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index ecc89e718b9c1..6255fb6d97a70 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -1578,10 +1578,10 @@ int brcms_ucode_init_buf(struct brcms_info *wl, void **pbuf, u32 idx)
+ if (le32_to_cpu(hdr->idx) == idx) {
+ pdata = wl->fw.fw_bin[i]->data +
+ le32_to_cpu(hdr->offset);
+- *pbuf = kmemdup(pdata, len, GFP_KERNEL);
++ *pbuf = kvmalloc(len, GFP_KERNEL);
+ if (*pbuf == NULL)
+ goto fail;
+-
++ memcpy(*pbuf, pdata, len);
+ return 0;
+ }
+ }
+@@ -1629,7 +1629,7 @@ int brcms_ucode_init_uint(struct brcms_info *wl, size_t *n_bytes, u32 idx)
+ */
+ void brcms_ucode_free_buf(void *p)
+ {
+- kfree(p);
++ kvfree(p);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From a887c647d8bb185669af370e194ca6074943aba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jul 2018 18:46:13 +0530
+Subject: cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set
+
+From: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+
+[ Upstream commit 7417844b63d4b0dc8ab23f88259bf95de7d09b57 ]
+
+When REGULATORY_COUNTRY_IE_IGNORE is set, __reg_process_hint_country_ie()
+ignores the country code change request from __cfg80211_connect_result()
+via regulatory_hint_country_ie().
+
+After Disconnect, similar to above, country code should not be reset to
+world when country IE ignore is set. But this is violated and restore of
+regulatory settings is invoked by cfg80211_disconnect_work via
+regulatory_hint_disconnect().
+
+To address this, avoid regulatory restore from regulatory_hint_disconnect()
+when COUNTRY_IE_IGNORE is set.
+
+Note: Currently, restore_regulatory_settings() takes care of clearing
+beacon hints. But in the proposed change, regulatory restore is avoided.
+Therefore, explicitly clear beacon hints when DISABLE_BEACON_HINTS
+is not set.
+
+Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index cccbf845079c8..68ae97ef8bf0b 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3225,8 +3225,54 @@ static void restore_regulatory_settings(bool reset_user)
+ schedule_work(®_work);
+ }
+
++static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
++{
++ struct cfg80211_registered_device *rdev;
++ struct wireless_dev *wdev;
++
++ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ wdev_lock(wdev);
++ if (!(wdev->wiphy->regulatory_flags & flag)) {
++ wdev_unlock(wdev);
++ return false;
++ }
++ wdev_unlock(wdev);
++ }
++ }
++
++ return true;
++}
++
+ void regulatory_hint_disconnect(void)
+ {
++ /* Restore of regulatory settings is not required when wiphy(s)
++ * ignore IE from connected access point but clearance of beacon hints
++ * is required when wiphy(s) supports beacon hints.
++ */
++ if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
++ struct reg_beacon *reg_beacon, *btmp;
++
++ if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
++ return;
++
++ spin_lock_bh(®_pending_beacons_lock);
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_pending_beacons, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++ spin_unlock_bh(®_pending_beacons_lock);
++
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_beacon_list, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++
++ return;
++ }
++
+ pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+ restore_regulatory_settings(false);
+ }
+--
+2.20.1
+
--- /dev/null
+From 110010f3c95950cfc68a019cb7cc69b195f421f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Aug 2018 13:52:22 +0200
+Subject: cfg80211: validate wmm rule when setting
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+[ Upstream commit 014f5a250fc49fa8c6cd50093e725e71f3ae52da ]
+
+Add validation check for wmm rule when copy rules from fwdb and print
+error when rule is invalid.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 64 +++++++++++++++++++++++++---------------------
+ 1 file changed, 35 insertions(+), 29 deletions(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 68ae97ef8bf0b..64841238df855 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -847,22 +847,36 @@ static bool valid_regdb(const u8 *data, unsigned int size)
+ return true;
+ }
+
+-static void set_wmm_rule(struct ieee80211_reg_rule *rrule,
+- struct fwdb_wmm_rule *wmm)
+-{
+- struct ieee80211_wmm_rule *rule = &rrule->wmm_rule;
+- unsigned int i;
++static void set_wmm_rule(const struct fwdb_header *db,
++ const struct fwdb_country *country,
++ const struct fwdb_rule *rule,
++ struct ieee80211_reg_rule *rrule)
++{
++ struct ieee80211_wmm_rule *wmm_rule = &rrule->wmm_rule;
++ struct fwdb_wmm_rule *wmm;
++ unsigned int i, wmm_ptr;
++
++ wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
++ wmm = (void *)((u8 *)db + wmm_ptr);
++
++ if (!valid_wmm(wmm)) {
++ pr_err("Invalid regulatory WMM rule %u-%u in domain %c%c\n",
++ be32_to_cpu(rule->start), be32_to_cpu(rule->end),
++ country->alpha2[0], country->alpha2[1]);
++ return;
++ }
+
+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+- rule->client[i].cw_min =
++ wmm_rule->client[i].cw_min =
+ ecw2cw((wmm->client[i].ecw & 0xf0) >> 4);
+- rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
+- rule->client[i].aifsn = wmm->client[i].aifsn;
+- rule->client[i].cot = 1000 * be16_to_cpu(wmm->client[i].cot);
+- rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
+- rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
+- rule->ap[i].aifsn = wmm->ap[i].aifsn;
+- rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
++ wmm_rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
++ wmm_rule->client[i].aifsn = wmm->client[i].aifsn;
++ wmm_rule->client[i].cot =
++ 1000 * be16_to_cpu(wmm->client[i].cot);
++ wmm_rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
++ wmm_rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
++ wmm_rule->ap[i].aifsn = wmm->ap[i].aifsn;
++ wmm_rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
+ }
+
+ rrule->has_wmm = true;
+@@ -870,7 +884,7 @@ static void set_wmm_rule(struct ieee80211_reg_rule *rrule,
+
+ static int __regdb_query_wmm(const struct fwdb_header *db,
+ const struct fwdb_country *country, int freq,
+- struct ieee80211_reg_rule *rule)
++ struct ieee80211_reg_rule *rrule)
+ {
+ unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
+ struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
+@@ -879,18 +893,14 @@ static int __regdb_query_wmm(const struct fwdb_header *db,
+ for (i = 0; i < coll->n_rules; i++) {
+ __be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
+ unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
+- struct fwdb_rule *rrule = (void *)((u8 *)db + rule_ptr);
+- struct fwdb_wmm_rule *wmm;
+- unsigned int wmm_ptr;
++ struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
+
+- if (rrule->len < offsetofend(struct fwdb_rule, wmm_ptr))
++ if (rule->len < offsetofend(struct fwdb_rule, wmm_ptr))
+ continue;
+
+- if (freq >= KHZ_TO_MHZ(be32_to_cpu(rrule->start)) &&
+- freq <= KHZ_TO_MHZ(be32_to_cpu(rrule->end))) {
+- wmm_ptr = be16_to_cpu(rrule->wmm_ptr) << 2;
+- wmm = (void *)((u8 *)db + wmm_ptr);
+- set_wmm_rule(rule, wmm);
++ if (freq >= KHZ_TO_MHZ(be32_to_cpu(rule->start)) &&
++ freq <= KHZ_TO_MHZ(be32_to_cpu(rule->end))) {
++ set_wmm_rule(db, country, rule, rrule);
+ return 0;
+ }
+ }
+@@ -972,12 +982,8 @@ static int regdb_query_country(const struct fwdb_header *db,
+ if (rule->len >= offsetofend(struct fwdb_rule, cac_timeout))
+ rrule->dfs_cac_ms =
+ 1000 * be16_to_cpu(rule->cac_timeout);
+- if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr)) {
+- u32 wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
+- struct fwdb_wmm_rule *wmm = (void *)((u8 *)db + wmm_ptr);
+-
+- set_wmm_rule(rrule, wmm);
+- }
++ if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr))
++ set_wmm_rule(db, country, rule, rrule);
+ }
+
+ return reg_schedule_apply(regdom);
+--
+2.20.1
+
--- /dev/null
+From acd22c29f7654444a7a01cbaa93aa73702422569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 23:16:38 +0800
+Subject: clk: sunxi-ng: h6: fix PWM gate/reset offset
+
+From: Rongyi Chen <chenyi@tt-cool.com>
+
+[ Upstream commit 58c0f79887d5e425fe6a9fd542778e50df69e9c6 ]
+
+Currently the register offset of the PWM bus gate in Allwinner H6 clock
+driver is wrong.
+
+Fix this issue.
+
+Fixes: 542353ea ("clk: sunxi-ng: add support for the Allwinner H6 CCU")
+Signed-off-by: Rongyi Chen <chenyi@tt-cool.com>
+[Icenowy: refactor commit message]
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index 0f7a0ffd3f706..d425b47cef179 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -352,7 +352,7 @@ static SUNXI_CCU_GATE(bus_dbg_clk, "bus-dbg", "psi-ahb1-ahb2",
+ static SUNXI_CCU_GATE(bus_psi_clk, "bus-psi", "psi-ahb1-ahb2",
+ 0x79c, BIT(0), 0);
+
+-static SUNXI_CCU_GATE(bus_pwm_clk, "bus-pwm", "apb1", 0x79c, BIT(0), 0);
++static SUNXI_CCU_GATE(bus_pwm_clk, "bus-pwm", "apb1", 0x7ac, BIT(0), 0);
+
+ static SUNXI_CCU_GATE(bus_iommu_clk, "bus-iommu", "apb1", 0x7bc, BIT(0), 0);
+
+--
+2.20.1
+
--- /dev/null
+From 2c79c6444048a804883c65c6764415c0dd3ee9c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 21:15:39 -0700
+Subject: component: fix loop condition to call unbind() if bind() fails
+
+From: Banajit Goswami <bgoswami@codeaurora.org>
+
+[ Upstream commit bdae566d5d9733b6e32b378668b84eadf28a94d4 ]
+
+During component_bind_all(), if bind() fails for any
+particular component associated with a master, unbind()
+should be called for all previous components in that
+master's match array, whose bind() might have completed
+successfully. As per the current logic, if bind() fails
+for the component at position 'n' in the master's match
+array, it would start calling unbind() from component in
+'n'th position itself and work backwards, and will always
+skip calling unbind() for component in 0th position in the
+master's match array.
+Fix this by updating the loop condition, and the logic to
+refer to the components in master's match array, so that
+unbind() is called for all components starting from 'n-1'st
+position in the array, until (and including) component in
+0th position.
+
+Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/component.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 8946dfee4768e..e8d676fad0c95 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -536,9 +536,9 @@ int component_bind_all(struct device *master_dev, void *data)
+ }
+
+ if (ret != 0) {
+- for (; i--; )
+- if (!master->match->compare[i].duplicate) {
+- c = master->match->compare[i].component;
++ for (; i > 0; i--)
++ if (!master->match->compare[i - 1].duplicate) {
++ c = master->match->compare[i - 1].component;
+ component_unbind(c, master, data);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 69ff1e92cce7e625ac1fad896b66bbdd55e97787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:10 -0600
+Subject: coresight: dynamic-replicator: Handle multiple connections
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 30af4fb619e5126cb3152072e687b377fc9398d6 ]
+
+When a replicator port is enabled, we block the traffic
+on the other port and route all traffic to the new enabled
+port. If there are two active trace sessions each targeting
+the two different paths from the replicator, the second session
+will disable the first session and route all the data to the
+second path.
+ ETR
+ /
+e.g, replicator
+ \
+ ETB
+
+If CPU0 is operated in sysfs mode to ETR and CPU1 is operated
+in perf mode to ETB, depending on the order in which the
+replicator is enabled one device is blocked.
+
+Ideally we need trace-id for the session to make the
+right choice. That implies we need a trace-id allocation
+logic for the coresight subsystem and use that to route
+the traffic. The short term solution is to only manage
+the "target port" and leave the other port untouched.
+That leaves both the paths unaffected, except that some
+unwanted traffic may be pushed to the paths (if the Trace-IDs
+are not far enough), which is still fine and can be filtered
+out while processing rather than silently blocking the data.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-dynamic-replicator.c | 64 ++++++++++++++-----
+ 1 file changed, 47 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
+index f6d0571ab9dd5..d31f1d8758b24 100644
+--- a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
+@@ -34,26 +34,42 @@ struct replicator_state {
+ struct coresight_device *csdev;
+ };
+
++/*
++ * replicator_reset : Reset the replicator configuration to sane values.
++ */
++static void replicator_reset(struct replicator_state *drvdata)
++{
++ CS_UNLOCK(drvdata->base);
++
++ writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
++ writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
++
++ CS_LOCK(drvdata->base);
++}
++
+ static int replicator_enable(struct coresight_device *csdev, int inport,
+ int outport)
+ {
++ u32 reg;
+ struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
+
++ switch (outport) {
++ case 0:
++ reg = REPLICATOR_IDFILTER0;
++ break;
++ case 1:
++ reg = REPLICATOR_IDFILTER1;
++ break;
++ default:
++ WARN_ON(1);
++ return -EINVAL;
++ }
++
+ CS_UNLOCK(drvdata->base);
+
+- /*
+- * Ensure that the other port is disabled
+- * 0x00 - passing through the replicator unimpeded
+- * 0xff - disable (or impede) the flow of ATB data
+- */
+- if (outport == 0) {
+- writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER0);
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
+- } else {
+- writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER1);
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+- }
+
++ /* Ensure that the outport is enabled. */
++ writel_relaxed(0x00, drvdata->base + reg);
+ CS_LOCK(drvdata->base);
+
+ dev_info(drvdata->dev, "REPLICATOR enabled\n");
+@@ -63,15 +79,25 @@ static int replicator_enable(struct coresight_device *csdev, int inport,
+ static void replicator_disable(struct coresight_device *csdev, int inport,
+ int outport)
+ {
++ u32 reg;
+ struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
+
++ switch (outport) {
++ case 0:
++ reg = REPLICATOR_IDFILTER0;
++ break;
++ case 1:
++ reg = REPLICATOR_IDFILTER1;
++ break;
++ default:
++ WARN_ON(1);
++ return;
++ }
++
+ CS_UNLOCK(drvdata->base);
+
+ /* disable the flow of ATB data through port */
+- if (outport == 0)
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+- else
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
++ writel_relaxed(0xff, drvdata->base + reg);
+
+ CS_LOCK(drvdata->base);
+
+@@ -156,7 +182,11 @@ static int replicator_probe(struct amba_device *adev, const struct amba_id *id)
+ desc.groups = replicator_groups;
+ drvdata->csdev = coresight_register(&desc);
+
+- return PTR_ERR_OR_ZERO(drvdata->csdev);
++ if (!IS_ERR(drvdata->csdev)) {
++ replicator_reset(drvdata);
++ return 0;
++ }
++ return PTR_ERR(drvdata->csdev);
+ }
+
+ #ifdef CONFIG_PM
+--
+2.20.1
+
--- /dev/null
+From e5395e8740af09ede5d97818528e9dd9e70b3fc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:00 -0600
+Subject: coresight: etm4x: Configure EL2 exception level when kernel is
+ running in HYP
+
+From: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+
+[ Upstream commit b860801e3237ec4c74cf8de0be4816996757ae5c ]
+
+For non-VHE systems host kernel runs at EL1 and jumps to EL2 whenever
+hypervisor code should be executed. In this case ETM4x driver must
+restrict configuration to EL1 when it setups kernel tracing.
+However, there is no separate hypervisor privilege level when VHE
+is enabled, the host kernel runs at EL2.
+
+This patch fixes configuration of TRCACATRn register for VHE systems
+so that ETM_EXLEVEL_NS_HYP bit is used instead of ETM_EXLEVEL_NS_OS
+to on/off kernel tracing. At the same time, it moves common code
+to new helper.
+
+Signed-off-by: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.c | 40 +++++++++----------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index e45b5ec2f4512..b7bc08cf90c69 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -28,6 +28,7 @@
+ #include <linux/pm_runtime.h>
+ #include <asm/sections.h>
+ #include <asm/local.h>
++#include <asm/virt.h>
+
+ #include "coresight-etm4x.h"
+ #include "coresight-etm-perf.h"
+@@ -616,7 +617,7 @@ static void etm4_set_default_config(struct etmv4_config *config)
+ config->vinst_ctrl |= BIT(0);
+ }
+
+-static u64 etm4_get_access_type(struct etmv4_config *config)
++static u64 etm4_get_ns_access_type(struct etmv4_config *config)
+ {
+ u64 access_type = 0;
+
+@@ -627,17 +628,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config)
+ * Bit[13] Exception level 1 - OS
+ * Bit[14] Exception level 2 - Hypervisor
+ * Bit[15] Never implemented
+- *
+- * Always stay away from hypervisor mode.
+ */
+- access_type = ETM_EXLEVEL_NS_HYP;
+-
+- if (config->mode & ETM_MODE_EXCL_KERN)
+- access_type |= ETM_EXLEVEL_NS_OS;
++ if (!is_kernel_in_hyp_mode()) {
++ /* Stay away from hypervisor mode for non-VHE */
++ access_type = ETM_EXLEVEL_NS_HYP;
++ if (config->mode & ETM_MODE_EXCL_KERN)
++ access_type |= ETM_EXLEVEL_NS_OS;
++ } else if (config->mode & ETM_MODE_EXCL_KERN) {
++ access_type = ETM_EXLEVEL_NS_HYP;
++ }
+
+ if (config->mode & ETM_MODE_EXCL_USER)
+ access_type |= ETM_EXLEVEL_NS_APP;
+
++ return access_type;
++}
++
++static u64 etm4_get_access_type(struct etmv4_config *config)
++{
++ u64 access_type = etm4_get_ns_access_type(config);
++
+ /*
+ * EXLEVEL_S, bits[11:8], don't trace anything happening
+ * in secure state.
+@@ -891,20 +901,10 @@ void etm4_config_trace_mode(struct etmv4_config *config)
+
+ addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP];
+ /* clear default config */
+- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS);
++ addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS |
++ ETM_EXLEVEL_NS_HYP);
+
+- /*
+- * EXLEVEL_NS, bits[15:12]
+- * The Exception levels are:
+- * Bit[12] Exception level 0 - Application
+- * Bit[13] Exception level 1 - OS
+- * Bit[14] Exception level 2 - Hypervisor
+- * Bit[15] Never implemented
+- */
+- if (mode & ETM_MODE_EXCL_KERN)
+- addr_acc |= ETM_EXLEVEL_NS_OS;
+- else
+- addr_acc |= ETM_EXLEVEL_NS_APP;
++ addr_acc |= etm4_get_ns_access_type(config);
+
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc;
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc;
+--
+2.20.1
+
--- /dev/null
+From 29f7303948e98487300936ad9c700913a3c8ff20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:45 -0600
+Subject: coresight: Fix handling of sinks
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit c71369de02b285d9da526a526d8f2affc7b17c59 ]
+
+The coresight components could be operated either in sysfs mode or in perf
+mode. For some of the components, the mode of operation doesn't matter as
+they simply relay the data to the next component in the trace path. But for
+sinks, they need to be able to provide the trace data back to the user.
+Thus we need to make sure that "mode" is handled appropriately. e.g,
+the sysfs mode could have multiple sources driving the trace data, while
+perf mode doesn't allow sharing the sink.
+
+The coresight_enable_sink() however doesn't really allow this check to
+trigger as it skips the "enable_sink" callback if the component is
+already enabled, irrespective of the mode. This could cause mixing
+of data from different modes or even same mode (in perf), if the
+sources are different. Also, if we fail to enable the sink while
+enabling a path (where sink is the first component enabled),
+we could end up in disabling the components in the "entire"
+path which were not enabled in this trial, causing disruptions
+in the existing trace paths.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 3e07fd335f8cf..c0dabbddc1e49 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -132,12 +132,14 @@ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+ {
+ int ret;
+
+- if (!csdev->enable) {
+- if (sink_ops(csdev)->enable) {
+- ret = sink_ops(csdev)->enable(csdev, mode);
+- if (ret)
+- return ret;
+- }
++ /*
++ * We need to make sure the "new" session is compatible with the
++ * existing "mode" of operation.
++ */
++ if (sink_ops(csdev)->enable) {
++ ret = sink_ops(csdev)->enable(csdev, mode);
++ if (ret)
++ return ret;
+ csdev->enable = true;
+ }
+
+@@ -339,8 +341,14 @@ int coresight_enable_path(struct list_head *path, u32 mode)
+ switch (type) {
+ case CORESIGHT_DEV_TYPE_SINK:
+ ret = coresight_enable_sink(csdev, mode);
++ /*
++ * Sink is the first component turned on. If we
++ * failed to enable the sink, there are no components
++ * that need disabling. Disabling the path here
++ * would mean we could disrupt an existing session.
++ */
+ if (ret)
+- goto err;
++ goto out;
+ break;
+ case CORESIGHT_DEV_TYPE_SOURCE:
+ /* sources are enabled from either sysFS or Perf */
+--
+2.20.1
+
--- /dev/null
+From bb96327960ea3aedb4b546029f221532cc44f4de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:50 -0600
+Subject: coresight: perf: Disable trace path upon source error
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 4f8ef21007531c3d7cb5b826e7b2c8999b65ecae ]
+
+We enable the trace path, before activating the source.
+If we fail to enable the source, we must disable the path
+to make sure it is available for another session.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 4b53d55788a07..c3c6452015142 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -306,11 +306,13 @@ static void etm_event_start(struct perf_event *event, int flags)
+
+ /* Finally enable the tracer */
+ if (source_ops(csdev)->enable(csdev, event, CS_MODE_PERF))
+- goto fail_end_stop;
++ goto fail_disable_path;
+
+ out:
+ return;
+
++fail_disable_path:
++ coresight_disable_path(path);
+ fail_end_stop:
+ perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);
+ perf_aux_output_end(handle, 0);
+--
+2.20.1
+
--- /dev/null
+From d244473f4be4870e94eedb489adb0738b24619ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:47 -0600
+Subject: coresight: perf: Fix per cpu path management
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 5ecabe4a76e8cdb61fa3e24862d9ca240a1c4ddf ]
+
+We create a coresight trace path for each online CPU when
+we start the event. We rely on the number of online CPUs
+and then go on to allocate an array matching the "number of
+online CPUs" for holding the path and then uses normal
+CPU id as the index to the array. This is problematic as
+we could have some offline CPUs causing us to access beyond
+the actual array size (e.g, on a dual SMP system, if CPU0 is
+offline, CPU1 could be really accessing beyond the array).
+The solution is to switch to per-cpu array for holding the path.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-etm-perf.c | 55 ++++++++++++++-----
+ 1 file changed, 40 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 0f5e03e4df22c..4b53d55788a07 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -12,6 +12,7 @@
+ #include <linux/mm.h>
+ #include <linux/init.h>
+ #include <linux/perf_event.h>
++#include <linux/percpu-defs.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/workqueue.h>
+@@ -33,7 +34,7 @@ struct etm_event_data {
+ struct work_struct work;
+ cpumask_t mask;
+ void *snk_config;
+- struct list_head **path;
++ struct list_head * __percpu *path;
+ };
+
+ static DEFINE_PER_CPU(struct perf_output_handle, ctx_handle);
+@@ -61,6 +62,18 @@ static const struct attribute_group *etm_pmu_attr_groups[] = {
+ NULL,
+ };
+
++static inline struct list_head **
++etm_event_cpu_path_ptr(struct etm_event_data *data, int cpu)
++{
++ return per_cpu_ptr(data->path, cpu);
++}
++
++static inline struct list_head *
++etm_event_cpu_path(struct etm_event_data *data, int cpu)
++{
++ return *etm_event_cpu_path_ptr(data, cpu);
++}
++
+ static void etm_event_read(struct perf_event *event) {}
+
+ static int etm_addr_filters_alloc(struct perf_event *event)
+@@ -120,23 +133,26 @@ static void free_event_data(struct work_struct *work)
+ */
+ if (event_data->snk_config) {
+ cpu = cpumask_first(mask);
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(etm_event_cpu_path(event_data, cpu));
+ if (sink_ops(sink)->free_buffer)
+ sink_ops(sink)->free_buffer(event_data->snk_config);
+ }
+
+ for_each_cpu(cpu, mask) {
+- if (!(IS_ERR_OR_NULL(event_data->path[cpu])))
+- coresight_release_path(event_data->path[cpu]);
++ struct list_head **ppath;
++
++ ppath = etm_event_cpu_path_ptr(event_data, cpu);
++ if (!(IS_ERR_OR_NULL(*ppath)))
++ coresight_release_path(*ppath);
++ *ppath = NULL;
+ }
+
+- kfree(event_data->path);
++ free_percpu(event_data->path);
+ kfree(event_data);
+ }
+
+ static void *alloc_event_data(int cpu)
+ {
+- int size;
+ cpumask_t *mask;
+ struct etm_event_data *event_data;
+
+@@ -147,7 +163,6 @@ static void *alloc_event_data(int cpu)
+
+ /* Make sure nothing disappears under us */
+ get_online_cpus();
+- size = num_online_cpus();
+
+ mask = &event_data->mask;
+ if (cpu != -1)
+@@ -164,8 +179,8 @@ static void *alloc_event_data(int cpu)
+ * unused memory when dealing with single CPU trace scenarios is small
+ * compared to the cost of searching through an optimized array.
+ */
+- event_data->path = kcalloc(size,
+- sizeof(struct list_head *), GFP_KERNEL);
++ event_data->path = alloc_percpu(struct list_head *);
++
+ if (!event_data->path) {
+ kfree(event_data);
+ return NULL;
+@@ -213,6 +228,7 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
+
+ /* Setup the path for each CPU in a trace session */
+ for_each_cpu(cpu, mask) {
++ struct list_head *path;
+ struct coresight_device *csdev;
+
+ csdev = per_cpu(csdev_src, cpu);
+@@ -224,9 +240,11 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
+ * list of devices from source to sink that can be
+ * referenced later when the path is actually needed.
+ */
+- event_data->path[cpu] = coresight_build_path(csdev, sink);
+- if (IS_ERR(event_data->path[cpu]))
++ path = coresight_build_path(csdev, sink);
++ if (IS_ERR(path))
+ goto err;
++
++ *etm_event_cpu_path_ptr(event_data, cpu) = path;
+ }
+
+ if (!sink_ops(sink)->alloc_buffer)
+@@ -255,6 +273,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ struct etm_event_data *event_data;
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
++ struct list_head *path;
+
+ if (!csdev)
+ goto fail;
+@@ -267,8 +286,9 @@ static void etm_event_start(struct perf_event *event, int flags)
+ if (!event_data)
+ goto fail;
+
++ path = etm_event_cpu_path(event_data, cpu);
+ /* We need a sink, no need to continue without one */
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(path);
+ if (WARN_ON_ONCE(!sink || !sink_ops(sink)->set_buffer))
+ goto fail_end_stop;
+
+@@ -278,7 +298,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ goto fail_end_stop;
+
+ /* Nothing will happen without a path */
+- if (coresight_enable_path(event_data->path[cpu], CS_MODE_PERF))
++ if (coresight_enable_path(path, CS_MODE_PERF))
+ goto fail_end_stop;
+
+ /* Tell the perf core the event is alive */
+@@ -306,6 +326,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct etm_event_data *event_data = perf_get_aux(handle);
++ struct list_head *path;
+
+ if (event->hw.state == PERF_HES_STOPPED)
+ return;
+@@ -313,7 +334,11 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ if (!csdev)
+ return;
+
+- sink = coresight_get_sink(event_data->path[cpu]);
++ path = etm_event_cpu_path(event_data, cpu);
++ if (!path)
++ return;
++
++ sink = coresight_get_sink(path);
+ if (!sink)
+ return;
+
+@@ -344,7 +369,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ }
+
+ /* Disabling the path make its elements available to other sessions */
+- coresight_disable_path(event_data->path[cpu]);
++ coresight_disable_path(path);
+ }
+
+ static int etm_event_add(struct perf_event *event, int mode)
+--
+2.20.1
+
--- /dev/null
+From 3b81ed5f3050d0df28f35f4e03f33aba4d0591bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:51 -0600
+Subject: coresight: tmc-etr: Handle driver mode specific ETR buffers
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 96a7f644006ecc05eaaa1a5d09373d0ee63beb0a ]
+
+Since the ETR could be driven either by SYSFS or by perf, it
+becomes complicated how we deal with the buffers used for each
+of these modes. The ETR driver cannot simply free the current
+attached buffer without knowing the provider (i.e, sysfs vs perf).
+
+To solve this issue, we provide:
+1) the driver-mode specific etr buffer to be retained in the drvdata
+2) the etr_buf for a session should be passed on when enabling the
+ hardware, which will be stored in drvdata->etr_buf. This will be
+ replaced (not free'd) as soon as the hardware is disabled, after
+ necessary sync operation.
+
+The advantages of this are :
+
+1) The common code path doesn't need to worry about how to dispose
+ an existing buffer, if it is about to start a new session with a
+ different buffer, possibly in a different mode.
+2) The driver mode can control its buffers and can get access to the
+ saved session even when the hardware is operating in a different
+ mode. (e.g, we can still access a trace buffer from a sysfs mode
+ even if the etr is now used in perf mode, without disrupting the
+ current session.)
+
+Towards this, we introduce a sysfs specific data which will hold the
+etr_buf used for sysfs mode of operation, controlled solely by the
+sysfs mode handling code.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-tmc-etr.c | 58 ++++++++++++-------
+ drivers/hwtracing/coresight/coresight-tmc.h | 2 +
+ 2 files changed, 40 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 11963647e19ae..2d6f428176ff8 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -895,10 +895,15 @@ static void tmc_sync_etr_buf(struct tmc_drvdata *drvdata)
+ tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
+ }
+
+-static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
++static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata,
++ struct etr_buf *etr_buf)
+ {
+ u32 axictl, sts;
+- struct etr_buf *etr_buf = drvdata->etr_buf;
++
++ /* Callers should provide an appropriate buffer for use */
++ if (WARN_ON(!etr_buf || drvdata->etr_buf))
++ return;
++ drvdata->etr_buf = etr_buf;
+
+ /*
+ * If this ETR is connected to a CATU, enable it before we turn
+@@ -960,13 +965,16 @@ static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
+ * also updating the @bufpp on where to find it. Since the trace data
+ * starts at anywhere in the buffer, depending on the RRP, we adjust the
+ * @len returned to handle buffer wrapping around.
++ *
++ * We are protected here by drvdata->reading != 0, which ensures the
++ * sysfs_buf stays alive.
+ */
+ ssize_t tmc_etr_get_sysfs_trace(struct tmc_drvdata *drvdata,
+ loff_t pos, size_t len, char **bufpp)
+ {
+ s64 offset;
+ ssize_t actual = len;
+- struct etr_buf *etr_buf = drvdata->etr_buf;
++ struct etr_buf *etr_buf = drvdata->sysfs_buf;
+
+ if (pos + actual > etr_buf->len)
+ actual = etr_buf->len - pos;
+@@ -996,7 +1004,14 @@ tmc_etr_free_sysfs_buf(struct etr_buf *buf)
+
+ static void tmc_etr_sync_sysfs_buf(struct tmc_drvdata *drvdata)
+ {
+- tmc_sync_etr_buf(drvdata);
++ struct etr_buf *etr_buf = drvdata->etr_buf;
++
++ if (WARN_ON(drvdata->sysfs_buf != etr_buf)) {
++ tmc_etr_free_sysfs_buf(drvdata->sysfs_buf);
++ drvdata->sysfs_buf = NULL;
++ } else {
++ tmc_sync_etr_buf(drvdata);
++ }
+ }
+
+ static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+@@ -1017,6 +1032,8 @@ static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+
+ /* Disable CATU device if this ETR is connected to one */
+ tmc_etr_disable_catu(drvdata);
++ /* Reset the ETR buf used by hardware */
++ drvdata->etr_buf = NULL;
+ }
+
+ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+@@ -1024,7 +1041,7 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ int ret = 0;
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+- struct etr_buf *new_buf = NULL, *free_buf = NULL;
++ struct etr_buf *sysfs_buf = NULL, *new_buf = NULL, *free_buf = NULL;
+
+ /*
+ * If we are enabling the ETR from disabled state, we need to make
+@@ -1035,7 +1052,8 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ * with the lock released.
+ */
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+- if (!drvdata->etr_buf || (drvdata->etr_buf->size != drvdata->size)) {
++ sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
++ if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+ /* Allocate memory with the locks released */
+@@ -1064,14 +1082,14 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ * If we don't have a buffer or it doesn't match the requested size,
+ * use the buffer allocated above. Otherwise reuse the existing buffer.
+ */
+- if (!drvdata->etr_buf ||
+- (new_buf && drvdata->etr_buf->size != new_buf->size)) {
+- free_buf = drvdata->etr_buf;
+- drvdata->etr_buf = new_buf;
++ sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
++ if (!sysfs_buf || (new_buf && sysfs_buf->size != new_buf->size)) {
++ free_buf = sysfs_buf;
++ drvdata->sysfs_buf = new_buf;
+ }
+
+ drvdata->mode = CS_MODE_SYSFS;
+- tmc_etr_enable_hw(drvdata);
++ tmc_etr_enable_hw(drvdata, drvdata->sysfs_buf);
+ out:
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+@@ -1156,13 +1174,13 @@ int tmc_read_prepare_etr(struct tmc_drvdata *drvdata)
+ goto out;
+ }
+
+- /* If drvdata::etr_buf is NULL the trace data has been read already */
+- if (drvdata->etr_buf == NULL) {
++ /* If sysfs_buf is NULL the trace data has been read already */
++ if (!drvdata->sysfs_buf) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+- /* Disable the TMC if need be */
++ /* Disable the TMC if we are trying to read from a running session */
+ if (drvdata->mode == CS_MODE_SYSFS)
+ tmc_etr_disable_hw(drvdata);
+
+@@ -1176,7 +1194,7 @@ out:
+ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
+ {
+ unsigned long flags;
+- struct etr_buf *etr_buf = NULL;
++ struct etr_buf *sysfs_buf = NULL;
+
+ /* config types are set a boot time and never change */
+ if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
+@@ -1191,22 +1209,22 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
+ * buffer. Since the tracer is still enabled drvdata::buf can't
+ * be NULL.
+ */
+- tmc_etr_enable_hw(drvdata);
++ tmc_etr_enable_hw(drvdata, drvdata->sysfs_buf);
+ } else {
+ /*
+ * The ETR is not tracing and the buffer was just read.
+ * As such prepare to free the trace buffer.
+ */
+- etr_buf = drvdata->etr_buf;
+- drvdata->etr_buf = NULL;
++ sysfs_buf = drvdata->sysfs_buf;
++ drvdata->sysfs_buf = NULL;
+ }
+
+ drvdata->reading = false;
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+ /* Free allocated memory out side of the spinlock */
+- if (etr_buf)
+- tmc_free_etr_buf(etr_buf);
++ if (sysfs_buf)
++ tmc_etr_free_sysfs_buf(sysfs_buf);
+
+ return 0;
+ }
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
+index 7027bd60c4cc8..872f63e3651ba 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.h
++++ b/drivers/hwtracing/coresight/coresight-tmc.h
+@@ -170,6 +170,7 @@ struct etr_buf {
+ * @trigger_cntr: amount of words to store after a trigger.
+ * @etr_caps: Bitmask of capabilities of the TMC ETR, inferred from the
+ * device configuration register (DEVID)
++ * @sysfs_data: SYSFS buffer for ETR.
+ */
+ struct tmc_drvdata {
+ void __iomem *base;
+@@ -189,6 +190,7 @@ struct tmc_drvdata {
+ enum tmc_mem_intf_width memwidth;
+ u32 trigger_cntr;
+ u32 etr_caps;
++ struct etr_buf *sysfs_buf;
+ };
+
+ struct etr_buf_operations {
+--
+2.20.1
+
--- /dev/null
+From 646d79986d2497ad233607269fde1e75acc24351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:02 -0600
+Subject: coresight: tmc: Fix byte-address alignment for RRP
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit e7753f3937610633a540f2be81be87531f96ff04 ]
+
+>From the comment in the code, it claims the requirement for byte-address
+alignment for RRP register: 'for 32-bit, 64-bit and 128-bit wide trace
+memory, the four LSBs must be 0s. For 256-bit wide trace memory, the
+five LSBs must be 0s'. This isn't consistent with the program, the
+program sets five LSBs as zeros for 32/64/128-bit wide trace memory and
+set six LSBs zeros for 256-bit wide trace memory.
+
+After checking with the CoreSight Trace Memory Controller technical
+reference manual (ARM DDI 0461B, section 3.3.4 RAM Read Pointer
+Register), it proves the comment is right and the program does wrong
+setting.
+
+This patch fixes byte-address alignment for RRP by following correct
+definition in the technical reference manual.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index 0549249f4b398..e31061308e19e 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -438,10 +438,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
+ case TMC_MEM_INTF_WIDTH_32BITS:
+ case TMC_MEM_INTF_WIDTH_64BITS:
+ case TMC_MEM_INTF_WIDTH_128BITS:
+- mask = GENMASK(31, 5);
++ mask = GENMASK(31, 4);
+ break;
+ case TMC_MEM_INTF_WIDTH_256BITS:
+- mask = GENMASK(31, 6);
++ mask = GENMASK(31, 5);
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 547912e8503a4e18aaaa49decf84fc629d89d06f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:44 -0600
+Subject: coresight: Use ERR_CAST instead of ERR_PTR
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit bbd35ba6fab5419e58e96f35f1431f13bdc14f98 ]
+
+Use ERR_CAT inlined function to replace the ERR_PTR(PTR_ERR). It
+make the code more concise.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 2eda5de304c20..11963647e19ae 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -536,7 +536,7 @@ tmc_init_etr_sg_table(struct device *dev, int node,
+ sg_table = tmc_alloc_sg_table(dev, node, nr_tpages, nr_dpages, pages);
+ if (IS_ERR(sg_table)) {
+ kfree(etr_table);
+- return ERR_PTR(PTR_ERR(sg_table));
++ return ERR_CAST(sg_table);
+ }
+
+ etr_table->sg_table = sg_table;
+--
+2.20.1
+
--- /dev/null
+From d9de3583ba41f17229c5dc404e800fdc4f66842c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:24 -0700
+Subject: cpufeature: avoid warning when compiling with clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to warnings when building the kernel with Clang:
+ arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable
+ 'cpu_feature_match_AES' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ module_cpu_feature_match(AES, aes_init);
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h
+index 986c06c88d814..84d3c81b59781 100644
+--- a/include/linux/cpufeature.h
++++ b/include/linux/cpufeature.h
+@@ -45,7 +45,7 @@
+ * 'asm/cpufeature.h' of your favorite architecture.
+ */
+ #define module_cpu_feature_match(x, __initfunc) \
+-static struct cpu_feature const cpu_feature_match_ ## x[] = \
++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \
+ { { .feature = cpu_feature(x) }, { } }; \
+ MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \
+ \
+--
+2.20.1
+
--- /dev/null
+From 43ec1fc09576bc5858355c976e4be2ed9aa19360 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:25 -0700
+Subject: crypto: arm/crc32 - avoid warning when compiling with Clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit cd560235d8f9ddd94aa51e1c4dabdf3212b9b241 ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to a warning when building the kernel with Clang:
+ arch/arm/crypto/crc32-ce-glue.c:239:33: warning: variable
+ 'crc32_cpu_feature' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ static const struct cpu_feature crc32_cpu_feature[] = {
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 2a9faf8b7e43 ("crypto: arm/crc32 - enable module autoloading based on CPU feature bits")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/crc32-ce-glue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/crypto/crc32-ce-glue.c b/arch/arm/crypto/crc32-ce-glue.c
+index 96e62ec105d06..cd9e93b46c2dd 100644
+--- a/arch/arm/crypto/crc32-ce-glue.c
++++ b/arch/arm/crypto/crc32-ce-glue.c
+@@ -236,7 +236,7 @@ static void __exit crc32_pmull_mod_exit(void)
+ ARRAY_SIZE(crc32_pmull_algs));
+ }
+
+-static const struct cpu_feature crc32_cpu_feature[] = {
++static const struct cpu_feature __maybe_unused crc32_cpu_feature[] = {
+ { cpu_feature(CRC32) }, { cpu_feature(PMULL) }, { }
+ };
+ MODULE_DEVICE_TABLE(cpu, crc32_cpu_feature);
+--
+2.20.1
+
--- /dev/null
+From 00943ea2c1e35aab16a8e33d932b6ab4bb5242ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 20:05:10 -0700
+Subject: crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit a5e9f557098e54af44ade5d501379be18435bfbf ]
+
+In commit 9f480faec58c ("crypto: chacha20 - Fix keystream alignment for
+chacha20_block()"), I had missed that chacha20_block() can be called
+directly on the buffer passed to get_random_bytes(), which can have any
+alignment. So, while my commit didn't break anything, it didn't fully
+solve the alignment problems.
+
+Revert my solution and just update chacha20_block() to use
+put_unaligned_le32(), so the output buffer need not be aligned.
+This is simpler, and on many CPUs it's the same speed.
+
+But, I kept the 'tmp' buffers in extract_crng_user() and
+_get_random_bytes() 4-byte aligned, since that alignment is actually
+needed for _crng_backtrack_protect() too.
+
+Reported-by: Stephan Müller <smueller@chronox.de>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/chacha20_generic.c | 7 ++++---
+ drivers/char/random.c | 24 ++++++++++++------------
+ include/crypto/chacha20.h | 3 +--
+ lib/chacha20.c | 6 +++---
+ 4 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/crypto/chacha20_generic.c b/crypto/chacha20_generic.c
+index e451c3cb6a56e..3ae96587caf9a 100644
+--- a/crypto/chacha20_generic.c
++++ b/crypto/chacha20_generic.c
+@@ -18,20 +18,21 @@
+ static void chacha20_docrypt(u32 *state, u8 *dst, const u8 *src,
+ unsigned int bytes)
+ {
+- u32 stream[CHACHA20_BLOCK_WORDS];
++ /* aligned to potentially speed up crypto_xor() */
++ u8 stream[CHACHA20_BLOCK_SIZE] __aligned(sizeof(long));
+
+ if (dst != src)
+ memcpy(dst, src, bytes);
+
+ while (bytes >= CHACHA20_BLOCK_SIZE) {
+ chacha20_block(state, stream);
+- crypto_xor(dst, (const u8 *)stream, CHACHA20_BLOCK_SIZE);
++ crypto_xor(dst, stream, CHACHA20_BLOCK_SIZE);
+ bytes -= CHACHA20_BLOCK_SIZE;
+ dst += CHACHA20_BLOCK_SIZE;
+ }
+ if (bytes) {
+ chacha20_block(state, stream);
+- crypto_xor(dst, (const u8 *)stream, bytes);
++ crypto_xor(dst, stream, bytes);
+ }
+ }
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 0a84b7f468ad0..86fe1df902393 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -433,9 +433,9 @@ static int crng_init_cnt = 0;
+ static unsigned long crng_global_init_time = 0;
+ #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
+ static void _extract_crng(struct crng_state *crng,
+- __u32 out[CHACHA20_BLOCK_WORDS]);
++ __u8 out[CHACHA20_BLOCK_SIZE]);
+ static void _crng_backtrack_protect(struct crng_state *crng,
+- __u32 tmp[CHACHA20_BLOCK_WORDS], int used);
++ __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+ static void process_random_ready_list(void);
+ static void _get_random_bytes(void *buf, int nbytes);
+
+@@ -929,7 +929,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ unsigned long flags;
+ int i, num;
+ union {
+- __u32 block[CHACHA20_BLOCK_WORDS];
++ __u8 block[CHACHA20_BLOCK_SIZE];
+ __u32 key[8];
+ } buf;
+
+@@ -976,7 +976,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ }
+
+ static void _extract_crng(struct crng_state *crng,
+- __u32 out[CHACHA20_BLOCK_WORDS])
++ __u8 out[CHACHA20_BLOCK_SIZE])
+ {
+ unsigned long v, flags;
+
+@@ -993,7 +993,7 @@ static void _extract_crng(struct crng_state *crng,
+ spin_unlock_irqrestore(&crng->lock, flags);
+ }
+
+-static void extract_crng(__u32 out[CHACHA20_BLOCK_WORDS])
++static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
+ {
+ struct crng_state *crng = NULL;
+
+@@ -1011,7 +1011,7 @@ static void extract_crng(__u32 out[CHACHA20_BLOCK_WORDS])
+ * enough) to mutate the CRNG key to provide backtracking protection.
+ */
+ static void _crng_backtrack_protect(struct crng_state *crng,
+- __u32 tmp[CHACHA20_BLOCK_WORDS], int used)
++ __u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+ {
+ unsigned long flags;
+ __u32 *s, *d;
+@@ -1023,14 +1023,14 @@ static void _crng_backtrack_protect(struct crng_state *crng,
+ used = 0;
+ }
+ spin_lock_irqsave(&crng->lock, flags);
+- s = &tmp[used / sizeof(__u32)];
++ s = (__u32 *) &tmp[used];
+ d = &crng->state[4];
+ for (i=0; i < 8; i++)
+ *d++ ^= *s++;
+ spin_unlock_irqrestore(&crng->lock, flags);
+ }
+
+-static void crng_backtrack_protect(__u32 tmp[CHACHA20_BLOCK_WORDS], int used)
++static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+ {
+ struct crng_state *crng = NULL;
+
+@@ -1046,7 +1046,7 @@ static void crng_backtrack_protect(__u32 tmp[CHACHA20_BLOCK_WORDS], int used)
+ static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
+ {
+ ssize_t ret = 0, i = CHACHA20_BLOCK_SIZE;
+- __u32 tmp[CHACHA20_BLOCK_WORDS];
++ __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+ int large_request = (nbytes > 256);
+
+ while (nbytes) {
+@@ -1625,7 +1625,7 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ */
+ static void _get_random_bytes(void *buf, int nbytes)
+ {
+- __u32 tmp[CHACHA20_BLOCK_WORDS];
++ __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+
+ trace_get_random_bytes(nbytes, _RET_IP_);
+
+@@ -2251,7 +2251,7 @@ u64 get_random_u64(void)
+ batch = raw_cpu_ptr(&batched_entropy_u64);
+ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+- extract_crng((__u32 *)batch->entropy_u64);
++ extract_crng((u8 *)batch->entropy_u64);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u64[batch->position++];
+@@ -2278,7 +2278,7 @@ u32 get_random_u32(void)
+ batch = raw_cpu_ptr(&batched_entropy_u32);
+ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+- extract_crng(batch->entropy_u32);
++ extract_crng((u8 *)batch->entropy_u32);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u32[batch->position++];
+diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h
+index b83d66073db03..f76302d99e2be 100644
+--- a/include/crypto/chacha20.h
++++ b/include/crypto/chacha20.h
+@@ -13,13 +13,12 @@
+ #define CHACHA20_IV_SIZE 16
+ #define CHACHA20_KEY_SIZE 32
+ #define CHACHA20_BLOCK_SIZE 64
+-#define CHACHA20_BLOCK_WORDS (CHACHA20_BLOCK_SIZE / sizeof(u32))
+
+ struct chacha20_ctx {
+ u32 key[8];
+ };
+
+-void chacha20_block(u32 *state, u32 *stream);
++void chacha20_block(u32 *state, u8 *stream);
+ void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv);
+ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ unsigned int keysize);
+diff --git a/lib/chacha20.c b/lib/chacha20.c
+index c1cc50fb68c9f..d907fec6a9ed1 100644
+--- a/lib/chacha20.c
++++ b/lib/chacha20.c
+@@ -16,9 +16,9 @@
+ #include <asm/unaligned.h>
+ #include <crypto/chacha20.h>
+
+-void chacha20_block(u32 *state, u32 *stream)
++void chacha20_block(u32 *state, u8 *stream)
+ {
+- u32 x[16], *out = stream;
++ u32 x[16];
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(x); i++)
+@@ -67,7 +67,7 @@ void chacha20_block(u32 *state, u32 *stream)
+ }
+
+ for (i = 0; i < ARRAY_SIZE(x); i++)
+- out[i] = cpu_to_le32(x[i] + state[i]);
++ put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
+
+ state[12]++;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8e6db698c20151639064a5039ad92bd7f42dd7a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 20:24:32 +0300
+Subject: crypto: fix a memory leak in rsa-kcs1pad's encryption mode
+
+From: Dan Aloni <dan@kernelim.com>
+
+[ Upstream commit 3944f139d5592790b70bc64f197162e643a8512b ]
+
+The encryption mode of pkcs1pad never uses out_sg and out_buf, so
+there's no need to allocate the buffer, which presently is not even
+being freed.
+
+CC: Herbert Xu <herbert@gondor.apana.org.au>
+CC: linux-crypto@vger.kernel.org
+CC: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Dan Aloni <dan@kernelim.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/rsa-pkcs1pad.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 9893dbfc1af45..812476e468213 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -261,15 +261,6 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
+ pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
+ ctx->key_size - 1 - req->src_len, req->src);
+
+- req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
+- if (!req_ctx->out_buf) {
+- kfree(req_ctx->in_buf);
+- return -ENOMEM;
+- }
+-
+- pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+- ctx->key_size, NULL);
+-
+ akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+ pkcs1pad_encrypt_sign_complete_cb, req);
+--
+2.20.1
+
--- /dev/null
+From f5c1a9d197e7725ceef244e1831f6d0880e767c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:09:28 +0200
+Subject: crypto: s5p-sss: Fix Fix argument list alignment
+
+From: Christoph Manszewski <c.manszewski@samsung.com>
+
+[ Upstream commit 6c12b6ba45490eeb820fdceccf5a53f42a26799c ]
+
+Fix misalignment of continued argument list.
+
+Signed-off-by: Christoph Manszewski <c.manszewski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/s5p-sss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index 9021ad9df0c45..b7216935236f0 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -491,7 +491,7 @@ static void s5p_unset_indata(struct s5p_aes_dev *dev)
+ }
+
+ static int s5p_make_sg_cpy(struct s5p_aes_dev *dev, struct scatterlist *src,
+- struct scatterlist **dst)
++ struct scatterlist **dst)
+ {
+ void *pages;
+ int len;
+@@ -1889,7 +1889,7 @@ static int s5p_set_indata_start(struct s5p_aes_dev *dev,
+ }
+
+ static int s5p_set_outdata_start(struct s5p_aes_dev *dev,
+- struct ablkcipher_request *req)
++ struct ablkcipher_request *req)
+ {
+ struct scatterlist *sg;
+ int err;
+--
+2.20.1
+
--- /dev/null
+From c802c7fa3e9d65259a1bae73f2dcfa467a5245ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:09:27 +0200
+Subject: crypto: s5p-sss: Fix race in error handling
+
+From: Christoph Manszewski <c.manszewski@samsung.com>
+
+[ Upstream commit 5842cd44786055231b233ed5ed98cdb63ffb7db3 ]
+
+Remove a race condition introduced by error path in functions:
+s5p_aes_interrupt and s5p_aes_crypt_start. Setting the busy field of
+struct s5p_aes_dev to false made it possible for s5p_tasklet_cb to
+change the req field, before s5p_aes_complete was called.
+
+Change the first parameter of s5p_aes_complete to struct
+ablkcipher_request. Before spin_unlock, make a copy of the currently
+handled request, to ensure s5p_aes_complete function call with the
+correct request.
+
+Signed-off-by: Christoph Manszewski <c.manszewski@samsung.com>
+Acked-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/s5p-sss.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index faa282074e5aa..9021ad9df0c45 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -475,9 +475,9 @@ static void s5p_sg_done(struct s5p_aes_dev *dev)
+ }
+
+ /* Calls the completion. Cannot be called with dev->lock hold. */
+-static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
++static void s5p_aes_complete(struct ablkcipher_request *req, int err)
+ {
+- dev->req->base.complete(&dev->req->base, err);
++ req->base.complete(&req->base, err);
+ }
+
+ static void s5p_unset_outdata(struct s5p_aes_dev *dev)
+@@ -655,6 +655,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+ {
+ struct platform_device *pdev = dev_id;
+ struct s5p_aes_dev *dev = platform_get_drvdata(pdev);
++ struct ablkcipher_request *req;
+ int err_dma_tx = 0;
+ int err_dma_rx = 0;
+ int err_dma_hx = 0;
+@@ -727,7 +728,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+- s5p_aes_complete(dev, 0);
++ s5p_aes_complete(dev->req, 0);
+ /* Device is still busy */
+ tasklet_schedule(&dev->tasklet);
+ } else {
+@@ -752,11 +753,12 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+ error:
+ s5p_sg_done(dev);
+ dev->busy = false;
++ req = dev->req;
+ if (err_dma_hx == 1)
+ s5p_set_dma_hashdata(dev, dev->hash_sg_iter);
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+- s5p_aes_complete(dev, err);
++ s5p_aes_complete(req, err);
+
+ hash_irq_end:
+ /*
+@@ -1983,7 +1985,7 @@ indata_error:
+ s5p_sg_done(dev);
+ dev->busy = false;
+ spin_unlock_irqrestore(&dev->lock, flags);
+- s5p_aes_complete(dev, err);
++ s5p_aes_complete(req, err);
+ }
+
+ static void s5p_tasklet_cb(unsigned long data)
+--
+2.20.1
+
--- /dev/null
+From 1d2c5daf992214f878c0dff9020ed576df707781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 14:36:27 +0530
+Subject: cxgb4: Fix endianness issue in t4_fwcache()
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ]
+
+Do not put host-endian 0 or 1 into big endian feild.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 5fe5d16dee724..8350c0c9b89d1 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3889,7 +3889,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op)
+ c.param[0].mnem =
+ cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) |
+ FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE));
+- c.param[0].val = (__force __be32)op;
++ c.param[0].val = cpu_to_be32(op);
+
+ return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL);
+ }
+--
+2.20.1
+
--- /dev/null
+From c32e2b2492229934d3998ef53d3a7624fbbd8a16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 May 2019 16:15:07 +0300
+Subject: dmaengine: at_xdmac: remove a stray bottom half unlock
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0b515abb6b7eb08e90bdfc01fc8fbdd112c15d81 ]
+
+We switched this code from spin_lock_bh() to vanilla spin_lock() but
+there was one stray spin_unlock_bh() that was overlooked. This
+patch converts it to spin_unlock() as well.
+
+Fixes: d8570d018f69 ("dmaengine: at_xdmac: move spin_lock_bh to spin_lock in tasklet")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index db5b8fe1dd4ab..7db66f974041e 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1608,7 +1608,7 @@ static void at_xdmac_tasklet(unsigned long data)
+ dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+ if (!desc->active_xfer) {
+ dev_err(chan2dev(&atchan->chan), "Xfer not active: exiting");
+- spin_unlock_bh(&atchan->lock);
++ spin_unlock(&atchan->lock);
+ return;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5973454d68eb66f9182176be7fee1dd15e2ec607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:48 +0200
+Subject: dmaengine: dma-jz4780: Don't depend on MACH_JZ4780
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit c558ecd21c852c97ff98dc6c61f715ba420ec251 ]
+
+If we make this driver depend on MACH_JZ4780, that means it can be
+enabled only if we're building a kernel specially crafted for a
+JZ4780-based board, while most GNU/Linux distributions will want one
+generic MIPS kernel that works on multiple boards.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index dacf3f42426de..a4f95574eb9ad 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -143,7 +143,7 @@ config DMA_JZ4740
+
+ config DMA_JZ4780
+ tristate "JZ4780 DMA support"
+- depends on MACH_JZ4780 || COMPILE_TEST
++ depends on MIPS || COMPILE_TEST
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+--
+2.20.1
+
--- /dev/null
+From 3061bbddec5be95283b8ad89d5f0269688f3f783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:56 +0200
+Subject: dmaengine: dma-jz4780: Further residue status fix
+
+From: Daniel Silsby <dansilsby@gmail.com>
+
+[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ]
+
+Func jz4780_dma_desc_residue() expects the index to the next hw
+descriptor as its last parameter. Caller func jz4780_dma_tx_status(),
+however, applied modulus before passing it. When the current hw
+descriptor was last in the list, the index passed became zero.
+
+The resulting excess of reported residue especially caused problems
+with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which
+rely on this for determining current DMA location within buffer.
+
+Combined with the recent and related residue-reporting fixes, spurious
+ALSA audio underruns on jz4770 hardware are now fixed.
+
+Signed-off-by: Daniel Silsby <dansilsby@gmail.com>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 987899610b461..edff93aacad36 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -587,7 +587,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ to_jz4780_dma_desc(vdesc), 0);
+ } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+ txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
+- (jzchan->curr_hwdesc + 1) % jzchan->desc->count);
++ jzchan->curr_hwdesc + 1);
+ } else
+ txstate->residue = 0;
+
+--
+2.20.1
+
--- /dev/null
+From a29fc3936943a9efbd88bd306f829ff7f50ebd99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 23:06:11 +0000
+Subject: Drivers: hv: vmbus: Fix synic per-cpu context initialization
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit f25a7ece08bdb1f2b3c4bbeae942682fc3a99dde ]
+
+If hv_synic_alloc() errors out, the state of the per-cpu context
+for some CPUs is unknown since the zero'ing is done as each
+CPU is iterated over. In such case, hv_synic_cleanup() may try to
+free memory based on uninitialized values. Fix this by zero'ing
+the per-cpu context for all CPUs before doing any memory
+allocations that might fail.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index 8e923e70e5945..12bc9fa211117 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -189,6 +189,17 @@ static void hv_init_clockevent_device(struct clock_event_device *dev, int cpu)
+ int hv_synic_alloc(void)
+ {
+ int cpu;
++ struct hv_per_cpu_context *hv_cpu;
++
++ /*
++ * First, zero all per-cpu memory areas so hv_synic_free() can
++ * detect what memory has been allocated and cleanup properly
++ * after any failures.
++ */
++ for_each_present_cpu(cpu) {
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
++ memset(hv_cpu, 0, sizeof(*hv_cpu));
++ }
+
+ hv_context.hv_numa_map = kcalloc(nr_node_ids, sizeof(struct cpumask),
+ GFP_KERNEL);
+@@ -198,10 +209,8 @@ int hv_synic_alloc(void)
+ }
+
+ for_each_present_cpu(cpu) {
+- struct hv_per_cpu_context *hv_cpu
+- = per_cpu_ptr(hv_context.cpu_context, cpu);
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
+
+- memset(hv_cpu, 0, sizeof(*hv_cpu));
+ tasklet_init(&hv_cpu->msg_dpc,
+ vmbus_on_msg_dpc, (unsigned long) hv_cpu);
+
+--
+2.20.1
+
--- /dev/null
+From 758df3b0f9af992fee782d8e5ffd6a946ed559fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 14:14:38 -0600
+Subject: drivers: qcom: rpmh-rsc: clear wait_for_compl after use
+
+From: Lina Iyer <ilina@codeaurora.org>
+
+[ Upstream commit 09e97b6c8754c91470455e69ebd827b741f80af5 ]
+
+The wait_for_compl register ensures the request sequence is maintained
+when sending requests from the TCS. Clear the register after sending
+active request and during invalidate of the sleep and wake TCS.
+
+Reported-by: Raju P.L.S.S.S.N <rplsssn@codeaurora.org>
+Signed-off-by: Lina Iyer <ilina@codeaurora.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index ee75da66d64bf..75bd9a83aef00 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -121,6 +121,7 @@ static int tcs_invalidate(struct rsc_drv *drv, int type)
+ return -EAGAIN;
+ }
+ write_tcs_reg_sync(drv, RSC_DRV_CMD_ENABLE, m, 0);
++ write_tcs_reg_sync(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, m, 0);
+ }
+ bitmap_zero(tcs->slots, MAX_TCS_SLOTS);
+ spin_unlock(&tcs->lock);
+@@ -239,6 +240,7 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
++ write_tcs_reg(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, i, 0);
+ write_tcs_reg(drv, RSC_DRV_IRQ_CLEAR, 0, BIT(i));
+ spin_lock(&drv->lock);
+ clear_bit(i, drv->tcs_in_use);
+--
+2.20.1
+
--- /dev/null
+From 89ae70c860c4b517fef7a27fa09de1129febe886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 17:34:33 -0700
+Subject: EDAC: Correct DIMM capacity unit symbol
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 6f6da136046294a1e8d2944336eb97412751f653 ]
+
+The {i3200|i7core|sb|skx}_edac drivers show DIMM capacity using the
+wrong unit symbol: 'Mb' - megabit. Fix them by replacing 'Mb' with
+'MiB' - mebibyte.
+
+[Tony: These are all "edac_dbg()" messages, so this won't break scripts
+ that parse console logs.]
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Aristeu Rozanski <aris@redhat.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180919003433.16475-1-tony.luck@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i3200_edac.c | 2 +-
+ drivers/edac/i7core_edac.c | 2 +-
+ drivers/edac/sb_edac.c | 2 +-
+ drivers/edac/skx_edac.c | 4 ++--
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
+index d92d56cee1017..299b441647cd5 100644
+--- a/drivers/edac/i3200_edac.c
++++ b/drivers/edac/i3200_edac.c
+@@ -399,7 +399,7 @@ static int i3200_probe1(struct pci_dev *pdev, int dev_idx)
+ if (nr_pages == 0)
+ continue;
+
+- edac_dbg(0, "csrow %d, channel %d%s, size = %ld Mb\n", i, j,
++ edac_dbg(0, "csrow %d, channel %d%s, size = %ld MiB\n", i, j,
+ stacked ? " (stacked)" : "", PAGES_TO_MiB(nr_pages));
+
+ dimm->nr_pages = nr_pages;
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index f1d19504a0281..4a3300c2da333 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -597,7 +597,7 @@ static int get_dimm_config(struct mem_ctl_info *mci)
+ /* DDR3 has 8 I/O banks */
+ size = (rows * cols * banks * ranks) >> (20 - 3);
+
+- edac_dbg(0, "\tdimm %d %d Mb offset: %x, bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "\tdimm %d %d MiB offset: %x, bank: %d, rank: %d, row: %#x, col: %#x\n",
+ j, size,
+ RANKOFFSET(dimm_dod[j]),
+ banks, ranks, rows, cols);
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 7447f1453200d..53074ad361e58 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -1622,7 +1622,7 @@ static int __populate_dimms(struct mem_ctl_info *mci,
+ size = ((u64)rows * cols * banks * ranks) >> (20 - 3);
+ npages = MiB_TO_PAGES(size);
+
+- edac_dbg(0, "mc#%d: ha %d channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "mc#%d: ha %d channel %d, dimm %d, %lld MiB (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+ pvt->sbridge_dev->mc, pvt->sbridge_dev->dom, i, j,
+ size, npages,
+ banks, ranks, rows, cols);
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index 4ba92f1dd0f74..dd209e0dd9abb 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -364,7 +364,7 @@ static int get_dimm_info(u32 mtr, u32 amap, struct dimm_info *dimm,
+ size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
+ npages = MiB_TO_PAGES(size);
+
+- edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld MiB (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+ imc->mc, chan, dimmno, size, npages,
+ banks, 1 << ranks, rows, cols);
+
+@@ -424,7 +424,7 @@ unknown_size:
+ dimm->mtype = MEM_NVDIMM;
+ dimm->edac_mode = EDAC_SECDED; /* likely better than this */
+
+- edac_dbg(0, "mc#%d: channel %d, dimm %d, %llu Mb (%u pages)\n",
++ edac_dbg(0, "mc#%d: channel %d, dimm %d, %llu MiB (%u pages)\n",
+ imc->mc, chan, dimmno, size >> 20, dimm->nr_pages);
+
+ snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
+--
+2.20.1
+
--- /dev/null
+From 07a78dcfa8906c18bcaadd325faba0a4283b7c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 09:34:49 -0500
+Subject: EDAC: Raise the maximum number of memory controllers
+
+From: Justin Ernst <justin.ernst@hpe.com>
+
+[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ]
+
+We observe an oops in the skx_edac module during boot:
+
+ EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0
+ EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ ...
+ EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1
+ Too many memory controllers: 16
+ EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0
+
+We observe there are two memory controllers per socket, with a limit
+of 16. Raise the maximum number of memory controllers from 16 to 2 *
+MAX_NUMNODES (1024).
+
+[ bp: This is just a band-aid fix until we've sorted out the whole issue
+ with the bus_type association and handling in EDAC and can get rid of
+ this arbitrary limit. ]
+
+Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Russ Anderson <russ.anderson@hpe.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/edac.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index bffb97828ed67..958d69332c1d5 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -17,6 +17,7 @@
+ #include <linux/completion.h>
+ #include <linux/workqueue.h>
+ #include <linux/debugfs.h>
++#include <linux/numa.h>
+
+ #define EDAC_DEVICE_NAME_LEN 31
+
+@@ -670,6 +671,6 @@ struct mem_ctl_info {
+ /*
+ * Maximum number of memory controllers in the coherent fabric.
+ */
+-#define EDAC_MAX_MCS 16
++#define EDAC_MAX_MCS 2 * MAX_NUMNODES
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 76267403750b4cac7d326d5786f4886c541b7178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:08:27 -0700
+Subject: EDAC, sb_edac: Return early on ADDRV bit and address type test
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit dcc960b225ceb2bd66c45e0845d03e577f7010f9 ]
+
+Users of the mce_register_decode_chain() are called for every logged
+error. EDAC drivers should check:
+
+1) Is this a memory error? [bit 7 in status register]
+2) Is there a valid address? [bit 58 in status register]
+3) Is the address a system address? [bitfield 8:6 in misc register]
+
+The sb_edac driver performed test "1" twice. Waited far too long to
+perform check "2". Didn't do check "3" at all.
+
+Fix it by moving the test for valid address from
+sbridge_mce_output_error() into sbridge_mce_check_error() and add a test
+for the type immediately after. Delete the redundant check for the type
+of the error from sbridge_mce_output_error().
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: Aristeu Rozanski <aris@redhat.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20180907230828.13901-2-tony.luck@intel.com
+[ Re-word commit message. ]
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/sb_edac.c | 68 ++++++++++++++++++++++--------------------
+ 1 file changed, 35 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 72cea3cb86224..7447f1453200d 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2912,35 +2912,27 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ * cccc = channel
+ * If the mask doesn't match, report an error to the parsing logic
+ */
+- if (! ((errcode & 0xef80) == 0x80)) {
+- optype = "Can't parse: it is not a mem";
+- } else {
+- switch (optypenum) {
+- case 0:
+- optype = "generic undef request error";
+- break;
+- case 1:
+- optype = "memory read error";
+- break;
+- case 2:
+- optype = "memory write error";
+- break;
+- case 3:
+- optype = "addr/cmd error";
+- break;
+- case 4:
+- optype = "memory scrubbing error";
+- break;
+- default:
+- optype = "reserved";
+- break;
+- }
++ switch (optypenum) {
++ case 0:
++ optype = "generic undef request error";
++ break;
++ case 1:
++ optype = "memory read error";
++ break;
++ case 2:
++ optype = "memory write error";
++ break;
++ case 3:
++ optype = "addr/cmd error";
++ break;
++ case 4:
++ optype = "memory scrubbing error";
++ break;
++ default:
++ optype = "reserved";
++ break;
+ }
+
+- /* Only decode errors with an valid address (ADDRV) */
+- if (!GET_BITFIELD(m->status, 58, 58))
+- return;
+-
+ if (pvt->info.type == KNIGHTS_LANDING) {
+ if (channel == 14) {
+ edac_dbg(0, "%s%s err_code:%04x:%04x EDRAM bank %d\n",
+@@ -3046,17 +3038,11 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ {
+ struct mce *mce = (struct mce *)data;
+ struct mem_ctl_info *mci;
+- struct sbridge_pvt *pvt;
+ char *type;
+
+ if (edac_get_report_status() == EDAC_REPORTING_DISABLED)
+ return NOTIFY_DONE;
+
+- mci = get_mci_for_node_id(mce->socketid, IMC0);
+- if (!mci)
+- return NOTIFY_DONE;
+- pvt = mci->pvt_info;
+-
+ /*
+ * Just let mcelog handle it if the error is
+ * outside the memory controller. A memory error
+@@ -3066,6 +3052,22 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ if ((mce->status & 0xefff) >> 7 != 1)
+ return NOTIFY_DONE;
+
++ /* Check ADDRV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 58, 58))
++ return NOTIFY_DONE;
++
++ /* Check MISCV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 59, 59))
++ return NOTIFY_DONE;
++
++ /* Check address type in MISC (physical address only) */
++ if (GET_BITFIELD(mce->misc, 6, 8) != 2)
++ return NOTIFY_DONE;
++
++ mci = get_mci_for_node_id(mce->socketid, IMC0);
++ if (!mci)
++ return NOTIFY_DONE;
++
+ if (mce->mcgstatus & MCG_STATUS_MCIP)
+ type = "Exception";
+ else
+--
+2.20.1
+
--- /dev/null
+From bba2d3ffaa63d10e6951f18d38f400474605cfdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:35:53 +0300
+Subject: extcon: cht-wc: Return from default case to avoid warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 962341b54b99965ebec5f70c8d39f1c382eea833 ]
+
+When we have first case to fall through it's not enough to put
+single comment there to satisfy compiler. Instead of doing that,
+return fall back value directly from default case.
+
+This to avoid following warnings:
+
+drivers/extcon/extcon-intel-cht-wc.c: In function ‘cht_wc_extcon_get_charger’:
+include/linux/device.h:1420:2: warning: this statement may fall through [-Wimplicit-fallthrough=]
+ _dev_warn(dev, dev_fmt(fmt), ##__VA_ARGS__)
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/extcon/extcon-intel-cht-wc.c:148:3: note: in expansion of macro ‘dev_warn’
+ dev_warn(ext->dev,
+ ^~~~~~~~
+drivers/extcon/extcon-intel-cht-wc.c:152:2: note: here
+ case CHT_WC_USBSRC_TYPE_SDP:
+ ^~~~
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-intel-cht-wc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-intel-cht-wc.c b/drivers/extcon/extcon-intel-cht-wc.c
+index 5e1dd27722781..bdb67878179ed 100644
+--- a/drivers/extcon/extcon-intel-cht-wc.c
++++ b/drivers/extcon/extcon-intel-cht-wc.c
+@@ -156,7 +156,7 @@ static int cht_wc_extcon_get_charger(struct cht_wc_extcon_data *ext,
+ dev_warn(ext->dev,
+ "Unhandled charger type %d, defaulting to SDP\n",
+ ret);
+- /* Fall through, treat as SDP */
++ return EXTCON_CHG_USB_SDP;
+ case CHT_WC_USBSRC_TYPE_SDP:
+ case CHT_WC_USBSRC_TYPE_FLOAT_DP_DN:
+ case CHT_WC_USBSRC_TYPE_OTHER:
+--
+2.20.1
+
--- /dev/null
+From 4db7ab68965fe039178c6069d7bb3be4d397675d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 15:45:19 -0700
+Subject: f2fs: avoid infinite loop in f2fs_alloc_nid
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit f84262b0862d43b71b3e80a036cdd9d82e620367 ]
+
+If we have an error in f2fs_build_free_nids, we're able to fall into a loop
+to find free nids.
+
+Suggested-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index aa8f19e1bdb3d..e5d474681471c 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2367,8 +2367,9 @@ retry:
+ spin_unlock(&nm_i->nid_list_lock);
+
+ /* Let's scan nat pages and its caches to get free nids */
+- f2fs_build_free_nids(sbi, true, false);
+- goto retry;
++ if (!f2fs_build_free_nids(sbi, true, false))
++ goto retry;
++ return false;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 811d84c1b105ddab5556bedb0fa89bf27cf4ec11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Aug 2018 21:18:00 -0700
+Subject: f2fs: avoid wrong decrypted data from disk
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 0ded69f632bb717be9aeea3ae74e29050fcb060c ]
+
+1. Create a file in an encrypted directory
+2. Do GC & drop caches
+3. Read stale data before its bio for metapage was not issued yet
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 18 ++++++++++--------
+ fs/f2fs/f2fs.h | 2 +-
+ fs/f2fs/file.c | 3 +--
+ fs/f2fs/segment.c | 6 +++++-
+ 4 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 9511466bc7857..c61beaedf0789 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -575,9 +575,6 @@ static struct bio *f2fs_grab_read_bio(struct inode *inode, block_t blkaddr,
+ ctx->bio = bio;
+ ctx->enabled_steps = post_read_steps;
+ bio->bi_private = ctx;
+-
+- /* wait the page to be moved by cleaning */
+- f2fs_wait_on_block_writeback(sbi, blkaddr);
+ }
+
+ return bio;
+@@ -592,6 +589,9 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page,
+ if (IS_ERR(bio))
+ return PTR_ERR(bio);
+
++ /* wait for GCed page writeback via META_MAPPING */
++ f2fs_wait_on_block_writeback(inode, blkaddr);
++
+ if (bio_add_page(bio, page, PAGE_SIZE, 0) < PAGE_SIZE) {
+ bio_put(bio);
+ return -EFAULT;
+@@ -1569,6 +1569,12 @@ submit_and_realloc:
+ }
+ }
+
++ /*
++ * If the page is under writeback, we need to wait for
++ * its completion to see the correct decrypted data.
++ */
++ f2fs_wait_on_block_writeback(inode, block_nr);
++
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
+@@ -1637,7 +1643,7 @@ static int encrypt_one_page(struct f2fs_io_info *fio)
+ return 0;
+
+ /* wait for GCed page writeback via META_MAPPING */
+- f2fs_wait_on_block_writeback(fio->sbi, fio->old_blkaddr);
++ f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
+
+ retry_encrypt:
+ fio->encrypted_page = fscrypt_encrypt_page(inode, fio->page,
+@@ -2402,10 +2408,6 @@ repeat:
+
+ f2fs_wait_on_page_writeback(page, DATA, false);
+
+- /* wait for GCed page writeback via META_MAPPING */
+- if (f2fs_post_read_required(inode))
+- f2fs_wait_on_block_writeback(sbi, blkaddr);
+-
+ if (len == PAGE_SIZE || PageUptodate(page))
+ return 0;
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index fb216488d67a9..6d361c8c61306 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2973,7 +2973,7 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ struct f2fs_io_info *fio, bool add_list);
+ void f2fs_wait_on_page_writeback(struct page *page,
+ enum page_type type, bool ordered);
+-void f2fs_wait_on_block_writeback(struct f2fs_sb_info *sbi, block_t blkaddr);
++void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr);
+ void f2fs_write_data_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
+ void f2fs_write_node_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
+ int f2fs_lookup_journal_in_cursum(struct f2fs_journal *journal, int type,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 8d1eb8dec6058..6972c6d7c3893 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -112,8 +112,7 @@ mapped:
+ f2fs_wait_on_page_writeback(page, DATA, false);
+
+ /* wait for GCed page writeback via META_MAPPING */
+- if (f2fs_post_read_required(inode))
+- f2fs_wait_on_block_writeback(sbi, dn.data_blkaddr);
++ f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
+ out_sem:
+ up_read(&F2FS_I(inode)->i_mmap_sem);
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 10d5dcdb34be6..d78009694f3fd 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3214,10 +3214,14 @@ void f2fs_wait_on_page_writeback(struct page *page,
+ }
+ }
+
+-void f2fs_wait_on_block_writeback(struct f2fs_sb_info *sbi, block_t blkaddr)
++void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr)
+ {
++ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct page *cpage;
+
++ if (!f2fs_post_read_required(inode))
++ return;
++
+ if (!is_valid_data_blkaddr(sbi, blkaddr))
+ return;
+
+--
+2.20.1
+
--- /dev/null
+From 512e7852ba13c7eac11d4415502326c5b0b3c495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 14:54:02 +0800
+Subject: f2fs: fix memory leak of percpu counter in fill_super()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 4a70e255449c9a13eed7a6eeecc85a1ea63cef76 ]
+
+In fill_super -> init_percpu_info, we should destroy percpu counter
+in error path, otherwise memory allcoated for percpu counter will
+leak.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 58931d55dc1d2..c5d28e92d146e 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2516,8 +2516,12 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ if (err)
+ return err;
+
+- return percpu_counter_init(&sbi->total_valid_inode_count, 0,
++ err = percpu_counter_init(&sbi->total_valid_inode_count, 0,
+ GFP_KERNEL);
++ if (err)
++ percpu_counter_destroy(&sbi->alloc_valid_block_count);
++
++ return err;
+ }
+
+ #ifdef CONFIG_BLK_DEV_ZONED
+--
+2.20.1
+
--- /dev/null
+From 9867d8a7180126efd576c3c52b5ecab5c903fae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 14:54:01 +0800
+Subject: f2fs: fix memory leak of write_io in fill_super()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 0b2103e886e6de9802e1170e57c573443286a483 ]
+
+It needs to release memory allocated for sbi->write_io in error path,
+otherwise, it will cause memory leak.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index d9106bbe7df63..58931d55dc1d2 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2929,7 +2929,7 @@ try_onemore:
+ GFP_KERNEL);
+ if (!sbi->write_io[i]) {
+ err = -ENOMEM;
+- goto free_options;
++ goto free_bio_info;
+ }
+
+ for (j = HOT; j < n; j++) {
+--
+2.20.1
+
--- /dev/null
+From 1633d50abf6b8a43b7d9a3628e755e726914a052 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 22:43:09 +0800
+Subject: f2fs: fix remount problem of option io_bits
+
+From: Chengguang Xu <cgxu519@gmx.com>
+
+[ Upstream commit c6b1867b1da3b1203b4c49988afeebdcbdf65499 ]
+
+Currently we show mount option "io_bits=%u" as "io_size=%uKB",
+it will cause option parsing problem(unrecognized mount option)
+in remount.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index c5d28e92d146e..b05e10c332b7e 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1336,7 +1336,8 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
+ from_kgid_munged(&init_user_ns,
+ F2FS_OPTION(sbi).s_resgid));
+ if (F2FS_IO_SIZE_BITS(sbi))
+- seq_printf(seq, ",io_size=%uKB", F2FS_IO_SIZE_KB(sbi));
++ seq_printf(seq, ",io_bits=%u",
++ F2FS_OPTION(sbi).write_io_size_bits);
+ #ifdef CONFIG_F2FS_FAULT_INJECTION
+ if (test_opt(sbi, FAULT_INJECTION)) {
+ seq_printf(seq, ",fault_injection=%u",
+--
+2.20.1
+
--- /dev/null
+From 6ef33eef6fe703711daacebfa403ed7e2226c093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 08:54:21 +0900
+Subject: f2fs: fix setattr project check upon fssetxattr ioctl
+
+From: Wang Shilong <wangshilong1991@gmail.com>
+
+[ Upstream commit c8e927579e00a182eda07e4c45df9c8c699c8ded ]
+
+Currently, project quota could be changed by fssetxattr
+ioctl, and existed permission check inode_owner_or_capable()
+is obviously not enough, just think that common users could
+change project id of file, that could make users to
+break project quota easily.
+
+This patch try to follow same regular of xfs project
+quota:
+
+"Project Quota ID state is only allowed to change from
+within the init namespace. Enforce that restriction only
+if we are trying to change the quota ID state.
+Everything else is allowed in user namespaces."
+
+Besides that, check and set project id'state should
+be an atomic operation, protect whole operation with
+inode lock.
+
+Signed-off-by: Wang Shilong <wshilong@ddn.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 60 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 37 insertions(+), 23 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 6972c6d7c3893..c7ea122997695 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2618,34 +2618,26 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
+ if (projid_eq(kprojid, F2FS_I(inode)->i_projid))
+ return 0;
+
+- err = mnt_want_write_file(filp);
+- if (err)
+- return err;
+-
+ err = -EPERM;
+- inode_lock(inode);
+-
+ /* Is it quota file? Do not allow user to mess with it */
+ if (IS_NOQUOTA(inode))
+- goto out_unlock;
++ return err;
+
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- if (IS_ERR(ipage)) {
+- err = PTR_ERR(ipage);
+- goto out_unlock;
+- }
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ if (!F2FS_FITS_IN_INODE(F2FS_INODE(ipage), fi->i_extra_isize,
+ i_projid)) {
+ err = -EOVERFLOW;
+ f2fs_put_page(ipage, 1);
+- goto out_unlock;
++ return err;
+ }
+ f2fs_put_page(ipage, 1);
+
+ err = dquot_initialize(inode);
+ if (err)
+- goto out_unlock;
++ return err;
+
+ transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+ if (!IS_ERR(transfer_to[PRJQUOTA])) {
+@@ -2659,9 +2651,6 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
+ inode->i_ctime = current_time(inode);
+ out_dirty:
+ f2fs_mark_inode_dirty_sync(inode, true);
+-out_unlock:
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ return err;
+ }
+ #else
+@@ -2737,6 +2726,30 @@ static int f2fs_ioc_fsgetxattr(struct file *filp, unsigned long arg)
+ return 0;
+ }
+
++static int f2fs_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
++{
++ /*
++ * Project Quota ID state is only allowed to change from within the init
++ * namespace. Enforce that restriction only if we are trying to change
++ * the quota ID state. Everything else is allowed in user namespaces.
++ */
++ if (current_user_ns() == &init_user_ns)
++ return 0;
++
++ if (__kprojid_val(F2FS_I(inode)->i_projid) != fa->fsx_projid)
++ return -EINVAL;
++
++ if (F2FS_I(inode)->i_flags & F2FS_PROJINHERIT_FL) {
++ if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
++ return -EINVAL;
++ } else {
++ if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -2764,19 +2777,20 @@ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
+ return err;
+
+ inode_lock(inode);
++ err = f2fs_ioctl_check_project(inode, &fa);
++ if (err)
++ goto out;
+ flags = (fi->i_flags & ~F2FS_FL_XFLAG_VISIBLE) |
+ (flags & F2FS_FL_XFLAG_VISIBLE);
+ err = __f2fs_ioc_setflags(inode, flags);
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ if (err)
+- return err;
++ goto out;
+
+ err = f2fs_ioc_setproject(filp, fa.fsx_projid);
+- if (err)
+- return err;
+-
+- return 0;
++out:
++ inode_unlock(inode);
++ mnt_drop_write_file(filp);
++ return err;
+ }
+
+ int f2fs_pin_file_control(struct inode *inode, bool inc)
+--
+2.20.1
+
--- /dev/null
+From c548a3559b914fca750439e089e0fe0c74a17c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 15:35:58 +0800
+Subject: f2fs: fix to recover inode's project id during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit f4474aa6e5e901ee4af21f39f1b9115aaaaec503 ]
+
+Testcase to reproduce this bug:
+1. mkfs.f2fs -O extra_attr -O project_quota /dev/sdd
+2. mount -t f2fs /dev/sdd /mnt/f2fs
+3. touch /mnt/f2fs/file
+4. sync
+5. chattr -p 1 /mnt/f2fs/file
+6. xfs_io -f /mnt/f2fs/file -c "fsync"
+7. godown /mnt/f2fs
+8. umount /mnt/f2fs
+9. mount -t f2fs /dev/sdd /mnt/f2fs
+10. lsattr -p /mnt/f2fs/file
+
+ 0 -----------------N- /mnt/f2fs/file
+
+But actually, we expect the correct result is:
+
+ 1 -----------------N- /mnt/f2fs/file
+
+The reason is we didn't recover inode.i_projid field during mount,
+fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 2c5d2c25d37e3..01636d996ba41 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -218,6 +218,19 @@ static void recover_inode(struct inode *inode, struct page *page)
+ inode->i_mode = le16_to_cpu(raw->i_mode);
+ i_uid_write(inode, le32_to_cpu(raw->i_uid));
+ i_gid_write(inode, le32_to_cpu(raw->i_gid));
++
++ if (raw->i_inline & F2FS_EXTRA_ATTR) {
++ if (f2fs_sb_has_project_quota(F2FS_I_SB(inode)->sb) &&
++ F2FS_FITS_IN_INODE(raw, le16_to_cpu(raw->i_extra_isize),
++ i_projid)) {
++ projid_t i_projid;
++
++ i_projid = (projid_t)le32_to_cpu(raw->i_projid);
++ F2FS_I(inode)->i_projid =
++ make_kprojid(&init_user_ns, i_projid);
++ }
++ }
++
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_atime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+--
+2.20.1
+
--- /dev/null
+From a9b01eec27a73b0de779c8cd1b6120b402cf407b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 17:41:30 +0800
+Subject: f2fs: fix to recover inode's uid/gid during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit dc4cd1257c86451cec3e8e352cc376348e4f4af4 ]
+
+Step to reproduce this bug:
+1. logon as root
+2. mount -t f2fs /dev/sdd /mnt;
+3. touch /mnt/file;
+4. chown system /mnt/file; chgrp system /mnt/file;
+5. xfs_io -f /mnt/file -c "fsync";
+6. godown /mnt;
+7. umount /mnt;
+8. mount -t f2fs /dev/sdd /mnt;
+
+After step 8) we will expect file's uid/gid are all system, but during
+recovery, these two fields were not been recovered, fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 2c3be4c3c626f..2c5d2c25d37e3 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -216,6 +216,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+ char *name;
+
+ inode->i_mode = le16_to_cpu(raw->i_mode);
++ i_uid_write(inode, le32_to_cpu(raw->i_uid));
++ i_gid_write(inode, le32_to_cpu(raw->i_gid));
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_atime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+--
+2.20.1
+
--- /dev/null
+From b3d2df71813149ea535464d49ea9ae3cb03e8ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 15:36:03 +0800
+Subject: f2fs: mark inode dirty explicitly in recover_inode()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 4a1728cad6340bfbe17bd17fd158b2165cd99508 ]
+
+Mark inode dirty explicitly in the end of recover_inode() to make sure
+that all recoverable fields can be persisted later.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 01636d996ba41..733f005b85d65 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -247,6 +247,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+
+ recover_inline_flags(inode, raw);
+
++ f2fs_mark_inode_dirty_sync(inode, true);
++
+ if (file_enc_name(inode))
+ name = "<encrypted>";
+ else
+--
+2.20.1
+
--- /dev/null
+From 4f96bbe2fd265279b15843541f6f16ba70bd8d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 11:40:12 -0700
+Subject: f2fs: submit bio after shutdown
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 5ce805869cbed93267ed26552ff76e30f05c91f7 ]
+
+Sometimes, some merged IOs could get a chance to be submitted, resulting in
+system hang in shutdown test. This issues IOs all the time after shutdown.
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index c61beaedf0789..b4a634da1372b 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -543,6 +543,8 @@ skip:
+ if (fio->in_list)
+ goto next;
+ out:
++ if (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN))
++ __submit_merged_bio(io);
+ up_write(&io->io_rwsem);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a3dfa1925ca8b6accf748aff585ae5979130175f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 15:28:40 -0700
+Subject: f2fs: update i_size after DIO completion
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 0a4daae5ffea39f5015334e4d18a6a80b447cae4 ]
+
+This is related to
+ee70daaba82d ("xfs: update i_size after unwritten conversion in dio completion")
+
+If we update i_size during dio_write, dio_read can read out stale data, which
+breaks xfstests/465.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 15 +++++++--------
+ fs/f2fs/f2fs.h | 1 +
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index b4a634da1372b..3a2fd66769660 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -889,7 +889,6 @@ static int __allocate_data_block(struct dnode_of_data *dn, int seg_type)
+ struct f2fs_summary sum;
+ struct node_info ni;
+ block_t old_blkaddr;
+- pgoff_t fofs;
+ blkcnt_t count = 1;
+ int err;
+
+@@ -918,12 +917,10 @@ alloc:
+ old_blkaddr, old_blkaddr);
+ f2fs_set_data_blkaddr(dn);
+
+- /* update i_size */
+- fofs = f2fs_start_bidx_of_node(ofs_of_node(dn->node_page), dn->inode) +
+- dn->ofs_in_node;
+- if (i_size_read(dn->inode) < ((loff_t)(fofs + 1) << PAGE_SHIFT))
+- f2fs_i_size_write(dn->inode,
+- ((loff_t)(fofs + 1) << PAGE_SHIFT));
++ /*
++ * i_size will be updated by direct_IO. Otherwise, we'll get stale
++ * data from unwritten block via dio_read.
++ */
+ return 0;
+ }
+
+@@ -1089,6 +1086,8 @@ next_block:
+ last_ofs_in_node = dn.ofs_in_node;
+ }
+ } else {
++ WARN_ON(flag != F2FS_GET_BLOCK_PRE_DIO &&
++ flag != F2FS_GET_BLOCK_DIO);
+ err = __allocate_data_block(&dn,
+ map->m_seg_type);
+ if (!err)
+@@ -1268,7 +1267,7 @@ static int get_data_block_dio(struct inode *inode, sector_t iblock,
+ struct buffer_head *bh_result, int create)
+ {
+ return __get_data_block(inode, iblock, bh_result, create,
+- F2FS_GET_BLOCK_DEFAULT, NULL,
++ F2FS_GET_BLOCK_DIO, NULL,
+ f2fs_rw_hint_to_seg_type(
+ inode->i_write_hint));
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 6d361c8c61306..2dc49a5419070 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -600,6 +600,7 @@ enum {
+ F2FS_GET_BLOCK_DEFAULT,
+ F2FS_GET_BLOCK_FIEMAP,
+ F2FS_GET_BLOCK_BMAP,
++ F2FS_GET_BLOCK_DIO,
+ F2FS_GET_BLOCK_PRE_DIO,
+ F2FS_GET_BLOCK_PRE_AIO,
+ F2FS_GET_BLOCK_PRECACHE,
+--
+2.20.1
+
--- /dev/null
+From af5f27197b6889ba1595b63c0d3ba6ddbb58613d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 21:04:12 +0800
+Subject: failover: Fix error return code in net_failover_create
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 09317da317e55e70ccbe23f65008348a4a1b7c7f ]
+
+if failover_register failed, 'err' code should be set correctly
+
+Fixes: cfc80d9a1163 ("net: Introduce net_failover driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/net_failover.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 5a749dc25bec4..beeb7eb76ca32 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -765,8 +765,10 @@ struct failover *net_failover_create(struct net_device *standby_dev)
+ netif_carrier_off(failover_dev);
+
+ failover = failover_register(failover_dev, &net_failover_ops);
+- if (IS_ERR(failover))
++ if (IS_ERR(failover)) {
++ err = PTR_ERR(failover);
+ goto err_failover_register;
++ }
+
+ return failover;
+
+--
+2.20.1
+
--- /dev/null
+From d8b0cd664fec0c5301733eb87376c07530837366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 17:03:25 +0100
+Subject: firmware: arm_scmi: use strlcpy to ensure NULL-terminated strings
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit ca64b719a1e665ac7449b6a968059176af7365a8 ]
+
+Replace all the memcpy() for copying name strings from the firmware with
+strlcpy() to make sure we are bounded by the source buffer size and we
+also always have NULL-terminated strings.
+
+This is needed to avoid out of bounds accesses if the firmware returns
+a non-terminated string.
+
+Reported-by: Olof Johansson <olof@lixom.net>
+Acked-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/base.c | 2 +-
+ drivers/firmware/arm_scmi/clock.c | 2 +-
+ drivers/firmware/arm_scmi/perf.c | 2 +-
+ drivers/firmware/arm_scmi/power.c | 2 +-
+ drivers/firmware/arm_scmi/sensors.c | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
+index 9dff33ea6416f..204390297f4bd 100644
+--- a/drivers/firmware/arm_scmi/base.c
++++ b/drivers/firmware/arm_scmi/base.c
+@@ -208,7 +208,7 @@ static int scmi_base_discover_agent_get(const struct scmi_handle *handle,
+
+ ret = scmi_do_xfer(handle, t);
+ if (!ret)
+- memcpy(name, t->rx.buf, SCMI_MAX_STR_SIZE);
++ strlcpy(name, t->rx.buf, SCMI_MAX_STR_SIZE);
+
+ scmi_xfer_put(handle, t);
+
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index e4119eb34986c..30fc04e284312 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -111,7 +111,7 @@ static int scmi_clock_attributes_get(const struct scmi_handle *handle,
+
+ ret = scmi_do_xfer(handle, t);
+ if (!ret)
+- memcpy(clk->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(clk->name, attr->name, SCMI_MAX_STR_SIZE);
+ else
+ clk->name[0] = '\0';
+
+diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
+index 64342944d9175..87c99d296ecd3 100644
+--- a/drivers/firmware/arm_scmi/perf.c
++++ b/drivers/firmware/arm_scmi/perf.c
+@@ -174,7 +174,7 @@ scmi_perf_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
+ dom_info->mult_factor =
+ (dom_info->sustained_freq_khz * 1000) /
+ dom_info->sustained_perf_level;
+- memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
+ }
+
+ scmi_xfer_put(handle, t);
+diff --git a/drivers/firmware/arm_scmi/power.c b/drivers/firmware/arm_scmi/power.c
+index cfa033b05aed5..62f3401a1f01e 100644
+--- a/drivers/firmware/arm_scmi/power.c
++++ b/drivers/firmware/arm_scmi/power.c
+@@ -106,7 +106,7 @@ scmi_power_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
+ dom_info->state_set_notify = SUPPORTS_STATE_SET_NOTIFY(flags);
+ dom_info->state_set_async = SUPPORTS_STATE_SET_ASYNC(flags);
+ dom_info->state_set_sync = SUPPORTS_STATE_SET_SYNC(flags);
+- memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
+ }
+
+ scmi_xfer_put(handle, t);
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index 27f2092b9882a..b53d5cc9c9f6c 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -140,7 +140,7 @@ static int scmi_sensor_description_get(const struct scmi_handle *handle,
+ s = &si->sensors[desc_index + cnt];
+ s->id = le32_to_cpu(buf->desc[cnt].id);
+ s->type = SENSOR_TYPE(attrh);
+- memcpy(s->name, buf->desc[cnt].name, SCMI_MAX_STR_SIZE);
++ strlcpy(s->name, buf->desc[cnt].name, SCMI_MAX_STR_SIZE);
+ }
+
+ desc_index += num_returned;
+--
+2.20.1
+
--- /dev/null
+From e074877895e67fb8f49e762e7a3466f9ffb66d18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 16:50:17 -0500
+Subject: firmware: dell_rbu: Make payload memory uncachable
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit 6aecee6ad41cf97c0270f72da032c10eef025bf0 ]
+
+The dell_rbu driver takes firmware update payloads and puts them in memory so
+the system BIOS can find them after a reboot. This sometimes fails (though
+rarely), because the memory containing the payload is in the CPU cache but
+never gets written back to main memory before the system is rebooted (CPU
+cache contents are lost on reboot).
+
+With this patch, the payload memory will be changed to uncachable to ensure
+that the payload is actually in main memory before the system is rebooted.
+
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/dell_rbu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
+index fb8af5cb7c9bf..ccefa84f73057 100644
+--- a/drivers/firmware/dell_rbu.c
++++ b/drivers/firmware/dell_rbu.c
+@@ -45,6 +45,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/firmware.h>
+ #include <linux/dma-mapping.h>
++#include <asm/set_memory.h>
+
+ MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
+ MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
+@@ -181,6 +182,11 @@ static int create_packet(void *data, size_t length)
+ packet_data_temp_buf = NULL;
+ }
+ }
++ /*
++ * set to uncachable or it may never get written back before reboot
++ */
++ set_memory_uc((unsigned long)packet_data_temp_buf, 1 << ordernum);
++
+ spin_lock(&rbu_data.lock);
+
+ newpacket->data = packet_data_temp_buf;
+@@ -349,6 +355,8 @@ static void packet_empty_list(void)
+ * to make sure there are no stale RBU packets left in memory
+ */
+ memset(newpacket->data, 0, rbu_data.packetsize);
++ set_memory_wb((unsigned long)newpacket->data,
++ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+ newpacket->ordernum);
+ kfree(newpacket);
+--
+2.20.1
+
--- /dev/null
+From c3cfc81bea83cb2f8027da2e361996e4d9fd819c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:29:29 +0300
+Subject: fuse: use READ_ONCE on congestion_threshold and max_background
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ]
+
+Since they are of unsigned int type, it's allowed to read them
+unlocked during reporting to userspace. Let's underline this fact
+with READ_ONCE() macroses.
+
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index 0b694655d9880..acc35819aae64 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->max_background;
++ val = READ_ONCE(fc->max_background);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->congestion_threshold;
++ val = READ_ONCE(fc->congestion_threshold);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+--
+2.20.1
+
--- /dev/null
+From b175ba556b5483aa699946c4e73c43818fc47298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 10:32:13 -0500
+Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ]
+
+The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when
+a rgrp buffer is valid. It's cleared when the glock is invalidated,
+signifying that the buffer data is now invalid. But before this
+patch, function update_rgrp_lvb was setting the flag when it
+determined it had a valid lvb. But that's an invalid assumption:
+just because you have a valid lvb doesn't mean you have valid
+buffers. After all, another node may have made the lvb valid,
+and this node just fetched it from the glock via dlm.
+
+Consider this scenario:
+1. The file system is mounted with RGRPLVB option.
+2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks
+ to GL_SKIP, it skips the gfs2_rgrp_bh_get.
+3. Since loops == 0 and the allocation target (ap->target) is
+ bigger than the largest known chunk of blocks in the rgrp
+ (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses
+ the call to gfs2_rgrp_bh_get there as well.
+4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses
+ gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due
+ to this invalid assumption.
+5. The next time update_rgrp_lvb is called, it sees the bit is set
+ and just returns 0, assuming both the lvb and rgrp are both
+ uptodate. But since this is a smaller allocation, or space has
+ been freed by another node, thus adjusting the lvb values,
+ it decides to use the rgrp for allocations, with invalid rd_free
+ due to the fact it was never updated.
+
+This patch changes update_rgrp_lvb so it doesn't set the UPTODATE
+flag anymore. That way, it has no choice but to fetch the latest
+values.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 449d0cb45a845..63e5387c84d26 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1227,7 +1227,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
+ rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
+ rl_flags &= ~GFS2_RDF_MASK;
+ rgd->rd_flags &= GFS2_RDF_MASK;
+- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK);
+ if (rgd->rd_rgl->rl_unlinked == 0)
+ rgd->rd_flags &= ~GFS2_RDF_CHECK;
+ rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free);
+--
+2.20.1
+
--- /dev/null
+From e60dd12496e86456a5ddb8d29e90a4f1cde574b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 12:36:03 +0200
+Subject: gpiolib: Fix gpio_direction_* for single direction GPIOs
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+[ Upstream commit ae9847f48a4b4bff0335da20be63ac84d94eb54c ]
+
+GPIOs with no programmable direction are not required to implement
+direction_output nor direction_input.
+
+If we try to set an output direction on an output-only GPIO or input
+direction on an input-only GPIO simply return 0.
+
+This allows this single direction GPIO to be used by libgpiod.
+
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 565ab945698ca..b81a27c7f89c4 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2541,19 +2541,27 @@ EXPORT_SYMBOL_GPL(gpiochip_free_own_desc);
+ int gpiod_direction_input(struct gpio_desc *desc)
+ {
+ struct gpio_chip *chip;
+- int status = -EINVAL;
++ int status = 0;
+
+ VALIDATE_DESC(desc);
+ chip = desc->gdev->chip;
+
+- if (!chip->get || !chip->direction_input) {
++ if (!chip->get && chip->direction_input) {
+ gpiod_warn(desc,
+- "%s: missing get() or direction_input() operations\n",
++ "%s: missing get() and direction_input() operations\n",
+ __func__);
+ return -EIO;
+ }
+
+- status = chip->direction_input(chip, gpio_chip_hwgpio(desc));
++ if (chip->direction_input) {
++ status = chip->direction_input(chip, gpio_chip_hwgpio(desc));
++ } else if (chip->get_direction &&
++ (chip->get_direction(chip, gpio_chip_hwgpio(desc)) != 1)) {
++ gpiod_warn(desc,
++ "%s: missing direction_input() operation\n",
++ __func__);
++ return -EIO;
++ }
+ if (status == 0)
+ clear_bit(FLAG_IS_OUT, &desc->flags);
+
+@@ -2575,16 +2583,28 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+ {
+ struct gpio_chip *gc = desc->gdev->chip;
+ int val = !!value;
+- int ret;
++ int ret = 0;
+
+- if (!gc->set || !gc->direction_output) {
++ if (!gc->set && !gc->direction_output) {
+ gpiod_warn(desc,
+- "%s: missing set() or direction_output() operations\n",
++ "%s: missing set() and direction_output() operations\n",
+ __func__);
+ return -EIO;
+ }
+
+- ret = gc->direction_output(gc, gpio_chip_hwgpio(desc), val);
++ if (gc->direction_output) {
++ ret = gc->direction_output(gc, gpio_chip_hwgpio(desc), val);
++ } else {
++ if (gc->get_direction &&
++ gc->get_direction(gc, gpio_chip_hwgpio(desc))) {
++ gpiod_warn(desc,
++ "%s: missing direction_output() operation\n",
++ __func__);
++ return -EIO;
++ }
++ gc->set(gc, gpio_chip_hwgpio(desc), val);
++ }
++
+ if (!ret)
+ set_bit(FLAG_IS_OUT, &desc->flags);
+ trace_gpio_value(desc_to_gpio(desc), 0, val);
+--
+2.20.1
+
--- /dev/null
+From 74976508f10318d8249d0149922a18f85ebe39e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 16:30:50 -0700
+Subject: i2c: aspeed: fix invalid clock parameters for very large divisors
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 17ccba67109cd0631f206cf49e17986218b47854 ]
+
+The function that computes clock parameters from divisors did not
+respect the maximum size of the bitfields that the parameters were
+written to. This fixes the bug.
+
+This bug can be reproduced with (and this fix verified with) the test
+at: https://kunit-review.googlesource.com/c/linux/+/1035/
+
+Discovered-by-KUnit: https://kunit-review.googlesource.com/c/linux/+/1035/
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Reviewed-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-aspeed.c | 65 +++++++++++++++++++++++----------
+ 1 file changed, 45 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
+index a19fbff168617..d9401b5191069 100644
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -137,7 +137,8 @@ struct aspeed_i2c_bus {
+ /* Synchronizes I/O mem access to base. */
+ spinlock_t lock;
+ struct completion cmd_complete;
+- u32 (*get_clk_reg_val)(u32 divisor);
++ u32 (*get_clk_reg_val)(struct device *dev,
++ u32 divisor);
+ unsigned long parent_clk_frequency;
+ u32 bus_frequency;
+ /* Transaction state. */
+@@ -686,16 +687,27 @@ static const struct i2c_algorithm aspeed_i2c_algo = {
+ #endif /* CONFIG_I2C_SLAVE */
+ };
+
+-static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
++static u32 aspeed_i2c_get_clk_reg_val(struct device *dev,
++ u32 clk_high_low_mask,
++ u32 divisor)
+ {
+- u32 base_clk, clk_high, clk_low, tmp;
++ u32 base_clk_divisor, clk_high_low_max, clk_high, clk_low, tmp;
++
++ /*
++ * SCL_high and SCL_low represent a value 1 greater than what is stored
++ * since a zero divider is meaningless. Thus, the max value each can
++ * store is every bit set + 1. Since SCL_high and SCL_low are added
++ * together (see below), the max value of both is the max value of one
++ * them times two.
++ */
++ clk_high_low_max = (clk_high_low_mask + 1) * 2;
+
+ /*
+ * The actual clock frequency of SCL is:
+ * SCL_freq = APB_freq / (base_freq * (SCL_high + SCL_low))
+ * = APB_freq / divisor
+ * where base_freq is a programmable clock divider; its value is
+- * base_freq = 1 << base_clk
++ * base_freq = 1 << base_clk_divisor
+ * SCL_high is the number of base_freq clock cycles that SCL stays high
+ * and SCL_low is the number of base_freq clock cycles that SCL stays
+ * low for a period of SCL.
+@@ -705,47 +717,59 @@ static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
+ * SCL_low = clk_low + 1
+ * Thus,
+ * SCL_freq = APB_freq /
+- * ((1 << base_clk) * (clk_high + 1 + clk_low + 1))
++ * ((1 << base_clk_divisor) * (clk_high + 1 + clk_low + 1))
+ * The documentation recommends clk_high >= clk_high_max / 2 and
+ * clk_low >= clk_low_max / 2 - 1 when possible; this last constraint
+ * gives us the following solution:
+ */
+- base_clk = divisor > clk_high_low_max ?
++ base_clk_divisor = divisor > clk_high_low_max ?
+ ilog2((divisor - 1) / clk_high_low_max) + 1 : 0;
+- tmp = (divisor + (1 << base_clk) - 1) >> base_clk;
+- clk_low = tmp / 2;
+- clk_high = tmp - clk_low;
+
+- if (clk_high)
+- clk_high--;
++ if (base_clk_divisor > ASPEED_I2CD_TIME_BASE_DIVISOR_MASK) {
++ base_clk_divisor = ASPEED_I2CD_TIME_BASE_DIVISOR_MASK;
++ clk_low = clk_high_low_mask;
++ clk_high = clk_high_low_mask;
++ dev_err(dev,
++ "clamping clock divider: divider requested, %u, is greater than largest possible divider, %u.\n",
++ divisor, (1 << base_clk_divisor) * clk_high_low_max);
++ } else {
++ tmp = (divisor + (1 << base_clk_divisor) - 1)
++ >> base_clk_divisor;
++ clk_low = tmp / 2;
++ clk_high = tmp - clk_low;
++
++ if (clk_high)
++ clk_high--;
+
+- if (clk_low)
+- clk_low--;
++ if (clk_low)
++ clk_low--;
++ }
+
+
+ return ((clk_high << ASPEED_I2CD_TIME_SCL_HIGH_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_HIGH_MASK)
+ | ((clk_low << ASPEED_I2CD_TIME_SCL_LOW_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_LOW_MASK)
+- | (base_clk & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
++ | (base_clk_divisor
++ & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
+ }
+
+-static u32 aspeed_i2c_24xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_24xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 3 bits wide, so each can hold a max
+ * value of 8 giving a clk_high_low_max of 16.
+ */
+- return aspeed_i2c_get_clk_reg_val(16, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(2, 0), divisor);
+ }
+
+-static u32 aspeed_i2c_25xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_25xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 4 bits wide, so each can hold a max
+ * value of 16 giving a clk_high_low_max of 32.
+ */
+- return aspeed_i2c_get_clk_reg_val(32, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(3, 0), divisor);
+ }
+
+ /* precondition: bus.lock has been acquired. */
+@@ -758,7 +782,7 @@ static int aspeed_i2c_init_clk(struct aspeed_i2c_bus *bus)
+ clk_reg_val &= (ASPEED_I2CD_TIME_TBUF_MASK |
+ ASPEED_I2CD_TIME_THDSTA_MASK |
+ ASPEED_I2CD_TIME_TACST_MASK);
+- clk_reg_val |= bus->get_clk_reg_val(divisor);
++ clk_reg_val |= bus->get_clk_reg_val(bus->dev, divisor);
+ writel(clk_reg_val, bus->base + ASPEED_I2C_AC_TIMING_REG1);
+ writel(ASPEED_NO_TIMEOUT_CTRL, bus->base + ASPEED_I2C_AC_TIMING_REG2);
+
+@@ -874,7 +898,8 @@ static int aspeed_i2c_probe_bus(struct platform_device *pdev)
+ if (!match)
+ bus->get_clk_reg_val = aspeed_i2c_24xx_get_clk_reg_val;
+ else
+- bus->get_clk_reg_val = (u32 (*)(u32))match->data;
++ bus->get_clk_reg_val = (u32 (*)(struct device *, u32))
++ match->data;
+
+ /* Initialize the I2C adapter */
+ spin_lock_init(&bus->lock);
+--
+2.20.1
+
--- /dev/null
+From f21250246dfbf1f8e2dae6ff2b19fac7e3c20928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 21:15:29 +0800
+Subject: i2c: mediatek: Use DMA safe buffers for i2c transactions
+
+From: Jun Gao <jun.gao@mediatek.com>
+
+[ Upstream commit fc66b39fe36acfd06f716e338de7cd8f9550fad2 ]
+
+DMA mode will always be used in i2c transactions, try to allocate
+a DMA safe buffer if the buf of struct i2c_msg used is not DMA safe.
+
+Signed-off-by: Jun Gao <jun.gao@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 62 +++++++++++++++++++++++++++++----
+ 1 file changed, 55 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 1e57f58fcb001..a74ef76705e0c 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -441,6 +441,8 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ u16 control_reg;
+ u16 restart_flag = 0;
+ u32 reg_4g_mode;
++ u8 *dma_rd_buf = NULL;
++ u8 *dma_wr_buf = NULL;
+ dma_addr_t rpaddr = 0;
+ dma_addr_t wpaddr = 0;
+ int ret;
+@@ -500,10 +502,18 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ if (i2c->op == I2C_MASTER_RD) {
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_RX, i2c->pdmabase + OFFSET_CON);
+- rpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_rd_buf)
++ return -ENOMEM;
++
++ rpaddr = dma_map_single(i2c->dev, dma_rd_buf,
+ msgs->len, DMA_FROM_DEVICE);
+- if (dma_mapping_error(i2c->dev, rpaddr))
++ if (dma_mapping_error(i2c->dev, rpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, msgs, false);
++
+ return -ENOMEM;
++ }
+
+ if (i2c->dev_comp->support_33bits) {
+ reg_4g_mode = mtk_i2c_set_4g_mode(rpaddr);
+@@ -515,10 +525,18 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ } else if (i2c->op == I2C_MASTER_WR) {
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_TX, i2c->pdmabase + OFFSET_CON);
+- wpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_wr_buf)
++ return -ENOMEM;
++
++ wpaddr = dma_map_single(i2c->dev, dma_wr_buf,
+ msgs->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(i2c->dev, wpaddr))
++ if (dma_mapping_error(i2c->dev, wpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
+ return -ENOMEM;
++ }
+
+ if (i2c->dev_comp->support_33bits) {
+ reg_4g_mode = mtk_i2c_set_4g_mode(wpaddr);
+@@ -530,16 +548,39 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ } else {
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_CON);
+- wpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_wr_buf)
++ return -ENOMEM;
++
++ wpaddr = dma_map_single(i2c->dev, dma_wr_buf,
+ msgs->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(i2c->dev, wpaddr))
++ if (dma_mapping_error(i2c->dev, wpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
+ return -ENOMEM;
+- rpaddr = dma_map_single(i2c->dev, (msgs + 1)->buf,
++ }
++
++ dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 0);
++ if (!dma_rd_buf) {
++ dma_unmap_single(i2c->dev, wpaddr,
++ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
++ return -ENOMEM;
++ }
++
++ rpaddr = dma_map_single(i2c->dev, dma_rd_buf,
+ (msgs + 1)->len,
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(i2c->dev, rpaddr)) {
+ dma_unmap_single(i2c->dev, wpaddr,
+ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, (msgs + 1), false);
++
+ return -ENOMEM;
+ }
+
+@@ -578,14 +619,21 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ if (i2c->op == I2C_MASTER_WR) {
+ dma_unmap_single(i2c->dev, wpaddr,
+ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, true);
+ } else if (i2c->op == I2C_MASTER_RD) {
+ dma_unmap_single(i2c->dev, rpaddr,
+ msgs->len, DMA_FROM_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, msgs, true);
+ } else {
+ dma_unmap_single(i2c->dev, wpaddr, msgs->len,
+ DMA_TO_DEVICE);
+ dma_unmap_single(i2c->dev, rpaddr, (msgs + 1)->len,
+ DMA_FROM_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, true);
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, (msgs + 1), true);
+ }
+
+ if (ret == 0) {
+--
+2.20.1
+
--- /dev/null
+From 9d00f01f285c7e23064429c210d6d08616e9ce20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:01 -0700
+Subject: i40e: Check and correct speed values for link on open
+
+From: Jan Sokolowski <jan.sokolowski@intel.com>
+
+[ Upstream commit e78d9a39fd06109022d11c8ca444cfcec2abb290 ]
+
+If our card has been put in an unstable state due to
+other drivers interacting with it, speed settings
+might be incorrect. If incorrect, forcefully reset them
+on open to known default values.
+
+Signed-off-by: Jan Sokolowski <jan.sokolowski@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 055562c930fb0..1577dbaab7425 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -6587,6 +6587,24 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ struct i40e_hw *hw = &pf->hw;
+ i40e_status err;
+ u64 mask;
++ u8 speed;
++
++ /* Card might've been put in an unstable state by other drivers
++ * and applications, which causes incorrect speed values being
++ * set on startup. In order to clear speed registers, we call
++ * get_phy_capabilities twice, once to get initial state of
++ * available speeds, and once to get current PHY config.
++ */
++ err = i40e_aq_get_phy_capabilities(hw, false, true, &abilities,
++ NULL);
++ if (err) {
++ dev_err(&pf->pdev->dev,
++ "failed to get phy cap., ret = %s last_status = %s\n",
++ i40e_stat_str(hw, err),
++ i40e_aq_str(hw, hw->aq.asq_last_status));
++ return err;
++ }
++ speed = abilities.link_speed;
+
+ /* Get the current phy config */
+ err = i40e_aq_get_phy_capabilities(hw, false, false, &abilities,
+@@ -6600,9 +6618,9 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ }
+
+ /* If link needs to go up, but was not forced to go down,
+- * no need for a flap
++ * and its speed values are OK, no need for a flap
+ */
+- if (is_up && abilities.phy_type != 0)
++ if (is_up && abilities.phy_type != 0 && abilities.link_speed != 0)
+ return I40E_SUCCESS;
+
+ /* To force link we need to set bits for all supported PHY types,
+@@ -6614,7 +6632,10 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ config.phy_type_ext = is_up ? (u8)((mask >> 32) & 0xff) : 0;
+ /* Copy the old settings, except of phy_type */
+ config.abilities = abilities.abilities;
+- config.link_speed = abilities.link_speed;
++ if (abilities.link_speed != 0)
++ config.link_speed = abilities.link_speed;
++ else
++ config.link_speed = speed;
+ config.eee_capability = abilities.eee_capability;
+ config.eeer = abilities.eeer_val;
+ config.low_power_ctrl = abilities.d3_lpan;
+--
+2.20.1
+
--- /dev/null
+From 6242b25954d84a3089b7293e650e62f36c0d6c76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:03 -0700
+Subject: i40e: hold the rtnl lock on clearing interrupt scheme
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ]
+
+Hold the rtnl lock when we're clearing interrupt scheme
+in i40e_shutdown and in i40e_remove.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1577dbaab7425..1a66373184d62 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -14208,6 +14208,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ mutex_destroy(&hw->aq.asq_mutex);
+
+ /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i]) {
+@@ -14216,6 +14217,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ pf->vsi[i] = NULL;
+ }
+ }
++ rtnl_unlock();
+
+ for (i = 0; i < I40E_MAX_VEB; i++) {
+ kfree(pf->veb[i]);
+@@ -14427,7 +14429,13 @@ static void i40e_shutdown(struct pci_dev *pdev)
+ wr32(hw, I40E_PFPM_WUFC,
+ (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
+
++ /* Since we're going to destroy queues during the
++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this
++ * whole section
++ */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
++ rtnl_unlock();
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ pci_wake_from_d3(pdev, pf->wol_en);
+--
+2.20.1
+
--- /dev/null
+From 280d3fda58c3364871e3734fb6acda312c4ddeaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:09 -0700
+Subject: i40e: Prevent deleting MAC address from VF when set by PF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ]
+
+To prevent VF from deleting MAC address that was assigned by the
+PF we need to check for that scenario when we try to delete a MAC
+address from a VF.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index d86f3fa7aa6a4..46a71d289bca2 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2571,6 +2571,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
+ ret = I40E_ERR_INVALID_MAC_ADDR;
+ goto error_param;
+ }
++
++ if (vf->pf_set_mac &&
++ ether_addr_equal(al->list[i].addr,
++ vf->default_lan_addr.addr)) {
++ dev_err(&pf->pdev->dev,
++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n",
++ vf->default_lan_addr.addr, vf->vf_id);
++ ret = I40E_ERR_PARAM;
++ goto error_param;
++ }
+ }
+ vsi = pf->vsi[vf->lan_vsi_idx];
+
+--
+2.20.1
+
--- /dev/null
+From aa39b27e95d92aca696c89c32e36f728b0c5023c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:30 -0700
+Subject: i40e: use correct length for strncpy
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ]
+
+Caught by GCC 8. When we provide a length for strncpy, we should not
+include the terminating null. So we must tell it one less than the size
+of the destination buffer.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+index 35f2866b38c6b..1199f0502d6d5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -694,7 +694,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf)
+ if (!IS_ERR_OR_NULL(pf->ptp_clock))
+ return 0;
+
+- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name));
++ strncpy(pf->ptp_caps.name, i40e_driver_name,
++ sizeof(pf->ptp_caps.name) - 1);
+ pf->ptp_caps.owner = THIS_MODULE;
+ pf->ptp_caps.max_adj = 999999999;
+ pf->ptp_caps.n_ext_ts = 0;
+--
+2.20.1
+
--- /dev/null
+From a204788bbb102a32defa0a07a3685fb4b3c9603b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:08 -0700
+Subject: i40evf: cancel workqueue sync for adminq when a VF is removed
+
+From: Lihong Yang <lihong.yang@intel.com>
+
+[ Upstream commit babbcc60040abfb7a9e3caa1c58fe182ae73762a ]
+
+If a VF is being removed, there is no need to continue with the
+workqueue sync for the adminq task, thus cancel it. Without this call,
+when VFs are created and removed right away, there might be a chance for
+the driver to crash with events stuck in the adminq.
+
+Signed-off-by: Lihong Yang <lihong.yang@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index 3fc46d2adc087..f50c19b833686 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -3884,6 +3884,8 @@ static void i40evf_remove(struct pci_dev *pdev)
+ if (adapter->watchdog_timer.function)
+ del_timer_sync(&adapter->watchdog_timer);
+
++ cancel_work_sync(&adapter->adminq_task);
++
+ i40evf_free_rss(adapter);
+
+ if (hw->aq.asq.count)
+--
+2.20.1
+
--- /dev/null
+From 85934d6e78dc8aed53906b18c68c09e2c2fcc4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:02 -0700
+Subject: i40evf: Don't enable vlan stripping when rx offload is turned on
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 3bd77e2ae1477d6f87fc3f542c737119d5decf9f ]
+
+With current implementation of i40evf_set_features when user sets
+any offload via ethtool we set I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING
+as a required aq which triggers driver to call
+i40evf_enable_vlan_stripping. This shouldn't take place.
+This patches fixes it by setting the flag only when VLAN offload
+is turned on.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40evf/i40evf_main.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index bc4fa9df6da3e..3fc46d2adc087 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -3097,18 +3097,19 @@ static int i40evf_set_features(struct net_device *netdev,
+ {
+ struct i40evf_adapter *adapter = netdev_priv(netdev);
+
+- /* Don't allow changing VLAN_RX flag when VLAN is set for VF
+- * and return an error in this case
++ /* Don't allow changing VLAN_RX flag when adapter is not capable
++ * of VLAN offload
+ */
+- if (VLAN_ALLOWED(adapter)) {
++ if (!VLAN_ALLOWED(adapter)) {
++ if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX)
++ return -EINVAL;
++ } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
+ if (features & NETIF_F_HW_VLAN_CTAG_RX)
+ adapter->aq_required |=
+ I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
+ else
+ adapter->aq_required |=
+ I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
+- } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
+- return -EINVAL;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 24ceb6e0296b9dcaf71df2ca3f35db0c909d4c8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:31 -0700
+Subject: i40evf: set IFF_UNICAST_FLT flag for the VF
+
+From: Lihong Yang <lihong.yang@intel.com>
+
+[ Upstream commit e65aae086330d0a6c6c9f874aef03c69cf98884b ]
+
+Set IFF_UNICAST_FLT flag for the VF to prevent it from entering
+promiscuous mode when macvlan is added to the VF.
+
+Signed-off-by: Lihong Yang <lihong.yang@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index fef6d892ed4cf..bc4fa9df6da3e 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -3332,6 +3332,8 @@ int i40evf_process_config(struct i40evf_adapter *adapter)
+ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
+ netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+
++ netdev->priv_flags |= IFF_UNICAST_FLT;
++
+ /* Do not turn on offloads when they are requested to be turned off.
+ * TSO needs minimum 576 bytes to work correctly.
+ */
+--
+2.20.1
+
--- /dev/null
+From 4a2bbdfd03b50a288a38f01f2b0c060e7793e4a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:29 -0700
+Subject: i40evf: Validate the number of queues a PF sends
+
+From: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
+
+[ Upstream commit 3c818910911c93bb5099c6637ec350f90c0e71fc ]
+
+A PF can send any number of queues to the VF and the VF may not
+be able to support that many. Check to see that the number of
+queues is less than or equal to the max number of queues the
+VF can have.
+
+Signed-off-by: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/i40evf/i40evf_virtchnl.c | 32 +++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+index 565677de5ba37..94dabc9d89f73 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+@@ -153,6 +153,32 @@ int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
+ NULL, 0);
+ }
+
++/**
++ * i40evf_validate_num_queues
++ * @adapter: adapter structure
++ *
++ * Validate that the number of queues the PF has sent in
++ * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.
++ **/
++static void i40evf_validate_num_queues(struct i40evf_adapter *adapter)
++{
++ if (adapter->vf_res->num_queue_pairs > I40EVF_MAX_REQ_QUEUES) {
++ struct virtchnl_vsi_resource *vsi_res;
++ int i;
++
++ dev_info(&adapter->pdev->dev, "Received %d queues, but can only have a max of %d\n",
++ adapter->vf_res->num_queue_pairs,
++ I40EVF_MAX_REQ_QUEUES);
++ dev_info(&adapter->pdev->dev, "Fixing by reducing queues to %d\n",
++ I40EVF_MAX_REQ_QUEUES);
++ adapter->vf_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ for (i = 0; i < adapter->vf_res->num_vsis; i++) {
++ vsi_res = &adapter->vf_res->vsi_res[i];
++ vsi_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ }
++ }
++}
++
+ /**
+ * i40evf_get_vf_config
+ * @adapter: private adapter structure
+@@ -195,6 +221,11 @@ int i40evf_get_vf_config(struct i40evf_adapter *adapter)
+ err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
+ memcpy(adapter->vf_res, event.msg_buf, min(event.msg_len, len));
+
++ /* some PFs send more queues than we should have so validate that
++ * we aren't getting too many queues
++ */
++ if (!err)
++ i40evf_validate_num_queues(adapter);
+ i40e_vf_parse_hw_config(hw, adapter->vf_res);
+ out_alloc:
+ kfree(event.msg_buf);
+@@ -1329,6 +1360,7 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
+ I40E_MAX_VF_VSI *
+ sizeof(struct virtchnl_vsi_resource);
+ memcpy(adapter->vf_res, msg, min(msglen, len));
++ i40evf_validate_num_queues(adapter);
+ i40e_vf_parse_hw_config(&adapter->hw, adapter->vf_res);
+ /* restore current mac address */
+ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+--
+2.20.1
+
--- /dev/null
+From 6513151af3e1a47a49e3c3c3562cb2bdfe182d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 09:39:28 -0700
+Subject: IB/hfi1: Missing return value in error path for user sdma
+
+From: Michael J. Ruhl <michael.j.ruhl@intel.com>
+
+[ Upstream commit 2bf4b33f83dfe521c4c7c407b6b150aeec04d69c ]
+
+If the set_txreq_header_agh() function returns an error, the exit path
+is chosen.
+
+In this path, the code fails to set the return value. This will cause
+the caller to not realize an error has occurred.
+
+Set the return value correctly in the error path.
+
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index cbff746d9e9de..684a298e15037 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -856,8 +856,10 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
+
+ changes = set_txreq_header_ahg(req, tx,
+ datalen);
+- if (changes < 0)
++ if (changes < 0) {
++ ret = changes;
+ goto free_tx;
++ }
+ }
+ } else {
+ ret = sdma_txinit(&tx->txreq, 0, sizeof(req->hdr) +
+--
+2.20.1
+
--- /dev/null
+From 8f9058d6fc2cbb1dbeae282265c8f3e64e54cbea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:45:30 +0300
+Subject: IB/ipoib: Ensure that MTU isn't less than minimum permitted
+
+From: Muhammad Sammar <muhammads@mellanox.com>
+
+[ Upstream commit 142a9c287613560edf5a03c8d142c8b6ebc1995b ]
+
+It is illegal to change MTU to a value lower than the minimum MTU
+stated in ethernet spec. In addition to that we need to add 4 bytes
+for encapsulation header (IPOIB_ENCAP_LEN).
+
+Before "ifconfig ib0 mtu 0" command, succeeds while it obviously shouldn't.
+
+Signed-off-by: Muhammad Sammar <muhammads@mellanox.com>
+Reviewed-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 78dd36daac00e..d8cb5bbe6eb58 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -243,7 +243,8 @@ static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
+ return 0;
+ }
+
+- if (new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
++ if (new_mtu < (ETH_MIN_MTU + IPOIB_ENCAP_LEN) ||
++ new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
+ return -EINVAL;
+
+ priv->admin_mtu = new_mtu;
+--
+2.20.1
+
--- /dev/null
+From 7cd37896085227c2063d4a6aa374316268813ccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 09:44:18 +0000
+Subject: IB/iser: Fix possible NULL deref at iser_inv_desc()
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 65f07f5a09dacf3b60619f196f096ea3671a5eda ]
+
+In case target remote invalidates bogus rkey and signature is not used,
+pi_ctx is NULL deref.
+
+The commit also fails the connection on bogus remote invalidation.
+
+Fixes: 59caaed7a72a ("IB/iser: Support the remote invalidation exception")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_initiator.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 2f6388596f886..96af06cfe0afd 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -589,13 +589,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc)
+ ib_conn->post_recv_buf_count--;
+ }
+
+-static inline void
++static inline int
+ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ {
+- if (likely(rkey == desc->rsc.mr->rkey))
++ if (likely(rkey == desc->rsc.mr->rkey)) {
+ desc->rsc.mr_valid = 0;
+- else if (likely(rkey == desc->pi_ctx->sig_mr->rkey))
++ } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) {
+ desc->pi_ctx->sig_mr_valid = 0;
++ } else {
++ iser_err("Bogus remote invalidation for rkey %#x\n", rkey);
++ return -EINVAL;
++ }
++
++ return 0;
+ }
+
+ static int
+@@ -623,12 +629,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn,
+
+ if (iser_task->dir[ISER_DIR_IN]) {
+ desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+
+ if (iser_task->dir[ISER_DIR_OUT]) {
+ desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+ } else {
+ iser_err("failed to get task for itt=%d\n", hdr->itt);
+--
+2.20.1
+
--- /dev/null
+From e10a0d25dd097b6a949eefd153b6114cd5f4a860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:29:05 +0300
+Subject: IB/mlx5: Change TX affinity assignment in RoCE LAG mode
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+[ Upstream commit c6a21c3864fc7f5febae7d096cd136f397c791f2 ]
+
+In the current code, the TX affinity is per RoCE device, which can cause
+unfairness between different contexts. e.g. if we open two contexts, and
+each open 10 QPs concurrently, all of the QPs of the first context might
+end up on the first port instead of distributed on the two ports as
+expected
+
+To overcome this unfairness between processes, we maintain per device TX
+affinity, and per process TX affinity.
+
+The allocation algorithm is as follow:
+
+1. Hold two tx_port_affinity atomic variables, one per RoCE device and one
+ per ucontext. Both initialized to 0.
+
+2. In mlx5_ib_alloc_ucontext do:
+ 2.1. ucontext.tx_port_affinity = device.tx_port_affinity
+ 2.2. device.tx_port_affinity += 1
+
+3. In modify QP INIT2RST:
+ 3.1. qp.tx_port_affinity = ucontext.tx_port_affinity % MLX5_PORT_NUM
+ 3.2. ucontext.tx_port_affinity += 1
+
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Reviewed-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 8 ++++++
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++-
+ drivers/infiniband/hw/mlx5/qp.c | 37 +++++++++++++++++++++++++---
+ 3 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index c05eae93170eb..f4ffdc588ea07 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1823,6 +1823,14 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
+ context->lib_caps = req.lib_caps;
+ print_lib_caps(dev, context->lib_caps);
+
++ if (mlx5_lag_is_active(dev->mdev)) {
++ u8 port = mlx5_core_native_port_num(dev->mdev);
++
++ atomic_set(&context->tx_port_affinity,
++ atomic_add_return(
++ 1, &dev->roce[port].tx_port_affinity));
++ }
++
+ return &context->ibucontext;
+
+ out_mdev:
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 941d1df54631a..6a060c84598fe 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -139,6 +139,8 @@ struct mlx5_ib_ucontext {
+ u64 lib_caps;
+ DECLARE_BITMAP(dm_pages, MLX5_MAX_MEMIC_PAGES);
+ u16 devx_uid;
++ /* For RoCE LAG TX affinity */
++ atomic_t tx_port_affinity;
+ };
+
+ static inline struct mlx5_ib_ucontext *to_mucontext(struct ib_ucontext *ibucontext)
+@@ -700,7 +702,7 @@ struct mlx5_roce {
+ rwlock_t netdev_lock;
+ struct net_device *netdev;
+ struct notifier_block nb;
+- atomic_t next_port;
++ atomic_t tx_port_affinity;
+ enum ib_port_state last_port_state;
+ struct mlx5_ib_dev *dev;
+ u8 native_port_num;
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 900f85ce0fb08..2e7230392a498 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2910,6 +2910,37 @@ static int modify_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ return 0;
+ }
+
++static unsigned int get_tx_affinity(struct mlx5_ib_dev *dev,
++ struct mlx5_ib_pd *pd,
++ struct mlx5_ib_qp_base *qp_base,
++ u8 port_num)
++{
++ struct mlx5_ib_ucontext *ucontext = NULL;
++ unsigned int tx_port_affinity;
++
++ if (pd && pd->ibpd.uobject && pd->ibpd.uobject->context)
++ ucontext = to_mucontext(pd->ibpd.uobject->context);
++
++ if (ucontext) {
++ tx_port_affinity = (unsigned int)atomic_add_return(
++ 1, &ucontext->tx_port_affinity) %
++ MLX5_MAX_PORTS +
++ 1;
++ mlx5_ib_dbg(dev, "Set tx affinity 0x%x to qpn 0x%x ucontext %p\n",
++ tx_port_affinity, qp_base->mqp.qpn, ucontext);
++ } else {
++ tx_port_affinity =
++ (unsigned int)atomic_add_return(
++ 1, &dev->roce[port_num].tx_port_affinity) %
++ MLX5_MAX_PORTS +
++ 1;
++ mlx5_ib_dbg(dev, "Set tx affinity 0x%x to qpn 0x%x\n",
++ tx_port_affinity, qp_base->mqp.qpn);
++ }
++
++ return tx_port_affinity;
++}
++
+ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ const struct ib_qp_attr *attr, int attr_mask,
+ enum ib_qp_state cur_state, enum ib_qp_state new_state,
+@@ -2975,6 +3006,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ if (!context)
+ return -ENOMEM;
+
++ pd = get_pd(qp);
+ context->flags = cpu_to_be32(mlx5_st << 16);
+
+ if (!(attr_mask & IB_QP_PATH_MIG_STATE)) {
+@@ -3003,9 +3035,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ (ibqp->qp_type == IB_QPT_XRC_TGT)) {
+ if (mlx5_lag_is_active(dev->mdev)) {
+ u8 p = mlx5_core_native_port_num(dev->mdev);
+- tx_affinity = (unsigned int)atomic_add_return(1,
+- &dev->roce[p].next_port) %
+- MLX5_MAX_PORTS + 1;
++ tx_affinity = get_tx_affinity(dev, pd, base, p);
+ context->flags |= cpu_to_be32(tx_affinity << 24);
+ }
+ }
+@@ -3063,7 +3093,6 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ goto out;
+ }
+
+- pd = get_pd(qp);
+ get_cqs(qp->ibqp.qp_type, qp->ibqp.send_cq, qp->ibqp.recv_cq,
+ &send_cq, &recv_cq);
+
+--
+2.20.1
+
--- /dev/null
+From 840ed120ff1bcde7cbbe8a7005800e07211492bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:45:29 +0300
+Subject: IB/mlx5: Don't hold spin lock while checking device state
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 6c75520f7e5a6a353f3b332509d205e213d05855 ]
+
+mdev->state device state is not protected by the QP for which WRs are
+being processed. Therefore, there is no need to hold spin lock while
+checking mdev state.
+
+Given that device fatal error is unlikely situation, wrap the condition
+check with unlikely().
+
+Additionally, kernel QP1 is also a kernel ULP for which soft CQEs needs
+to be generated. Therefore, check for device fatal error before
+processing QP1 work requests.
+
+Fixes: 89ea94a7b6c4 ("IB/mlx5: Reset flow support for IB kernel ULPs")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 2e7230392a498..ef0f710587ad8 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -4407,6 +4407,12 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ u8 next_fence = 0;
+ u8 fence;
+
++ if (unlikely(mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR &&
++ !drain)) {
++ *bad_wr = wr;
++ return -EIO;
++ }
++
+ if (unlikely(ibqp->qp_type == IB_QPT_GSI))
+ return mlx5_ib_gsi_post_send(ibqp, wr, bad_wr);
+
+@@ -4416,13 +4422,6 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+
+ spin_lock_irqsave(&qp->sq.lock, flags);
+
+- if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR && !drain) {
+- err = -EIO;
+- *bad_wr = wr;
+- nreq = 0;
+- goto out;
+- }
+-
+ for (nreq = 0; wr; nreq++, wr = wr->next) {
+ if (unlikely(wr->opcode >= ARRAY_SIZE(mlx5_ib_opcode))) {
+ mlx5_ib_warn(dev, "\n");
+@@ -4737,18 +4736,17 @@ static int _mlx5_ib_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+ int ind;
+ int i;
+
++ if (unlikely(mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR &&
++ !drain)) {
++ *bad_wr = wr;
++ return -EIO;
++ }
++
+ if (unlikely(ibqp->qp_type == IB_QPT_GSI))
+ return mlx5_ib_gsi_post_recv(ibqp, wr, bad_wr);
+
+ spin_lock_irqsave(&qp->rq.lock, flags);
+
+- if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR && !drain) {
+- err = -EIO;
+- *bad_wr = wr;
+- nreq = 0;
+- goto out;
+- }
+-
+ ind = qp->rq.head & (qp->rq.wqe_cnt - 1);
+
+ for (nreq = 0; wr; nreq++, wr = wr->next) {
+--
+2.20.1
+
--- /dev/null
+From ef2a2dbf3a97d09bf3dda15f23249703fbd7a5a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jun 2018 18:47:30 -0700
+Subject: IB/rxe: avoid back-to-back retries
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit 4e4c53df567714b3d08b2b5d8ccb1d175fc9be01 ]
+
+Error retries can occur due to timeouts, NAKs or receiving
+packets beyond the current read request. Avoid back-to-back
+retries due to packet processing, by only retrying the initial
+attempt immediately. Subsequent retries must be due to timeouts.
+
+Continue to process completion packets after scheduling a retry.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 18 +++++++++++++++++-
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 1 +
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 83311dd07019b..ed96441595d81 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -191,6 +191,7 @@ static inline void reset_retry_counters(struct rxe_qp *qp)
+ {
+ qp->comp.retry_cnt = qp->attr.retry_cnt;
+ qp->comp.rnr_retry = qp->attr.rnr_retry;
++ qp->comp.started_retry = 0;
+ }
+
+ static inline enum comp_state check_psn(struct rxe_qp *qp,
+@@ -676,6 +677,20 @@ int rxe_completer(void *arg)
+ goto exit;
+ }
+
++ /* if we've started a retry, don't start another
++ * retry sequence, unless this is a timeout.
++ */
++ if (qp->comp.started_retry &&
++ !qp->comp.timeout_retry) {
++ if (pkt) {
++ rxe_drop_ref(pkt->qp);
++ kfree_skb(skb);
++ skb = NULL;
++ }
++
++ goto done;
++ }
++
+ if (qp->comp.retry_cnt > 0) {
+ if (qp->comp.retry_cnt != 7)
+ qp->comp.retry_cnt--;
+@@ -692,6 +707,7 @@ int rxe_completer(void *arg)
+ rxe_counter_inc(rxe,
+ RXE_CNT_COMP_RETRY);
+ qp->req.need_retry = 1;
++ qp->comp.started_retry = 1;
+ rxe_run_task(&qp->req.task, 1);
+ }
+
+@@ -701,7 +717,7 @@ int rxe_completer(void *arg)
+ skb = NULL;
+ }
+
+- goto exit;
++ goto done;
+
+ } else {
+ rxe_counter_inc(rxe, RXE_CNT_RETRY_EXCEEDED);
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 3b731c7682e5b..a0ec28d2b71a4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -158,6 +158,7 @@ struct rxe_comp_info {
+ int opcode;
+ int timeout;
+ int timeout_retry;
++ int started_retry;
+ u32 retry_cnt;
+ u32 rnr_retry;
+ struct rxe_task task;
+--
+2.20.1
+
--- /dev/null
+From 5211c40c48b3b9d5f0a6636c39da3ac258725378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jun 2018 18:48:07 -0700
+Subject: IB/rxe: fixes for rdma read retry
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit 030e46e495af855a13964a0aab9753ea82a96edc ]
+
+When a read request is retried for the remaining partial
+data, the response may restart from read response first
+or read response only. So support those cases.
+
+Do not advance the comp psn beyond the current wqe's last_psn
+as that could skip over an entire read wqe and will cause the
+req_retry() logic to set an incorrect req psn.
+An example sequence is as follows:
+Write PSN 40 -- this is the current WQE.
+Read request PSN 41
+Write PSN 42
+Receive ACK PSN 42 -- this will complete the current WQE
+for PSN 40, and set the comp psn to 42 which is a problem
+because the read request at PSN 41 has been skipped over.
+So when req_retry() tries to retransmit the read request,
+it sets the req psn to 42 which is incorrect.
+
+When retrying a read request, calculate the number of psns
+completed based on the dma resid instead of the wqe first_psn.
+The wqe first_psn could have moved if the read request was
+retried multiple times.
+
+Set the reth length to the dma resid to handle read retries for
+the remaining partial data.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 21 ++++++++++++++++-----
+ drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++------
+ 2 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index ed96441595d81..ea089cb091ade 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -254,6 +254,17 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ if (pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE &&
+ pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_LAST) {
++ /* read retries of partial data may restart from
++ * read response first or response only.
++ */
++ if ((pkt->psn == wqe->first_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) ||
++ (wqe->first_psn == wqe->last_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_ONLY))
++ break;
++
+ return COMPST_ERROR;
+ }
+ break;
+@@ -500,11 +511,11 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt,
+ struct rxe_send_wqe *wqe)
+ {
+- qp->comp.opcode = -1;
+-
+- if (pkt) {
+- if (psn_compare(pkt->psn, qp->comp.psn) >= 0)
+- qp->comp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ if (pkt && wqe->state == wqe_state_pending) {
++ if (psn_compare(wqe->last_psn, qp->comp.psn) >= 0) {
++ qp->comp.psn = (wqe->last_psn + 1) & BTH_PSN_MASK;
++ qp->comp.opcode = -1;
++ }
+
+ if (qp->req.wait_psn) {
+ qp->req.wait_psn = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index fa98a52796470..f7dd8de799415 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -73,9 +73,6 @@ static void req_retry(struct rxe_qp *qp)
+ int npsn;
+ int first = 1;
+
+- wqe = queue_head(qp->sq.queue);
+- npsn = (qp->comp.psn - wqe->first_psn) & BTH_PSN_MASK;
+-
+ qp->req.wqe_index = consumer_index(qp->sq.queue);
+ qp->req.psn = qp->comp.psn;
+ qp->req.opcode = -1;
+@@ -107,11 +104,17 @@ static void req_retry(struct rxe_qp *qp)
+ if (first) {
+ first = 0;
+
+- if (mask & WR_WRITE_OR_SEND_MASK)
++ if (mask & WR_WRITE_OR_SEND_MASK) {
++ npsn = (qp->comp.psn - wqe->first_psn) &
++ BTH_PSN_MASK;
+ retry_first_write_send(qp, wqe, mask, npsn);
++ }
+
+- if (mask & WR_READ_MASK)
++ if (mask & WR_READ_MASK) {
++ npsn = (wqe->dma.length - wqe->dma.resid) /
++ qp->mtu;
+ wqe->iova += npsn * qp->mtu;
++ }
+ }
+
+ wqe->state = wqe_state_posted;
+@@ -435,7 +438,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ if (pkt->mask & RXE_RETH_MASK) {
+ reth_set_rkey(pkt, ibwr->wr.rdma.rkey);
+ reth_set_va(pkt, wqe->iova);
+- reth_set_len(pkt, wqe->dma.length);
++ reth_set_len(pkt, wqe->dma.resid);
+ }
+
+ if (pkt->mask & RXE_IMMDT_MASK)
+--
+2.20.1
+
--- /dev/null
+From fa03641b39818ecdf1b91c6de98cadff4b68e7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Aug 2018 06:29:58 -0700
+Subject: ice: Fix and update driver version string
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit 9ea47d81a7f17c6b77211ab75fbca2127719ad39 ]
+
+Remove the "ice" prefix for the driver version string and bump version
+to 0.7.1-k.
+
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index e1f95e7a51393..00c833cd2b3ae 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -7,7 +7,7 @@
+
+ #include "ice.h"
+
+-#define DRV_VERSION "ice-0.7.0-k"
++#define DRV_VERSION "0.7.1-k"
+ #define DRV_SUMMARY "Intel(R) Ethernet Connection E800 Series Linux Driver"
+ const char ice_drv_ver[] = DRV_VERSION;
+ static const char ice_driver_string[] = DRV_SUMMARY;
+--
+2.20.1
+
--- /dev/null
+From db94abf192925054066e8067c3444b54a3a500fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Aug 2018 06:29:47 -0700
+Subject: ice: Prevent control queue operations during reset
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit fd2a981777d911b2e94cdec50779c85c58a0dec9 ]
+
+Once reset is issued, the driver loses all control queue interfaces.
+Exercising control queue operations during reset is incorrect and
+may result in long timeouts.
+
+This patch introduces a new field 'reset_ongoing' in the hw structure.
+This is set to 1 by the core driver when it receives a reset interrupt.
+ice_sq_send_cmd checks reset_ongoing before actually issuing the control
+queue operation. If a reset is in progress, it returns a soft error code
+(ICE_ERR_RESET_PENDING) to the caller. The caller may or may not have to
+take any action based on this return. Once the driver knows that the
+reset is done, it has to set reset_ongoing back to 0. This will allow
+control queue operations to be posted to the hardware again.
+
+This "bail out" logic was specifically added to ice_sq_send_cmd (which
+is pretty low level function) so that we have one solution in one place
+that applies to all types of control queues.
+
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_controlq.c | 3 ++
+ drivers/net/ethernet/intel/ice/ice_main.c | 34 ++++++++++++++++---
+ drivers/net/ethernet/intel/ice/ice_status.h | 1 +
+ drivers/net/ethernet/intel/ice/ice_type.h | 1 +
+ 4 files changed, 34 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index e783976c401d8..89f18fe18fe36 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -814,6 +814,9 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,
+ u16 retval = 0;
+ u32 val = 0;
+
++ /* if reset is in progress return a soft error */
++ if (hw->reset_ongoing)
++ return ICE_ERR_RESET_ONGOING;
+ mutex_lock(&cq->sq_lock);
+
+ cq->sq_last_status = ICE_AQ_RC_OK;
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 875f97aba6e0d..e1f95e7a51393 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -535,10 +535,13 @@ static void ice_reset_subtask(struct ice_pf *pf)
+ ice_prepare_for_reset(pf);
+
+ /* make sure we are ready to rebuild */
+- if (ice_check_reset(&pf->hw))
++ if (ice_check_reset(&pf->hw)) {
+ set_bit(__ICE_RESET_FAILED, pf->state);
+- else
++ } else {
++ /* done with reset. start rebuild */
++ pf->hw.reset_ongoing = false;
+ ice_rebuild(pf);
++ }
+ clear_bit(__ICE_RESET_RECOVERY_PENDING, pf->state);
+ goto unlock;
+ }
+@@ -1757,7 +1760,8 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+ * We also make note of which reset happened so that peer
+ * devices/drivers can be informed.
+ */
+- if (!test_bit(__ICE_RESET_RECOVERY_PENDING, pf->state)) {
++ if (!test_and_set_bit(__ICE_RESET_RECOVERY_PENDING,
++ pf->state)) {
+ if (reset == ICE_RESET_CORER)
+ set_bit(__ICE_CORER_RECV, pf->state);
+ else if (reset == ICE_RESET_GLOBR)
+@@ -1765,7 +1769,20 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+ else
+ set_bit(__ICE_EMPR_RECV, pf->state);
+
+- set_bit(__ICE_RESET_RECOVERY_PENDING, pf->state);
++ /* There are couple of different bits at play here.
++ * hw->reset_ongoing indicates whether the hardware is
++ * in reset. This is set to true when a reset interrupt
++ * is received and set back to false after the driver
++ * has determined that the hardware is out of reset.
++ *
++ * __ICE_RESET_RECOVERY_PENDING in pf->state indicates
++ * that a post reset rebuild is required before the
++ * driver is operational again. This is set above.
++ *
++ * As this is the start of the reset/rebuild cycle, set
++ * both to indicate that.
++ */
++ hw->reset_ongoing = true;
+ }
+ }
+
+@@ -4188,7 +4205,14 @@ static int ice_vsi_stop_tx_rings(struct ice_vsi *vsi)
+ }
+ status = ice_dis_vsi_txq(vsi->port_info, vsi->num_txq, q_ids, q_teids,
+ NULL);
+- if (status) {
++ /* if the disable queue command was exercised during an active reset
++ * flow, ICE_ERR_RESET_ONGOING is returned. This is not an error as
++ * the reset operation disables queues at the hardware level anyway.
++ */
++ if (status == ICE_ERR_RESET_ONGOING) {
++ dev_dbg(&pf->pdev->dev,
++ "Reset in progress. LAN Tx queues already disabled\n");
++ } else if (status) {
+ dev_err(&pf->pdev->dev,
+ "Failed to disable LAN Tx queues, error: %d\n",
+ status);
+diff --git a/drivers/net/ethernet/intel/ice/ice_status.h b/drivers/net/ethernet/intel/ice/ice_status.h
+index 9a95c4ffd7d79..d2dae913d81e0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_status.h
++++ b/drivers/net/ethernet/intel/ice/ice_status.h
+@@ -20,6 +20,7 @@ enum ice_status {
+ ICE_ERR_ALREADY_EXISTS = -14,
+ ICE_ERR_DOES_NOT_EXIST = -15,
+ ICE_ERR_MAX_LIMIT = -17,
++ ICE_ERR_RESET_ONGOING = -18,
+ ICE_ERR_BUF_TOO_SHORT = -52,
+ ICE_ERR_NVM_BLANK_MODE = -53,
+ ICE_ERR_AQ_ERROR = -100,
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index a509fe5f1e543..5ca9d684429d1 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -293,6 +293,7 @@ struct ice_hw {
+ u8 sw_entry_point_layer;
+
+ u8 evb_veb; /* true for VEB, false for VEPA */
++ u8 reset_ongoing; /* true if hw is in reset, false otherwise */
+ struct ice_bus_info bus;
+ struct ice_nvm_info nvm;
+ struct ice_hw_dev_caps dev_caps; /* device capabilities */
+--
+2.20.1
+
--- /dev/null
+From 55e690a55350c775872833bc48fdb932838e1955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Aug 2018 06:29:46 -0700
+Subject: ice: Update request resource command to latest specification
+
+From: Dan Nowlin <dan.nowlin@intel.com>
+
+[ Upstream commit ff2b13213a6a0baca105bc3bc724225f0adde1f8 ]
+
+Align Request Resource Ownership AQ command (0x0008) to the latest
+specification. This includes:
+
+- Correcting the resource IDs for the Global Cfg and Change locks.
+- new enum ICE_CHANGE_LOCK_RES_ID
+- new enum ICE_GLOBAL_CFG_LOCK_RES_ID
+- Altering the flow for Global Config Lock to allow only the first PF to
+ download the package.
+
+Signed-off-by: Dan Nowlin <dan.nowlin@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_common.c | 75 ++++++++++++++++-----
+ drivers/net/ethernet/intel/ice/ice_common.h | 2 +-
+ drivers/net/ethernet/intel/ice/ice_nvm.c | 2 +-
+ drivers/net/ethernet/intel/ice/ice_type.h | 9 ++-
+ 4 files changed, 67 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
+index 661beea6af795..f8d00263d9019 100644
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -904,7 +904,22 @@ enum ice_status ice_aq_q_shutdown(struct ice_hw *hw, bool unloading)
+ * @timeout: the maximum time in ms that the driver may hold the resource
+ * @cd: pointer to command details structure or NULL
+ *
+- * requests common resource using the admin queue commands (0x0008)
++ * Requests common resource using the admin queue commands (0x0008).
++ * When attempting to acquire the Global Config Lock, the driver can
++ * learn of three states:
++ * 1) ICE_SUCCESS - acquired lock, and can perform download package
++ * 2) ICE_ERR_AQ_ERROR - did not get lock, driver should fail to load
++ * 3) ICE_ERR_AQ_NO_WORK - did not get lock, but another driver has
++ * successfully downloaded the package; the driver does
++ * not have to download the package and can continue
++ * loading
++ *
++ * Note that if the caller is in an acquire lock, perform action, release lock
++ * phase of operation, it is possible that the FW may detect a timeout and issue
++ * a CORER. In this case, the driver will receive a CORER interrupt and will
++ * have to determine its cause. The calling thread that is handling this flow
++ * will likely get an error propagated back to it indicating the Download
++ * Package, Update Package or the Release Resource AQ commands timed out.
+ */
+ static enum ice_status
+ ice_aq_req_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+@@ -922,13 +937,43 @@ ice_aq_req_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+ cmd_resp->res_id = cpu_to_le16(res);
+ cmd_resp->access_type = cpu_to_le16(access);
+ cmd_resp->res_number = cpu_to_le32(sdp_number);
++ cmd_resp->timeout = cpu_to_le32(*timeout);
++ *timeout = 0;
+
+ status = ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
++
+ /* The completion specifies the maximum time in ms that the driver
+ * may hold the resource in the Timeout field.
+- * If the resource is held by someone else, the command completes with
+- * busy return value and the timeout field indicates the maximum time
+- * the current owner of the resource has to free it.
++ */
++
++ /* Global config lock response utilizes an additional status field.
++ *
++ * If the Global config lock resource is held by some other driver, the
++ * command completes with ICE_AQ_RES_GLBL_IN_PROG in the status field
++ * and the timeout field indicates the maximum time the current owner
++ * of the resource has to free it.
++ */
++ if (res == ICE_GLOBAL_CFG_LOCK_RES_ID) {
++ if (le16_to_cpu(cmd_resp->status) == ICE_AQ_RES_GLBL_SUCCESS) {
++ *timeout = le32_to_cpu(cmd_resp->timeout);
++ return 0;
++ } else if (le16_to_cpu(cmd_resp->status) ==
++ ICE_AQ_RES_GLBL_IN_PROG) {
++ *timeout = le32_to_cpu(cmd_resp->timeout);
++ return ICE_ERR_AQ_ERROR;
++ } else if (le16_to_cpu(cmd_resp->status) ==
++ ICE_AQ_RES_GLBL_DONE) {
++ return ICE_ERR_AQ_NO_WORK;
++ }
++
++ /* invalid FW response, force a timeout immediately */
++ *timeout = 0;
++ return ICE_ERR_AQ_ERROR;
++ }
++
++ /* If the resource is held by some other driver, the command completes
++ * with a busy return value and the timeout field indicates the maximum
++ * time the current owner of the resource has to free it.
+ */
+ if (!status || hw->adminq.sq_last_status == ICE_AQ_RC_EBUSY)
+ *timeout = le32_to_cpu(cmd_resp->timeout);
+@@ -967,30 +1012,28 @@ ice_aq_release_res(struct ice_hw *hw, enum ice_aq_res_ids res, u8 sdp_number,
+ * @hw: pointer to the HW structure
+ * @res: resource id
+ * @access: access type (read or write)
++ * @timeout: timeout in milliseconds
+ *
+ * This function will attempt to acquire the ownership of a resource.
+ */
+ enum ice_status
+ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+- enum ice_aq_res_access_type access)
++ enum ice_aq_res_access_type access, u32 timeout)
+ {
+ #define ICE_RES_POLLING_DELAY_MS 10
+ u32 delay = ICE_RES_POLLING_DELAY_MS;
++ u32 time_left = timeout;
+ enum ice_status status;
+- u32 time_left = 0;
+- u32 timeout;
+
+ status = ice_aq_req_res(hw, res, access, 0, &time_left, NULL);
+
+- /* An admin queue return code of ICE_AQ_RC_EEXIST means that another
+- * driver has previously acquired the resource and performed any
+- * necessary updates; in this case the caller does not obtain the
+- * resource and has no further work to do.
++ /* A return code of ICE_ERR_AQ_NO_WORK means that another driver has
++ * previously acquired the resource and performed any necessary updates;
++ * in this case the caller does not obtain the resource and has no
++ * further work to do.
+ */
+- if (hw->adminq.sq_last_status == ICE_AQ_RC_EEXIST) {
+- status = ICE_ERR_AQ_NO_WORK;
++ if (status == ICE_ERR_AQ_NO_WORK)
+ goto ice_acquire_res_exit;
+- }
+
+ if (status)
+ ice_debug(hw, ICE_DBG_RES,
+@@ -1003,11 +1046,9 @@ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+ timeout = (timeout > delay) ? timeout - delay : 0;
+ status = ice_aq_req_res(hw, res, access, 0, &time_left, NULL);
+
+- if (hw->adminq.sq_last_status == ICE_AQ_RC_EEXIST) {
++ if (status == ICE_ERR_AQ_NO_WORK)
+ /* lock free, but no work to do */
+- status = ICE_ERR_AQ_NO_WORK;
+ break;
+- }
+
+ if (!status)
+ /* lock acquired */
+diff --git a/drivers/net/ethernet/intel/ice/ice_common.h b/drivers/net/ethernet/intel/ice/ice_common.h
+index 9a5519130af13..6455b6952ec8e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_common.h
++++ b/drivers/net/ethernet/intel/ice/ice_common.h
+@@ -23,7 +23,7 @@ enum ice_status
+ ice_get_link_status(struct ice_port_info *pi, bool *link_up);
+ enum ice_status
+ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+- enum ice_aq_res_access_type access);
++ enum ice_aq_res_access_type access, u32 timeout);
+ void ice_release_res(struct ice_hw *hw, enum ice_aq_res_ids res);
+ enum ice_status ice_init_nvm(struct ice_hw *hw);
+ enum ice_status
+diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.c b/drivers/net/ethernet/intel/ice/ice_nvm.c
+index 295a8cd87fc16..3274c543283c6 100644
+--- a/drivers/net/ethernet/intel/ice/ice_nvm.c
++++ b/drivers/net/ethernet/intel/ice/ice_nvm.c
+@@ -137,7 +137,7 @@ ice_acquire_nvm(struct ice_hw *hw, enum ice_aq_res_access_type access)
+ if (hw->nvm.blank_nvm_mode)
+ return 0;
+
+- return ice_acquire_res(hw, ICE_NVM_RES_ID, access);
++ return ice_acquire_res(hw, ICE_NVM_RES_ID, access, ICE_NVM_TIMEOUT);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index ba11b58988331..a509fe5f1e543 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -34,10 +34,15 @@ static inline bool ice_is_tc_ena(u8 bitmap, u8 tc)
+ enum ice_aq_res_ids {
+ ICE_NVM_RES_ID = 1,
+ ICE_SPD_RES_ID,
+- ICE_GLOBAL_CFG_LOCK_RES_ID,
+- ICE_CHANGE_LOCK_RES_ID
++ ICE_CHANGE_LOCK_RES_ID,
++ ICE_GLOBAL_CFG_LOCK_RES_ID
+ };
+
++/* FW update timeout definitions are in milliseconds */
++#define ICE_NVM_TIMEOUT 180000
++#define ICE_CHANGE_LOCK_TIMEOUT 1000
++#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000
++
+ enum ice_aq_res_access_type {
+ ICE_RES_READ = 1,
+ ICE_RES_WRITE
+--
+2.20.1
+
--- /dev/null
+From a3a3442420306fef902a9aeea899fc627dc9b2c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Aug 2018 11:12:19 +0200
+Subject: iio: adc: max9611: explicitly cast gain_selectors
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit b1ec0802503820ccbc894aadfd2a44da20232f5e ]
+
+After finding a reasonable gain, the function converts the configured
+gain to a gain configuration option selector enum max9611_csa_gain.
+Make the conversion clearly visible by using an explicit cast. This
+also avoids a warning seen with clang:
+ drivers/iio/adc/max9611.c:292:16: warning: implicit conversion from
+ enumeration type 'enum max9611_conf_ids' to different enumeration
+ type 'enum max9611_csa_gain' [-Wenum-conversion]
+ *csa_gain = gain_selectors[i];
+ ~ ^~~~~~~~~~~~~~~~~
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/max9611.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index 49c1956e6a674..0884435eec68d 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -289,7 +289,7 @@ static int max9611_read_csa_voltage(struct max9611_dev *max9611,
+ return ret;
+
+ if (*adc_raw > 0) {
+- *csa_gain = gain_selectors[i];
++ *csa_gain = (enum max9611_csa_gain)gain_selectors[i];
+ return 0;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From adaa56996b598b3553b4f06958352638ecd10f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 22:24:40 +0200
+Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ]
+
+Do not try to write negative values and make sure that the write goes well.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/mcp4922.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c
+index bf9aa3fc0534e..b5190d1dae8e3 100644
+--- a/drivers/iio/dac/mcp4922.c
++++ b/drivers/iio/dac/mcp4922.c
+@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev,
+ long mask)
+ {
+ struct mcp4922_state *state = iio_priv(indio_dev);
++ int ret;
+
+ if (val2 != 0)
+ return -EINVAL;
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val > GENMASK(chan->scan_type.realbits-1, 0))
++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0))
+ return -EINVAL;
+ val <<= chan->scan_type.shift;
+- state->value[chan->channel] = val;
+- return mcp4922_spi_write(state, chan->channel, val);
++
++ ret = mcp4922_spi_write(state, chan->channel, val);
++ if (!ret)
++ state->value[chan->channel] = val;
++ return ret;
++
+ default:
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1f63cfeb72e5158768de1f70b046e5803a3d5437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 12:26:47 +0800
+Subject: ip_gre: fix parsing gre header in ipgre_err
+
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+
+[ Upstream commit b0350d51f001e6edc13ee4f253b98b50b05dd401 ]
+
+gre_parse_header stops parsing when csum_err is encountered, which means
+tpi->key is undefined and ip_tunnel_lookup will return NULL improperly.
+
+This patch introduce a NULL pointer as csum_err parameter. Even when
+csum_err is encountered, it won't return error and continue parsing gre
+header as expected.
+
+Fixes: 9f57c67c379d ("gre: Remove support for sharing GRE protocol hook.")
+Reported-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/gre_demux.c | 7 ++++---
+ net/ipv4/ip_gre.c | 9 +++------
+ 2 files changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index f21ea6125fc2d..511b32ea25331 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -87,13 +87,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+
+ options = (__be32 *)(greh + 1);
+ if (greh->flags & GRE_CSUM) {
+- if (skb_checksum_simple_validate(skb)) {
++ if (!skb_checksum_simple_validate(skb)) {
++ skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
++ null_compute_pseudo);
++ } else if (csum_err) {
+ *csum_err = true;
+ return -EINVAL;
+ }
+
+- skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+- null_compute_pseudo);
+ options++;
+ }
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 758a0f86d499f..681276111310b 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -232,13 +232,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
+ const int type = icmp_hdr(skb)->type;
+ const int code = icmp_hdr(skb)->code;
+ struct tnl_ptk_info tpi;
+- bool csum_err = false;
+
+- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+- iph->ihl * 4) < 0) {
+- if (!csum_err) /* ignore csum errors. */
+- return;
+- }
++ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
++ iph->ihl * 4) < 0)
++ return;
+
+ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+--
+2.20.1
+
--- /dev/null
+From 1dde09cec43aa71e0c30c6a3adc94b67118e397c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jun 2018 15:32:48 -0500
+Subject: ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 1574608f5f4204440d6d9f52b971aba967664764 ]
+
+Looking at logs from systems all over the place, it looks like tons
+of broken systems exist that set the base address to zero. I can
+only guess that is some sort of non-standard idea to mark the
+interface as not being present. It can't be zero, anyway, so just
+complain and ignore it.
+
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_dmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
+index e2c143861b1e5..28dbd5529188a 100644
+--- a/drivers/char/ipmi/ipmi_dmi.c
++++ b/drivers/char/ipmi/ipmi_dmi.c
+@@ -217,6 +217,10 @@ static void __init dmi_decode_ipmi(const struct dmi_header *dm)
+ slave_addr = data[DMI_IPMI_SLAVEADDR];
+
+ memcpy(&base_addr, data + DMI_IPMI_ADDR, sizeof(unsigned long));
++ if (!base_addr) {
++ pr_err("Base address is zero, assuming no IPMI interface\n");
++ return;
++ }
+ if (len >= DMI_IPMI_VER2_LENGTH) {
+ if (type == IPMI_DMI_TYPE_SSIF) {
+ offset = 0;
+--
+2.20.1
+
--- /dev/null
+From cbdc2a0143f6f1313748dd2954ad8e16d3d5d83b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 07:07:36 +0000
+Subject: ipmi: fix return value of ipmi_set_my_LUN
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 060e8fb53fe3455568982d10ab8c3dd605565049 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/char/ipmi/ipmi_msghandler.c: In function 'ipmi_set_my_LUN':
+drivers/char/ipmi/ipmi_msghandler.c:1335:13: warning:
+ variable 'rv' set but not used [-Wunused-but-set-variable]
+ int index, rv = 0;
+
+'rv' should be the correct return value.
+
+Fixes: 048f7c3e352e ("ipmi: Properly release srcu locks on error conditions")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 3fb297b5fb176..84c17f936c09c 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -1365,7 +1365,7 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
+ }
+ release_ipmi_user(user, index);
+
+- return 0;
++ return rv;
+ }
+ EXPORT_SYMBOL(ipmi_set_my_LUN);
+
+--
+2.20.1
+
--- /dev/null
+From 7c75a4af01b6723ef67421e5637163588b79bee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jun 2018 17:51:07 +0100
+Subject: ipmi_si: fix potential integer overflow on large shift
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 97a103e6b584442cd848887ed8d47be2410b7e09 ]
+
+Shifting unsigned char b by an int type can lead to sign-extension
+overflow. For example, if b is 0xff and the shift is 24, then top
+bit is sign-extended so the final value passed to writeq has all
+the upper 32 bits set. Fix this by casting b to a 64 bit unsigned
+before the shift.
+
+Detected by CoverityScan, CID#1465246 ("Unintended sign extension")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_si_mem_io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c
+index 638f4ab88f445..75583612ab105 100644
+--- a/drivers/char/ipmi/ipmi_si_mem_io.c
++++ b/drivers/char/ipmi/ipmi_si_mem_io.c
+@@ -51,7 +51,7 @@ static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset)
+ static void mem_outq(const struct si_sm_io *io, unsigned int offset,
+ unsigned char b)
+ {
+- writeq(b << io->regshift, (io->addr)+(offset * io->regspacing));
++ writeq((u64)b << io->regshift, (io->addr)+(offset * io->regspacing));
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From fb0282b74bfd6f9c13e178018400f3f92ec830e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jun 2018 16:11:26 +0300
+Subject: ipmi_si_pci: fix NULL device in ipmi_si error message
+
+From: Meelis Roos <mroos@linux.ee>
+
+[ Upstream commit 01508d9ebf4fc863f2fc4561c390bf4b7c3301a6 ]
+
+I noticed that 4.17.0 logs the follwing during ipmi_si setup:
+
+ ipmi_si 0000:01:04.6: probing via PCI
+ (NULL device *): Could not setup I/O space
+ ipmi_si 0000:01:04.6: [mem 0xf5ef0000-0xf5ef00ff] regsize 1 spacing 1 irq 21
+
+Fix the "NULL device *) by moving io.dev assignment before its potential
+use by ipmi_pci_probe_regspacing().
+
+Result:
+ ipmi_si 0000:01:04.6: probing via PCI
+ ipmi_si 0000:01:04.6: Could not setup I/O space
+ ipmi_si 0000:01:04.6: [mem 0xf5ef0000-0xf5ef00ff] regsize 1 spacing 1 irq 21
+
+Signed-off-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_si_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
+index f54ca6869ed2c..022e03634ce2a 100644
+--- a/drivers/char/ipmi/ipmi_si_pci.c
++++ b/drivers/char/ipmi/ipmi_si_pci.c
+@@ -120,6 +120,8 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
+ }
+ io.addr_data = pci_resource_start(pdev, 0);
+
++ io.dev = &pdev->dev;
++
+ io.regspacing = ipmi_pci_probe_regspacing(&io);
+ io.regsize = DEFAULT_REGSIZE;
+ io.regshift = 0;
+@@ -128,8 +130,6 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
+ if (io.irq)
+ io.irq_setup = ipmi_std_irq_setup;
+
+- io.dev = &pdev->dev;
+-
+ dev_info(&pdev->dev, "%pR regsize %d spacing %d irq %d\n",
+ &pdev->resource[0], io.regsize, io.regspacing, io.irq);
+
+--
+2.20.1
+
--- /dev/null
+From 6f4f60565c3b2e3f46a79b68330459ae29fb90de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Sep 2018 12:29:03 -0700
+Subject: iw_cxgb4: Use proper enumerated type in c4iw_bar2_addrs
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 1b571086e869395b6a11ab24186b0104fe05c057 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/infiniband/hw/cxgb4/qp.c:287:8: warning: implicit conversion
+from enumeration type 'enum t4_bar2_qtype' to different enumeration type
+'enum cxgb4_bar2_qtype' [-Wenum-conversion]
+ T4_BAR2_QTYPE_EGRESS,
+ ^~~~~~~~~~~~~~~~~~~~
+
+c4iw_bar2_addrs expects a value from enum cxgb4_bar2_qtype so use the
+corresponding values from that type so Clang is satisfied without changing
+the meaning of the code.
+
+T4_BAR2_QTYPE_EGRESS = CXGB4_BAR2_QTYPE_EGRESS = 0
+T4_BAR2_QTYPE_INGRESS = CXGB4_BAR2_QTYPE_INGRESS = 1
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 2 +-
+ drivers/infiniband/hw/cxgb4/qp.c | 7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 6d30427940942..1fd8798d91a73 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -161,7 +161,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+ cq->gts = rdev->lldi.gts_reg;
+ cq->rdev = rdev;
+
+- cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS,
++ cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, CXGB4_BAR2_QTYPE_INGRESS,
+ &cq->bar2_qid,
+ user ? &cq->bar2_pa : NULL);
+ if (user && !cq->bar2_pa) {
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index 347fe18b1a41c..a9e3a11bea54a 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -279,12 +279,13 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+
+ wq->db = rdev->lldi.db_reg;
+
+- wq->sq.bar2_va = c4iw_bar2_addrs(rdev, wq->sq.qid, T4_BAR2_QTYPE_EGRESS,
++ wq->sq.bar2_va = c4iw_bar2_addrs(rdev, wq->sq.qid,
++ CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->sq.bar2_qid,
+ user ? &wq->sq.bar2_pa : NULL);
+ if (need_rq)
+ wq->rq.bar2_va = c4iw_bar2_addrs(rdev, wq->rq.qid,
+- T4_BAR2_QTYPE_EGRESS,
++ CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->rq.bar2_qid,
+ user ? &wq->rq.bar2_pa : NULL);
+
+@@ -2572,7 +2573,7 @@ static int alloc_srq_queue(struct c4iw_srq *srq, struct c4iw_dev_ucontext *uctx,
+ memset(wq->queue, 0, wq->memsize);
+ pci_unmap_addr_set(wq, mapping, wq->dma_addr);
+
+- wq->bar2_va = c4iw_bar2_addrs(rdev, wq->qid, T4_BAR2_QTYPE_EGRESS,
++ wq->bar2_va = c4iw_bar2_addrs(rdev, wq->qid, CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->bar2_qid,
+ user ? &wq->bar2_pa : NULL);
+
+--
+2.20.1
+
--- /dev/null
+From 0e93f24ab2882c52daf8145b1b69c3f0fb17d6b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 May 2018 14:13:18 +0200
+Subject: iwlwifi: api: annotate compressed BA notif array sizes
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6f68cc367ab6578a33cca21b6056804165621f00 ]
+
+Annotate the compressed BA notification array sizes and
+make both of them 0-length since the length of 1 is just
+confusing - it may be different than that and the offset
+to the second one needs to be calculated in the C code
+anyhow.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+index 514b86123d3d3..80853f6cbd6d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+@@ -747,9 +747,9 @@ enum iwl_mvm_ba_resp_flags {
+ * @tfd_cnt: number of TFD-Q elements
+ * @ra_tid_cnt: number of RATID-Q elements
+ * @tfd: array of TFD queue status updates. See &iwl_mvm_compressed_ba_tfd
+- * for details.
++ * for details. Length in @tfd_cnt.
+ * @ra_tid: array of RA-TID queue status updates. For debug purposes only. See
+- * &iwl_mvm_compressed_ba_ratid for more details.
++ * &iwl_mvm_compressed_ba_ratid for more details. Length in @ra_tid_cnt.
+ */
+ struct iwl_mvm_compressed_ba_notif {
+ __le32 flags;
+@@ -766,7 +766,7 @@ struct iwl_mvm_compressed_ba_notif {
+ __le32 tx_rate;
+ __le16 tfd_cnt;
+ __le16 ra_tid_cnt;
+- struct iwl_mvm_compressed_ba_tfd tfd[1];
++ struct iwl_mvm_compressed_ba_tfd tfd[0];
+ struct iwl_mvm_compressed_ba_ratid ra_tid[0];
+ } __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
+
+--
+2.20.1
+
--- /dev/null
+From 3e8ed995543000e72a2d82a3d1e1d5e3729392db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 10:04:16 +0300
+Subject: iwlwifi: dbg: don't crash if the firmware crashes in the middle of a
+ debug dump
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 79f25b10c9da3dbc953e47033d0494e51580ac3b ]
+
+We can dump data from the firmware either when it crashes,
+or when the firmware is alive.
+Not all the data is available if the firmware is running
+(like the Tx / Rx FIFOs which are available only when the
+firmware is halted), so we first check that the firmware
+is alive to compute the required size for the dump and then
+fill the buffer with the data.
+
+When we allocate the buffer, we test the STATUS_FW_ERROR
+bit to check if the firmware is alive or not. This bit
+can be changed during the course of the dump since it is
+modified in the interrupt handler.
+
+We hit a case where we allocate the buffer while the
+firmware is sill working, and while we start to fill the
+buffer, the firmware crashes. Then we test STATUS_FW_ERROR
+again and decide to fill the buffer with data like the
+FIFOs even if no room was allocated for this data in the
+buffer. This means that we overflow the buffer that was
+allocated leading to memory corruption.
+
+To fix this, test the STATUS_FW_ERROR bit only once and
+rely on local variables to check if we should dump fifos
+or other firmware components.
+
+Fixes: 04fd2c28226f ("iwlwifi: mvm: add rxf and txf to dump data")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 8070b2d4c46fe..3443cbdbab4ae 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -824,7 +824,7 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
+ }
+
+ /* We only dump the FIFOs if the FW is in error state */
+- if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status)) {
++ if (fifo_data_len) {
+ iwl_fw_dump_fifos(fwrt, &dump_data);
+ if (radio_len)
+ iwl_read_radio_regs(fwrt, &dump_data);
+--
+2.20.1
+
--- /dev/null
+From 241d07e6947945e20580799db0ebfa21ac4988ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Apr 2018 10:57:08 +0200
+Subject: iwlwifi: don't WARN on trying to dump dead firmware
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 84f260251ed8153e84c64eb2c5278ab18d3ddef6 ]
+
+There's no point in warning here, the user will just get an
+error back to the debugfs file write, and warning just makes
+it seem like there's an internal consistency problem when in
+reality the user just happened to hit this at a bad time.
+Remove the warning.
+
+Fixes: f45f979dc208 ("iwlwifi: mvm: disable dbg data collect when fw isn't alive")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index a31a42e673c46..8070b2d4c46fe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -1016,7 +1016,7 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * If the loading of the FW completed successfully, the next step is to
+ * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
+ * zero, the FW was already loaded successully. If the state is "NO_FW"
+- * in such a case - WARN and exit, since FW may be dead. Otherwise, we
++ * in such a case - exit, since FW may be dead. Otherwise, we
+ * can try to collect the data, since FW might just not be fully
+ * loaded (no "ALIVE" yet), and the debug data is accessible.
+ *
+@@ -1024,9 +1024,8 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * config. In such a case, due to HW access problems, we might
+ * collect garbage.
+ */
+- if (WARN((fwrt->trans->state == IWL_TRANS_NO_FW) &&
+- fwrt->smem_cfg.num_lmacs,
+- "Can't collect dbg data when FW isn't alive\n"))
++ if (fwrt->trans->state == IWL_TRANS_NO_FW &&
++ fwrt->smem_cfg.num_lmacs)
+ return -EIO;
+
+ if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
+--
+2.20.1
+
--- /dev/null
+From e45ad6e10e00d9fa81600aff6824dc674abaa3cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Apr 2018 14:00:27 +0300
+Subject: iwlwifi: drop packets with bad status in CD
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 7891965d74bc48fb42b5068033192f97c9aa2090 ]
+
+We need to drop packets with errors (such as replay,
+MIC, ICV, conversion, duplicate and so on).
+
+Drop invalid packets, put the status bits in the metadata and
+move the enum definition to the correct place (FW API header).
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/fw/api/rx.h | 63 +++++++++++++++++++
+ .../net/wireless/intel/iwlwifi/iwl-trans.h | 1 +
+ .../wireless/intel/iwlwifi/pcie/internal.h | 60 ------------------
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 8 ++-
+ 4 files changed, 70 insertions(+), 62 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
+index 2f599353c8856..2ba1401e5c0d5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
+@@ -574,6 +574,69 @@ struct iwl_rx_mpdu_desc {
+
+ #define IWL_RX_DESC_SIZE_V1 offsetofend(struct iwl_rx_mpdu_desc, v1)
+
++#define IWL_CD_STTS_OPTIMIZED_POS 0
++#define IWL_CD_STTS_OPTIMIZED_MSK 0x01
++#define IWL_CD_STTS_TRANSFER_STATUS_POS 1
++#define IWL_CD_STTS_TRANSFER_STATUS_MSK 0x0E
++#define IWL_CD_STTS_WIFI_STATUS_POS 4
++#define IWL_CD_STTS_WIFI_STATUS_MSK 0xF0
++
++/**
++ * enum iwl_completion_desc_transfer_status - transfer status (bits 1-3)
++ * @IWL_CD_STTS_UNUSED: unused
++ * @IWL_CD_STTS_UNUSED_2: unused
++ * @IWL_CD_STTS_END_TRANSFER: successful transfer complete.
++ * In sniffer mode, when split is used, set in last CD completion. (RX)
++ * @IWL_CD_STTS_OVERFLOW: In sniffer mode, when using split - used for
++ * all CD completion. (RX)
++ * @IWL_CD_STTS_ABORTED: CR abort / close flow. (RX)
++ * @IWL_CD_STTS_ERROR: general error (RX)
++ */
++enum iwl_completion_desc_transfer_status {
++ IWL_CD_STTS_UNUSED,
++ IWL_CD_STTS_UNUSED_2,
++ IWL_CD_STTS_END_TRANSFER,
++ IWL_CD_STTS_OVERFLOW,
++ IWL_CD_STTS_ABORTED,
++ IWL_CD_STTS_ERROR,
++};
++
++/**
++ * enum iwl_completion_desc_wifi_status - wifi status (bits 4-7)
++ * @IWL_CD_STTS_VALID: the packet is valid (RX)
++ * @IWL_CD_STTS_FCS_ERR: frame check sequence error (RX)
++ * @IWL_CD_STTS_SEC_KEY_ERR: error handling the security key of rx (RX)
++ * @IWL_CD_STTS_DECRYPTION_ERR: error decrypting the frame (RX)
++ * @IWL_CD_STTS_DUP: duplicate packet (RX)
++ * @IWL_CD_STTS_ICV_MIC_ERR: MIC error (RX)
++ * @IWL_CD_STTS_INTERNAL_SNAP_ERR: problems removing the snap (RX)
++ * @IWL_CD_STTS_SEC_PORT_FAIL: security port fail (RX)
++ * @IWL_CD_STTS_BA_OLD_SN: block ack received old SN (RX)
++ * @IWL_CD_STTS_QOS_NULL: QoS null packet (RX)
++ * @IWL_CD_STTS_MAC_HDR_ERR: MAC header conversion error (RX)
++ * @IWL_CD_STTS_MAX_RETRANS: reached max number of retransmissions (TX)
++ * @IWL_CD_STTS_EX_LIFETIME: exceeded lifetime (TX)
++ * @IWL_CD_STTS_NOT_USED: completed but not used (RX)
++ * @IWL_CD_STTS_REPLAY_ERR: pn check failed, replay error (RX)
++ */
++enum iwl_completion_desc_wifi_status {
++ IWL_CD_STTS_VALID,
++ IWL_CD_STTS_FCS_ERR,
++ IWL_CD_STTS_SEC_KEY_ERR,
++ IWL_CD_STTS_DECRYPTION_ERR,
++ IWL_CD_STTS_DUP,
++ IWL_CD_STTS_ICV_MIC_ERR,
++ IWL_CD_STTS_INTERNAL_SNAP_ERR,
++ IWL_CD_STTS_SEC_PORT_FAIL,
++ IWL_CD_STTS_BA_OLD_SN,
++ IWL_CD_STTS_QOS_NULL,
++ IWL_CD_STTS_MAC_HDR_ERR,
++ IWL_CD_STTS_MAX_RETRANS,
++ IWL_CD_STTS_EX_LIFETIME,
++ IWL_CD_STTS_NOT_USED,
++ IWL_CD_STTS_REPLAY_ERR,
++};
++
+ struct iwl_frame_release {
+ u8 baid;
+ u8 reserved;
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index 279dd7b7a3fb9..0b8cf7f3af933 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -269,6 +269,7 @@ struct iwl_rx_cmd_buffer {
+ bool _page_stolen;
+ u32 _rx_page_order;
+ unsigned int truesize;
++ u8 status;
+ };
+
+ static inline void *rxb_addr(struct iwl_rx_cmd_buffer *r)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index 00f9566bcc213..e9d67ba3e56dd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -102,66 +102,6 @@ struct isr_statistics {
+ u32 unhandled;
+ };
+
+-#define IWL_CD_STTS_OPTIMIZED_POS 0
+-#define IWL_CD_STTS_OPTIMIZED_MSK 0x01
+-#define IWL_CD_STTS_TRANSFER_STATUS_POS 1
+-#define IWL_CD_STTS_TRANSFER_STATUS_MSK 0x0E
+-#define IWL_CD_STTS_WIFI_STATUS_POS 4
+-#define IWL_CD_STTS_WIFI_STATUS_MSK 0xF0
+-
+-/**
+- * enum iwl_completion_desc_transfer_status - transfer status (bits 1-3)
+- * @IWL_CD_STTS_END_TRANSFER: successful transfer complete.
+- * In sniffer mode, when split is used, set in last CD completion. (RX)
+- * @IWL_CD_STTS_OVERFLOW: In sniffer mode, when using split - used for
+- * all CD completion. (RX)
+- * @IWL_CD_STTS_ABORTED: CR abort / close flow. (RX)
+- */
+-enum iwl_completion_desc_transfer_status {
+- IWL_CD_STTS_UNUSED,
+- IWL_CD_STTS_UNUSED_2,
+- IWL_CD_STTS_END_TRANSFER,
+- IWL_CD_STTS_OVERFLOW,
+- IWL_CD_STTS_ABORTED,
+- IWL_CD_STTS_ERROR,
+-};
+-
+-/**
+- * enum iwl_completion_desc_wifi_status - wifi status (bits 4-7)
+- * @IWL_CD_STTS_VALID: the packet is valid (RX)
+- * @IWL_CD_STTS_FCS_ERR: frame check sequence error (RX)
+- * @IWL_CD_STTS_SEC_KEY_ERR: error handling the security key of rx (RX)
+- * @IWL_CD_STTS_DECRYPTION_ERR: error decrypting the frame (RX)
+- * @IWL_CD_STTS_DUP: duplicate packet (RX)
+- * @IWL_CD_STTS_ICV_MIC_ERR: MIC error (RX)
+- * @IWL_CD_STTS_INTERNAL_SNAP_ERR: problems removing the snap (RX)
+- * @IWL_CD_STTS_SEC_PORT_FAIL: security port fail (RX)
+- * @IWL_CD_STTS_BA_OLD_SN: block ack received old SN (RX)
+- * @IWL_CD_STTS_QOS_NULL: QoS null packet (RX)
+- * @IWL_CD_STTS_MAC_HDR_ERR: MAC header conversion error (RX)
+- * @IWL_CD_STTS_MAX_RETRANS: reached max number of retransmissions (TX)
+- * @IWL_CD_STTS_EX_LIFETIME: exceeded lifetime (TX)
+- * @IWL_CD_STTS_NOT_USED: completed but not used (RX)
+- * @IWL_CD_STTS_REPLAY_ERR: pn check failed, replay error (RX)
+- */
+-enum iwl_completion_desc_wifi_status {
+- IWL_CD_STTS_VALID,
+- IWL_CD_STTS_FCS_ERR,
+- IWL_CD_STTS_SEC_KEY_ERR,
+- IWL_CD_STTS_DECRYPTION_ERR,
+- IWL_CD_STTS_DUP,
+- IWL_CD_STTS_ICV_MIC_ERR,
+- IWL_CD_STTS_INTERNAL_SNAP_ERR,
+- IWL_CD_STTS_SEC_PORT_FAIL,
+- IWL_CD_STTS_BA_OLD_SN,
+- IWL_CD_STTS_QOS_NULL,
+- IWL_CD_STTS_MAC_HDR_ERR,
+- IWL_CD_STTS_MAX_RETRANS,
+- IWL_CD_STTS_EX_LIFETIME,
+- IWL_CD_STTS_NOT_USED,
+- IWL_CD_STTS_REPLAY_ERR,
+-};
+-
+ #define IWL_RX_TD_TYPE_MSK 0xff000000
+ #define IWL_RX_TD_SIZE_MSK 0x00ffffff
+ #define IWL_RX_TD_SIZE_2K BIT(11)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 1d144985ea589..80a1a50f5da51 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1198,7 +1198,8 @@ static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
+ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
+ struct iwl_rxq *rxq,
+ struct iwl_rx_mem_buffer *rxb,
+- bool emergency)
++ bool emergency,
++ int i)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct iwl_txq *txq = trans_pcie->txq[trans_pcie->cmd_queue];
+@@ -1224,6 +1225,9 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
+ .truesize = max_len,
+ };
+
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
++ rxcb.status = rxq->cd[i].status;
++
+ pkt = rxb_addr(&rxcb);
+
+ if (pkt->len_n_flags == cpu_to_le32(FH_RSCSR_FRAME_INVALID)) {
+@@ -1430,7 +1434,7 @@ restart:
+ goto out;
+
+ IWL_DEBUG_RX(trans, "Q %d: HW = %d, SW = %d\n", rxq->id, r, i);
+- iwl_pcie_rx_handle_rb(trans, rxq, rxb, emergency);
++ iwl_pcie_rx_handle_rb(trans, rxq, rxb, emergency, i);
+
+ i = (i + 1) & (rxq->queue_size - 1);
+
+--
+2.20.1
+
--- /dev/null
+From b6ea9e8e1d908a7392b2e396ba494839411ee09c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 May 2018 17:15:56 +0300
+Subject: iwlwifi: fix non_shared_ant for 22000 devices
+
+From: Erel Geron <erelx.geron@intel.com>
+
+[ Upstream commit a40287727d9b737e183959fd31a4e0c55f312853 ]
+
+The non-shared antenna was wrong for 22000 device series.
+Fix it to ANT_B for correct antenna preference by coex in MVM driver.
+
+Fixes: e34d975e40ff ("iwlwifi: Add a000 HW family support")
+Signed-off-by: Erel Geron <erelx.geron@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index b4347806a59ed..a0de61aa0feff 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -143,7 +143,7 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
+ .ucode_api_min = IWL_22000_UCODE_API_MIN, \
+ .led_mode = IWL_LED_RF_STATE, \
+ .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_22000, \
+- .non_shared_ant = ANT_A, \
++ .non_shared_ant = ANT_B, \
+ .dccm_offset = IWL_22000_DCCM_OFFSET, \
+ .dccm_len = IWL_22000_DCCM_LEN, \
+ .dccm2_offset = IWL_22000_DCCM2_OFFSET, \
+--
+2.20.1
+
--- /dev/null
+From 6c6d7d33ec42e6b67d4cdce883bcfa42cc91b4e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jun 2018 14:05:11 +0300
+Subject: iwlwifi: mvm: Allow TKIP for AP mode
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 6f3df8c1192c873a6ad9a76328920f6f85af90a8 ]
+
+Support for setting keys for TKIP cipher suite was mistakenly removed
+for AP mode. Fix this.
+
+Fixes: 85aeb58cec1a ("iwlwifi: mvm: Enable security on new TX API")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 18db1ed92d9b0..04ea516bddcc0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -3133,10 +3133,6 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
+
+ switch (keyconf->cipher) {
+ case WLAN_CIPHER_SUITE_TKIP:
+- if (vif->type == NL80211_IFTYPE_AP) {
+- ret = -EINVAL;
+- break;
+- }
+ addr = iwl_mvm_get_mac_addr(mvm, vif, sta);
+ /* get phase 1 key from mac80211 */
+ ieee80211_get_key_rx_seq(keyconf, 0, &seq);
+--
+2.20.1
+
--- /dev/null
+From aa2338ca4b6d9ab95959e0ad2669887a4c41da22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 May 2018 15:12:08 +0300
+Subject: iwlwifi: mvm: avoid sending too many BARs
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 1a19c139be18ed4d6d681049cc48586fae070120 ]
+
+When we receive TX response, we may release a few packets
+due to a hole that was closed in the transmission window.
+
+However, if that frame failed, we will mark all the released
+frames as failed and will send multiple BARs.
+
+This affects statistics badly, and cause unnecessary frames
+transmission.
+
+Instead, mark all the following packets as success, with the
+desired result of sending a bar for the failed frame only.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 5615ce55cef56..cb2e52e7f46c9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1438,6 +1438,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ break;
+ }
+
++ /*
++ * If we are freeing multiple frames, mark all the frames
++ * but the first one as acked, since they were acknowledged
++ * before
++ * */
++ if (skb_freed > 1)
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ iwl_mvm_tx_status_check_trigger(mvm, status);
+
+ info->status.rates[0].count = tx_resp->failure_frame + 1;
+--
+2.20.1
+
--- /dev/null
+From c739c1303282a9cb8beda45bd974a8dadb97b57a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jun 2018 09:19:35 +0300
+Subject: iwlwifi: mvm: use correct FIFO length
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 7126b6f2bbdf8e25f85e7ca6d91d49ea4ce9f6a6 ]
+
+Current FIFO size calculation is wrong for two reasons:
+- We access lmac 0 by default
+- We don't take 11ax into consideration.
+Fix both.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 ++
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 47 +++++++++++++------
+ 2 files changed, 36 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index b3fd20502abb3..d90d58309bf0e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -85,6 +85,10 @@ const u8 iwl_mvm_ac_to_gen2_tx_fifo[] = {
+ IWL_GEN2_EDCA_TX_FIFO_VI,
+ IWL_GEN2_EDCA_TX_FIFO_BE,
+ IWL_GEN2_EDCA_TX_FIFO_BK,
++ IWL_GEN2_TRIG_TX_FIFO_VO,
++ IWL_GEN2_TRIG_TX_FIFO_VI,
++ IWL_GEN2_TRIG_TX_FIFO_BE,
++ IWL_GEN2_TRIG_TX_FIFO_BK,
+ };
+
+ struct iwl_mvm_mac_iface_iterator_data {
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index cb2e52e7f46c9..449e3d32811a6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -778,6 +778,36 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
+ return 0;
+ }
+
++static unsigned int iwl_mvm_max_amsdu_size(struct iwl_mvm *mvm,
++ struct ieee80211_sta *sta,
++ unsigned int tid)
++{
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
++ enum nl80211_band band = mvmsta->vif->bss_conf.chandef.chan->band;
++ u8 ac = tid_to_mac80211_ac[tid];
++ unsigned int txf;
++ int lmac = IWL_LMAC_24G_INDEX;
++
++ if (iwl_mvm_is_cdb_supported(mvm) &&
++ band == NL80211_BAND_5GHZ)
++ lmac = IWL_LMAC_5G_INDEX;
++
++ /* For HE redirect to trigger based fifos */
++ if (sta->he_cap.has_he && !WARN_ON(!iwl_mvm_has_new_tx_api(mvm)))
++ ac += 4;
++
++ txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, ac);
++
++ /*
++ * Don't send an AMSDU that will be longer than the TXF.
++ * Add a security margin of 256 for the TX command + headers.
++ * We also want to have the start of the next packet inside the
++ * fifo to be able to send bursts.
++ */
++ return min_t(unsigned int, mvmsta->max_amsdu_len,
++ mvm->fwrt.smem_cfg.lmac[lmac].txfifo_size[txf] - 256);
++}
++
+ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ struct ieee80211_tx_info *info,
+ struct ieee80211_sta *sta,
+@@ -790,7 +820,7 @@ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ u16 snap_ip_tcp, pad;
+ unsigned int dbg_max_amsdu_len;
+ netdev_features_t netdev_flags = NETIF_F_CSUM_MASK | NETIF_F_SG;
+- u8 tid, txf;
++ u8 tid;
+
+ snap_ip_tcp = 8 + skb_transport_header(skb) - skb_network_header(skb) +
+ tcp_hdrlen(skb);
+@@ -829,20 +859,7 @@ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ !(mvmsta->amsdu_enabled & BIT(tid)))
+ return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
+
+- max_amsdu_len = mvmsta->max_amsdu_len;
+-
+- /* the Tx FIFO to which this A-MSDU will be routed */
+- txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, tid_to_mac80211_ac[tid]);
+-
+- /*
+- * Don't send an AMSDU that will be longer than the TXF.
+- * Add a security margin of 256 for the TX command + headers.
+- * We also want to have the start of the next packet inside the
+- * fifo to be able to send bursts.
+- */
+- max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+- mvm->fwrt.smem_cfg.lmac[0].txfifo_size[txf] -
+- 256);
++ max_amsdu_len = iwl_mvm_max_amsdu_size(mvm, sta, tid);
+
+ if (unlikely(dbg_max_amsdu_len))
+ max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+--
+2.20.1
+
--- /dev/null
+From 0e85362c8adfbb87d44ae9a708d8323f38273028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jun 2018 11:58:13 +0300
+Subject: iwlwifi: pcie: fit reclaim msg to MAX_MSG_LEN
+
+From: Golan Ben Ami <golan.ben.ami@intel.com>
+
+[ Upstream commit 81f0c66187e1ebb7b63529d82faf7ff1e0ef428a ]
+
+Today, the length of a debug message in iwl_trans_pcie_reclaim
+may pass the MAX_MSG_LEN, which is 110.
+An example for this kind of message is:
+
+'iwl_trans_pcie_reclaim: Read index for DMA queue txq id (2),
+last_to_free 65535 is out of range [0-65536] 2 2.'
+
+Cut the message a bit so it will fit the allowed MAX_MSG_LEN.
+
+Signed-off-by: Golan Ben Ami <golan.ben.ami@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 42fdb7970cfdc..2fec394a988c1 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1103,7 +1103,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+
+ if (!iwl_queue_used(txq, last_to_free)) {
+ IWL_ERR(trans,
+- "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
++ "%s: Read index for txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
+ __func__, txq_id, last_to_free,
+ trans->cfg->base_params->max_tfd_queue_size,
+ txq->write_ptr, txq->read_ptr);
+--
+2.20.1
+
--- /dev/null
+From 2c227d8a11f28c42944ea5c6b0c7066b82d7798e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jun 2018 09:45:55 +0200
+Subject: iwlwifi: pcie: gen2: build A-MSDU only for GSO
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 53f474e6a8d74d5dc0c3a015d889471f9a157685 ]
+
+If the incoming frame should be an A-MSDU, it may already be one,
+for example in the case of NAN multicast being encapsulated in an
+A-MSDU. Thus, use the GSO algorithm to build A-MSDU only if the
+skb actually contains GSO data.
+
+Fixes: 6ffe5de35b05 ("iwlwifi: pcie: add AMSDU to gen2")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index b99f33ff91230..61ffa1d1a00d7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -526,7 +526,12 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans,
+
+ hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+- if (amsdu)
++ /*
++ * Only build A-MSDUs here if doing so by GSO, otherwise it may be
++ * an A-MSDU for other reasons, e.g. NAN or an A-MSDU having been
++ * built in the higher layers already.
++ */
++ if (amsdu && skb_shinfo(skb)->gso_size)
+ return iwl_pcie_gen2_build_tx_amsdu(trans, txq, dev_cmd, skb,
+ out_meta, hdr_len, len);
+
+--
+2.20.1
+
--- /dev/null
+From 61aefbdf4ca3f6643eea7860d03897a50980e661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 May 2018 15:19:56 +0300
+Subject: iwlwifi: pcie: read correct prph address for newer devices
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 84fb372c892e231e9a2ffdaa5c2df52d94aa536c ]
+
+For newer devices we have higher range of periphery
+addresses. Currently it is masked out, so we end up
+reading another address.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 7d319b6863feb..954f932e9c88e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1830,18 +1830,30 @@ static u32 iwl_trans_pcie_read32(struct iwl_trans *trans, u32 ofs)
+ return readl(IWL_TRANS_GET_PCIE_TRANS(trans)->hw_base + ofs);
+ }
+
++static u32 iwl_trans_pcie_prph_msk(struct iwl_trans *trans)
++{
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
++ return 0x00FFFFFF;
++ else
++ return 0x000FFFFF;
++}
++
+ static u32 iwl_trans_pcie_read_prph(struct iwl_trans *trans, u32 reg)
+ {
++ u32 mask = iwl_trans_pcie_prph_msk(trans);
++
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_RADDR,
+- ((reg & 0x000FFFFF) | (3 << 24)));
++ ((reg & mask) | (3 << 24)));
+ return iwl_trans_pcie_read32(trans, HBUS_TARG_PRPH_RDAT);
+ }
+
+ static void iwl_trans_pcie_write_prph(struct iwl_trans *trans, u32 addr,
+ u32 val)
+ {
++ u32 mask = iwl_trans_pcie_prph_msk(trans);
++
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WADDR,
+- ((addr & 0x000FFFFF) | (3 << 24)));
++ ((addr & mask) | (3 << 24)));
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WDAT, val);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 023392c0276f843384efd5eb6fc66d8bdc6a2772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jul 2018 17:52:47 +0000
+Subject: kernfs: Fix range checks in kernfs_get_target_path
+
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+
+[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ]
+
+The terminating NUL byte is only there because the buffer is
+allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the
+range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the
+returned string may not be zero-terminated if it is exactly
+PATH_MAX characters long. Furthermore also the initial loop
+may theoretically exceed PATH_MAX and cause a fault.
+
+Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/symlink.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index 305b220af45d3..162f43b80c84c 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -72,6 +72,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (base == kn)
+ break;
+
++ if ((s - path) + 3 >= PATH_MAX)
++ return -ENAMETOOLONG;
++
+ strcpy(s, "../");
+ s += 3;
+ base = base->parent;
+@@ -88,7 +91,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (len < 2)
+ return -EINVAL;
+ len--;
+- if ((s - path) + len > PATH_MAX)
++ if ((s - path) + len >= PATH_MAX)
+ return -ENAMETOOLONG;
+
+ /* reverse fillup of target string from target to base */
+--
+2.20.1
+
--- /dev/null
+From 6e752f541b0045193ac210df1363ed4df0286029 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 19:21:09 +0900
+Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ]
+
+Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe
+list, just remove it from the list and keep it on kprobe hash list
+as same as other in-use kprobes.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index b8efca9dc2cbb..aed90788db5c1 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -544,8 +544,14 @@ static void do_free_cleaned_kprobes(void)
+ struct optimized_kprobe *op, *tmp;
+
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+- BUG_ON(!kprobe_unused(&op->kp));
+ list_del_init(&op->list);
++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) {
++ /*
++ * This must not happen, but if there is a kprobe
++ * still in use, keep it on kprobes hash list.
++ */
++ continue;
++ }
+ free_aggr_kprobe(&op->kp);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 8fd528e74ecb19a831a48e6a9717c3535d9bfcf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 15:16:22 -0500
+Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ]
+
+The next update of libfdt has a new dependency on INT_MAX. Update the
+instances of libfdt_env.h in the kernel to either include the necessary
+header with the definition or define it locally.
+
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/libfdt_env.h | 2 ++
+ arch/powerpc/boot/libfdt_env.h | 2 ++
+ include/linux/libfdt_env.h | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index 07437816e0986..b36c0289a308e 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -6,6 +6,8 @@
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index 2a0c8b1bf1479..2abc8e83b95e9 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -5,6 +5,8 @@
+ #include <types.h>
+ #include <string.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ #include "of.h"
+
+ typedef unsigned long uintptr_t;
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index c6ac1fe7ec68a..edb0f0c309044 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -2,6 +2,7 @@
+ #ifndef LIBFDT_ENV_H
+ #define LIBFDT_ENV_H
+
++#include <linux/kernel.h> /* For INT_MAX */
+ #include <linux/string.h>
+
+ #include <asm/byteorder.h>
+--
+2.20.1
+
--- /dev/null
+From dfc5f139eb2d96606401eaaad33005bba649444f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 11:32:55 -0700
+Subject: liquidio: fix race condition in instruction completion processing
+
+From: Rick Farrington <ricardo.farrington@cavium.com>
+
+[ Upstream commit b943f17e06493fd2c7fd00743093ad5dcdb90e7f ]
+
+In lio_enable_irq, the pkt_in_done count register was being cleared to
+zero. However, there could be some completed instructions which were not
+yet processed due to budget and limit constraints.
+So, only write this register with the number of actual completions
+that were processed.
+
+Signed-off-by: Rick Farrington <ricardo.farrington@cavium.com>
+Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/octeon_device.c | 5 +++--
+ drivers/net/ethernet/cavium/liquidio/octeon_iq.h | 2 ++
+ drivers/net/ethernet/cavium/liquidio/request_manager.c | 2 ++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_device.c b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+index f878a552fef3b..d0ed6c4f9e1a2 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+@@ -1450,8 +1450,9 @@ void lio_enable_irq(struct octeon_droq *droq, struct octeon_instr_queue *iq)
+ }
+ if (iq) {
+ spin_lock_bh(&iq->lock);
+- writel(iq->pkt_in_done, iq->inst_cnt_reg);
+- iq->pkt_in_done = 0;
++ writel(iq->pkts_processed, iq->inst_cnt_reg);
++ iq->pkt_in_done -= iq->pkts_processed;
++ iq->pkts_processed = 0;
+ /* this write needs to be flushed before we release the lock */
+ mmiowb();
+ spin_unlock_bh(&iq->lock);
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+index 2327062e8af6b..aecd0d36d6349 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+@@ -94,6 +94,8 @@ struct octeon_instr_queue {
+
+ u32 pkt_in_done;
+
++ u32 pkts_processed;
++
+ /** A spinlock to protect access to the input ring.*/
+ spinlock_t iq_flush_running_lock;
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+index 3deb3c07681fd..1d9ab7f4a2fef 100644
+--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
++++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+@@ -123,6 +123,7 @@ int octeon_init_instr_queue(struct octeon_device *oct,
+ iq->do_auto_flush = 1;
+ iq->db_timeout = (u32)conf->db_timeout;
+ atomic_set(&iq->instr_pending, 0);
++ iq->pkts_processed = 0;
+
+ /* Initialize the spinlock for this instruction queue */
+ spin_lock_init(&iq->lock);
+@@ -497,6 +498,7 @@ octeon_flush_iq(struct octeon_device *oct, struct octeon_instr_queue *iq,
+ lio_process_iq_request_list(oct, iq, 0);
+
+ if (inst_processed) {
++ iq->pkts_processed += inst_processed;
+ atomic_sub(inst_processed, &iq->instr_pending);
+ iq->stats.instr_processed += inst_processed;
+ }
+--
+2.20.1
+
--- /dev/null
+From 33bd500c22d99c8213fe7fb2583188dc0c323184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 11:42:06 -0700
+Subject: llc: avoid blocking in llc_sap_close()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ]
+
+llc_sap_close() is called by llc_sap_put() which
+could be called in BH context in llc_rcv(). We can't
+block in BH.
+
+There is no reason to block it here, kfree_rcu() should
+be sufficient.
+
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/llc.h | 1 +
+ net/llc/llc_core.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/llc.h b/include/net/llc.h
+index 890a87318014d..df282d9b40170 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -66,6 +66,7 @@ struct llc_sap {
+ int sk_count;
+ struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+ struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
++ struct rcu_head rcu;
+ };
+
+ static inline
+diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
+index 260b3dc1b4a2a..64d4bef04e730 100644
+--- a/net/llc/llc_core.c
++++ b/net/llc/llc_core.c
+@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap)
+ list_del_rcu(&sap->node);
+ spin_unlock_bh(&llc_sap_list_lock);
+
+- synchronize_rcu();
+-
+- kfree(sap);
++ kfree_rcu(sap, rcu);
+ }
+
+ static struct packet_type llc_packet_type __read_mostly = {
+--
+2.20.1
+
--- /dev/null
+From 022936bbea77af3fb322d6766887717b5bbc45d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 08:06:07 +0300
+Subject: mac80211: fix saving a few HE values
+
+From: Naftali Goldstein <naftali.goldstein@intel.com>
+
+[ Upstream commit 77cbbc35a49b75969d98edce9400beb21720aa39 ]
+
+After masking the he_oper_params, to get the requested values as
+integers one must rshift and not lshift. Fix that by using the
+le32_get_bits() macro.
+
+Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
+Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
+[converted to use le32_get_bits()]
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 5c9dcafbc3424..b0667467337d4 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3255,19 +3255,16 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+ }
+
+ if (bss_conf->he_support) {
+- u32 he_oper_params =
+- le32_to_cpu(elems.he_operation->he_oper_params);
++ bss_conf->bss_color =
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
+
+- bss_conf->bss_color = he_oper_params &
+- IEEE80211_HE_OPERATION_BSS_COLOR_MASK;
+ bss_conf->htc_trig_based_pkt_ext =
+- (he_oper_params &
+- IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK) <<
+- IEEE80211_HE_OPERATION_DFLT_PE_DURATION_OFFSET;
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
+ bss_conf->frame_time_rts_th =
+- (he_oper_params &
+- IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK) <<
+- IEEE80211_HE_OPERATION_RTS_THRESHOLD_OFFSET;
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
+
+ bss_conf->multi_sta_back_32bit =
+ sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
+--
+2.20.1
+
--- /dev/null
+From de7e0df67aa3508d008cb1e69f9c07d337378381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:07:49 -0400
+Subject: media: au0828: Fix incorrect error messages
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit f347596f2bf114a3af3d80201c6e6bef538d884f ]
+
+Correcting red herring error messages.
+
+Where appropriate, replaces au0282_dev_register with:
+- au0828_analog_register
+- au0828_dvb_register
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/au0828/au0828-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index e3f63299f85c0..07e3322bb1827 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -632,7 +632,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Analog TV */
+ retval = au0828_analog_register(dev, interface);
+ if (retval) {
+- pr_err("%s() au0282_dev_register failed to register on V4L2\n",
++ pr_err("%s() au0828_analog_register failed to register on V4L2\n",
+ __func__);
+ mutex_unlock(&dev->lock);
+ goto done;
+@@ -641,7 +641,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Digital TV */
+ retval = au0828_dvb_register(dev);
+ if (retval)
+- pr_err("%s() au0282_dev_register failed\n",
++ pr_err("%s() au0828_dvb_register failed\n",
+ __func__);
+
+ /* Remote controller */
+--
+2.20.1
+
--- /dev/null
+From 7401e543e429a1223be73e24c7091ec57beb90cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 02:16:15 -0400
+Subject: media: davinci: Fix implicit enum conversion warning
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit
+conversion from enumeration type 'enum osd_v_exp_ratio' to different
+enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion]
+ layer_info->h_exp = V_EXP_6_OVER_5;
+ ~ ^~~~~~~~~~~~~~
+1 warning generated.
+
+This appears to be a copy and paste error judging from the couple of
+lines directly above this statement and the way that height is handled
+in the if block above this one.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index b0eb3d899eb44..6f82693524331 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -521,7 +521,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev,
+ else if (v_scale == 4)
+ layer_info->v_zoom = ZOOM_X4;
+ if (v_exp)
+- layer_info->h_exp = V_EXP_6_OVER_5;
++ layer_info->v_exp = V_EXP_6_OVER_5;
+ } else {
+ /* no scaling, only cropping. Set display area to crop area */
+ cfg->ysize = expected_ysize;
+--
+2.20.1
+
--- /dev/null
+From c8c6502efda1e976e61ea527b2dcf323f9082579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jun 2018 09:48:07 -0400
+Subject: media: dt-bindings: adv748x: Fix decimal unit addresses
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 27582f0ea97fe3e4a38beb98ab36cce4b6f029d5 ]
+
+With recent dtc and W=1:
+
+ Warning (graph_port): video-receiver@70/port@10: graph node unit address error, expected "a"
+ Warning (graph_port): video-receiver@70/port@11: graph node unit address error, expected "b"
+
+Unit addresses are always hexadecimal (without prefix), while the bases
+of reg property values depend on their prefixes.
+
+Fixes: e69595170b1cad85 ("media: adv748x: Add adv7481, adv7482 bindings")
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/media/i2c/adv748x.txt | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/i2c/adv748x.txt b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+index 21ffb5ed81830..54d1d3bc18694 100644
+--- a/Documentation/devicetree/bindings/media/i2c/adv748x.txt
++++ b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+@@ -73,7 +73,7 @@ Example:
+ };
+ };
+
+- port@10 {
++ port@a {
+ reg = <10>;
+
+ adv7482_txa: endpoint {
+@@ -83,7 +83,7 @@ Example:
+ };
+ };
+
+- port@11 {
++ port@b {
+ reg = <11>;
+
+ adv7482_txb: endpoint {
+--
+2.20.1
+
--- /dev/null
+From bf55a9f67bff1779933b307f6fb79891f86577a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:56:21 -0400
+Subject: media: dvb: fix compat ioctl translation
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 ]
+
+The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but
+it never worked because the command number is wrong.
+
+Using the right command number means we have a better chance of them
+actually doing the right thing, though clearly nobody has ever tried
+it successfully.
+
+I noticed these while auditing the remaining users of compat_time_t
+for y2038 bugs. This one is fine in that regard, it just never did
+anything.
+
+Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/compat_ioctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 8f08095ee54e9..3a03f74a8cc4e 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -141,6 +141,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -152,7 +153,7 @@ static int do_video_get_event(struct file *file,
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -171,6 +172,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -193,7 +195,7 @@ static int do_video_stillpicture(struct file *file,
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1302,9 +1304,9 @@ static long do_ioctl_trans(unsigned int cmd,
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ec369c2e5142f8b7a574d0a7035a7255f6547ddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jul 2018 08:15:53 -0400
+Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary
+ access
+
+From: Lao Wei <zrlw@qq.com>
+
+[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ]
+
+Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter
+'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying
+pass different arbitrary address.
+Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1
+
+Signed-off-by: Lao Wei <zrlw@qq.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/meye/meye.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
+index 8001d3e9134e4..db2a7ad1e5231 100644
+--- a/drivers/media/pci/meye/meye.c
++++ b/drivers/media/pci/meye/meye.c
+@@ -1460,7 +1460,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long page, pos;
+
+ mutex_lock(&meye.lock);
+- if (size > gbuffers * gbufsize) {
++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) {
+ mutex_unlock(&meye.lock);
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From b6f5908ebb06478e823ca46a47d18670c7297cbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 07:44:43 -0400
+Subject: media: i2c: Fix pm_runtime_get_if_in_use() usage in sensor drivers
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 4d471563d87b2b83e73b8abffb9273950e6d2e36 ]
+
+pm_runtime_get_if_in_use() returns -EINVAL if runtime PM is disabled. This
+should not be considered an error. Generally the driver has enabled
+runtime PM already so getting this error due to runtime PM being disabled
+will not happen.
+
+Instead of checking for lesser or equal to zero, check for zero only.
+Address this for drivers where this pattern exists.
+
+This patch has been produced using the following command:
+
+$ git grep -l pm_runtime_get_if_in_use -- drivers/media/i2c/ | \
+ xargs perl -i -pe 's/(pm_runtime_get_if_in_use\(.*\)) \<\= 0/!$1/'
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov13858.c | 2 +-
+ drivers/media/i2c/ov2685.c | 2 +-
+ drivers/media/i2c/ov5670.c | 2 +-
+ drivers/media/i2c/ov5695.c | 2 +-
+ drivers/media/i2c/ov7740.c | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/ov13858.c b/drivers/media/i2c/ov13858.c
+index a66f6201f53c7..0e7a85c4996c7 100644
+--- a/drivers/media/i2c/ov13858.c
++++ b/drivers/media/i2c/ov13858.c
+@@ -1230,7 +1230,7 @@ static int ov13858_set_ctrl(struct v4l2_ctrl *ctrl)
+ * Applying V4L2 control value only happens
+ * when power is up for streaming
+ */
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ ret = 0;
+diff --git a/drivers/media/i2c/ov2685.c b/drivers/media/i2c/ov2685.c
+index 385c1886a9470..98a1f2e312b58 100644
+--- a/drivers/media/i2c/ov2685.c
++++ b/drivers/media/i2c/ov2685.c
+@@ -549,7 +549,7 @@ static int ov2685_set_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ }
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index 7b7c74d773707..53dd30d96e691 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2016,7 +2016,7 @@ static int ov5670_set_ctrl(struct v4l2_ctrl *ctrl)
+ }
+
+ /* V4L2 controls values will be applied only when power is already up */
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov5695.c b/drivers/media/i2c/ov5695.c
+index 9a80decd93d3c..5d107c53364d6 100644
+--- a/drivers/media/i2c/ov5695.c
++++ b/drivers/media/i2c/ov5695.c
+@@ -1110,7 +1110,7 @@ static int ov5695_set_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ }
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
+index 8a6a7a5929aa3..7804013934ab5 100644
+--- a/drivers/media/i2c/ov7740.c
++++ b/drivers/media/i2c/ov7740.c
+@@ -510,7 +510,7 @@ static int ov7740_set_ctrl(struct v4l2_ctrl *ctrl)
+ int ret;
+ u8 val = 0;
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+--
+2.20.1
+
--- /dev/null
+From ea28780c38e324d36ae62b9c3db57c684c17c6b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Aug 2018 17:32:17 -0400
+Subject: media: imx: work around false-positive warning, again
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8d1a4817cce1b15b4909f0e324a4f5af5952da67 ]
+
+A warning that I thought to be solved by a previous patch of mine
+has resurfaced with gcc-8:
+
+media/imx/imx-media-csi.c: In function 'csi_link_validate':
+media/imx/imx-media-csi.c:1025:20: error: 'upstream_ep' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+media/imx/imx-media-csi.c:1026:24: error: 'upstream_ep.bus_type' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+media/imx/imx-media-csi.c:127:19: error: 'upstream_ep.bus.parallel.bus_width' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+media/imx/imx-media-csi.c: In function 'csi_enum_mbus_code':
+media/imx/imx-media-csi.c:132:9: error: '*((void *)&upstream_ep+12)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+media/imx/imx-media-csi.c:132:48: error: 'upstream_ep.bus.parallel.bus_width' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+I spent some more time digging in this time, and think I have a better
+fix, bailing out of the function that either initializes or errors
+out here, which simplifies the code enough for gcc to figure out
+what is going on. The earlier partial workaround can be removed now,
+as the new workaround is better.
+
+Fixes: 890f27693f2a ("media: imx: work around false-positive warning")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-csi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index d17ce1fb4ef51..0f8fdc347091b 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -166,6 +166,9 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_subdev *sd;
+ struct media_pad *pad;
+
++ if (!IS_ENABLED(CONFIG_OF))
++ return -ENXIO;
++
+ if (!priv->src_sd)
+ return -EPIPE;
+
+@@ -1072,7 +1075,7 @@ static int csi_link_validate(struct v4l2_subdev *sd,
+ struct v4l2_subdev_format *sink_fmt)
+ {
+ struct csi_priv *priv = v4l2_get_subdevdata(sd);
+- struct v4l2_fwnode_endpoint upstream_ep = {};
++ struct v4l2_fwnode_endpoint upstream_ep;
+ bool is_csi2;
+ int ret;
+
+--
+2.20.1
+
--- /dev/null
+From 981b0140ecfd17101ef83e101d6c9a5171d1cf13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 08:46:29 -0400
+Subject: media: ov2680: don't register the v4l2 subdevice before checking chip
+ ID
+
+From: Javier Martinez Canillas <javierm@redhat.com>
+
+[ Upstream commit b7a417628abf49dae98cb80a272dc133b0e4d1a3 ]
+
+The driver registers the v4l2 subdevice before attempting to power on the
+chip and checking its ID. This means that a media device driver that it's
+waiting for this subdevice to be bound, will prematurely expose its media
+device node to userspace because if something goes wrong the media entity
+will be cleaned up again on the ov2680 probe function.
+
+This also simplifies the probe function error path since no initialization
+is made before attempting to enable the resources or checking the chip ID.
+
+Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index f753a1c333ef9..3ccd584568fb5 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -1088,26 +1088,20 @@ static int ov2680_probe(struct i2c_client *client)
+
+ mutex_init(&sensor->lock);
+
+- ret = ov2680_v4l2_init(sensor);
++ ret = ov2680_check_id(sensor);
+ if (ret < 0)
+ goto lock_destroy;
+
+- ret = ov2680_check_id(sensor);
++ ret = ov2680_v4l2_init(sensor);
+ if (ret < 0)
+- goto error_cleanup;
++ goto lock_destroy;
+
+ dev_info(dev, "ov2680 init correctly\n");
+
+ return 0;
+
+-error_cleanup:
+- dev_err(dev, "ov2680 init fail: %d\n", ret);
+-
+- media_entity_cleanup(&sensor->sd.entity);
+- v4l2_async_unregister_subdev(&sensor->sd);
+- v4l2_ctrl_handler_free(&sensor->ctrls.handler);
+-
+ lock_destroy:
++ dev_err(dev, "ov2680 init fail: %d\n", ret);
+ mutex_destroy(&sensor->lock);
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From ffa16aeb36f653a3891db66441831778840b4520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 05:59:55 -0500
+Subject: media: ov2680: fix null dereference at power on
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit c45fbdf24c61a7b7a37f1b3bbd46f054637a3627 ]
+
+Swapping the order between v4l2 subdevice registration and checking chip
+id in b7a417628abf ("media: ov2680: don't register the v4l2 subdevice
+before checking chip ID") makes the mode restore to use the sensor
+controls before they are set, so move the mode restore call to s_power
+after the handler setup for controls is done.
+
+This remove also the need for the error code path in power on function.
+
+Fixes: b7a417628abf ("media: ov2680: don't register the v4l2 subdevice before checking chip ID")
+
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 3ccd584568fb5..d8798fb714ba8 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -568,10 +568,6 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- ret = ov2680_mode_restore(sensor);
+- if (ret < 0)
+- goto disable;
+-
+ sensor->is_enabled = true;
+
+ /* Set clock lane into LP-11 state */
+@@ -580,12 +576,6 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ov2680_stream_disable(sensor);
+
+ return 0;
+-
+-disable:
+- dev_err(dev, "failed to enable sensor: %d\n", ret);
+- ov2680_power_off(sensor);
+-
+- return ret;
+ }
+
+ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+@@ -606,6 +596,8 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+ ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+ if (ret < 0)
+ return ret;
++
++ ret = ov2680_mode_restore(sensor);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 7d2ba8b090bd63794ca8467a3ce66e56db97d3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Aug 2018 16:10:39 -0400
+Subject: media: ov772x: Disable clk on error path
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+[ Upstream commit 1d18c2cd9d38ad639b2e00546b9ee638f2cef4b0 ]
+
+If ov772x_power_on() is unable to get GPIO rstb,
+the clock is left undisabled.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov772x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
+index 7158c31d8403b..4eae5f2f7d318 100644
+--- a/drivers/media/i2c/ov772x.c
++++ b/drivers/media/i2c/ov772x.c
+@@ -896,6 +896,7 @@ static int ov772x_power_on(struct ov772x_priv *priv)
+ GPIOD_OUT_LOW);
+ if (IS_ERR(priv->rstb_gpio)) {
+ dev_info(&client->dev, "Unable to get GPIO \"reset\"");
++ clk_disable_unprepare(priv->clk);
+ return PTR_ERR(priv->rstb_gpio);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3b722c0a6b3fbb343a0330a37380571850bc55b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 07:44:09 -0400
+Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in
+ ivtv_yuv_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ]
+
+The driver may sleep in a interrupt handler.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] kzalloc(GFP_KERNEL)
+drivers/media/pci/ivtv/ivtv-yuv.c, 938:
+ kzalloc in ivtv_yuv_init
+drivers/media/pci/ivtv/ivtv-yuv.c, 960:
+ ivtv_yuv_init in ivtv_yuv_next_free
+drivers/media/pci/ivtv/ivtv-yuv.c, 1126:
+ ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame
+drivers/media/pci/ivtv/ivtv-irq.c, 827:
+ ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req
+drivers/media/pci/ivtv/ivtv-irq.c, 1013:
+ ivtv_irq_dec_data_req in ivtv_irq_handler
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-yuv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
+index 44936d6d7c396..1380474519f2b 100644
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv)
+ }
+
+ /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
+- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN);
+ if (yi->blanking_ptr) {
+ yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
+ } else {
+--
+2.20.1
+
--- /dev/null
+From b7cf0d47dfcdebb5625b84202040929aefa6e828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 04:10:05 -0400
+Subject: media: vicodec: fix out-of-range values when decoding
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit be5a1509af8dd8a78fea24a35fe4a82d4cd0ae70 ]
+
+While decoding you need to make sure you do not get values < 0
+or > 255. Note that since this code will also be used in userspace
+utilities the clamp macro isn't used since that is kernel-only.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vicodec/vicodec-codec.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/vicodec/vicodec-codec.c b/drivers/media/platform/vicodec/vicodec-codec.c
+index 2d047646f6147..d854b2344f12b 100644
+--- a/drivers/media/platform/vicodec/vicodec-codec.c
++++ b/drivers/media/platform/vicodec/vicodec-codec.c
+@@ -588,8 +588,14 @@ static void fill_decoder_block(u8 *dst, const s16 *input, int stride)
+ int i, j;
+
+ for (i = 0; i < 8; i++) {
+- for (j = 0; j < 8; j++)
+- *dst++ = *input++;
++ for (j = 0; j < 8; j++, input++, dst++) {
++ if (*input < 0)
++ *dst = 0;
++ else if (*input > 255)
++ *dst = 255;
++ else
++ *dst = *input;
++ }
+ dst += stride - 8;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 5776f68aa609eaf6dfe2590607be4c13591aa16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Apr 2018 17:41:12 -0400
+Subject: media: vsp1: Fix vsp1_regs.h license header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 5eea860a6fec1e60709d19832015ee0991d3e80c ]
+
+All source files of the vsp1 driver are licensed under the GPLv2+ except
+for vsp1_regs.h which is licensed under GPLv2. This is caused by a bad
+copy&paste that dates back from the initial version of the driver. Fix
+it.
+
+Acked-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Acked-by: Sergei Shtylyov<sergei.shtylyov@cogentembedded.com>
+Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Acked-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vsp1/vsp1_regs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vsp1/vsp1_regs.h b/drivers/media/platform/vsp1/vsp1_regs.h
+index 3738ff2f7b850..f6e4157095cc0 100644
+--- a/drivers/media/platform/vsp1/vsp1_regs.h
++++ b/drivers/media/platform/vsp1/vsp1_regs.h
+@@ -1,4 +1,4 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
++/* SPDX-License-Identifier: GPL-2.0+ */
+ /*
+ * vsp1_regs.h -- R-Car VSP1 Registers Definitions
+ *
+--
+2.20.1
+
--- /dev/null
+From 3df4a0800905dc0d50c0d74fbbbd87f357dc5311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2017 02:27:51 -0400
+Subject: media: vsp1: Fix YCbCr planar formats pitch calculation
+
+From: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+
+[ Upstream commit 9b2798d5b71c50f64c41a40f0cbcae47c3fbd067 ]
+
+YCbCr planar formats can have different pitch values for the luma and
+chroma planes. This isn't taken into account in the driver. Fix it.
+
+Based on a BSP patch from Koji Matsuoka <koji.matsuoka.xm@renesas.com>.
+
+Fixes: 7863ac504bc5 ("drm: rcar-du: Add tri-planar memory formats support")
+[Updated documentation of the struct vsp1_du_atomic_config pitch field]
+
+Signed-off-by: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vsp1/vsp1_drm.c | 11 ++++++++++-
+ include/media/vsp1.h | 2 +-
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
+index b9c0f695d002b..8d86f618ec776 100644
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -770,6 +770,7 @@ int vsp1_du_atomic_update(struct device *dev, unsigned int pipe_index,
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+ struct vsp1_drm_pipeline *drm_pipe = &vsp1->drm->pipe[pipe_index];
+ const struct vsp1_format_info *fmtinfo;
++ unsigned int chroma_hsub;
+ struct vsp1_rwpf *rpf;
+
+ if (rpf_index >= vsp1->info->rpf_count)
+@@ -810,10 +811,18 @@ int vsp1_du_atomic_update(struct device *dev, unsigned int pipe_index,
+ return -EINVAL;
+ }
+
++ /*
++ * Only formats with three planes can affect the chroma planes pitch.
++ * All formats with two planes have a horizontal subsampling value of 2,
++ * but combine U and V in a single chroma plane, which thus results in
++ * the luma plane and chroma plane having the same pitch.
++ */
++ chroma_hsub = (fmtinfo->planes == 3) ? fmtinfo->hsub : 1;
++
+ rpf->fmtinfo = fmtinfo;
+ rpf->format.num_planes = fmtinfo->planes;
+ rpf->format.plane_fmt[0].bytesperline = cfg->pitch;
+- rpf->format.plane_fmt[1].bytesperline = cfg->pitch;
++ rpf->format.plane_fmt[1].bytesperline = cfg->pitch / chroma_hsub;
+ rpf->alpha = cfg->alpha;
+
+ rpf->mem.addr[0] = cfg->mem[0];
+diff --git a/include/media/vsp1.h b/include/media/vsp1.h
+index 3093b9cb9067e..5b383d01c84a0 100644
+--- a/include/media/vsp1.h
++++ b/include/media/vsp1.h
+@@ -46,7 +46,7 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int pipe_index,
+ /**
+ * struct vsp1_du_atomic_config - VSP atomic configuration parameters
+ * @pixelformat: plane pixel format (V4L2 4CC)
+- * @pitch: line pitch in bytes, for all planes
++ * @pitch: line pitch in bytes for the first plane
+ * @mem: DMA memory address for each plane of the frame buffer
+ * @src: source rectangle in the frame buffer (integer coordinates)
+ * @dst: destination rectangle on the display (integer coordinates)
+--
+2.20.1
+
--- /dev/null
+From ac96c1e153d2bd41b90589c41331c0482536163d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Aug 2018 22:20:23 +0300
+Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+
+[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ]
+
+Setting GPIO 21 high seems to be required to enable power to USB ports
+on the WNDR3400v3. As there is already similar code for WNR3500L,
+make the existing USB power GPIO code generic and use that.
+
+Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20259/
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/workarounds.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
+index 1a8a07e7a5633..46eddbec8d9fd 100644
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -5,9 +5,8 @@
+ #include <bcm47xx_board.h>
+ #include <bcm47xx.h>
+
+-static void __init bcm47xx_workarounds_netgear_wnr3500l(void)
++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power)
+ {
+- const int usb_power = 12;
+ int err;
+
+ err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power");
+@@ -23,7 +22,10 @@ void __init bcm47xx_workarounds(void)
+
+ switch (board) {
+ case BCM47XX_BOARD_NETGEAR_WNR3500L:
+- bcm47xx_workarounds_netgear_wnr3500l();
++ bcm47xx_workarounds_enable_usb_power(12);
++ break;
++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++ bcm47xx_workarounds_enable_usb_power(21);
+ break;
+ default:
+ /* No workaround(s) needed */
+--
+2.20.1
+
--- /dev/null
+From 3d4029213bffec7fe0f48209a42313f0f182892e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:49:23 -0700
+Subject: MIPS: kexec: Relax memory restriction
+
+From: Dengcheng Zhu <dzhu@wavecomp.com>
+
+[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ]
+
+We can rely on the system kernel and the dump capture kernel themselves in
+memory usage.
+
+Being restrictive with 512MB limit may cause kexec tool failure on some
+platforms.
+
+Tested-by: Rachel Mozes <rachel.mozes@intel.com>
+Reported-by: Rachel Mozes <rachel.mozes@intel.com>
+Signed-off-by: Dengcheng Zhu <dzhu@wavecomp.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20568/
+Cc: pburton@wavecomp.com
+Cc: ralf@linux-mips.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/kexec.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h
+index 493a3cc7c39ad..cfdbe66575f4d 100644
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -12,11 +12,11 @@
+ #include <asm/stacktrace.h>
+
+ /* Maximum physical address we can use pages from */
+-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can use for the control code buffer */
+-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+ /* Reserve 3*4096 bytes for board-specific info */
+ #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+
+--
+2.20.1
+
--- /dev/null
+From 5356ef2a5148d8b92fefc277b727245bf1458bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:16:42 +0200
+Subject: MIPS: lantiq: Do not enable IRQs in dma open
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit cc973aecf0b0541918c5ecabe6c90d1f709b5f89 ]
+
+When a DMA channel is opened the IRQ should not get activated
+automatically, this allows it to pull data out manually without the help
+of interrupts. This is needed for a workaround in the vrx200 Ethernet
+driver.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Acked-by: Paul Burton <paul.burton@mips.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/dma.c | 1 -
+ drivers/net/ethernet/lantiq_etop.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
+index 664f2f7f55c1c..982859f2b2a38 100644
+--- a/arch/mips/lantiq/xway/dma.c
++++ b/arch/mips/lantiq/xway/dma.c
+@@ -106,7 +106,6 @@ ltq_dma_open(struct ltq_dma_channel *ch)
+ spin_lock_irqsave(<q_dma_lock, flag);
+ ltq_dma_w32(ch->nr, LTQ_DMA_CS);
+ ltq_dma_w32_mask(0, DMA_CHAN_ON, LTQ_DMA_CCTRL);
+- ltq_dma_w32_mask(0, 1 << ch->nr, LTQ_DMA_IRNEN);
+ spin_unlock_irqrestore(<q_dma_lock, flag);
+ }
+ EXPORT_SYMBOL_GPL(ltq_dma_open);
+diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
+index e08301d833e2e..379db19a303c8 100644
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -439,6 +439,7 @@ ltq_etop_open(struct net_device *dev)
+ if (!IS_TX(i) && (!IS_RX(i)))
+ continue;
+ ltq_dma_open(&ch->dma);
++ ltq_dma_enable_irq(&ch->dma);
+ napi_enable(&ch->napi);
+ }
+ phy_start(dev->phydev);
+--
+2.20.1
+
--- /dev/null
+From 1a82d6f0e2ccb3a8e27226db619bb3191417c554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 12:19:19 +0800
+Subject: mips: txx9: fix iounmap related issue
+
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+
+[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ]
+
+if device_register return error, iounmap should be called, also iounmap
+need to call before put_device.
+
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Reviewed-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20476/
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/txx9/generic/setup.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
+index f6d9182ef82a9..70a1ab66d252c 100644
+--- a/arch/mips/txx9/generic/setup.c
++++ b/arch/mips/txx9/generic/setup.c
+@@ -960,12 +960,11 @@ void __init txx9_sramc_init(struct resource *r)
+ goto exit_put;
+ err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr);
+ if (err) {
+- device_unregister(&dev->dev);
+ iounmap(dev->base);
+- kfree(dev);
++ device_unregister(&dev->dev);
+ }
+ return;
+ exit_put:
++ iounmap(dev->base);
+ put_device(&dev->dev);
+- return;
+ }
+--
+2.20.1
+
--- /dev/null
+From a4929ccc771f5763db091007feabd16fdf4c54d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:29:13 +0800
+Subject: misc: genwqe: should return proper error value.
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ]
+
+The function should return -EFAULT when copy_from_user fails. Even
+though the caller does not distinguish them. but we should keep backward
+compatibility.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_utils.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index f68435df76d48..22301bba8c495 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages)
+ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ void __user *user_addr, size_t user_size, int write)
+ {
+- int rc;
++ int ret = -ENOMEM;
+ struct pci_dev *pci_dev = cd->pci_dev;
+
+ sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
+@@ -318,7 +318,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (get_order(sgl->sgl_size) > MAX_ORDER) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: too much memory requested!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
+@@ -326,7 +326,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (sgl->sgl == NULL) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: no memory available!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ /* Only use buffering on incomplete pages */
+@@ -339,7 +339,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+ user_addr, sgl->fpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out;
+ }
+ }
+@@ -352,7 +352,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out2;
+ }
+ }
+@@ -374,7 +374,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
+- return -ENOMEM;
++
++ return ret;
+ }
+
+ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+--
+2.20.1
+
--- /dev/null
+From 0a998c218366633a48acf7affb5e720172f4225d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:44:03 -0700
+Subject: misc: kgdbts: Fix restrict error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ]
+
+kgdbts current fails when compiled with restrict:
+
+drivers/misc/kgdbts.c: In function ‘configure_kgdbts’:
+drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict]
+ strcpy(config, opt);
+ ^~~~~~~~~~~~~~~~~~~
+
+As the error says, config is being used in both the source and destination.
+Refactor the code to avoid the extra copy and put the parsing closer to
+the actual location.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index eb4d90b7d99e1..8b01257783dd8 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -985,6 +985,12 @@ static void kgdbts_run_tests(void)
+ int nmi_sleep = 0;
+ int i;
+
++ verbose = 0;
++ if (strstr(config, "V1"))
++ verbose = 1;
++ if (strstr(config, "V2"))
++ verbose = 2;
++
+ ptr = strchr(config, 'F');
+ if (ptr)
+ fork_test = simple_strtol(ptr + 1, NULL, 10);
+@@ -1068,13 +1074,6 @@ static int kgdbts_option_setup(char *opt)
+ return -ENOSPC;
+ }
+ strcpy(config, opt);
+-
+- verbose = 0;
+- if (strstr(config, "V1"))
+- verbose = 1;
+- if (strstr(config, "V2"))
+- verbose = 2;
+-
+ return 0;
+ }
+
+@@ -1086,9 +1085,6 @@ static int configure_kgdbts(void)
+
+ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+- err = kgdbts_option_setup(config);
+- if (err)
+- goto noconfig;
+
+ final_ack = 0;
+ run_plant_and_detach_test(1);
+--
+2.20.1
+
--- /dev/null
+From 8ffcd89c0b72fa458ba79de45db58e21d68c93fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Sep 2018 17:48:55 +0300
+Subject: mlxsw: Make MLXSW_SP1_FWREV_MINOR a hard requirement
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 12ba7e1045521ec9f251c93ae0a6735cc3f42337 ]
+
+Up until now, mlxsw tolerated firmware versions that weren't exactly
+matching the required version, if the branch number matched. That
+allowed the users to test various firmware versions as long as they were
+on the right branch.
+
+On the other hand, it made it impossible for mlxsw to put a hard lower
+bound on a version that fixes all problems known to date. If a user had
+a somewhat older FW version installed, mlxsw would start up just fine,
+possibly performing non-optimally as it would use features that trigger
+problematic behavior.
+
+Therefore tweak the check to accept any FW version that is:
+
+- on the same branch as the preferred version, and
+- the same as or newer than the preferred version.
+
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 1c170a0fd2cc9..e498ee95bacab 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -336,7 +336,10 @@ static int mlxsw_sp_fw_rev_validate(struct mlxsw_sp *mlxsw_sp)
+ return -EINVAL;
+ }
+ if (MLXSW_SP_FWREV_MINOR_TO_BRANCH(rev->minor) ==
+- MLXSW_SP_FWREV_MINOR_TO_BRANCH(req_rev->minor))
++ MLXSW_SP_FWREV_MINOR_TO_BRANCH(req_rev->minor) &&
++ (rev->minor > req_rev->minor ||
++ (rev->minor == req_rev->minor &&
++ rev->subminor >= req_rev->subminor)))
+ return 0;
+
+ dev_info(mlxsw_sp->bus_info->dev, "The firmware version %d.%d.%d is incompatible with the driver\n",
+--
+2.20.1
+
--- /dev/null
+From 1583a1d502f14079fe7035bc423c809fbe79018e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 09:21:24 +0300
+Subject: mlxsw: spectrum: Init shaper for TCs 8..15
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit a9f36656b519a9a21309793c306941a3cd0eeb8f ]
+
+With introduction of MC-aware mode to mlxsw, it became necessary to
+configure TCs above 7 as well. There is now code in mlxsw to disable ETS
+for these higher classes, but disablement of max shaper was neglected.
+
+By default, max shaper is currently disabled to begin with, so the
+problem is just cosmetic. However, for symmetry, do like we do for ETS
+configuration, and call mlxsw_sp_port_ets_maxrate_set() for both TC i
+and i + 8.
+
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index ccd9aca281b37..1c170a0fd2cc9 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2815,6 +2815,13 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ MLXSW_REG_QEEC_MAS_DIS);
+ if (err)
+ return err;
++
++ err = mlxsw_sp_port_ets_maxrate_set(mlxsw_sp_port,
++ MLXSW_REG_QEEC_HIERARCY_TC,
++ i + 8, i,
++ MLXSW_REG_QEEC_MAS_DIS);
++ if (err)
++ return err;
+ }
+
+ /* Map all priorities to traffic class 0. */
+--
+2.20.1
+
--- /dev/null
+From e362d0181b88e8f63fb215d9a237e7b412a80f84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 23:27:38 +0200
+Subject: mt76: Fix comparisons with invalid hardware key index
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 81c8eccc2404d06082025b773f1d90e8c861bc6a ]
+
+With gcc 4.1.2:
+
+ drivers/net/wireless/mediatek/mt76/mt76x0/tx.c: In function ‘mt76x0_tx’:
+ drivers/net/wireless/mediatek/mt76/mt76x0/tx.c:169: warning: comparison is always true due to limited range of data type
+ drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c: In function ‘mt76x2_tx’:
+ drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c:35: warning: comparison is always true due to limited range of data type
+
+While assigning -1 to a u8 works fine, comparing with -1 does not work
+as expected.
+
+Fix this by comparing with 0xff, like is already done in some other
+places.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x0/tx.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c b/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
+index 751b49c28ae53..c45d05d5aab1d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
+@@ -166,7 +166,7 @@ void mt76x0_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+ if (sta) {
+ msta = (struct mt76_sta *) sta->drv_priv;
+ wcid = &msta->wcid;
+- } else if (vif && (!info->control.hw_key && wcid->hw_key_idx != -1)) {
++ } else if (vif && (!info->control.hw_key && wcid->hw_key_idx != 0xff)) {
+ struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+
+ wcid = &mvif->group_wcid;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
+index 36afb166fa3ff..c0ca0df84ed8b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
+@@ -32,7 +32,7 @@ void mt76x2_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+ msta = (struct mt76x2_sta *)control->sta->drv_priv;
+ wcid = &msta->wcid;
+ /* sw encrypted frames */
+- if (!info->control.hw_key && wcid->hw_key_idx != -1)
++ if (!info->control.hw_key && wcid->hw_key_idx != 0xff)
+ control->sta = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a973d8d97fc8cb754fecdad146d27a3da7d6151d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Aug 2018 09:18:45 +0200
+Subject: mtd: rawnand: fsl_ifc: check result of SRAM initialization
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit 434655af6a187129d8114640443b27d2cecfb979 ]
+
+The SRAM initialization might fail. If that happens further NAND operations
+won't be successful. Therefore, the chip init routine should fail if the SRAM
+initialization didn't work.
+
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_ifc_nand.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index 24f59d0066afd..e4f5792dc5893 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -761,7 +761,7 @@ static const struct nand_controller_ops fsl_ifc_controller_ops = {
+ .attach_chip = fsl_ifc_attach_chip,
+ };
+
+-static void fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
++static int fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ {
+ struct fsl_ifc_ctrl *ctrl = priv->ctrl;
+ struct fsl_ifc_runtime __iomem *ifc_runtime = ctrl->rregs;
+@@ -805,12 +805,16 @@ static void fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ wait_event_timeout(ctrl->nand_wait, ctrl->nand_stat,
+ msecs_to_jiffies(IFC_TIMEOUT_MSECS));
+
+- if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC)
++ if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC) {
+ pr_err("fsl-ifc: Failed to Initialise SRAM\n");
++ return -ETIMEDOUT;
++ }
+
+ /* Restore CSOR and CSOR_ext */
+ ifc_out32(csor, &ifc_global->csor_cs[cs].csor);
+ ifc_out32(csor_ext, &ifc_global->csor_cs[cs].csor_ext);
++
++ return 0;
+ }
+
+ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+@@ -914,8 +918,13 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+ chip->ecc.algo = NAND_ECC_HAMMING;
+ }
+
+- if (ctrl->version >= FSL_IFC_VERSION_1_1_0)
+- fsl_ifc_sram_init(priv);
++ if (ctrl->version >= FSL_IFC_VERSION_1_1_0) {
++ int ret;
++
++ ret = fsl_ifc_sram_init(priv);
++ if (ret)
++ return ret;
++ }
+
+ /*
+ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
+--
+2.20.1
+
--- /dev/null
+From 681e0ad3b5d0c9970f73973b9f5a9f33d22ffcd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Aug 2018 09:18:46 +0200
+Subject: mtd: rawnand: fsl_ifc: fixup SRAM init for newer ctrl versions
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit ff8648f29fe58c2d94d32a076d2de7b92be4b485 ]
+
+Newer versions of the IFC controller use a different method of initializing the
+internal SRAM: Instead of reading from flash, a bit in the NAND configuration
+register has to be set in order to trigger the self-initializing process.
+
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_ifc_nand.c | 33 +++++++++++++++++++++++------
+ include/linux/fsl_ifc.h | 2 ++
+ 2 files changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index e4f5792dc5893..7e7729df78278 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -30,6 +30,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/mtd/nand_ecc.h>
+ #include <linux/fsl_ifc.h>
++#include <linux/iopoll.h>
+
+ #define ERR_BYTE 0xFF /* Value returned for read
+ bytes when read failed */
+@@ -769,6 +770,27 @@ static int fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ uint32_t csor = 0, csor_8k = 0, csor_ext = 0;
+ uint32_t cs = priv->bank;
+
++ if (ctrl->version < FSL_IFC_VERSION_1_1_0)
++ return 0;
++
++ if (ctrl->version > FSL_IFC_VERSION_1_1_0) {
++ u32 ncfgr, status;
++ int ret;
++
++ /* Trigger auto initialization */
++ ncfgr = ifc_in32(&ifc_runtime->ifc_nand.ncfgr);
++ ifc_out32(ncfgr | IFC_NAND_NCFGR_SRAM_INIT_EN, &ifc_runtime->ifc_nand.ncfgr);
++
++ /* Wait until done */
++ ret = readx_poll_timeout(ifc_in32, &ifc_runtime->ifc_nand.ncfgr,
++ status, !(status & IFC_NAND_NCFGR_SRAM_INIT_EN),
++ 10, IFC_TIMEOUT_MSECS * 1000);
++ if (ret)
++ dev_err(priv->dev, "Failed to initialize SRAM!\n");
++
++ return ret;
++ }
++
+ /* Save CSOR and CSOR_ext */
+ csor = ifc_in32(&ifc_global->csor_cs[cs].csor);
+ csor_ext = ifc_in32(&ifc_global->csor_cs[cs].csor_ext);
+@@ -825,6 +847,7 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+ struct nand_chip *chip = &priv->chip;
+ struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+ u32 csor;
++ int ret;
+
+ /* Fill in fsl_ifc_mtd structure */
+ mtd->dev.parent = priv->dev;
+@@ -918,13 +941,9 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+ chip->ecc.algo = NAND_ECC_HAMMING;
+ }
+
+- if (ctrl->version >= FSL_IFC_VERSION_1_1_0) {
+- int ret;
+-
+- ret = fsl_ifc_sram_init(priv);
+- if (ret)
+- return ret;
+- }
++ ret = fsl_ifc_sram_init(priv);
++ if (ret)
++ return ret;
+
+ /*
+ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
+diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h
+index 3fdfede2f0f3e..5f343b796ad95 100644
+--- a/include/linux/fsl_ifc.h
++++ b/include/linux/fsl_ifc.h
+@@ -274,6 +274,8 @@
+ */
+ /* Auto Boot Mode */
+ #define IFC_NAND_NCFGR_BOOT 0x80000000
++/* SRAM Initialization */
++#define IFC_NAND_NCFGR_SRAM_INIT_EN 0x20000000
+ /* Addressing Mode-ROW0+n/COL0 */
+ #define IFC_NAND_NCFGR_ADDR_MODE_RC0 0x00000000
+ /* Addressing Mode-ROW0+n/COL0+n */
+--
+2.20.1
+
--- /dev/null
+From ec971ab2f03d46ba7ae07194b6bf685fb9f8c791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 10:56:25 +0200
+Subject: mtd: rawnand: marvell: use regmap_update_bits() for syscon access
+
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+
+[ Upstream commit 88aa3bbfc020d14b13d67af3f5c08aa992d82cd8 ]
+
+The marvell_nfc_init() function fiddles with some bits of a system
+controller on Armada 7K/8K. However, it does a read/modify/write
+sequence on GENCONF_CLK_GATING_CTRL and GENCONF_ND_CLK_CTRL, which
+isn't safe from a concurrency point of view, as the regmap lock isn't
+taken accross the read/modify/write sequence. To solve this issue, use
+regmap_update_bits().
+
+While at it, since the "reg" variable is no longer needed for the
+read/modify/write sequences, get rid of it for the regmap_write() to
+GENCONF_SOC_DEVICE_MUX, and directly pass the value to be written as
+argument.
+
+Fixes: 02f26ecf8c772 ("mtd: nand: add reworked Marvell NAND controller driver")
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/marvell_nand.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index 9c90695a885fe..7a84a8f05b46d 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2710,24 +2710,23 @@ static int marvell_nfc_init(struct marvell_nfc *nfc)
+ struct regmap *sysctrl_base =
+ syscon_regmap_lookup_by_phandle(np,
+ "marvell,system-controller");
+- u32 reg;
+
+ if (IS_ERR(sysctrl_base))
+ return PTR_ERR(sysctrl_base);
+
+- reg = GENCONF_SOC_DEVICE_MUX_NFC_EN |
+- GENCONF_SOC_DEVICE_MUX_ECC_CLK_RST |
+- GENCONF_SOC_DEVICE_MUX_ECC_CORE_RST |
+- GENCONF_SOC_DEVICE_MUX_NFC_INT_EN;
+- regmap_write(sysctrl_base, GENCONF_SOC_DEVICE_MUX, reg);
++ regmap_write(sysctrl_base, GENCONF_SOC_DEVICE_MUX,
++ GENCONF_SOC_DEVICE_MUX_NFC_EN |
++ GENCONF_SOC_DEVICE_MUX_ECC_CLK_RST |
++ GENCONF_SOC_DEVICE_MUX_ECC_CORE_RST |
++ GENCONF_SOC_DEVICE_MUX_NFC_INT_EN);
+
+- regmap_read(sysctrl_base, GENCONF_CLK_GATING_CTRL, ®);
+- reg |= GENCONF_CLK_GATING_CTRL_ND_GATE;
+- regmap_write(sysctrl_base, GENCONF_CLK_GATING_CTRL, reg);
++ regmap_update_bits(sysctrl_base, GENCONF_CLK_GATING_CTRL,
++ GENCONF_CLK_GATING_CTRL_ND_GATE,
++ GENCONF_CLK_GATING_CTRL_ND_GATE);
+
+- regmap_read(sysctrl_base, GENCONF_ND_CLK_CTRL, ®);
+- reg |= GENCONF_ND_CLK_CTRL_EN;
+- regmap_write(sysctrl_base, GENCONF_ND_CLK_CTRL, reg);
++ regmap_update_bits(sysctrl_base, GENCONF_ND_CLK_CTRL,
++ GENCONF_ND_CLK_CTRL_EN,
++ GENCONF_ND_CLK_CTRL_EN);
+ }
+
+ /* Configure the DMA if appropriate */
+--
+2.20.1
+
--- /dev/null
+From c79b682a0476a58909a0370ffc7d437d5c806e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 10:59:43 +0200
+Subject: mtd: rawnand: qcom: don't include dma-direct.h
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit ab0fb17c7d46406e1aac2dda265874751946626d ]
+
+A recent commit removed the incorrect use of phys_to_dma from this
+driver, but failed to remove the dma-direct.h include, so do that
+now.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 880e75f63a19b..07d8750313fd6 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -23,7 +23,6 @@
+ #include <linux/of_device.h>
+ #include <linux/delay.h>
+ #include <linux/dma/qcom_bam_dma.h>
+-#include <linux/dma-direct.h> /* XXX: drivers shall never use this directly! */
+
+ /* NANDc reg offsets */
+ #define NAND_FLASH_CMD 0x00
+--
+2.20.1
+
--- /dev/null
+From 0b997917d9cb115ecb95b509befe30b0a435611b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 13:23:02 +0530
+Subject: mwifex: free rx_cmd skb in suspended state
+
+From: Ganapathi Bhat <gbhat@marvell.com>
+
+[ Upstream commit 33a164fa8a4c91408e0b7738f754cb1a7827c5f2 ]
+
+USB suspend handler will kill the presubmitted rx_cmd URB. This
+triggers a call to the corresponding URB complete handler, which
+will free the rx_cmd skb, associated with rx_cmd URB. Due to a
+possible race betwen suspend handler and main thread, depicted in
+'commit bfcacac6c84b ("mwifiex: do no submit URB in suspended
+state")', it is possible that the rx_cmd skb will fail to get
+freed. This causes a memory leak, since the resume handler will
+always allocate a new rx_cmd skb.
+
+To fix this, free the rx_cmd skb in mwifiex_usb_submit_rx_urb, if
+the device is in suspended state.
+
+Signed-off-by: Vidya Dharmaraju <vidyad@marvell.com>
+Signed-off-by: Cathy Luo <cluo@marvell.com>
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/usb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 76d80fd545236..d445acc4786b7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -299,6 +299,12 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size)
+ struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+
+ if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
++ if (card->rx_cmd_ep == ctx->ep) {
++ mwifiex_dbg(adapter, INFO, "%s: free rx_cmd skb\n",
++ __func__);
++ dev_kfree_skb_any(ctx->skb);
++ ctx->skb = NULL;
++ }
+ mwifiex_dbg(adapter, ERROR,
+ "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n",
+ __func__, ctx->ep);
+--
+2.20.1
+
--- /dev/null
+From 7007d54e5f9334136b1f775be000aba92e1145d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 13:23:01 +0530
+Subject: mwifiex: do no submit URB in suspended state
+
+From: Ganapathi Bhat <gbhat@marvell.com>
+
+[ Upstream commit 7bd4628c2f31c51254aa39628ecae521d00d0b90 ]
+
+There is a possible race between USB suspend and main thread:
+
+1. After processing the command response, main thread will submit
+rx_cmd URB back so as to process next command response, by
+calling mwifiex_usb_submit_rx_urb.
+
+2. During USB suspend, the suspend handler will check if rx_cmd
+URB is pending(submitted) and if true, kill this URB.
+
+There is a possible race between #1 and #2, where rx_cmd URB will
+be submitted by main thread(#1) after the suspend handler check
+in #2.
+
+To fix this, check if device is already suspended in
+mwifiex_usb_submit_rx_urb, in which case do not submit the URB.
+
+Signed-off-by: Vidya Dharmaraju <vidyad@marvell.com>
+Signed-off-by: Cathy Luo <cluo@marvell.com>
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/usb.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 433c6a16870b6..76d80fd545236 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -298,6 +298,13 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size)
+ struct mwifiex_adapter *adapter = ctx->adapter;
+ struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+
++ if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
++ mwifiex_dbg(adapter, ERROR,
++ "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n",
++ __func__, ctx->ep);
++ return -1;
++ }
++
+ if (card->rx_cmd_ep != ctx->ep) {
+ ctx->skb = dev_alloc_skb(size);
+ if (!ctx->skb) {
+--
+2.20.1
+
--- /dev/null
+From bb45b2f2333117de66b9d072895008817fc54dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:50:17 +0800
+Subject: net: amd: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/am79c961a.c | 2 +-
+ drivers/net/ethernet/amd/atarilance.c | 6 ++++--
+ drivers/net/ethernet/amd/declance.c | 2 +-
+ drivers/net/ethernet/amd/sun3lance.c | 6 ++++--
+ drivers/net/ethernet/amd/sunlance.c | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++--
+ 6 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
+index 01d132c02ff90..265039c57023f 100644
+--- a/drivers/net/ethernet/amd/am79c961a.c
++++ b/drivers/net/ethernet/amd/am79c961a.c
+@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev)
+ /*
+ * Transmit a packet
+ */
+-static int
++static netdev_tx_t
+ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dev_priv *priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index c5b81268c2849..d3d44e07afbc0 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -769,7 +770,8 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index 00332a1ea84b9..9f23703dd509f 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -894,7 +894,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 77b1db2677309..da7e3d4f41661 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -236,7 +236,8 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 19f89d9b1781f..9d48998268233 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 24f1053b8785e..d96a84a62d78d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -2009,7 +2009,7 @@ static int xgbe_close(struct net_device *netdev)
+ return 0;
+ }
+
+-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct xgbe_prv_data *pdata = netdev_priv(netdev);
+ struct xgbe_hw_if *hw_if = &pdata->hw_if;
+@@ -2018,7 +2018,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ struct xgbe_ring *ring;
+ struct xgbe_packet_data *packet;
+ struct netdev_queue *txq;
+- int ret;
++ netdev_tx_t ret;
+
+ DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len);
+
+--
+2.20.1
+
--- /dev/null
+From d8001e83c3d9740ef68c9f7636ad17a4220d175b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 12:39:28 +0300
+Subject: net: aquantia: fix hw_atl_utils_fw_upload_dwords
+
+From: Yana Esina <yana.esina@aquantia.com>
+
+[ Upstream commit 3ee5c8873fd369e2005dc93bf6d4b299b4976e68 ]
+
+This patch fixes the upload function, which worked incorrectly with
+some chips.
+
+Signed-off-by: Yana Esina <yana.esina@aquantia.com>
+Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Tested-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../aquantia/atlantic/hw_atl/hw_atl_llh.c | 8 +++++
+ .../aquantia/atlantic/hw_atl/hw_atl_llh.h | 3 ++
+ .../atlantic/hw_atl/hw_atl_llh_internal.h | 13 +++++++
+ .../aquantia/atlantic/hw_atl/hw_atl_utils.c | 36 +++++++++++++------
+ .../aquantia/atlantic/hw_atl/hw_atl_utils.h | 5 +++
+ .../atlantic/hw_atl/hw_atl_utils_fw2x.c | 5 +++
+ 6 files changed, 59 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 10ec5dc88e243..5502ec5f0f699 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -1468,3 +1468,11 @@ void hw_atl_reg_glb_cpu_scratch_scp_set(struct aq_hw_s *aq_hw,
+ aq_hw_write_reg(aq_hw, HW_ATL_GLB_CPU_SCRATCH_SCP_ADR(scratch_scp),
+ glb_cpu_scratch_scp);
+ }
++
++void hw_atl_mcp_up_force_intr_set(struct aq_hw_s *aq_hw, u32 up_force_intr)
++{
++ aq_hw_write_reg_bit(aq_hw, HW_ATL_MCP_UP_FORCE_INTERRUPT_ADR,
++ HW_ATL_MCP_UP_FORCE_INTERRUPT_MSK,
++ HW_ATL_MCP_UP_FORCE_INTERRUPT_SHIFT,
++ up_force_intr);
++}
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index b3bf64b48b93d..41f239928c157 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -701,4 +701,7 @@ void hw_atl_msm_reg_wr_strobe_set(struct aq_hw_s *aq_hw, u32 reg_wr_strobe);
+ /* set pci register reset disable */
+ void hw_atl_pci_pci_reg_res_dis_set(struct aq_hw_s *aq_hw, u32 pci_reg_res_dis);
+
++/* set uP Force Interrupt */
++void hw_atl_mcp_up_force_intr_set(struct aq_hw_s *aq_hw, u32 up_force_intr);
++
+ #endif /* HW_ATL_LLH_H */
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index e2ecdb1c5a5c4..a715fa317b1c8 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -2405,4 +2405,17 @@
+ #define HW_ATL_GLB_CPU_SCRATCH_SCP_ADR(scratch_scp) \
+ (0x00000300u + (scratch_scp) * 0x4)
+
++/* register address for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_ADR 0x00000404
++/* bitmask for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_MSK 0x00000002
++/* inverted bitmask for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_MSKN 0xFFFFFFFD
++/* lower bit position of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_SHIFT 1
++/* width of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_WIDTH 1
++/* default value of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_DEFAULT 0x0
++
+ #endif /* HW_ATL_LLH_INTERNAL_H */
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index 9939ccaeb125b..096ec18e8f15a 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -327,17 +327,31 @@ static int hw_atl_utils_fw_upload_dwords(struct aq_hw_s *self, u32 a, u32 *p,
+ err = -ETIME;
+ goto err_exit;
+ }
++ if (IS_CHIP_FEATURE(REVISION_B1)) {
++ u32 offset = 0;
++
++ for (; offset < cnt; ++offset) {
++ aq_hw_write_reg(self, 0x328, p[offset]);
++ aq_hw_write_reg(self, 0x32C,
++ (0x80000000 | (0xFFFF & (offset * 4))));
++ hw_atl_mcp_up_force_intr_set(self, 1);
++ /* 1000 times by 10us = 10ms */
++ AQ_HW_WAIT_FOR((aq_hw_read_reg(self,
++ 0x32C) & 0xF0000000) !=
++ 0x80000000,
++ 10, 1000);
++ }
++ } else {
++ u32 offset = 0;
+
+- aq_hw_write_reg(self, 0x00000208U, a);
+-
+- for (++cnt; --cnt;) {
+- u32 i = 0U;
++ aq_hw_write_reg(self, 0x208, a);
+
+- aq_hw_write_reg(self, 0x0000020CU, *(p++));
+- aq_hw_write_reg(self, 0x00000200U, 0xC000U);
++ for (; offset < cnt; ++offset) {
++ aq_hw_write_reg(self, 0x20C, p[offset]);
++ aq_hw_write_reg(self, 0x200, 0xC000);
+
+- for (i = 1024U;
+- (0x100U & aq_hw_read_reg(self, 0x00000200U)) && --i;) {
++ AQ_HW_WAIT_FOR((aq_hw_read_reg(self, 0x200U) &
++ 0x100) == 0, 10, 1000);
+ }
+ }
+
+@@ -401,7 +415,7 @@ struct aq_hw_atl_utils_fw_rpc_tid_s {
+
+ #define hw_atl_utils_fw_rpc_init(_H_) hw_atl_utils_fw_rpc_wait(_H_, NULL)
+
+-static int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size)
++int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size)
+ {
+ int err = 0;
+ struct aq_hw_atl_utils_fw_rpc_tid_s sw;
+@@ -425,8 +439,8 @@ err_exit:
+ return err;
+ }
+
+-static int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
+- struct hw_aq_atl_utils_fw_rpc **rpc)
++int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
++ struct hw_aq_atl_utils_fw_rpc **rpc)
+ {
+ int err = 0;
+ struct aq_hw_atl_utils_fw_rpc_tid_s sw;
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+index b875590efcbdd..505c8a2abd9ca 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+@@ -319,6 +319,11 @@ struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
+ int hw_atl_utils_fw_downld_dwords(struct aq_hw_s *self, u32 a,
+ u32 *p, u32 cnt);
+
++int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size);
++
++int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
++ struct hw_aq_atl_utils_fw_rpc **rpc);
++
+ extern const struct aq_fw_ops aq_fw_1x_ops;
+ extern const struct aq_fw_ops aq_fw_2x_ops;
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+index e37943760a58b..6300d94c9ff07 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+@@ -21,6 +21,7 @@
+
+ #define HW_ATL_FW2X_MPI_EFUSE_ADDR 0x364
+ #define HW_ATL_FW2X_MPI_MBOX_ADDR 0x360
++#define HW_ATL_FW2X_MPI_RPC_ADDR 0x334
+
+ #define HW_ATL_FW2X_MPI_CONTROL_ADDR 0x368
+ #define HW_ATL_FW2X_MPI_CONTROL2_ADDR 0x36C
+@@ -40,6 +41,10 @@ static int aq_fw2x_init(struct aq_hw_s *self)
+ AQ_HW_WAIT_FOR(0U != (self->mbox_addr =
+ aq_hw_read_reg(self, HW_ATL_FW2X_MPI_MBOX_ADDR)),
+ 1000U, 10U);
++ AQ_HW_WAIT_FOR(0U != (self->rpc_addr =
++ aq_hw_read_reg(self, HW_ATL_FW2X_MPI_RPC_ADDR)),
++ 1000U, 100U);
++
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 74ab74b50fd3aaf92e5708ac9af825076423f122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 01:53:12 +0200
+Subject: net: bcmgenet: Fix speed selection for reverse MII
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit 00eb2243b933a496958f4ce1bcf59840fea8be16 ]
+
+The phy supported speed is being used to determine if the MAC should
+be configured to 100 or 1G. The masking logic is broken. Instead, look
+at 1G supported speeds to enable 1G MAC support.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 0d527fa5de610..b0592fd4135b3 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -226,11 +226,10 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ * capabilities, use that knowledge to also configure the
+ * Reverse MII interface correctly.
+ */
+- if ((dev->phydev->supported & PHY_BASIC_FEATURES) ==
+- PHY_BASIC_FEATURES)
+- port_ctrl = PORT_MODE_EXT_RVMII_25;
+- else
++ if (dev->phydev->supported & PHY_1000BT_FEATURES)
+ port_ctrl = PORT_MODE_EXT_RVMII_50;
++ else
++ port_ctrl = PORT_MODE_EXT_RVMII_25;
+ bcmgenet_sys_writel(priv, port_ctrl, SYS_PORT_CTRL);
+ break;
+
+--
+2.20.1
+
--- /dev/null
+From 4024715a8505904ac090358e46e12a1337537078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:45:12 +0800
+Subject: net: broadcom: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++--
+ drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index 897302adc38ec..50f8a377596e1 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -568,12 +568,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
+ u32 len_stat;
+- int ret;
++ netdev_tx_t ret;
+
+ priv = netdev_priv(dev);
+
+diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
+index ef4a0c326736d..7e3f9642ba6c5 100644
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -299,7 +299,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *,
+ static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff);
+ static uint64_t sbmac_addr2reg(unsigned char *ptr);
+ static irqreturn_t sbmac_intr(int irq, void *dev_instance);
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
+ static void sbmac_setmulti(struct sbmac_softc *sc);
+ static int sbmac_init(struct platform_device *pldev, long long base);
+ static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed);
+@@ -2028,7 +2028,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance)
+ * Return value:
+ * nothing
+ ********************************************************************* */
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sbmac_softc *sc = netdev_priv(dev);
+ unsigned long flags;
+--
+2.20.1
+
--- /dev/null
+From 5e3773a96acb515a3b471af3dc19b626219d1354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 14:19:05 +0800
+Subject: net: cavium: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit ac1172dea10b6ba51de9346d3130db688b5196c5 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/lio_main.c | 2 +-
+ drivers/net/ethernet/cavium/liquidio/lio_vf_main.c | 2 +-
+ drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 5 +++--
+ drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 5 +++--
+ 4 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+index 6fb13fa73b271..304e4b9436276 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+@@ -2324,7 +2324,7 @@ static inline int send_nic_timestamp_pkt(struct octeon_device *oct,
+ * @returns whether the packet was transmitted to the device okay or not
+ * (NETDEV_TX_OK or NETDEV_TX_BUSY)
+ */
+-static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct lio *lio;
+ struct octnet_buf_free_info *finfo;
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+index b77835724dc84..d83773bc0dd7f 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+@@ -1390,7 +1390,7 @@ static int send_nic_timestamp_pkt(struct octeon_device *oct,
+ * @returns whether the packet was transmitted to the device okay or not
+ * (NETDEV_TX_OK or NETDEV_TX_BUSY)
+ */
+-static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct octnet_buf_free_info *finfo;
+ union octnic_cmd_setup cmdsetup;
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+index c99b59fe4c8fb..a1bda1683ebfc 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+@@ -31,7 +31,8 @@
+
+ static int lio_vf_rep_open(struct net_device *ndev);
+ static int lio_vf_rep_stop(struct net_device *ndev);
+-static int lio_vf_rep_pkt_xmit(struct sk_buff *skb, struct net_device *ndev);
++static netdev_tx_t lio_vf_rep_pkt_xmit(struct sk_buff *skb,
++ struct net_device *ndev);
+ static void lio_vf_rep_tx_timeout(struct net_device *netdev);
+ static int lio_vf_rep_phys_port_name(struct net_device *dev,
+ char *buf, size_t len);
+@@ -382,7 +383,7 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct,
+ netif_wake_queue(ndev);
+ }
+
+-static int
++static netdev_tx_t
+ lio_vf_rep_pkt_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct lio_vf_rep_desc *vf_rep = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+index 592fb9e847b95..0957e735cdc4d 100644
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -1268,12 +1268,13 @@ static int octeon_mgmt_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct octeon_mgmt *p = netdev_priv(netdev);
+ union mgmt_port_ring_entry re;
+ unsigned long flags;
+- int rv = NETDEV_TX_BUSY;
++ netdev_tx_t rv = NETDEV_TX_BUSY;
+
+ re.d64 = 0;
+ re.s.tstamp = ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) != 0);
+--
+2.20.1
+
--- /dev/null
+From 793236ab4714b638edf4d93a98a0f3740c705c44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:13:05 +0800
+Subject: net: faraday: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0a715156656bddf4aa92d9868f850aeeb0465fd0 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/faraday/ftgmac100.c | 4 ++--
+ drivers/net/ethernet/faraday/ftmac100.c | 7 ++++---
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index f6ed889bc36a2..e4fc38cbe8535 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -712,8 +712,8 @@ static bool ftgmac100_prep_tx_csum(struct sk_buff *skb, u32 *csum_vlan)
+ return skb_checksum_help(skb) == 0;
+ }
+
+-static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
+- struct net_device *netdev)
++static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
++ struct net_device *netdev)
+ {
+ struct ftgmac100 *priv = netdev_priv(netdev);
+ struct ftgmac100_txdes *txdes, *first;
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index 9015bd911bee9..084f24daf2b5a 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -634,8 +634,8 @@ static void ftmac100_tx_complete(struct ftmac100 *priv)
+ ;
+ }
+
+-static int ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
+- dma_addr_t map)
++static netdev_tx_t ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
++ dma_addr_t map)
+ {
+ struct net_device *netdev = priv->netdev;
+ struct ftmac100_txdes *txdes;
+@@ -1015,7 +1015,8 @@ static int ftmac100_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ftmac100 *priv = netdev_priv(netdev);
+ dma_addr_t map;
+--
+2.20.1
+
--- /dev/null
+From 52c11a596d12e62ed691fb0095f415de4b9b5cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:50:32 +0800
+Subject: net: freescale: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 06983aa526c759ebdf43f202d8d0491d9494e2f4 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 3 ++-
+ drivers/net/ethernet/freescale/fec_mpc52xx.c | 3 ++-
+ drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c | 3 ++-
+ drivers/net/ethernet/freescale/gianfar.c | 4 ++--
+ drivers/net/ethernet/freescale/ucc_geth.c | 3 ++-
+ 5 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index d7915cd68dc14..462bb8c4f80c9 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2046,7 +2046,8 @@ static inline int dpaa_xmit(struct dpaa_priv *priv,
+ return 0;
+ }
+
+-static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
++static netdev_tx_t
++dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ {
+ const int queue_mapping = skb_get_queue_mapping(skb);
+ bool nonlinear = skb_is_nonlinear(skb);
+diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+index 6d7269d87a850..b90bab72efdb3 100644
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+@@ -305,7 +305,8 @@ static int mpc52xx_fec_close(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+ struct bcom_fec_bd *bd;
+diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+index 2c2976a2dda6b..7c548ed535da5 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+@@ -481,7 +481,8 @@ static struct sk_buff *tx_skb_align_workaround(struct net_device *dev,
+ }
+ #endif
+
+-static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct fs_enet_private *fep = netdev_priv(dev);
+ cbd_t __iomem *bdp;
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index f27f9bae1a4ac..c97c4edfa31bc 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -112,7 +112,7 @@
+ const char gfar_driver_version[] = "2.0";
+
+ static int gfar_enet_open(struct net_device *dev);
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static void gfar_reset_task(struct work_struct *work);
+ static void gfar_timeout(struct net_device *dev);
+ static int gfar_close(struct net_device *dev);
+@@ -2334,7 +2334,7 @@ static inline bool gfar_csum_errata_76(struct gfar_private *priv,
+ /* This is called by the kernel when a frame is ready for transmission.
+ * It is pointed to by the dev->hard_start_xmit function pointer
+ */
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct gfar_private *priv = netdev_priv(dev);
+ struct gfar_priv_tx_q *tx_queue = NULL;
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 1e2b53a934fb9..a5bf02ae4bc5c 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3085,7 +3085,8 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
+
+ /* This is called by the kernel when a frame is ready for transmission. */
+ /* It is pointed to by the dev->hard_start_xmit function pointer */
+-static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ucc_geth_private *ugeth = netdev_priv(dev);
+ #ifdef CONFIG_UGETH_TX_ON_DEMAND
+--
+2.20.1
+
--- /dev/null
+From fab73ebddc70fa58206f687279e0f4d4372921a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 11:21:54 +0100
+Subject: net: hns3: Change the dst mac addr of loopback packet
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 7f7d9e501f4123e64b130576621d24f9379adc8f ]
+
+Currently, the dst mac addr of loopback packet is the same as
+the host' mac addr, the SSU component may loop back the packet
+to host before the packet reaches mac or serdes, which will defect
+the purpose of mac or serdes selftest.
+
+This patch changes it by adding 0x1f to the last byte of dst mac
+addr.
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 5bdcd92d86122..0c34ea1223580 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -137,6 +137,7 @@ static void hns3_lp_setup_skb(struct sk_buff *skb)
+ packet = skb_put(skb, HNS3_NIC_LB_TEST_PACKET_SIZE);
+
+ memcpy(ethh->h_dest, ndev->dev_addr, ETH_ALEN);
++ ethh->h_dest[5] += 0x1f;
+ eth_zero_addr(ethh->h_source);
+ ethh->h_proto = htons(ETH_P_ARP);
+ skb_reset_mac_header(skb);
+--
+2.20.1
+
--- /dev/null
+From 33d3468b90863e0906b1872fc462171fe5852a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:56 +0100
+Subject: net: hns3: Clear client pointer when initialize client failed or
+ unintialize finished
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 49dd80541c75c2f21c28bbbdd958e993b55bf97b ]
+
+If initialize client failed or finish uninitializing client, we should
+clear the client pointer. It may cause unexpected result when use
+uninitialized client. Meanwhile, we also should check whether client
+exist when uninitialize it.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 25 +++++++++-----
+ .../hisilicon/hns3/hns3vf/hclgevf_main.c | 33 ++++++++++++++-----
+ 2 files changed, 41 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 6889e83a55707..c5e617fdb809f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5476,13 +5476,13 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ vport->nic.client = client;
+ ret = client->ops->init_instance(&vport->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
+
+ ret = hclge_init_instance_hw(hdev);
+ if (ret) {
+ client->ops->uninit_instance(&vport->nic,
+ 0);
+- return ret;
++ goto clear_nic;
+ }
+
+ if (hdev->roce_client &&
+@@ -5491,11 +5491,11 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+
+ ret = hclge_init_roce_base_info(vport);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = rc->ops->init_instance(&vport->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ }
+
+ break;
+@@ -5505,7 +5505,7 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&vport->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
+
+ break;
+ case HNAE3_CLIENT_ROCE:
+@@ -5517,16 +5517,25 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ if (hdev->roce_client && hdev->nic_client) {
+ ret = hclge_init_roce_base_info(vport);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = client->ops->init_instance(&vport->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ }
+ }
+ }
+
+ return 0;
++
++clear_nic:
++ hdev->nic_client = NULL;
++ vport->nic.client = NULL;
++ return ret;
++clear_roce:
++ hdev->roce_client = NULL;
++ vport->roce.client = NULL;
++ return ret;
+ }
+
+ static void hclge_uninit_client_instance(struct hnae3_client *client,
+@@ -5546,7 +5555,7 @@ static void hclge_uninit_client_instance(struct hnae3_client *client,
+ }
+ if (client->type == HNAE3_CLIENT_ROCE)
+ return;
+- if (client->ops->uninit_instance) {
++ if (hdev->nic_client && client->ops->uninit_instance) {
+ hclge_uninit_instance_hw(hdev);
+ client->ops->uninit_instance(&vport->nic, 0);
+ hdev->nic_client = NULL;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 5570fb5dc2eb4..83fcdd326de71 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1629,17 +1629,17 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&hdev->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
+
+ if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
+ struct hnae3_client *rc = hdev->roce_client;
+
+ ret = hclgevf_init_roce_base_info(hdev);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ ret = rc->ops->init_instance(&hdev->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ }
+ break;
+ case HNAE3_CLIENT_UNIC:
+@@ -1648,7 +1648,7 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&hdev->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
+ break;
+ case HNAE3_CLIENT_ROCE:
+ if (hnae3_dev_roce_supported(hdev)) {
+@@ -1659,15 +1659,24 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ if (hdev->roce_client && hdev->nic_client) {
+ ret = hclgevf_init_roce_base_info(hdev);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = client->ops->init_instance(&hdev->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ }
+ }
+
+ return 0;
++
++clear_nic:
++ hdev->nic_client = NULL;
++ hdev->nic.client = NULL;
++ return ret;
++clear_roce:
++ hdev->roce_client = NULL;
++ hdev->roce.client = NULL;
++ return ret;
+ }
+
+ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
+@@ -1676,13 +1685,19 @@ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
+ struct hclgevf_dev *hdev = ae_dev->priv;
+
+ /* un-init roce, if it exists */
+- if (hdev->roce_client)
++ if (hdev->roce_client) {
+ hdev->roce_client->ops->uninit_instance(&hdev->roce, 0);
++ hdev->roce_client = NULL;
++ hdev->roce.client = NULL;
++ }
+
+ /* un-init nic/unic, if this was not called by roce client */
+- if ((client->ops->uninit_instance) &&
+- (client->type != HNAE3_CLIENT_ROCE))
++ if (client->ops->uninit_instance && hdev->nic_client &&
++ client->type != HNAE3_CLIENT_ROCE) {
+ client->ops->uninit_instance(&hdev->nic, 0);
++ hdev->nic_client = NULL;
++ hdev->nic.client = NULL;
++ }
+ }
+
+ static int hclgevf_pci_init(struct hclgevf_dev *hdev)
+--
+2.20.1
+
--- /dev/null
+From b1fa560df4868601df81e2dee362aa44cc432d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:57 +0100
+Subject: net: hns3: Fix client initialize state issue when roce client
+ initialize failed
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit d9f28fc23d544f673d087b00a6c7132d972f89ea ]
+
+When roce is loaded before nic, the roce client will not be initialized
+until nic client is initialized, but roce init flag is set before it.
+Furthermore, in this case of nic initialized success and roce failed,
+the nic init flag is not set, and roce init flag is not cleared.
+
+This patch fixes it by set init flag only after the client is initialized
+successfully.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 12 +++++-------
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 +++
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 9 +++++++++
+ .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 9 +++++++++
+ 4 files changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 0594a6c3dccda..2097f92e14c5c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -29,8 +29,8 @@ static bool hnae3_client_match(enum hnae3_client_type client_type,
+ return false;
+ }
+
+-static void hnae3_set_client_init_flag(struct hnae3_client *client,
+- struct hnae3_ae_dev *ae_dev, int inited)
++void hnae3_set_client_init_flag(struct hnae3_client *client,
++ struct hnae3_ae_dev *ae_dev, int inited)
+ {
+ switch (client->type) {
+ case HNAE3_CLIENT_KNIC:
+@@ -46,6 +46,7 @@ static void hnae3_set_client_init_flag(struct hnae3_client *client,
+ break;
+ }
+ }
++EXPORT_SYMBOL(hnae3_set_client_init_flag);
+
+ static int hnae3_get_client_init_flag(struct hnae3_client *client,
+ struct hnae3_ae_dev *ae_dev)
+@@ -86,14 +87,11 @@ static int hnae3_match_n_instantiate(struct hnae3_client *client,
+ /* now, (un-)instantiate client by calling lower layer */
+ if (is_reg) {
+ ret = ae_dev->ops->init_client_instance(client, ae_dev);
+- if (ret) {
++ if (ret)
+ dev_err(&ae_dev->pdev->dev,
+ "fail to instantiate client, ret = %d\n", ret);
+- return ret;
+- }
+
+- hnae3_set_client_init_flag(client, ae_dev, 1);
+- return 0;
++ return ret;
+ }
+
+ if (hnae3_get_client_init_flag(client, ae_dev)) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 67befff0bfc50..f5c7fc9c5e5cc 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -521,4 +521,7 @@ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo);
+
+ void hnae3_unregister_client(struct hnae3_client *client);
+ int hnae3_register_client(struct hnae3_client *client);
++
++void hnae3_set_client_init_flag(struct hnae3_client *client,
++ struct hnae3_ae_dev *ae_dev, int inited);
+ #endif
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index c5e617fdb809f..b04df79f393f8 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5485,6 +5485,8 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ goto clear_nic;
+ }
+
++ hnae3_set_client_init_flag(client, ae_dev, 1);
++
+ if (hdev->roce_client &&
+ hnae3_dev_roce_supported(hdev)) {
+ struct hnae3_client *rc = hdev->roce_client;
+@@ -5496,6 +5498,9 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ ret = rc->ops->init_instance(&vport->roce);
+ if (ret)
+ goto clear_roce;
++
++ hnae3_set_client_init_flag(hdev->roce_client,
++ ae_dev, 1);
+ }
+
+ break;
+@@ -5507,6 +5512,8 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ if (ret)
+ goto clear_nic;
+
++ hnae3_set_client_init_flag(client, ae_dev, 1);
++
+ break;
+ case HNAE3_CLIENT_ROCE:
+ if (hnae3_dev_roce_supported(hdev)) {
+@@ -5522,6 +5529,8 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ ret = client->ops->init_instance(&vport->roce);
+ if (ret)
+ goto clear_roce;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ }
+ }
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 83fcdd326de71..beae1e2cd59b1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1631,6 +1631,8 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ if (ret)
+ goto clear_nic;
+
++ hnae3_set_client_init_flag(client, ae_dev, 1);
++
+ if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
+ struct hnae3_client *rc = hdev->roce_client;
+
+@@ -1640,6 +1642,9 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ ret = rc->ops->init_instance(&hdev->roce);
+ if (ret)
+ goto clear_roce;
++
++ hnae3_set_client_init_flag(hdev->roce_client, ae_dev,
++ 1);
+ }
+ break;
+ case HNAE3_CLIENT_UNIC:
+@@ -1649,6 +1654,8 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ ret = client->ops->init_instance(&hdev->nic);
+ if (ret)
+ goto clear_nic;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ break;
+ case HNAE3_CLIENT_ROCE:
+ if (hnae3_dev_roce_supported(hdev)) {
+@@ -1665,6 +1672,8 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ if (ret)
+ goto clear_roce;
+ }
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From ada5c927d9dc2fbcc20885996c656bbd18e5e389 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:55 +0100
+Subject: net: hns3: Fix cmdq registers initialization issue for vf
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 37dc9cdbdc1bd64bd3b6ea285a9c2e811404dc82 ]
+
+According to hardware's description, the head pointer register should
+be written before the tail pointer register while initializing the vf
+command queue. Otherwise, it may trigger an interrupt even though there
+is no command received.
+
+Fixes: fedd0c15d288 ("net: hns3: Add HNS3 VF IMP(Integrated Management Proc) cmd interface")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+index fb471fe2c4946..d8c0cc8e04c9d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+@@ -132,8 +132,8 @@ static int hclgevf_init_cmd_queue(struct hclgevf_dev *hdev,
+ reg_val |= HCLGEVF_NIC_CMQ_ENABLE;
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_DEPTH_REG, reg_val);
+
+- hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_TAIL_REG, 0);
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_HEAD_REG, 0);
++ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_TAIL_REG, 0);
+ break;
+ case HCLGEVF_TYPE_CRQ:
+ reg_val = (u32)ring->desc_dma_addr;
+@@ -145,8 +145,8 @@ static int hclgevf_init_cmd_queue(struct hclgevf_dev *hdev,
+ reg_val |= HCLGEVF_NIC_CMQ_ENABLE;
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_DEPTH_REG, reg_val);
+
+- hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_TAIL_REG, 0);
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_HEAD_REG, 0);
++ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_TAIL_REG, 0);
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7844f2b4e216fefba118311def51df6f02043c35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 11:21:48 +0100
+Subject: net: hns3: Fix error of checking used vlan id
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 54e97d117bafa161b08c6ade243a335d92890d94 ]
+
+PF uses hdev->vlan_table to manage the port vlan table. In function
+hclge_set_vlan_filter_hw(), it checks whether a vlan id has been used,
+by foreach all the vport bits. It should use macro HCLGE_VPORT_NUM,
+not VLAN_N_VID as the foreach condition.
+
+Fixes: 6c251711b37f ("net: hns3: Disable vf vlan filter when vf vlan table is full")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 44d0cb3f73a44..0e7c92f624e91 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4784,7 +4784,7 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+ return -EINVAL;
+ }
+
+- for_each_set_bit(vport_idx, hdev->vlan_table[vlan_id], VLAN_N_VID)
++ for_each_set_bit(vport_idx, hdev->vlan_table[vlan_id], HCLGE_VPORT_NUM)
+ vport_num++;
+
+ if ((is_kill && vport_num == 0) || (!is_kill && vport_num == 1))
+--
+2.20.1
+
--- /dev/null
+From 0b2c8b316297a6979c5ca483c9809bb675537474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 11:21:50 +0100
+Subject: net: hns3: Fix for loopback selftest failed problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 0f29fc23b21d3cbd966537bfabba07c00466b787 ]
+
+Tqp and mac need to be enabled when doing loopback selftest,
+ae_algo->ops->start/stop is used to do the job, there is a
+time window between ae_algo->ops->start/stop and loopback setup,
+which will cause selftest failed problem when there is frame
+coming in during that time window.
+
+This patch fixes it by enabling the tqp and mac during loopback
+setup process.
+
+Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3_ethtool.c | 17 +------
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 51 +++++++++++--------
+ 2 files changed, 31 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 6a3c6b02a77cd..5bdcd92d86122 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -100,41 +100,26 @@ static int hns3_lp_up(struct net_device *ndev, enum hnae3_loop loop_mode)
+ struct hnae3_handle *h = hns3_get_handle(ndev);
+ int ret;
+
+- if (!h->ae_algo->ops->start)
+- return -EOPNOTSUPP;
+-
+ ret = hns3_nic_reset_all_ring(h);
+ if (ret)
+ return ret;
+
+- ret = h->ae_algo->ops->start(h);
+- if (ret) {
+- netdev_err(ndev,
+- "hns3_lb_up ae start return error: %d\n", ret);
+- return ret;
+- }
+-
+ ret = hns3_lp_setup(ndev, loop_mode, true);
+ usleep_range(10000, 20000);
+
+- return ret;
++ return 0;
+ }
+
+ static int hns3_lp_down(struct net_device *ndev, enum hnae3_loop loop_mode)
+ {
+- struct hnae3_handle *h = hns3_get_handle(ndev);
+ int ret;
+
+- if (!h->ae_algo->ops->stop)
+- return -EOPNOTSUPP;
+-
+ ret = hns3_lp_setup(ndev, loop_mode, false);
+ if (ret) {
+ netdev_err(ndev, "lb_setup return error: %d\n", ret);
+ return ret;
+ }
+
+- h->ae_algo->ops->stop(h);
+ usleep_range(10000, 20000);
+
+ return 0;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 0e7c92f624e91..0cf33fa351df3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3666,6 +3666,8 @@ static int hclge_set_mac_loopback(struct hclge_dev *hdev, bool en)
+ /* 2 Then setup the loopback flag */
+ loop_en = le32_to_cpu(req->txrx_pad_fcs_loop_en);
+ hnae3_set_bit(loop_en, HCLGE_MAC_APP_LP_B, en ? 1 : 0);
++ hnae3_set_bit(loop_en, HCLGE_MAC_TX_EN_B, en ? 1 : 0);
++ hnae3_set_bit(loop_en, HCLGE_MAC_RX_EN_B, en ? 1 : 0);
+
+ req->txrx_pad_fcs_loop_en = cpu_to_le32(loop_en);
+
+@@ -3726,15 +3728,36 @@ static int hclge_set_serdes_loopback(struct hclge_dev *hdev, bool en)
+ return -EIO;
+ }
+
++ hclge_cfg_mac_mode(hdev, en);
+ return 0;
+ }
+
++static int hclge_tqp_enable(struct hclge_dev *hdev, int tqp_id,
++ int stream_id, bool enable)
++{
++ struct hclge_desc desc;
++ struct hclge_cfg_com_tqp_queue_cmd *req =
++ (struct hclge_cfg_com_tqp_queue_cmd *)desc.data;
++ int ret;
++
++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_COM_TQP_QUEUE, false);
++ req->tqp_id = cpu_to_le16(tqp_id & HCLGE_RING_ID_MASK);
++ req->stream_id = cpu_to_le16(stream_id);
++ req->enable |= enable << HCLGE_TQP_ENABLE_B;
++
++ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
++ if (ret)
++ dev_err(&hdev->pdev->dev,
++ "Tqp enable fail, status =%d.\n", ret);
++ return ret;
++}
++
+ static int hclge_set_loopback(struct hnae3_handle *handle,
+ enum hnae3_loop loop_mode, bool en)
+ {
+ struct hclge_vport *vport = hclge_get_vport(handle);
+ struct hclge_dev *hdev = vport->back;
+- int ret;
++ int i, ret;
+
+ switch (loop_mode) {
+ case HNAE3_MAC_INTER_LOOP_MAC:
+@@ -3750,27 +3773,13 @@ static int hclge_set_loopback(struct hnae3_handle *handle,
+ break;
+ }
+
+- return ret;
+-}
+-
+-static int hclge_tqp_enable(struct hclge_dev *hdev, int tqp_id,
+- int stream_id, bool enable)
+-{
+- struct hclge_desc desc;
+- struct hclge_cfg_com_tqp_queue_cmd *req =
+- (struct hclge_cfg_com_tqp_queue_cmd *)desc.data;
+- int ret;
+-
+- hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_COM_TQP_QUEUE, false);
+- req->tqp_id = cpu_to_le16(tqp_id & HCLGE_RING_ID_MASK);
+- req->stream_id = cpu_to_le16(stream_id);
+- req->enable |= enable << HCLGE_TQP_ENABLE_B;
++ for (i = 0; i < vport->alloc_tqps; i++) {
++ ret = hclge_tqp_enable(hdev, i, 0, en);
++ if (ret)
++ return ret;
++ }
+
+- ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+- if (ret)
+- dev_err(&hdev->pdev->dev,
+- "Tqp enable fail, status =%d.\n", ret);
+- return ret;
++ return 0;
+ }
+
+ static void hclge_reset_tqp_stats(struct hnae3_handle *handle)
+--
+2.20.1
+
--- /dev/null
+From 2a5d50f9ed50d4d93a9d295d0d0f9f35a410b408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 11:21:47 +0100
+Subject: net: hns3: Fix for multicast failure
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit fd5f9da3f6583046215d614a87792b46e55785e2 ]
+
+When the lower 24 bits of the IPV6 link-local addresses at both
+ends are the same, the multicast MAC address for Neigbour Discovery
+is the same. The multicast for Neigbour Discovery will fail.
+
+This patch fixes it by including the bonding uplink port in the
+multicast group.
+
+Fixes: 46a3df9f9718("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 89ca69fa2b97b..44d0cb3f73a44 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4374,7 +4374,7 @@ int hclge_add_mc_addr_common(struct hclge_vport *vport,
+ hnae3_set_bit(req.flags, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT1_EN_B, 1);
+- hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
++ hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hclge_prepare_mac_addr(&req, addr);
+ status = hclge_lookup_mac_vlan_tbl(vport, &req, desc, true);
+ if (!status) {
+@@ -4441,7 +4441,7 @@ int hclge_rm_mc_addr_common(struct hclge_vport *vport,
+ hnae3_set_bit(req.flags, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT1_EN_B, 1);
+- hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
++ hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hclge_prepare_mac_addr(&req, addr);
+ status = hclge_lookup_mac_vlan_tbl(vport, &req, desc, true);
+ if (!status) {
+--
+2.20.1
+
--- /dev/null
+From 0de6f0a14660b1590c14cac07e8a412d621268e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:54 +0100
+Subject: net: hns3: Fix for setting speed for phy failed problem
+
+From: Fuyun Liang <liangfuyun1@huawei.com>
+
+[ Upstream commit fd8133148eb6a733f9cfdaecd4d99f378e21d582 ]
+
+The function of genphy_read_status is that reading phy information
+from HW and using these information to update SW variable. If user
+is using ethtool to setting the speed of phy and service task is calling
+by hclge_get_mac_phy_link, the result of speed setting is uncertain.
+Because ethtool cmd will modified phydev and hclge_get_mac_phy_link also
+will modified phydev.
+
+Because phy state machine will update phy link periodically, we can
+just use phydev->link to check the link status. This patch removes
+function call of genphy_read_status. To ensure accuracy, this patch
+adds a phy state check. If phy state is not PHY_RUNNING, we consider
+link is down. Because in some scenarios, phydev->link may be link up,
+but phy state is not PHY_RUNNING. This is just an intermediate state.
+In fact, the link is not ready yet.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 0cf33fa351df3..6889e83a55707 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2367,7 +2367,7 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+- if (!genphy_read_status(hdev->hw.mac.phydev))
++ if (hdev->hw.mac.phydev->state == PHY_RUNNING)
+ link_stat = mac_state &
+ hdev->hw.mac.phydev->link;
+ else
+--
+2.20.1
+
--- /dev/null
+From c50c869f8d83be8656910ec6760a6993b4ed7d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:58 +0100
+Subject: net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg()
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 32c7fbc8ffd752c6aa05d2dd7c13b0f0aa00ddaa ]
+
+So far all the places calling hclge_tm_q_to_qs_map_cfg() are assigning
+an u16 type value to "q_id", and in the processing of
+hclge_tm_q_to_qs_map_cfg(), it also converts the "q_id" to le16.
+
+The max tqp number for pf can be more than 256, we should use "u16" to
+store the queue id, instead of "u8", which may cause data lost.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 11e9259ca0407..0d45d045706c7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -298,7 +298,7 @@ static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev,
+ }
+
+ static int hclge_tm_q_to_qs_map_cfg(struct hclge_dev *hdev,
+- u8 q_id, u16 qs_id)
++ u16 q_id, u16 qs_id)
+ {
+ struct hclge_nq_to_qs_link_cmd *map;
+ struct hclge_desc desc;
+--
+2.20.1
+
--- /dev/null
+From 5ebfca403cb81f63ce2efbcc776122ca382bb8de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 14:09:43 +0800
+Subject: net: hns3: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c9c3941186c5637caed131c4f4064411d6882299 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, also the implementation in this
+driver has returns 'netdev_tx_t' value, so just change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 3 ++-
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 644ad78d00515..e8936ae46add9 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -424,7 +424,8 @@ static void hip04_start_tx_timer(struct hip04_priv *priv)
+ ns, HRTIMER_MODE_REL);
+ }
+
+-static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct hip04_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index c5727003af8c1..471805ea363b6 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -736,7 +736,7 @@ static int hix5hd2_fill_sg_desc(struct hix5hd2_priv *priv,
+ return 0;
+ }
+
+-static int hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct hix5hd2_priv *priv = netdev_priv(dev);
+ struct hix5hd2_desc *desc;
+--
+2.20.1
+
--- /dev/null
+From 786748be3fc491b821dcfa2134e6d5f6f2211f24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 14:35:47 +0800
+Subject: net: ibm: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 94b2bb28dbb43fcb943d5275ab19fd5a4972bedb ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ drivers/net/ethernet/ibm/emac/core.c | 7 ++++---
+ drivers/net/ethernet/ibm/ibmvnic.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 506f78322d741..e8ee69d4e4d34 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2027,7 +2027,7 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
+ dev_consume_skb_any(skb);
+ }
+
+-static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ehea_port *port = netdev_priv(dev);
+ struct ehea_swqe *swqe;
+diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
+index 129f4e9f38dac..a96f501813ff7 100644
+--- a/drivers/net/ethernet/ibm/emac/core.c
++++ b/drivers/net/ethernet/ibm/emac/core.c
+@@ -1409,7 +1409,7 @@ static inline u16 emac_tx_csum(struct emac_instance *dev,
+ return 0;
+ }
+
+-static inline int emac_xmit_finish(struct emac_instance *dev, int len)
++static inline netdev_tx_t emac_xmit_finish(struct emac_instance *dev, int len)
+ {
+ struct emac_regs __iomem *p = dev->emacp;
+ struct net_device *ndev = dev->ndev;
+@@ -1436,7 +1436,7 @@ static inline int emac_xmit_finish(struct emac_instance *dev, int len)
+ }
+
+ /* Tx lock BH */
+-static int emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ unsigned int len = skb->len;
+@@ -1494,7 +1494,8 @@ static inline int emac_xmit_split(struct emac_instance *dev, int slot,
+ }
+
+ /* Tx lock BH disabled (SG version for TAH equipped EMACs) */
+-static int emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ int nr_frags = skb_shinfo(skb)->nr_frags;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 8fa14736449bc..8a1916443235a 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1420,7 +1420,7 @@ static int ibmvnic_xmit_workarounds(struct sk_buff *skb,
+ return 0;
+ }
+
+-static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+ int queue_num = skb_get_queue_mapping(skb);
+@@ -1444,7 +1444,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ u64 *handle_array;
+ int index = 0;
+ u8 proto = 0;
+- int ret = 0;
++ netdev_tx_t ret = NETDEV_TX_OK;
+
+ if (adapter->resetting) {
+ if (!netif_subqueue_stopped(netdev, skb))
+--
+2.20.1
+
--- /dev/null
+From 69f6bf1034c9d8084620fbca38c1d99d256dc25a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 19:29:09 +0200
+Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ]
+
+We need to bail out if lan78xx_get_endpoints() fails, otherwise the
+result is overwritten.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Raghuram Chary Jallipalli <raghuramchary.jallipalli@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 3a172fcb06fe0..50bf4b2080d5f 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2950,6 +2950,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ int i;
+
+ ret = lan78xx_get_endpoints(dev, intf);
++ if (ret) {
++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
++ ret);
++ return ret;
++ }
+
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+--
+2.20.1
+
--- /dev/null
+From f31599f0951eb19e06fc5254e646d94bb67e8bd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:19:26 +0800
+Subject: net: marvell: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit f03508ce3f9650148262c176e0178413e16c902b ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +-
+ drivers/net/ethernet/marvell/pxa168_eth.c | 3 ++-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 28762314353f9..4313bbb2396f4 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2394,7 +2394,7 @@ error:
+ }
+
+ /* Main tx processing */
+-static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mvneta_port *pp = netdev_priv(dev);
+ u16 txq_id = skb_get_queue_mapping(skb);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 29f1260535325..1cc0e8fda4d5e 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -2901,7 +2901,7 @@ release:
+ }
+
+ /* Main tx processing */
+-static int mvpp2_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t mvpp2_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mvpp2_port *port = netdev_priv(dev);
+ struct mvpp2_tx_queue *txq, *aggr_txq;
+diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
+index 3a9730612a704..ff2fea0f8b751 100644
+--- a/drivers/net/ethernet/marvell/pxa168_eth.c
++++ b/drivers/net/ethernet/marvell/pxa168_eth.c
+@@ -1260,7 +1260,8 @@ static int pxa168_rx_poll(struct napi_struct *napi, int budget)
+ return work_done;
+ }
+
+-static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct pxa168_eth_private *pep = netdev_priv(dev);
+ struct net_device_stats *stats = &dev->stats;
+--
+2.20.1
+
--- /dev/null
+From 73caafd57a2b9ae787fb491a194669abe09ae310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:42:15 +0800
+Subject: net: micrel: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8695net.c | 2 +-
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index bd51e057e9150..b881f5d4a7f9e 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1164,7 +1164,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 0e9719fbc6243..35f8c9ef204d9 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -1021,9 +1021,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ * spin_lock_irqsave is required because tx and rx should be mutual exclusive.
+ * So while tx is in-progress, prevent IRQ interrupt from happenning.
+ */
+-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+- int retv = NETDEV_TX_OK;
++ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
+
+ disable_irq(netdev->irq);
+--
+2.20.1
+
--- /dev/null
+From d9099da3735f52bfd5b2c3b59972b27600adf12f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 20:19:28 +0300
+Subject: net/mlx5: Fix atomic_mode enum values
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit aa7e80b220f3a543eefbe4b7e2c5d2b73e2e2ef7 ]
+
+The field atomic_mode is 4 bits wide and therefore can hold values
+from 0x0 to 0xf. Remove the unnecessary 20 bit shift that made the values
+be incorrect. While that, remove unused enum values.
+
+Fixes: 57cda166bbe0 ("net/mlx5: Add DCT command interface")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/driver.h | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index e8b92dee5a726..ae64fced188d1 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -163,10 +163,7 @@ enum mlx5_dcbx_oper_mode {
+ };
+
+ enum mlx5_dct_atomic_mode {
+- MLX5_ATOMIC_MODE_DCT_OFF = 20,
+- MLX5_ATOMIC_MODE_DCT_NONE = 0 << MLX5_ATOMIC_MODE_DCT_OFF,
+- MLX5_ATOMIC_MODE_DCT_IB_COMP = 1 << MLX5_ATOMIC_MODE_DCT_OFF,
+- MLX5_ATOMIC_MODE_DCT_CX = 2 << MLX5_ATOMIC_MODE_DCT_OFF,
++ MLX5_ATOMIC_MODE_DCT_CX = 2,
+ };
+
+ enum {
+--
+2.20.1
+
--- /dev/null
+From e3ce12ce9d4ca872e4855cb903eff02bbeb87ff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 11:27:04 +0200
+Subject: net: mvpp2: fix the number of queues per cpu for PPv2.2
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 70afb58e9856a70ff9e45760af2d0ebeb7c46ac2 ]
+
+The Marvell PPv2.2 engine only has 8 Rx queues per CPU, while PPv2.1 has
+16 of them. This patch updates the code so that the Rx queues mask width
+is selected given the version of the network controller used.
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 3 ++-
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 ++++---
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index 67b9e81b7c024..46911b67b0398 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -253,7 +253,8 @@
+ #define MVPP2_ISR_ENABLE_INTERRUPT(mask) ((mask) & 0xffff)
+ #define MVPP2_ISR_DISABLE_INTERRUPT(mask) (((mask) << 16) & 0xffff0000)
+ #define MVPP2_ISR_RX_TX_CAUSE_REG(port) (0x5480 + 4 * (port))
+-#define MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK 0xffff
++#define MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(version) \
++ ((version) == MVPP21 ? 0xffff : 0xff)
+ #define MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK 0xff0000
+ #define MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET 16
+ #define MVPP2_CAUSE_RX_FIFO_OVERRUN_MASK BIT(24)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 9b608d23ff7ee..29f1260535325 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -908,7 +908,7 @@ static void mvpp2_interrupts_unmask(void *arg)
+ u32 val;
+
+ val = MVPP2_CAUSE_MISC_SUM_MASK |
+- MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(port->priv->hw_version);
+ if (port->has_tx_irqs)
+ val |= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
+
+@@ -928,7 +928,7 @@ mvpp2_shared_interrupt_mask_unmask(struct mvpp2_port *port, bool mask)
+ if (mask)
+ val = 0;
+ else
+- val = MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ val = MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(MVPP22);
+
+ for (i = 0; i < port->nqvecs; i++) {
+ struct mvpp2_queue_vector *v = port->qvecs + i;
+@@ -3059,7 +3059,8 @@ static int mvpp2_poll(struct napi_struct *napi, int budget)
+ }
+
+ /* Process RX packets */
+- cause_rx = cause_rx_tx & MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ cause_rx = cause_rx_tx &
++ MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(port->priv->hw_version);
+ cause_rx <<= qv->first_rxq;
+ cause_rx |= qv->pending_cause_rx;
+ while (cause_rx && budget > 0) {
+--
+2.20.1
+
--- /dev/null
+From 9bd91aed639be122f2e809d6f5812b1db27c83bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 17:05:40 -0700
+Subject: net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit b78ac6ecd1b6b46f8767cbafa95a7b0b51b87ad8 ]
+
+Allow the configuration of the MDIO clock divider when the Device Tree
+contains 'clock-frequency' property (similar to I2C and SPI buses).
+Because the hardware may have lost its state during suspend/resume,
+re-apply the MDIO clock divider upon resumption.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/net/brcm,unimac-mdio.txt | 3 +
+ drivers/net/phy/mdio-bcm-unimac.c | 83 ++++++++++++++++++-
+ 2 files changed, 84 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+index 4648948f7c3b8..e15589f477876 100644
+--- a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
++++ b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+@@ -19,6 +19,9 @@ Optional properties:
+ - interrupt-names: must be "mdio_done_error" when there is a share interrupt fed
+ to this hardware block, or must be "mdio_done" for the first interrupt and
+ "mdio_error" for the second when there are separate interrupts
++- clocks: A reference to the clock supplying the MDIO bus controller
++- clock-frequency: the MDIO bus clock that must be output by the MDIO bus
++ hardware, if absent, the default hardware values are used
+
+ Child nodes of this MDIO bus controller node are standard Ethernet PHY device
+ nodes as described in Documentation/devicetree/bindings/net/phy.txt
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index 8d370667fa1b3..80b9583eaa952 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -16,6 +16,7 @@
+ #include <linux/module.h>
+ #include <linux/io.h>
+ #include <linux/delay.h>
++#include <linux/clk.h>
+
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+@@ -45,6 +46,8 @@ struct unimac_mdio_priv {
+ void __iomem *base;
+ int (*wait_func) (void *wait_func_data);
+ void *wait_func_data;
++ struct clk *clk;
++ u32 clk_freq;
+ };
+
+ static inline u32 unimac_mdio_readl(struct unimac_mdio_priv *priv, u32 offset)
+@@ -189,6 +192,35 @@ static int unimac_mdio_reset(struct mii_bus *bus)
+ return 0;
+ }
+
++static void unimac_mdio_clk_set(struct unimac_mdio_priv *priv)
++{
++ unsigned long rate;
++ u32 reg, div;
++
++ /* Keep the hardware default values */
++ if (!priv->clk_freq)
++ return;
++
++ if (!priv->clk)
++ rate = 250000000;
++ else
++ rate = clk_get_rate(priv->clk);
++
++ div = (rate / (2 * priv->clk_freq)) - 1;
++ if (div & ~MDIO_CLK_DIV_MASK) {
++ pr_warn("Incorrect MDIO clock frequency, ignoring\n");
++ return;
++ }
++
++ /* The MDIO clock is the reference clock (typicaly 250Mhz) divided by
++ * 2 x (MDIO_CLK_DIV + 1)
++ */
++ reg = unimac_mdio_readl(priv, MDIO_CFG);
++ reg &= ~(MDIO_CLK_DIV_MASK << MDIO_CLK_DIV_SHIFT);
++ reg |= div << MDIO_CLK_DIV_SHIFT;
++ unimac_mdio_writel(priv, reg, MDIO_CFG);
++}
++
+ static int unimac_mdio_probe(struct platform_device *pdev)
+ {
+ struct unimac_mdio_pdata *pdata = pdev->dev.platform_data;
+@@ -217,9 +249,26 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
++ priv->clk = devm_clk_get(&pdev->dev, NULL);
++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
++ return PTR_ERR(priv->clk);
++ else
++ priv->clk = NULL;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ if (of_property_read_u32(np, "clock-frequency", &priv->clk_freq))
++ priv->clk_freq = 0;
++
++ unimac_mdio_clk_set(priv);
++
+ priv->mii_bus = mdiobus_alloc();
+- if (!priv->mii_bus)
+- return -ENOMEM;
++ if (!priv->mii_bus) {
++ ret = -ENOMEM;
++ goto out_clk_disable;
++ }
+
+ bus = priv->mii_bus;
+ bus->priv = priv;
+@@ -253,6 +302,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+
+ out_mdio_free:
+ mdiobus_free(bus);
++out_clk_disable:
++ clk_disable_unprepare(priv->clk);
+ return ret;
+ }
+
+@@ -262,10 +313,37 @@ static int unimac_mdio_remove(struct platform_device *pdev)
+
+ mdiobus_unregister(priv->mii_bus);
+ mdiobus_free(priv->mii_bus);
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int unimac_mdio_suspend(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int unimac_mdio_resume(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++ int ret;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ unimac_mdio_clk_set(priv);
+
+ return 0;
+ }
+
++static SIMPLE_DEV_PM_OPS(unimac_mdio_pm_ops,
++ unimac_mdio_suspend, unimac_mdio_resume);
++
+ static const struct of_device_id unimac_mdio_ids[] = {
+ { .compatible = "brcm,genet-mdio-v5", },
+ { .compatible = "brcm,genet-mdio-v4", },
+@@ -281,6 +359,7 @@ static struct platform_driver unimac_mdio_driver = {
+ .driver = {
+ .name = UNIMAC_MDIO_DRV_NAME,
+ .of_match_table = unimac_mdio_ids,
++ .pm = &unimac_mdio_pm_ops,
+ },
+ .probe = unimac_mdio_probe,
+ .remove = unimac_mdio_remove,
+--
+2.20.1
+
--- /dev/null
+From 274a9b9a786e516db67804c30bae01c1dc90ae5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 15:14:10 +0200
+Subject: net: phy: mdio-bcm-unimac: mark PM functions as __maybe_unused
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9b97123a584f60a5bca5a2663485768a1f6cd0a4 ]
+
+The newly added runtime-pm support causes a harmless warning
+when CONFIG_PM is disabled:
+
+drivers/net/phy/mdio-bcm-unimac.c:330:12: error: 'unimac_mdio_resume' defined but not used [-Werror=unused-function]
+ static int unimac_mdio_resume(struct device *d)
+drivers/net/phy/mdio-bcm-unimac.c:321:12: error: 'unimac_mdio_suspend' defined but not used [-Werror=unused-function]
+ static int unimac_mdio_suspend(struct device *d)
+
+Marking the functions as __maybe_unused is the easiest workaround
+and avoids adding #ifdef checks.
+
+Fixes: b78ac6ecd1b6 ("net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio-bcm-unimac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index 80b9583eaa952..df75efa96a7d9 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -318,7 +318,7 @@ static int unimac_mdio_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int unimac_mdio_suspend(struct device *d)
++static int __maybe_unused unimac_mdio_suspend(struct device *d)
+ {
+ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
+
+@@ -327,7 +327,7 @@ static int unimac_mdio_suspend(struct device *d)
+ return 0;
+ }
+
+-static int unimac_mdio_resume(struct device *d)
++static int __maybe_unused unimac_mdio_resume(struct device *d)
+ {
+ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
+ int ret;
+--
+2.20.1
+
--- /dev/null
+From 39eb4037f82c77fea71cbc7beeacc880fd3d7f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 10:48:50 +0200
+Subject: net: phy: mscc: read 'vsc8531, edge-slowdown' as an u32
+
+From: Quentin Schulz <quentin.schulz@bootlin.com>
+
+[ Upstream commit 36c53cf0f46526b898390659b125155939f67892 ]
+
+In the DT binding, it is specified nowhere that 'vsc8531,edge-slowdown'
+is an u8, even though it's read as an u8 in the driver.
+
+Let's update the driver to take into consideration that the
+'vsc8531,edge-slowdown' property is of the default type u32.
+
+Signed-off-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
+index 53d63a71a03e2..36647b70b9a36 100644
+--- a/drivers/net/phy/mscc.c
++++ b/drivers/net/phy/mscc.c
+@@ -112,7 +112,7 @@ struct vsc8531_private {
+ #ifdef CONFIG_OF_MDIO
+ struct vsc8531_edge_rate_table {
+ u32 vddmac;
+- u8 slowdown[8];
++ u32 slowdown[8];
+ };
+
+ static const struct vsc8531_edge_rate_table edge_table[] = {
+@@ -375,8 +375,7 @@ out_unlock:
+ #ifdef CONFIG_OF_MDIO
+ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ {
+- u8 sd;
+- u32 vdd;
++ u32 vdd, sd;
+ int rc, i, j;
+ struct device *dev = &phydev->mdio.dev;
+ struct device_node *of_node = dev->of_node;
+@@ -389,7 +388,7 @@ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ if (rc != 0)
+ vdd = MSCC_VDDMAC_3300;
+
+- rc = of_property_read_u8(of_node, "vsc8531,edge-slowdown", &sd);
++ rc = of_property_read_u32(of_node, "vsc8531,edge-slowdown", &sd);
+ if (rc != 0)
+ sd = 0;
+
+--
+2.20.1
+
--- /dev/null
+From 231994d4935588a682b0b5058641113b17648817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 10:48:49 +0200
+Subject: net: phy: mscc: read 'vsc8531,vddmac' as an u32
+
+From: Quentin Schulz <quentin.schulz@bootlin.com>
+
+[ Upstream commit a993e0f583c7925adaa7721226ccd7a41e7e63d1 ]
+
+In the DT binding, it is specified nowhere that 'vsc8531,vddmac' is an
+u16, even though it's read as an u16 in the driver.
+
+Let's update the driver to take into consideration that the
+'vsc8531,vddmac' property is of the default type u32.
+
+Signed-off-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
+index 84ca9ff40ae0b..53d63a71a03e2 100644
+--- a/drivers/net/phy/mscc.c
++++ b/drivers/net/phy/mscc.c
+@@ -111,7 +111,7 @@ struct vsc8531_private {
+
+ #ifdef CONFIG_OF_MDIO
+ struct vsc8531_edge_rate_table {
+- u16 vddmac;
++ u32 vddmac;
+ u8 slowdown[8];
+ };
+
+@@ -376,7 +376,7 @@ out_unlock:
+ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ {
+ u8 sd;
+- u16 vdd;
++ u32 vdd;
+ int rc, i, j;
+ struct device *dev = &phydev->mdio.dev;
+ struct device_node *of_node = dev->of_node;
+@@ -385,7 +385,7 @@ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ if (!of_node)
+ return -ENODEV;
+
+- rc = of_property_read_u16(of_node, "vsc8531,vddmac", &vdd);
++ rc = of_property_read_u32(of_node, "vsc8531,vddmac", &vdd);
+ if (rc != 0)
+ vdd = MSCC_VDDMAC_3300;
+
+--
+2.20.1
+
--- /dev/null
+From bf5764b279d4a6467aac747c0a7c84e66858938f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:06:29 +0800
+Subject: net: smsc: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc911x.c | 3 ++-
+ drivers/net/ethernet/smsc/smc91x.c | 3 ++-
+ drivers/net/ethernet/smsc/smsc911x.c | 3 ++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index b1b53f6c452f5..8355dfbb8ec3c 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -513,7 +513,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index b944828f9ea3d..8d6cff8bd1622 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -638,7 +638,8 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index f0afb88d7bc2b..ce4bfecc26c7a 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1786,7 +1786,8 @@ static int smsc911x_stop(struct net_device *dev)
+ }
+
+ /* Entry point for transmitting a packet */
+-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
+ unsigned int freespace;
+--
+2.20.1
+
--- /dev/null
+From bebc12c98d03b66eecf98eaf35a1d5d35bc63500 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 12:02:46 +0800
+Subject: net: socionext: Fix two sleep-in-atomic-context bugs in
+ ave_rxfifo_reset()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 0020f5c807ef67954d9210eea0ba17a6134cdf7d ]
+
+The driver may sleep with holding a spinlock.
+The function call paths (from bottom to top) in Linux-4.17 are:
+
+[FUNC] usleep_range
+drivers/net/ethernet/socionext/sni_ave.c, 892:
+ usleep_range in ave_rxfifo_reset
+drivers/net/ethernet/socionext/sni_ave.c, 932:
+ ave_rxfifo_reset in ave_irq_handler
+
+[FUNC] usleep_range
+drivers/net/ethernet/socionext/sni_ave.c, 888:
+ usleep_range in ave_rxfifo_reset
+drivers/net/ethernet/socionext/sni_ave.c, 932:
+ ave_rxfifo_reset in ave_irq_handler
+
+To fix these bugs, usleep_range() is replaced with udelay().
+
+These bugs are found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/sni_ave.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index f27d67a4d3045..09d25b87cf7c0 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -906,11 +906,11 @@ static void ave_rxfifo_reset(struct net_device *ndev)
+
+ /* assert reset */
+ writel(AVE_GRR_RXFFR, priv->base + AVE_GRR);
+- usleep_range(40, 50);
++ udelay(50);
+
+ /* negate reset */
+ writel(0, priv->base + AVE_GRR);
+- usleep_range(10, 20);
++ udelay(20);
+
+ /* negate interrupt status */
+ writel(AVE_GI_RXOVF, priv->base + AVE_GISR);
+--
+2.20.1
+
--- /dev/null
+From eef6a38f914b6fd90a9f4903dc5d61ce59f5f984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 19:21:32 +0800
+Subject: net: sun: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0e0cc31f6999df18bb5cfd0bd83c892ed5633975 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, but the implementation in this
+driver returns an 'int'.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Shannon Nelson <shannon.nelson@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/ldmvsw.c | 2 +-
+ drivers/net/ethernet/sun/sunbmac.c | 3 ++-
+ drivers/net/ethernet/sun/sunqe.c | 2 +-
+ drivers/net/ethernet/sun/sunvnet.c | 2 +-
+ drivers/net/ethernet/sun/sunvnet_common.c | 14 ++++++++------
+ drivers/net/ethernet/sun/sunvnet_common.h | 7 ++++---
+ 6 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
+index d42f47f6c632f..644e42c181ee6 100644
+--- a/drivers/net/ethernet/sun/ldmvsw.c
++++ b/drivers/net/ethernet/sun/ldmvsw.c
+@@ -113,7 +113,7 @@ static u16 vsw_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vsw_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
+index f047b27971564..720b7ac77f3b3 100644
+--- a/drivers/net/ethernet/sun/sunbmac.c
++++ b/drivers/net/ethernet/sun/sunbmac.c
+@@ -950,7 +950,8 @@ static void bigmac_tx_timeout(struct net_device *dev)
+ }
+
+ /* Put a packet on the wire. */
+-static int bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bigmac *bp = netdev_priv(dev);
+ int len, entry;
+diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
+index 7fe0d5e339221..1468fa0a54e9b 100644
+--- a/drivers/net/ethernet/sun/sunqe.c
++++ b/drivers/net/ethernet/sun/sunqe.c
+@@ -570,7 +570,7 @@ out:
+ }
+
+ /* Get a packet queued to go onto the wire. */
+-static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sunqe *qep = netdev_priv(dev);
+ struct sunqe_buffers *qbufs = qep->buffers;
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 12539b357a784..590172818b922 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -247,7 +247,7 @@ static u16 vnet_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vnet_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethernet/sun/sunvnet_common.c
+index d8f4c3f281505..baa3088b475c7 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.c
++++ b/drivers/net/ethernet/sun/sunvnet_common.c
+@@ -1216,9 +1216,10 @@ static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, int ncookies)
+ return skb;
+ }
+
+-static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++static netdev_tx_t
++vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct net_device *dev = VNET_PORT_TO_NET_DEVICE(port);
+ struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+@@ -1321,9 +1322,10 @@ out_dropped:
+ return NETDEV_TX_OK;
+ }
+
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct vnet_port *port = NULL;
+ struct vio_dring_state *dr;
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.h b/drivers/net/ethernet/sun/sunvnet_common.h
+index 1ea0b016580a4..2b808d2482d60 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.h
++++ b/drivers/net/ethernet/sun/sunvnet_common.h
+@@ -136,9 +136,10 @@ int sunvnet_close_common(struct net_device *dev);
+ void sunvnet_set_rx_mode_common(struct net_device *dev, struct vnet *vp);
+ int sunvnet_set_mac_addr_common(struct net_device *dev, void *p);
+ void sunvnet_tx_timeout_common(struct net_device *dev);
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *));
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *));
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ void sunvnet_poll_controller_common(struct net_device *dev, struct vnet *vp);
+ #endif
+--
+2.20.1
+
--- /dev/null
+From a8e630e508349f66a60cc50a3d155d94787da1c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:23:39 +0800
+Subject: net: toshiba: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +-
+ drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/tc35815.c | 6 ++++--
+ 4 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 88d74aef218a2..75237c81c63d6 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card,
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, <0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct gelic_card *card = netdev_card(netdev);
+ struct gelic_descr *descr;
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index 003d0452d9cb1..fbbf9b54b173b 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card);
+ void gelic_card_down(struct gelic_card *card);
+ int gelic_net_open(struct net_device *netdev);
+ int gelic_net_stop(struct net_device *netdev);
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+ void gelic_net_set_multi(struct net_device *netdev);
+ void gelic_net_tx_timeout(struct net_device *netdev);
+ int gelic_net_setup_netdev(struct net_device *netdev, struct gelic_card *card);
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index d925b82039966..23417266b7ecc 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -880,9 +880,9 @@ out:
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, !0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-static int
++static netdev_tx_t
+ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int cnt;
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index 9146068979d2c..03afc4d8c3ec1 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -474,7 +474,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_
+ /* Index to functions, as function prototypes. */
+
+ static int tc35815_open(struct net_device *dev);
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t tc35815_interrupt(int irq, void *dev_id);
+ static int tc35815_rx(struct net_device *dev, int limit);
+ static int tc35815_poll(struct napi_struct *napi, int budget);
+@@ -1248,7 +1249,8 @@ tc35815_open(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tc35815_local *lp = netdev_priv(dev);
+ struct TxFD *txfd;
+--
+2.20.1
+
--- /dev/null
+From bd7597ca7468c06ba2d3794e522ddf29416a7eb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:32:40 +0800
+Subject: net: xilinx: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 60abc9250f56a..2241f98970926 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -674,7 +674,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 66b30ebd45ee8..28764268a44f8 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -657,7 +657,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 42f1f518dad69..c77c81eb7ab3b 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1020,9 +1020,10 @@ static int xemaclite_close(struct net_device *dev)
+ * deferred and the Tx queue is stopped so that the deferred socket buffer can
+ * be transmitted when the Emaclite device is free to transmit data.
+ *
+- * Return: 0, always.
++ * Return: NETDEV_TX_OK, always.
+ */
+-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
++static netdev_tx_t
++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ {
+ struct net_local *lp = netdev_priv(dev);
+ struct sk_buff *new_skb;
+@@ -1044,7 +1045,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ /* Take the time stamp now, since we can't do this in an ISR. */
+ skb_tx_timestamp(new_skb);
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+- return 0;
++ return NETDEV_TX_OK;
+ }
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+
+@@ -1053,7 +1054,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ dev->stats.tx_bytes += len;
+ dev_consume_skb_any(new_skb);
+
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From e3e43ceaa880f27ac4fcae2228b5a47a26098054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:33:33 +0800
+Subject: netfilter: masquerade: don't flush all conntracks if only one address
+ deleted on device
+
+From: Tan Hu <tan.hu@zte.com.cn>
+
+[ Upstream commit 097f95d319f817e651bd51f8846aced92a55a6a1 ]
+
+We configured iptables as below, which only allowed incoming data on
+established connections:
+
+iptables -t mangle -A PREROUTING -m state --state ESTABLISHED -j ACCEPT
+iptables -t mangle -P PREROUTING DROP
+
+When deleting a secondary address, current masquerade implements would
+flush all conntracks on this device. All the established connections on
+primary address also be deleted, then subsequent incoming data on the
+connections would be dropped wrongly because it was identified as NEW
+connection.
+
+So when an address was delete, it should only flush connections related
+with the address.
+
+Signed-off-by: Tan Hu <tan.hu@zte.com.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 22 ++++++++++++++++++---
+ net/ipv6/netfilter/nf_nat_masquerade_ipv6.c | 19 +++++++++++++++---
+ 2 files changed, 35 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index 4c7fcd32f8e62..41327bb990932 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -104,12 +104,26 @@ static int masq_device_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+ }
+
++static int inet_cmp(struct nf_conn *ct, void *ptr)
++{
++ struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
++ struct net_device *dev = ifa->ifa_dev->dev;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)dev->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ifa->ifa_address == tuple->dst.u3.ip;
++}
++
+ static int masq_inet_event(struct notifier_block *this,
+ unsigned long event,
+ void *ptr)
+ {
+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+- struct netdev_notifier_info info;
++ struct net *net = dev_net(idev->dev);
+
+ /* The masq_dev_notifier will catch the case of the device going
+ * down. So if the inetdev is dead and being destroyed we have
+@@ -119,8 +133,10 @@ static int masq_inet_event(struct notifier_block *this,
+ if (idev->dead)
+ return NOTIFY_DONE;
+
+- netdev_notifier_info_init(&info, idev->dev);
+- return masq_device_event(this, event, &info);
++ if (event == NETDEV_DOWN)
++ nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);
++
++ return NOTIFY_DONE;
+ }
+
+ static struct notifier_block masq_dev_notifier = {
+diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+index 37b1d413c825b..0ad0da5a26002 100644
+--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+@@ -87,18 +87,30 @@ static struct notifier_block masq_dev_notifier = {
+ struct masq_dev_work {
+ struct work_struct work;
+ struct net *net;
++ struct in6_addr addr;
+ int ifindex;
+ };
+
++static int inet_cmp(struct nf_conn *ct, void *work)
++{
++ struct masq_dev_work *w = (struct masq_dev_work *)work;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)w->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
++}
++
+ static void iterate_cleanup_work(struct work_struct *work)
+ {
+ struct masq_dev_work *w;
+- long index;
+
+ w = container_of(work, struct masq_dev_work, work);
+
+- index = w->ifindex;
+- nf_ct_iterate_cleanup_net(w->net, device_cmp, (void *)index, 0, 0);
++ nf_ct_iterate_cleanup_net(w->net, inet_cmp, (void *)w, 0, 0);
+
+ put_net(w->net);
+ kfree(w);
+@@ -147,6 +159,7 @@ static int masq_inet6_event(struct notifier_block *this,
+ INIT_WORK(&w->work, iterate_cleanup_work);
+ w->ifindex = dev->ifindex;
+ w->net = net;
++ w->addr = ifa->addr;
+ schedule_work(&w->work);
+
+ return NOTIFY_DONE;
+--
+2.20.1
+
--- /dev/null
+From fe3849ac89c7dd7cca1ba9d10d04f50e6676b1bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 16:01:47 +0200
+Subject: netfilter: nf_tables: avoid BUG_ON usage
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit fa5950e498e7face21a1761f327e6c1152f778c3 ]
+
+None of these spots really needs to crash the kernel.
+In one two cases we can jsut report error to userspace, in the other
+cases we can just use WARN_ON (and leak memory instead).
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 9 ++++++---
+ net/netfilter/nft_cmp.c | 6 ++++--
+ net/netfilter/nft_reject.c | 6 ++++--
+ 3 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 24fddf0322790..289d079008ee8 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1031,7 +1031,8 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
+
+ static void nf_tables_table_destroy(struct nft_ctx *ctx)
+ {
+- BUG_ON(ctx->table->use > 0);
++ if (WARN_ON(ctx->table->use > 0))
++ return;
+
+ rhltable_destroy(&ctx->table->chains_ht);
+ kfree(ctx->table->name);
+@@ -1446,7 +1447,8 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
+ {
+ struct nft_chain *chain = ctx->chain;
+
+- BUG_ON(chain->use > 0);
++ if (WARN_ON(chain->use > 0))
++ return;
+
+ /* no concurrent access possible anymore */
+ nf_tables_chain_free_chain_rules(chain);
+@@ -7253,7 +7255,8 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ {
+ struct nft_rule *rule, *nr;
+
+- BUG_ON(!nft_is_base_chain(ctx->chain));
++ if (WARN_ON(!nft_is_base_chain(ctx->chain)))
++ return 0;
+
+ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+ list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index fa90a8402845d..79d48c1d06f4d 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -79,7 +79,8 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+
+ err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &desc,
+ tb[NFTA_CMP_DATA]);
+- BUG_ON(err < 0);
++ if (err < 0)
++ return err;
+
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+@@ -129,7 +130,8 @@ static int nft_cmp_fast_init(const struct nft_ctx *ctx,
+
+ err = nft_data_init(NULL, &data, sizeof(data), &desc,
+ tb[NFTA_CMP_DATA]);
+- BUG_ON(err < 0);
++ if (err < 0)
++ return err;
+
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
+index 29f5bd2377b0d..b48e58cceeb72 100644
+--- a/net/netfilter/nft_reject.c
++++ b/net/netfilter/nft_reject.c
+@@ -94,7 +94,8 @@ static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = {
+
+ int nft_reject_icmp_code(u8 code)
+ {
+- BUG_ON(code > NFT_REJECT_ICMPX_MAX);
++ if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX))
++ return ICMP_NET_UNREACH;
+
+ return icmp_code_v4[code];
+ }
+@@ -111,7 +112,8 @@ static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = {
+
+ int nft_reject_icmpv6_code(u8 code)
+ {
+- BUG_ON(code > NFT_REJECT_ICMPX_MAX);
++ if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX))
++ return ICMPV6_NOROUTE;
+
+ return icmp_code_v6[code];
+ }
+--
+2.20.1
+
--- /dev/null
+From cd94155c7cc20aa525dec4229a96af874ec6d8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 14:42:50 -0700
+Subject: nfp: provide a better warning when ring allocation fails
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 23d9f5531c7c28546954b0bf332134a9b8a38c0a ]
+
+NFP supports fairly enormous ring sizes (up to 256k descriptors).
+In commit 466271703867 ("nfp: use kvcalloc() to allocate SW buffer
+descriptor arrays") we have started using kvcalloc() functions to
+make sure the allocation of software state arrays doesn't hit
+the MAX_ORDER limit. Unfortunately, we can't use virtual mappings
+for the DMA region holding HW descriptors. In case this allocation
+fails instead of the generic (and fairly scary) warning/splat in
+the logs print a helpful message explaining what happened and
+suggesting how to fix it.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/netronome/nfp/nfp_net_common.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index c6d29fdbb880f..d288c7eebacd8 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -2187,9 +2187,13 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
+
+ tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));
+ tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
+- &tx_ring->dma, GFP_KERNEL);
+- if (!tx_ring->txds)
++ &tx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!tx_ring->txds) {
++ netdev_warn(dp->netdev, "failed to allocate TX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ tx_ring->cnt);
+ goto err_alloc;
++ }
+
+ tx_ring->txbufs = kvcalloc(tx_ring->cnt, sizeof(*tx_ring->txbufs),
+ GFP_KERNEL);
+@@ -2341,9 +2345,13 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
+ rx_ring->cnt = dp->rxd_cnt;
+ rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));
+ rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
+- &rx_ring->dma, GFP_KERNEL);
+- if (!rx_ring->rxds)
++ &rx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!rx_ring->rxds) {
++ netdev_warn(dp->netdev, "failed to allocate RX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ rx_ring->cnt);
+ goto err_alloc;
++ }
+
+ rx_ring->rxbufs = kvcalloc(rx_ring->cnt, sizeof(*rx_ring->rxbufs),
+ GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 2669fae9e587e60d37351fb47d495fa3940be824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:19:35 +0100
+Subject: nvmem: core: return error code instead of NULL from nvmem_device_get
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ]
+
+nvmem_device_get() should return ERR_PTR() on error or valid pointer
+on success, but one of the code path seems to return NULL, so fix it.
+
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index d32eba11c000f..30c040786fde2 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -692,7 +692,7 @@ static struct nvmem_device *nvmem_find(const char *name)
+ d = bus_find_device_by_name(&nvmem_bus_type, NULL, name);
+
+ if (!d)
+- return NULL;
++ return ERR_PTR(-ENOENT);
+
+ return to_nvmem_device(d);
+ }
+--
+2.20.1
+
--- /dev/null
+From 94cad514f686a3602280dce26ea5252c9960ba8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 09:50:09 -0500
+Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ]
+
+Cache nodes under the cpu node(s) is PowerMac specific according to the
+comment above, so make the code enforce that.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 3f21ea6a90dcb..f0dbb7ad88cf6 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2066,7 +2066,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
+ /* OF on pmac has nodes instead of properties named "l2-cache"
+ * beneath CPU nodes.
+ */
+- if (!strcmp(np->type, "cpu"))
++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu"))
+ for_each_child_of_node(np, child)
+ if (!strcmp(child->type, "cache"))
+ return child;
+--
+2.20.1
+
--- /dev/null
+From 7d2df7542de4db0705362ad36be8935d7eb4239a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 14:38:56 -0500
+Subject: of/unittest: Fix I2C bus unit-address error
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 62287dce5d0ee207b6a09a0a1abd06b61cee1094 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses in
+the unittests.
+
+drivers/of/unittest-data/testcases.dtb: Warning (i2c_bus_reg): /testcase-data/overlay-node/test-bus/i2c-test-bus/test-unittest14/i2c@0/test-mux-dev: I2C bus unit address format error, expected "20"
+drivers/of/unittest-data/overlay_15.dtb: Warning (i2c_bus_reg): /fragment@0/__overlay__/test-unittest15/i2c@0/test-mux-dev: I2C bus unit address format error, expected "20"
+
+Cc: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest-data/overlay_15.dts | 4 ++--
+ drivers/of/unittest-data/tests-overlay.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/of/unittest-data/overlay_15.dts b/drivers/of/unittest-data/overlay_15.dts
+index b98f2514df4b3..5728490474f6b 100644
+--- a/drivers/of/unittest-data/overlay_15.dts
++++ b/drivers/of/unittest-data/overlay_15.dts
+@@ -20,8 +20,8 @@
+ #size-cells = <0>;
+ reg = <0>;
+
+- test-mux-dev {
+- reg = <32>;
++ test-mux-dev@20 {
++ reg = <0x20>;
+ compatible = "unittest-i2c-dev";
+ status = "okay";
+ };
+diff --git a/drivers/of/unittest-data/tests-overlay.dtsi b/drivers/of/unittest-data/tests-overlay.dtsi
+index 25cf397b8f6b6..4ea024d908ee2 100644
+--- a/drivers/of/unittest-data/tests-overlay.dtsi
++++ b/drivers/of/unittest-data/tests-overlay.dtsi
+@@ -103,8 +103,8 @@
+ #size-cells = <0>;
+ reg = <0>;
+
+- test-mux-dev {
+- reg = <32>;
++ test-mux-dev@20 {
++ reg = <0x20>;
+ compatible = "unittest-i2c-dev";
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From d135511abc4db2e243f677320bd2669a759dd8ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 07:05:21 +0530
+Subject: OPP: Protect dev_list with opp_table lock
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 3d2556992a878a2210d3be498416aee39e0c32aa ]
+
+The dev_list needs to be protected with a lock, else we may have
+simultaneous access (addition/removal) to it and that would be racy.
+Extend scope of the opp_table lock to protect dev_list as well.
+
+Tested-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 21 +++++++++++++++++++--
+ drivers/opp/cpu.c | 2 ++
+ drivers/opp/opp.h | 2 +-
+ 3 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index f3433bf47b100..14d4ef5943741 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -48,9 +48,14 @@ static struct opp_device *_find_opp_dev(const struct device *dev,
+ static struct opp_table *_find_opp_table_unlocked(struct device *dev)
+ {
+ struct opp_table *opp_table;
++ bool found;
+
+ list_for_each_entry(opp_table, &opp_tables, node) {
+- if (_find_opp_dev(dev, opp_table)) {
++ mutex_lock(&opp_table->lock);
++ found = !!_find_opp_dev(dev, opp_table);
++ mutex_unlock(&opp_table->lock);
++
++ if (found) {
+ _get_opp_table_kref(opp_table);
+
+ return opp_table;
+@@ -766,6 +771,8 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+
+ /* Initialize opp-dev */
+ opp_dev->dev = dev;
++
++ mutex_lock(&opp_table->lock);
+ list_add(&opp_dev->node, &opp_table->dev_list);
+
+ /* Create debugfs entries for the opp_table */
+@@ -773,6 +780,7 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+ if (ret)
+ dev_err(dev, "%s: Failed to register opp debugfs (%d)\n",
+ __func__, ret);
++ mutex_unlock(&opp_table->lock);
+
+ return opp_dev;
+ }
+@@ -791,6 +799,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+ if (!opp_table)
+ return NULL;
+
++ mutex_init(&opp_table->lock);
+ INIT_LIST_HEAD(&opp_table->dev_list);
+
+ opp_dev = _add_opp_dev(dev, opp_table);
+@@ -812,7 +821,6 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+
+ BLOCKING_INIT_NOTIFIER_HEAD(&opp_table->head);
+ INIT_LIST_HEAD(&opp_table->opp_list);
+- mutex_init(&opp_table->lock);
+ kref_init(&opp_table->kref);
+
+ /* Secure the device table modification */
+@@ -854,6 +862,10 @@ static void _opp_table_kref_release(struct kref *kref)
+ if (!IS_ERR(opp_table->clk))
+ clk_put(opp_table->clk);
+
++ /*
++ * No need to take opp_table->lock here as we are guaranteed that no
++ * references to the OPP table are taken at this point.
++ */
+ opp_dev = list_first_entry(&opp_table->dev_list, struct opp_device,
+ node);
+
+@@ -1719,6 +1731,9 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ {
+ struct dev_pm_opp *opp, *tmp;
+
++ /* Protect dev_list */
++ mutex_lock(&opp_table->lock);
++
+ /* Find if opp_table manages a single device */
+ if (list_is_singular(&opp_table->dev_list)) {
+ /* Free static OPPs */
+@@ -1736,6 +1751,8 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ } else {
+ _remove_opp_dev(_find_opp_dev(dev, opp_table), opp_table);
+ }
++
++ mutex_unlock(&opp_table->lock);
+ }
+
+ void _dev_pm_opp_find_and_remove_table(struct device *dev, bool remove_all)
+diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
+index 0c09107094350..2868a022a0407 100644
+--- a/drivers/opp/cpu.c
++++ b/drivers/opp/cpu.c
+@@ -222,8 +222,10 @@ int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)
+ cpumask_clear(cpumask);
+
+ if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED) {
++ mutex_lock(&opp_table->lock);
+ list_for_each_entry(opp_dev, &opp_table->dev_list, node)
+ cpumask_set_cpu(opp_dev->dev->id, cpumask);
++ mutex_unlock(&opp_table->lock);
+ } else {
+ cpumask_set_cpu(cpu_dev->id, cpumask);
+ }
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index 7c540fd063b2d..e0866b1c1f1b2 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -126,7 +126,7 @@ enum opp_table_access {
+ * @dev_list: list of devices that share these OPPs
+ * @opp_list: table of opps
+ * @kref: for reference count of the table.
+- * @lock: mutex protecting the opp_list.
++ * @lock: mutex protecting the opp_list and dev_list.
+ * @np: struct device_node pointer for opp's DT node.
+ * @clock_latency_ns_max: Max clock latency in nanoseconds.
+ * @shared_opp: OPP is shared between multiple devices.
+--
+2.20.1
+
--- /dev/null
+From ca8b0778f7f4d126db386e658b97d01461819042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 04:32:11 +0000
+Subject: PCI/ACPI: Correct error message for ASPM disabling
+
+From: Sinan Kaya <okaya@kernel.org>
+
+[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ]
+
+If _OSC execution fails today for platforms without an _OSC entry, code is
+printing a misleading message saying disabling ASPM as follows:
+
+ acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
+
+We need to ensure that platform supports ASPM to begin with.
+
+Reported-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_root.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 7433035ded955..e465e720eab20 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -455,8 +455,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ decode_osc_support(root, "OS supports", support);
+ status = acpi_pci_osc_support(root, support);
+ if (ACPI_FAILURE(status)) {
+- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n",
+- acpi_format_exception(status));
++ dev_info(&device->dev, "_OSC failed (%s)%s\n",
++ acpi_format_exception(status),
++ pcie_aspm_support_enabled() ? "; disabling ASPM" : "");
+ *no_aspm = 1;
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From ea7b8e7a9e50d94c035f9824a33cec78829ffb64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:27:10 -0600
+Subject: PCI/AER: Don't read upstream ports below fatal errors
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit 9d938ea53b265ed6df6cdd1715d971f0235fdbfc ]
+
+The AER driver has never read the config space of an endpoint that reported
+a fatal error because the link to that device is considered unreliable.
+
+An ERR_FATAL from an upstream port almost certainly indicates an error on
+its upstream link, so we can't expect to reliably read its config space for
+the same reason.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index ffbbd759683c5..5c3ea7254c6ae 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1116,8 +1116,9 @@ int aer_get_device_error_info(struct pci_dev *dev, struct aer_err_info *info)
+ &info->mask);
+ if (!(info->status & ~info->mask))
+ return 0;
+- } else if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE ||
+- info->severity == AER_NONFATAL) {
++ } else if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
++ pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM ||
++ info->severity == AER_NONFATAL) {
+
+ /* Link is still healthy for IO reads */
+ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS,
+--
+2.20.1
+
--- /dev/null
+From dfad76628972046f65f45f11beb624a1d6d20e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:27:09 -0600
+Subject: PCI/AER: Take reference on error devices
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit 60271ab044a53edb9dcbe76bebea2221c4ff04d9 ]
+
+Error handling may be running in parallel with a hot removal. Reference
+count the device during AER handling so the device can not be freed while
+AER wants to reference it.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 637d638f73da5..ffbbd759683c5 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -866,7 +866,7 @@ void cper_print_aer(struct pci_dev *dev, int aer_severity,
+ static int add_error_device(struct aer_err_info *e_info, struct pci_dev *dev)
+ {
+ if (e_info->error_dev_num < AER_MAX_MULTI_ERR_DEVICES) {
+- e_info->dev[e_info->error_dev_num] = dev;
++ e_info->dev[e_info->error_dev_num] = pci_dev_get(dev);
+ e_info->error_dev_num++;
+ return 0;
+ }
+@@ -1013,6 +1013,7 @@ static void handle_error_source(struct pci_dev *dev, struct aer_err_info *info)
+ pcie_do_nonfatal_recovery(dev);
+ else if (info->severity == AER_FATAL)
+ pcie_do_fatal_recovery(dev, PCIE_PORT_SERVICE_AER);
++ pci_dev_put(dev);
+ }
+
+ #ifdef CONFIG_ACPI_APEI_PCIEAER
+--
+2.20.1
+
--- /dev/null
+From d92129a424ad43eb0b200548715e96d96e9a74cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:27:13 -0600
+Subject: PCI/ERR: Run error recovery callbacks for all affected devices
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit bfcb79fca19d267712e425af1dd48812c40dec0c ]
+
+If an Endpoint reported an error with ERR_FATAL, we previously ran driver
+error recovery callbacks only for the Endpoint's driver. But if we reset a
+Link to recover from the error, all downstream components are affected,
+including the Endpoint, any multi-function peers, and children of those
+peers.
+
+Initiate the Link reset from the deepest Downstream Port that is
+reliable, and call the error recovery callbacks for all its children.
+
+If a Downstream Port (including a Root Port) reports an error, we assume
+the Port itself is reliable and we need to reset its downstream Link. In
+all other cases (Switch Upstream Ports, Endpoints, Bridges, etc), we assume
+the Link leading to the component needs to be reset, so we initiate the
+reset at the parent Downstream Port.
+
+This allows two other clean-ups. First, we currently only use a Link
+reset, which can only be initiated using a Downstream Port, so we can
+remove checks for Endpoints. Second, the Downstream Port where we initiate
+the Link reset is reliable (unlike components downstream from it), so the
+special cases for error detect and resume are no longer necessary.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/err.c | 85 +++++++++++-------------------------------
+ 1 file changed, 21 insertions(+), 64 deletions(-)
+
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index 12c1205e1d804..2c3b5bd59b18f 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -63,30 +63,12 @@ static int report_error_detected(struct pci_dev *dev, void *data)
+ if (!dev->driver ||
+ !dev->driver->err_handler ||
+ !dev->driver->err_handler->error_detected) {
+- if (result_data->state == pci_channel_io_frozen &&
+- dev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
+- /*
+- * In case of fatal recovery, if one of down-
+- * stream device has no driver. We might be
+- * unable to recover because a later insmod
+- * of a driver for this device is unaware of
+- * its hw state.
+- */
+- pci_printk(KERN_DEBUG, dev, "device has %s\n",
+- dev->driver ?
+- "no AER-aware driver" : "no driver");
+- }
+-
+ /*
+- * If there's any device in the subtree that does not
+- * have an error_detected callback, returning
+- * PCI_ERS_RESULT_NO_AER_DRIVER prevents calling of
+- * the subsequent mmio_enabled/slot_reset/resume
+- * callbacks of "any" device in the subtree. All the
+- * devices in the subtree are left in the error state
+- * without recovery.
++ * If any device in the subtree does not have an error_detected
++ * callback, PCI_ERS_RESULT_NO_AER_DRIVER prevents subsequent
++ * error callbacks of "any" device in the subtree, and will
++ * exit in the disconnected error state.
+ */
+-
+ if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE)
+ vote = PCI_ERS_RESULT_NO_AER_DRIVER;
+ else
+@@ -184,34 +166,23 @@ static pci_ers_result_t default_reset_link(struct pci_dev *dev)
+
+ static pci_ers_result_t reset_link(struct pci_dev *dev, u32 service)
+ {
+- struct pci_dev *udev;
+ pci_ers_result_t status;
+ struct pcie_port_service_driver *driver = NULL;
+
+- if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+- /* Reset this port for all subordinates */
+- udev = dev;
+- } else {
+- /* Reset the upstream component (likely downstream port) */
+- udev = dev->bus->self;
+- }
+-
+- /* Use the aer driver of the component firstly */
+- driver = pcie_port_find_service(udev, service);
+-
++ driver = pcie_port_find_service(dev, service);
+ if (driver && driver->reset_link) {
+- status = driver->reset_link(udev);
+- } else if (udev->has_secondary_link) {
+- status = default_reset_link(udev);
++ status = driver->reset_link(dev);
++ } else if (dev->has_secondary_link) {
++ status = default_reset_link(dev);
+ } else {
+ pci_printk(KERN_DEBUG, dev, "no link-reset support at upstream device %s\n",
+- pci_name(udev));
++ pci_name(dev));
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
+ if (status != PCI_ERS_RESULT_RECOVERED) {
+ pci_printk(KERN_DEBUG, dev, "link reset at upstream device %s failed\n",
+- pci_name(udev));
++ pci_name(dev));
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
+@@ -243,31 +214,7 @@ static pci_ers_result_t broadcast_error_message(struct pci_dev *dev,
+ else
+ result_data.result = PCI_ERS_RESULT_RECOVERED;
+
+- if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+- /*
+- * If the error is reported by a bridge, we think this error
+- * is related to the downstream link of the bridge, so we
+- * do error recovery on all subordinates of the bridge instead
+- * of the bridge and clear the error status of the bridge.
+- */
+- if (cb == report_error_detected)
+- dev->error_state = state;
+- pci_walk_bus(dev->subordinate, cb, &result_data);
+- if (cb == report_resume) {
+- pci_aer_clear_device_status(dev);
+- pci_cleanup_aer_uncorrect_error_status(dev);
+- dev->error_state = pci_channel_io_normal;
+- }
+- } else {
+- /*
+- * If the error is reported by an end point, we think this
+- * error is related to the upstream link of the end point.
+- * The error is non fatal so the bus is ok; just invoke
+- * the callback for the function that logged the error.
+- */
+- cb(dev, &result_data);
+- }
+-
++ pci_walk_bus(dev->subordinate, cb, &result_data);
+ return result_data.result;
+ }
+
+@@ -347,6 +294,14 @@ void pcie_do_nonfatal_recovery(struct pci_dev *dev)
+
+ state = pci_channel_io_normal;
+
++ /*
++ * Error recovery runs on all subordinates of the first downstream port.
++ * If the downstream port detected the error, it is cleared at the end.
++ */
++ if (!(pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
++ pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM))
++ dev = dev->bus->self;
++
+ status = broadcast_error_message(dev,
+ state,
+ "error_detected",
+@@ -378,6 +333,8 @@ void pcie_do_nonfatal_recovery(struct pci_dev *dev)
+ "resume",
+ report_resume);
+
++ pci_aer_clear_device_status(dev);
++ pci_cleanup_aer_uncorrect_error_status(dev);
+ pci_info(dev, "AER: Device recovery successful\n");
+ return;
+
+--
+2.20.1
+
--- /dev/null
+From 2479ca35ff61b1076c2cbd5663cd62e05db95d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:27:11 -0600
+Subject: PCI/ERR: Use slot reset if available
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit c4eed62a214330908eec11b0dc170d34fa50b412 ]
+
+The secondary bus reset may have link side effects that a hotplug capable
+port may incorrectly react to. Use the slot specific reset for hotplug
+ports, fixing the undesirable link down-up handling during error
+recovering.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+[bhelgaas: fold in
+https://lore.kernel.org/linux-pci/20180926152326.14821-1-keith.busch@intel.com
+for issue reported by Stephen Rothwell <sfr@canb.auug.org.au>]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 37 +++++++++++++++++++++++++++++++++++++
+ drivers/pci/pci.h | 2 ++
+ drivers/pci/pcie/aer.c | 2 +-
+ drivers/pci/pcie/err.c | 2 +-
+ drivers/pci/slot.c | 1 -
+ 5 files changed, 41 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 2baf1f82f8933..c9f51fc24563c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -35,6 +35,8 @@
+ #include <linux/aer.h>
+ #include "pci.h"
+
++DEFINE_MUTEX(pci_slot_mutex);
++
+ const char *pci_power_names[] = {
+ "error", "D0", "D1", "D2", "D3hot", "D3cold", "unknown",
+ };
+@@ -5191,6 +5193,41 @@ static int pci_bus_reset(struct pci_bus *bus, int probe)
+ return ret;
+ }
+
++/**
++ * pci_bus_error_reset - reset the bridge's subordinate bus
++ * @bridge: The parent device that connects to the bus to reset
++ *
++ * This function will first try to reset the slots on this bus if the method is
++ * available. If slot reset fails or is not available, this will fall back to a
++ * secondary bus reset.
++ */
++int pci_bus_error_reset(struct pci_dev *bridge)
++{
++ struct pci_bus *bus = bridge->subordinate;
++ struct pci_slot *slot;
++
++ if (!bus)
++ return -ENOTTY;
++
++ mutex_lock(&pci_slot_mutex);
++ if (list_empty(&bus->slots))
++ goto bus_reset;
++
++ list_for_each_entry(slot, &bus->slots, list)
++ if (pci_probe_reset_slot(slot))
++ goto bus_reset;
++
++ list_for_each_entry(slot, &bus->slots, list)
++ if (pci_slot_reset(slot, 0))
++ goto bus_reset;
++
++ mutex_unlock(&pci_slot_mutex);
++ return 0;
++bus_reset:
++ mutex_unlock(&pci_slot_mutex);
++ return pci_bus_reset(bridge->subordinate, 0);
++}
++
+ /**
+ * pci_probe_reset_bus - probe whether a PCI bus can be reset
+ * @bus: PCI bus to probe
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index ab25752f00d96..e9ede82ee2c25 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -35,6 +35,7 @@ int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vmai,
+
+ int pci_probe_reset_function(struct pci_dev *dev);
+ int pci_bridge_secondary_bus_reset(struct pci_dev *dev);
++int pci_bus_error_reset(struct pci_dev *dev);
+
+ /**
+ * struct pci_platform_pm_ops - Firmware PM callbacks
+@@ -136,6 +137,7 @@ static inline void pci_remove_legacy_files(struct pci_bus *bus) { return; }
+
+ /* Lock for read/write access to pci device and bus lists */
+ extern struct rw_semaphore pci_bus_sem;
++extern struct mutex pci_slot_mutex;
+
+ extern raw_spinlock_t pci_lock;
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 5c3ea7254c6ae..1563e22600eca 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1528,7 +1528,7 @@ static pci_ers_result_t aer_root_reset(struct pci_dev *dev)
+ reg32 &= ~ROOT_PORT_INTR_ON_MESG_MASK;
+ pci_write_config_dword(dev, pos + PCI_ERR_ROOT_COMMAND, reg32);
+
+- rc = pci_bridge_secondary_bus_reset(dev);
++ rc = pci_bus_error_reset(dev);
+ pci_printk(KERN_DEBUG, dev, "Root Port link has been reset\n");
+
+ /* Clear Root Error Status */
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index 708fd3a0d6466..12c1205e1d804 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -177,7 +177,7 @@ static pci_ers_result_t default_reset_link(struct pci_dev *dev)
+ {
+ int rc;
+
+- rc = pci_bridge_secondary_bus_reset(dev);
++ rc = pci_bus_error_reset(dev);
+ pci_printk(KERN_DEBUG, dev, "downstream link has been reset\n");
+ return rc ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
+ }
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index e634229ece895..a32897f83ee51 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -14,7 +14,6 @@
+
+ struct kset *pci_slots_kset;
+ EXPORT_SYMBOL_GPL(pci_slots_kset);
+-static DEFINE_MUTEX(pci_slot_mutex);
+
+ static ssize_t pci_slot_attr_show(struct kobject *kobj,
+ struct attribute *attr, char *buf)
+--
+2.20.1
+
--- /dev/null
+From 980dd99f86dd5aa70f73ee9afe25561bdf7e1645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jul 2018 10:01:58 -0500
+Subject: PCI: mediatek: Fix unchecked return value
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 17a0a1e5f6c4bd6df17834312ff577c1373d87b8 ]
+
+Check return value of devm_pci_remap_iospace().
+
+Addresses-Coverity-ID: 1471965 ("Unchecked return value")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Honghui Zhang <honghui.zhang@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index c5ff6ca65eab2..0d100f56cb884 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -1120,7 +1120,9 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
+ if (err < 0)
+ return err;
+
+- devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
++ err = devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
++ if (err)
++ return err;
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 73c93c2ef97576f83880cb93d6fb87e3663064fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:27:06 -0600
+Subject: PCI: portdrv: Initialize service drivers directly
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit c29de84149aba5f74e87b6491c13ac7203c12f55 ]
+
+The PCI port driver saves the PCI state after initializing the device with
+the applicable service devices. This was, however, before the service
+drivers were even registered because PCI probe happens before the
+device_initcall initialized those service drivers. The config space state
+that the services set up were not being saved. The end result would cause
+PCI devices to not react to events that the drivers think they did if the
+PCI state ever needed to be restored.
+
+Fix this by changing the service drivers from using the init calls to
+having the portdrv driver calling the services directly. This will get the
+state saved as desired, while making the relationship between the port
+driver and the services under it more explicit in the code.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/pciehp_core.c | 3 +--
+ drivers/pci/pcie/aer.c | 3 +--
+ drivers/pci/pcie/dpc.c | 3 +--
+ drivers/pci/pcie/pme.c | 3 +--
+ drivers/pci/pcie/portdrv.h | 24 ++++++++++++++++++++++++
+ drivers/pci/pcie/portdrv_pci.c | 9 +++++++++
+ 6 files changed, 37 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index ec48c9433ae50..518c46f8e63b7 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -348,7 +348,7 @@ static struct pcie_port_service_driver hpdriver_portdrv = {
+ #endif /* PM */
+ };
+
+-static int __init pcied_init(void)
++int __init pcie_hp_init(void)
+ {
+ int retval = 0;
+
+@@ -359,4 +359,3 @@ static int __init pcied_init(void)
+
+ return retval;
+ }
+-device_initcall(pcied_init);
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 83180edd6ed47..637d638f73da5 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1569,10 +1569,9 @@ static struct pcie_port_service_driver aerdriver = {
+ *
+ * Invoked when AER root service driver is loaded.
+ */
+-static int __init aer_service_init(void)
++int __init pcie_aer_init(void)
+ {
+ if (!pci_aer_available() || aer_acpi_firmware_first())
+ return -ENXIO;
+ return pcie_port_service_register(&aerdriver);
+ }
+-device_initcall(aer_service_init);
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index 1908dd2978d3c..118b5bcae42ea 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -307,8 +307,7 @@ static struct pcie_port_service_driver dpcdriver = {
+ .reset_link = dpc_reset_link,
+ };
+
+-static int __init dpc_service_init(void)
++int __init pcie_dpc_init(void)
+ {
+ return pcie_port_service_register(&dpcdriver);
+ }
+-device_initcall(dpc_service_init);
+diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
+index 6ac17f0c40775..54d593d10396f 100644
+--- a/drivers/pci/pcie/pme.c
++++ b/drivers/pci/pcie/pme.c
+@@ -455,8 +455,7 @@ static struct pcie_port_service_driver pcie_pme_driver = {
+ /**
+ * pcie_pme_service_init - Register the PCIe PME service driver.
+ */
+-static int __init pcie_pme_service_init(void)
++int __init pcie_pme_init(void)
+ {
+ return pcie_port_service_register(&pcie_pme_driver);
+ }
+-device_initcall(pcie_pme_service_init);
+diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
+index d59afa42fc14b..2498b2d340095 100644
+--- a/drivers/pci/pcie/portdrv.h
++++ b/drivers/pci/pcie/portdrv.h
+@@ -23,6 +23,30 @@
+
+ #define PCIE_PORT_DEVICE_MAXSERVICES 4
+
++#ifdef CONFIG_PCIEAER
++int pcie_aer_init(void);
++#else
++static inline int pcie_aer_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_HOTPLUG_PCI_PCIE
++int pcie_hp_init(void);
++#else
++static inline int pcie_hp_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_PCIE_PME
++int pcie_pme_init(void);
++#else
++static inline int pcie_pme_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_PCIE_DPC
++int pcie_dpc_init(void);
++#else
++static inline int pcie_dpc_init(void) { return 0; }
++#endif
++
+ /* Port Type */
+ #define PCIE_ANY_PORT (~0)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index eef22dc29140c..23a5a0c2c3fe9 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -226,11 +226,20 @@ static const struct dmi_system_id pcie_portdrv_dmi_table[] __initconst = {
+ {}
+ };
+
++static void __init pcie_init_services(void)
++{
++ pcie_aer_init();
++ pcie_pme_init();
++ pcie_dpc_init();
++ pcie_hp_init();
++}
++
+ static int __init pcie_portdrv_init(void)
+ {
+ if (pcie_ports_disabled)
+ return -EACCES;
+
++ pcie_init_services();
+ dmi_check_system(pcie_portdrv_dmi_table);
+
+ return pci_register_driver(&pcie_portdriver);
+--
+2.20.1
+
--- /dev/null
+From 75372de9bae5252ee43d888ee622843be13b7d48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 12:16:36 -0700
+Subject: phy: brcm-sata: allow PHY_BRCM_SATA driver to be built for DSL SoCs
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 26728df4b254ae06247726a9a6e64823e39ac504 ]
+
+Broadcom ARM-based DSL SoCs (BCM63xx product line) have the same
+Broadcom SATA PHY that other SoCs are using, make it possible to select
+that driver on these platforms.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/broadcom/Kconfig b/drivers/phy/broadcom/Kconfig
+index 8786a9674471d..aa917a61071db 100644
+--- a/drivers/phy/broadcom/Kconfig
++++ b/drivers/phy/broadcom/Kconfig
+@@ -60,7 +60,8 @@ config PHY_NS2_USB_DRD
+
+ config PHY_BRCM_SATA
+ tristate "Broadcom SATA PHY driver"
+- depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || COMPILE_TEST
++ depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || \
++ ARCH_BCM_63XX || COMPILE_TEST
+ depends on OF
+ select GENERIC_PHY
+ default ARCH_BCM_IPROC
+--
+2.20.1
+
--- /dev/null
+From db2ce1860b0821942c4c75380b1d0c8ee4d64cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 21:54:07 +0200
+Subject: phy: lantiq: Fix compile warning
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit 3a00dae006623d799266d85f28b5f76ef07d6b6c ]
+
+This local variable is unused, remove it.
+
+Fixes: dea54fbad332 ("phy: Add an USB PHY driver for the Lantiq SoCs using the RCU module")
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/lantiq/phy-lantiq-rcu-usb2.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+index 986224fca9e91..5a180f71d8d4d 100644
+--- a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
++++ b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+@@ -156,7 +156,6 @@ static int ltq_rcu_usb2_of_parse(struct ltq_rcu_usb2_priv *priv,
+ {
+ struct device *dev = priv->dev;
+ const __be32 *offset;
+- int ret;
+
+ priv->reg_bits = of_device_get_match_data(dev);
+
+--
+2.20.1
+
--- /dev/null
+From c5713f7b3635b82b6ddef3298e8994802d943ee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 11:44:05 +0200
+Subject: phy: phy-twl4030-usb: fix denied runtime access
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 6c7103aa026094a4ee2c2708ec6977a6dfc5331d ]
+
+When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS,
+the counter will be incremented but the resume callback not called,
+so enumeration and charging will not start properly.
+To avoid that happen, disable irq on suspend and recheck on resume.
+
+Practically this happens when the device is woken up from suspend by
+plugging in usb.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-twl4030-usb.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
+index a44680d64f9b4..c267afb68f077 100644
+--- a/drivers/phy/ti/phy-twl4030-usb.c
++++ b/drivers/phy/ti/phy-twl4030-usb.c
+@@ -144,6 +144,7 @@
+ #define PMBR1 0x0D
+ #define GPIO_USB_4PIN_ULPI_2430C (3 << 0)
+
++static irqreturn_t twl4030_usb_irq(int irq, void *_twl);
+ /*
+ * If VBUS is valid or ID is ground, then we know a
+ * cable is present and we need to be runtime-enabled
+@@ -395,6 +396,33 @@ static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
+ WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+ }
+
++static int __maybe_unused twl4030_usb_suspend(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ /*
++ * we need enabled runtime on resume,
++ * so turn irq off here, so we do not get it early
++ * note: wakeup on usb plug works independently of this
++ */
++ dev_dbg(twl->dev, "%s\n", __func__);
++ disable_irq(twl->irq);
++
++ return 0;
++}
++
++static int __maybe_unused twl4030_usb_resume(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ dev_dbg(twl->dev, "%s\n", __func__);
++ enable_irq(twl->irq);
++ /* check whether cable status changed */
++ twl4030_usb_irq(0, twl);
++
++ return 0;
++}
++
+ static int __maybe_unused twl4030_usb_runtime_suspend(struct device *dev)
+ {
+ struct twl4030_usb *twl = dev_get_drvdata(dev);
+@@ -655,6 +683,7 @@ static const struct phy_ops ops = {
+ static const struct dev_pm_ops twl4030_usb_pm_ops = {
+ SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend,
+ twl4030_usb_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(twl4030_usb_suspend, twl4030_usb_resume)
+ };
+
+ static int twl4030_usb_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From c18122a54fd207cd35b35924fb3107ab3e74ccec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 20:53:18 +0900
+Subject: phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 09938ea9d136243e8d1fed6d4d7a257764f28f6d ]
+
+This patch fixes and issue that the vbus_ctrl is disabled by
+rcar_gen3_init_from_a_peri_to_a_host(), so a usb host cannot
+supply the vbus.
+
+Note that this condition will exit when the otg irq happens
+even if we don't apply this patch.
+
+Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index 6fb2b69695905..d22b1ec2e58c7 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -199,7 +199,7 @@ static void rcar_gen3_init_from_a_peri_to_a_host(struct rcar_gen3_chan *ch)
+ val = readl(usb2_base + USB2_OBINTEN);
+ writel(val & ~USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+
+- rcar_gen3_enable_vbus_ctrl(ch, 0);
++ rcar_gen3_enable_vbus_ctrl(ch, 1);
+ rcar_gen3_init_for_host(ch);
+
+ writel(val | USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+--
+2.20.1
+
--- /dev/null
+From 78750aa343c1faf66ead1d6207f734f39ffe1891 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 14:42:13 +0200
+Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ]
+
+Sharing the same irqchip with multiple gpiochips is not a good
+practice. For instance, when installing hooks, we change the state
+of the irqchip. The initial state of the irqchip for the second
+gpiochip to register is then disrupted.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 50f0ec42c6372..fad0e132ead84 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1574,16 +1574,6 @@ void at91_pinctrl_gpio_resume(void)
+ #define gpio_irq_set_wake NULL
+ #endif /* CONFIG_PM */
+
+-static struct irq_chip gpio_irqchip = {
+- .name = "GPIO",
+- .irq_ack = gpio_irq_ack,
+- .irq_disable = gpio_irq_mask,
+- .irq_mask = gpio_irq_mask,
+- .irq_unmask = gpio_irq_unmask,
+- /* .irq_set_type is set dynamically */
+- .irq_set_wake = gpio_irq_set_wake,
+-};
+-
+ static void gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+@@ -1624,12 +1614,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
++ struct irq_chip *gpio_irqchip;
+ int ret, i;
+
++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL);
++ if (!gpio_irqchip)
++ return -ENOMEM;
++
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+- /* Setup proper .irq_set_type function */
+- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++ gpio_irqchip->name = "GPIO";
++ gpio_irqchip->irq_ack = gpio_irq_ack;
++ gpio_irqchip->irq_disable = gpio_irq_mask;
++ gpio_irqchip->irq_mask = gpio_irq_mask;
++ gpio_irqchip->irq_unmask = gpio_irq_unmask;
++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake,
++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type;
+
+ /* Disable irqs of this PIO controller */
+ writel_relaxed(~0, at91_gpio->regbase + PIO_IDR);
+@@ -1640,7 +1640,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ * interrupt.
+ */
+ ret = gpiochip_irqchip_add(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ 0,
+ handle_edge_irq,
+ IRQ_TYPE_NONE);
+@@ -1658,7 +1658,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ if (!gpiochip_prev) {
+ /* Then register the chain on the parent IRQ */
+ gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ at91_gpio->pioc_virq,
+ gpio_irq_handler);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 1fec8ba47c0f5a2966bbb7cfe33b928c129ecdae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:37:45 +0300
+Subject: pinctrl: at91-pio4: fix has_config check in
+ atmel_pctl_dt_subnode_to_map()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ]
+
+Smatch complains about this condition:
+
+ if (has_config && num_pins >= 1)
+
+The "has_config" variable is either uninitialized or true. The
+"num_pins" variable is unsigned and we verified that it is non-zero on
+the lines before so we know "num_pines >= 1" is true. Really, we could
+just check "num_configs" directly and remove the "has_config" variable.
+
+Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index ef7ab208b951e..9e2f3738bf3ec 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -493,7 +493,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned num_pins, num_configs, reserve;
+ unsigned long *configs;
+ struct property *pins;
+- bool has_config;
+ u32 pinfunc;
+ int ret, i;
+
+@@ -509,9 +508,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ return ret;
+ }
+
+- if (num_configs)
+- has_config = true;
+-
+ num_pins = pins->length / sizeof(u32);
+ if (!num_pins) {
+ dev_err(pctldev->dev, "no pins found in node %pOF\n", np);
+@@ -524,7 +520,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ * map for each pin.
+ */
+ reserve = 1;
+- if (has_config && num_pins >= 1)
++ if (num_configs)
+ reserve++;
+ reserve *= num_pins;
+ ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps,
+@@ -547,7 +543,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps,
+ group, func);
+
+- if (has_config) {
++ if (num_configs) {
+ ret = pinctrl_utils_add_map_configs(pctldev, map,
+ reserved_maps, num_maps, group,
+ configs, num_configs,
+--
+2.20.1
+
--- /dev/null
+From 8976c0a10463f9e7b9dfd47c5adb17232fe43b00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 18:42:30 +0200
+Subject: pinctrl: ingenic: Probe driver at subsys_initcall
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 556a36a71ed80e17ade49225b58513ea3c9e4558 ]
+
+Using postcore_initcall() makes the driver try to initialize way too
+early.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-ingenic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
+index 628817c40e3bb..a5accffbc8c91 100644
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -847,4 +847,4 @@ static int __init ingenic_pinctrl_drv_register(void)
+ {
+ return platform_driver_register(&ingenic_pinctrl_driver);
+ }
+-postcore_initcall(ingenic_pinctrl_drv_register);
++subsys_initcall(ingenic_pinctrl_drv_register);
+--
+2.20.1
+
--- /dev/null
+From eb60fa371a841bfc7e87ea8fac7b71457b6fb294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 14:50:11 +0300
+Subject: power: reset: at91-poweroff: do not procede if at91_shdwc is
+ allocated
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 9f1e44774be578fb92776add95f1fcaf8284d692 ]
+
+There should be only one instance of struct shdwc in the system. This is
+referenced through at91_shdwc. Return in probe if at91_shdwc is already
+allocated.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/at91-sama5d2_shdwc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index 0206cce328b3d..d9493e893d64e 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -246,6 +246,9 @@ static int __init at91_shdwc_probe(struct platform_device *pdev)
+ if (!pdev->dev.of_node)
+ return -ENODEV;
+
++ if (at91_shdwc)
++ return -EBUSY;
++
+ at91_shdwc = devm_kzalloc(&pdev->dev, sizeof(*at91_shdwc), GFP_KERNEL);
+ if (!at91_shdwc)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From d588df7affd2b7d3508b80d8f8ff7dc65a9d11e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:39:04 +0300
+Subject: power: supply: ab8500_fg: silence uninitialized variable warnings
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ]
+
+If kstrtoul() fails then we print "charge_full" when it's uninitialized.
+The debug printk doesn't add anything so I deleted it and cleaned these
+two functions up a bit.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_fg.c | 31 ++++++++++++-------------------
+ 1 file changed, 12 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 02356f9b5f22a..8bb89c697c1eb 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2433,17 +2433,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_full;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_full);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full);
+-
+- if (!ret) {
+- di->bat_cap.max_mah = (int) charge_full;
+- ret = count;
+- }
+- return ret;
++ di->bat_cap.max_mah = (int) charge_full;
++ return count;
+ }
+
+ static ssize_t charge_now_show(struct ab8500_fg *di, char *buf)
+@@ -2455,20 +2452,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_now;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_now);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d",
+- ret, charge_now, di->bat_cap.prev_mah);
+-
+- if (!ret) {
+- di->bat_cap.user_mah = (int) charge_now;
+- di->flags.user_cap = true;
+- ret = count;
+- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
+- }
+- return ret;
++ di->bat_cap.user_mah = (int) charge_now;
++ di->flags.user_cap = true;
++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
++ return count;
+ }
+
+ static struct ab8500_fg_sysfs_entry charge_full_attr =
+--
+2.20.1
+
--- /dev/null
+From 47ae3061e00e56d2b7b1e350c34a38687a55219e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jul 2018 18:05:07 +0200
+Subject: power: supply: max8998-charger: Fix platform data retrieval
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Figa <tomasz.figa@gmail.com>
+
+[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ]
+
+Since the max8998 MFD driver supports instantiation by DT, platform data
+retrieval is handled in MFD probe and cell drivers should get use
+the pdata field of max8998_dev struct to obtain them.
+
+Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree")
+Signed-off-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max8998_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max8998_charger.c b/drivers/power/supply/max8998_charger.c
+index cad7d1a8feec7..aa65e6c36c55e 100644
+--- a/drivers/power/supply/max8998_charger.c
++++ b/drivers/power/supply/max8998_charger.c
+@@ -86,7 +86,7 @@ static const struct power_supply_desc max8998_battery_desc = {
+ static int max8998_battery_probe(struct platform_device *pdev)
+ {
+ struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev);
++ struct max8998_platform_data *pdata = iodev->pdata;
+ struct power_supply_config psy_cfg = {};
+ struct max8998_battery_data *max8998;
+ struct i2c_client *i2c;
+--
+2.20.1
+
--- /dev/null
+From 6b5bbc490de961b9749a68b1a8b56a2bf9fbdea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:00:07 +0200
+Subject: power: supply: twl4030_charger: disable eoc interrupt on linear
+ charge
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ]
+
+This avoids getting woken up from suspend after power interruptions
+when the bci wrongly thinks the battery is full just because
+of input current going low because of low input power
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 27 +++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index adcaa0a10a6f4..0e202d4273fb6 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -440,6 +440,7 @@ static void twl4030_current_worker(struct work_struct *data)
+ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ {
+ int ret;
++ u32 reg;
+
+ if (bci->usb_mode == CHARGE_OFF)
+ enable = false;
+@@ -453,14 +454,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ bci->usb_enabled = 1;
+ }
+
+- if (bci->usb_mode == CHARGE_AUTO)
++ if (bci->usb_mode == CHARGE_AUTO) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC |
++ TWL4030_TBATOR2 | TWL4030_TBATOR1 |
++ TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */
+ ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB);
++ }
+
+ /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */
+ ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0,
+ TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4);
+ if (bci->usb_mode == CHARGE_LINEAR) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 |
++ TWL4030_TBATOR1 | TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0);
+ /* Watch dog key: WOVF acknowledge */
+ ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33,
+--
+2.20.1
+
--- /dev/null
+From f2a33ffcb34f07ea56ec2c040f6d374624427d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:20:35 +0200
+Subject: power: supply: twl4030_charger: fix charging current out-of-bounds
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ]
+
+the charging current uses unsigned int variables, if we step back
+if the current is still low, we would run into negative which
+means setting the target to a huge value.
+Better add checks here.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index b6a7d9f74cf30..adcaa0a10a6f4 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -420,7 +420,8 @@ static void twl4030_current_worker(struct work_struct *data)
+
+ if (v < USB_MIN_VOLT) {
+ /* Back up and stop adjusting. */
+- bci->usb_cur -= USB_CUR_STEP;
++ if (bci->usb_cur >= USB_CUR_STEP)
++ bci->usb_cur -= USB_CUR_STEP;
+ bci->usb_cur_target = bci->usb_cur;
+ } else if (bci->usb_cur >= bci->usb_cur_target ||
+ bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
+--
+2.20.1
+
--- /dev/null
+From 17165f66a8a6b2e5a7e7bd9c10aaadda4805877d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 01:30:45 +1000
+Subject: powerpc/64s/hash: Fix stab_rr off by one initialization
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ]
+
+This causes SLB alloation to start 1 beyond the start of the SLB.
+There is no real problem because after it wraps it stats behaving
+properly, it's just surprisig to see when looking at SLB traces.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/slb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 9f574e59d1786..2f162c6e52d4f 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -355,7 +355,7 @@ void slb_initialize(void)
+ #endif
+ }
+
+- get_paca()->stab_rr = SLB_NUM_BOLTED;
++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1;
+
+ lflags = SLB_VSID_KERNEL | linear_llp;
+ vflags = SLB_VSID_KERNEL | vmalloc_llp;
+--
+2.20.1
+
--- /dev/null
+From 1437187fb1fefe6ad048d409a05fe6f89c2e9d1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:36:48 +0930
+Subject: powerpc: Fix duplicate const clang warning in user access code
+
+From: Anton Blanchard <anton@samba.org>
+
+[ Upstream commit e00d93ac9a189673028ac125a74b9bc8ae73eebc ]
+
+This re-applies commit b91c1e3e7a6f ("powerpc: Fix duplicate const
+clang warning in user access code") (Jun 2015) which was undone in
+commits:
+ f2ca80905929 ("powerpc/sparse: Constify the address pointer in __get_user_nosleep()") (Feb 2017)
+ d466f6c5cac1 ("powerpc/sparse: Constify the address pointer in __get_user_nocheck()") (Feb 2017)
+ f84ed59a612d ("powerpc/sparse: Constify the address pointer in __get_user_check()") (Feb 2017)
+
+We see a large number of duplicate const errors in the user access
+code when building with llvm/clang:
+
+ include/linux/pagemap.h:576:8: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+ ret = __get_user(c, uaddr);
+
+The problem is we are doing const __typeof__(*(ptr)), which will hit
+the warning if ptr is marked const.
+
+Removing const does not seem to have any effect on GCC code
+generation.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/uaccess.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 1ca9e37f7cc99..38a25ff8afb76 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -260,7 +260,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+@@ -274,7 +274,7 @@ do { \
+ ({ \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ might_fault(); \
+ if (access_ok(VERIFY_READ, __gu_addr, (size))) { \
+ barrier_nospec(); \
+@@ -288,7 +288,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ barrier_nospec(); \
+ __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
+--
+2.20.1
+
--- /dev/null
+From 31b150d50693dd7653dd5c39ee3aad3ef764e156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 15:44:48 -0300
+Subject: powerpc/iommu: Avoid derefence before pointer check
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ]
+
+The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check
+if it is not NULL.
+
+Just moving the dereference code to after the check, where there will
+be guarantee that 'tbl' will not be NULL.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index 19b4c628f3bec..f0dc680e659af 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -785,9 +785,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl,
+
+ vaddr = page_address(page) + offset;
+ uaddr = (unsigned long)vaddr;
+- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+
+ if (tbl) {
++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+ align = 0;
+ if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE &&
+ ((unsigned long)vaddr & ~PAGE_MASK) == 0)
+--
+2.20.1
+
--- /dev/null
+From d3e83b2d892e5f6923fd593b7476531c019884b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 14:14:02 -0500
+Subject: powerpc/pseries: Disable CPU hotplug across migrations
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ]
+
+When performing partition migrations all present CPUs must be online
+as all present CPUs must make the H_JOIN call as part of the migration
+process. Once all present CPUs make the H_JOIN call, one CPU is returned
+to make the rtas call to perform the migration to the destination system.
+
+During testing of migration and changing the SMT state we have found
+instances where CPUs are offlined, as part of the SMT state change,
+before they make the H_JOIN call. This results in a hung system where
+every CPU is either in H_JOIN or offline.
+
+To prevent this this patch disables CPU hotplug during the migration
+process.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 9e41a9de43235..95d1264ba7952 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -985,6 +985,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ goto out;
+ }
+
++ cpu_hotplug_disable();
+ stop_topology_update();
+
+ /* Call function on all CPUs. One of us will make the
+@@ -999,6 +1000,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ printk(KERN_ERR "Error doing global join\n");
+
+ start_topology_update();
++ cpu_hotplug_enable();
+
+ /* Take down CPUs not online prior to suspend */
+ cpuret = rtas_offline_cpus_mask(offline_mask);
+--
+2.20.1
+
--- /dev/null
+From 8033cc8445f9810f7a723ebbb38faecbc715d94b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Apr 2018 15:29:48 -0500
+Subject: powerpc/pseries/memory-hotplug: Only update DT once per memory DLPAR
+ request
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+[ Upstream commit 063b8b1251fd069f3740339fca56119d218f11ba ]
+
+The updates to powerpc numa and memory hotplug code now use the
+in-kernel LMB array instead of the device tree. This change allows the
+pseries memory DLPAR code to only update the device tree once after
+successfully handling a DLPAR request.
+
+Prior to the in-kernel LMB array, the numa code looked up the affinity
+for memory being added in the device tree, the code now looks this up
+in the LMB array. This change means the memory hotplug code can just
+update the affinity for an LMB in the LMB array instead of updating
+the device tree.
+
+This also provides a savings in kernel memory. When updating the
+device tree old properties are never free'ed since there is no
+usecount on properties. This behavior leads to a new copy of the
+property being allocated every time a LMB is added or removed (i.e. a
+request to add 100 LMBs creates 100 new copies of the property). With
+this update only a single new property is created when a DLPAR request
+completes successfully.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/drmem.h | 5 ++
+ .../platforms/pseries/hotplug-memory.c | 55 ++++++-------------
+ 2 files changed, 21 insertions(+), 39 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h
+index ce242b9ea8c67..7c1d8e74b25d4 100644
+--- a/arch/powerpc/include/asm/drmem.h
++++ b/arch/powerpc/include/asm/drmem.h
+@@ -99,4 +99,9 @@ void __init walk_drmem_lmbs_early(unsigned long node,
+ void (*func)(struct drmem_lmb *, const __be32 **));
+ #endif
+
++static inline void invalidate_lmb_associativity_index(struct drmem_lmb *lmb)
++{
++ lmb->aa_index = 0xffffffff;
++}
++
+ #endif /* _ASM_POWERPC_LMB_H */
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index f99cd31b6fd1a..2f166136bb50a 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -163,7 +163,7 @@ static u32 find_aa_index(struct device_node *dr_node,
+ return aa_index;
+ }
+
+-static u32 lookup_lmb_associativity_index(struct drmem_lmb *lmb)
++static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ {
+ struct device_node *parent, *lmb_node, *dr_node;
+ struct property *ala_prop;
+@@ -203,43 +203,14 @@ static u32 lookup_lmb_associativity_index(struct drmem_lmb *lmb)
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
+ dlpar_free_cc_nodes(lmb_node);
+- return aa_index;
+-}
+-
+-static int dlpar_add_device_tree_lmb(struct drmem_lmb *lmb)
+-{
+- int rc, aa_index;
+-
+- lmb->flags |= DRCONF_MEM_ASSIGNED;
+
+- aa_index = lookup_lmb_associativity_index(lmb);
+ if (aa_index < 0) {
+- pr_err("Couldn't find associativity index for drc index %x\n",
+- lmb->drc_index);
+- return aa_index;
++ pr_err("Could not find LMB associativity\n");
++ return -1;
+ }
+
+ lmb->aa_index = aa_index;
+-
+- rtas_hp_event = true;
+- rc = drmem_update_dt();
+- rtas_hp_event = false;
+-
+- return rc;
+-}
+-
+-static int dlpar_remove_device_tree_lmb(struct drmem_lmb *lmb)
+-{
+- int rc;
+-
+- lmb->flags &= ~DRCONF_MEM_ASSIGNED;
+- lmb->aa_index = 0xffffffff;
+-
+- rtas_hp_event = true;
+- rc = drmem_update_dt();
+- rtas_hp_event = false;
+-
+- return rc;
++ return 0;
+ }
+
+ static struct memory_block *lmb_to_memblock(struct drmem_lmb *lmb)
+@@ -431,7 +402,9 @@ static int dlpar_remove_lmb(struct drmem_lmb *lmb)
+ /* Update memory regions for memory remove */
+ memblock_remove(lmb->base_addr, block_sz);
+
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
++ lmb->flags &= ~DRCONF_MEM_ASSIGNED;
++
+ return 0;
+ }
+
+@@ -691,10 +664,8 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+ if (lmb->flags & DRCONF_MEM_ASSIGNED)
+ return -EINVAL;
+
+- rc = dlpar_add_device_tree_lmb(lmb);
++ rc = update_lmb_associativity_index(lmb);
+ if (rc) {
+- pr_err("Couldn't update device tree for drc index %x\n",
+- lmb->drc_index);
+ dlpar_release_drc(lmb->drc_index);
+ return rc;
+ }
+@@ -707,14 +678,14 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+ /* Add the memory */
+ rc = add_memory(nid, lmb->base_addr, block_sz);
+ if (rc) {
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
+ return rc;
+ }
+
+ rc = dlpar_online_lmb(lmb);
+ if (rc) {
+ remove_memory(nid, lmb->base_addr, block_sz);
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
+ } else {
+ lmb->flags |= DRCONF_MEM_ASSIGNED;
+ }
+@@ -961,6 +932,12 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)
+ break;
+ }
+
++ if (!rc) {
++ rtas_hp_event = true;
++ rc = drmem_update_dt();
++ rtas_hp_event = false;
++ }
++
+ unlock_device_hotplug();
+ return rc;
+ }
+--
+2.20.1
+
--- /dev/null
+From ccf886b107591ddfa3798949b38bcf4d4915890a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:10:04 +0930
+Subject: powerpc/vdso: Correct call frame information
+
+From: Alan Modra <amodra@gmail.com>
+
+[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ]
+
+Call Frame Information is used by gdb for back-traces and inserting
+breakpoints on function return for the "finish" command. This failed
+when inside __kernel_clock_gettime. More concerning than difficulty
+debugging is that CFI is also used by stack frame unwinding code to
+implement exceptions. If you have an app that needs to handle
+asynchronous exceptions for some reason, and you are unlucky enough to
+get one inside the VDSO time functions, your app will crash.
+
+What's wrong: There is control flow in __kernel_clock_gettime that
+reaches label 99 without saving lr in r12. CFI info however is
+interpreted by the unwinder without reference to control flow: It's a
+simple matter of "Execute all the CFI opcodes up to the current
+address". That means the unwinder thinks r12 contains the return
+address at label 99. Disabuse it of that notion by resetting CFI for
+the return address at label 99.
+
+Note that the ".cfi_restore lr" could have gone anywhere from the
+"mtlr r12" a few instructions earlier to the instruction at label 99.
+I put the CFI as late as possible, because in general that's best
+practice (and if possible grouped with other CFI in order to reduce
+the number of CFI opcodes executed when unwinding). Using r12 as the
+return address is perfectly fine after the "mtlr r12" since r12 on
+that code path still contains the return address.
+
+__get_datapage also has a CFI error. That function temporarily saves
+lr in r0, and reflects that fact with ".cfi_register lr,r0". A later
+use of r0 means the CFI at that point isn't correct, as r0 no longer
+contains the return address. Fix that too.
+
+Signed-off-by: Alan Modra <amodra@gmail.com>
+Tested-by: Reza Arbab <arbab@linux.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso32/datapage.S | 1 +
+ arch/powerpc/kernel/vdso32/gettimeofday.S | 1 +
+ arch/powerpc/kernel/vdso64/datapage.S | 1 +
+ arch/powerpc/kernel/vdso64/gettimeofday.S | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S
+index 3745113fcc652..2a7eb5452aba7 100644
+--- a/arch/powerpc/kernel/vdso32/datapage.S
++++ b/arch/powerpc/kernel/vdso32/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 75cff3f336b3a..afd516b572f86 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index abf17feffe404..bf96686915116 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index afbad2ac31472..1f324c28705bc 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -169,6 +169,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+--
+2.20.1
+
--- /dev/null
+From ba951529973e0c617b6522230ed88b42a8c3dacb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 22:27:47 +0200
+Subject: qxl: fix null-pointer crash during suspend
+
+From: Peter Wu <peter@lekensteyn.nl>
+
+[ Upstream commit 7948a2b15873319d1bff4d37c09b9f2bf87b9021 ]
+
+"crtc->helper_private" is not initialized by the QXL driver and thus the
+"crtc_funcs->disable" call would crash (resulting in suspend failure).
+Fix this by converting the suspend/resume functions to use the
+drm_mode_config_helper_* helpers.
+
+Tested system sleep with QEMU 3.0 using "echo mem > /sys/power/state".
+During suspend the following message is visible from QEMU:
+
+ spice/server/display-channel.c:2425:display_channel_validate_surface: canvas address is 0x7fd05da68308 for 0 (and is NULL)
+ spice/server/display-channel.c:2426:display_channel_validate_surface: failed on 0
+
+This seems to be triggered by QXL_IO_NOTIFY_CMD after
+QXL_IO_DESTROY_PRIMARY_ASYNC, but aside from the warning things still
+seem to work (tested with both the GTK and -spice options).
+
+Signed-off-by: Peter Wu <peter@lekensteyn.nl>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180904202747.14968-1-peter@lekensteyn.nl
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/qxl/qxl_drv.c | 26 +++++---------------------
+ 1 file changed, 5 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
+index 2445e75cf7ea6..d00f45eed03ca 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.c
++++ b/drivers/gpu/drm/qxl/qxl_drv.c
+@@ -136,20 +136,11 @@ static int qxl_drm_freeze(struct drm_device *dev)
+ {
+ struct pci_dev *pdev = dev->pdev;
+ struct qxl_device *qdev = dev->dev_private;
+- struct drm_crtc *crtc;
+-
+- drm_kms_helper_poll_disable(dev);
+-
+- console_lock();
+- qxl_fbdev_set_suspend(qdev, 1);
+- console_unlock();
++ int ret;
+
+- /* unpin the front buffers */
+- list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+- const struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+- if (crtc->enabled)
+- (*crtc_funcs->disable)(crtc);
+- }
++ ret = drm_mode_config_helper_suspend(dev);
++ if (ret)
++ return ret;
+
+ qxl_destroy_monitors_object(qdev);
+ qxl_surf_evict(qdev);
+@@ -175,14 +166,7 @@ static int qxl_drm_resume(struct drm_device *dev, bool thaw)
+ }
+
+ qxl_create_monitors_object(qdev);
+- drm_helper_resume_force_mode(dev);
+-
+- console_lock();
+- qxl_fbdev_set_suspend(qdev, 0);
+- console_unlock();
+-
+- drm_kms_helper_poll_enable(dev);
+- return 0;
++ return drm_mode_config_helper_resume(dev);
+ }
+
+ static int qxl_pm_suspend(struct device *dev)
+--
+2.20.1
+
--- /dev/null
+From 505260b2aee55888a1cb4a68a1cc18172d2085ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 10:55:31 +0300
+Subject: RDMA/core: Follow correct unregister order between sysfs and cgroup
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit c715a39541bb399eb03d728a996b224d90ce1336 ]
+
+During register_device() init sequence is,
+(a) register with rdma cgroup followed by
+(b) register with sysfs
+
+Therefore, unregister_device() sequence should follow the reverse order.
+
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 6d8ac51a39cc0..6a585c3e21923 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -599,8 +599,8 @@ void ib_unregister_device(struct ib_device *device)
+ }
+ up_read(&lists_rwsem);
+
+- ib_device_unregister_rdmacg(device);
+ ib_device_unregister_sysfs(device);
++ ib_device_unregister_rdmacg(device);
+
+ mutex_unlock(&device_mutex);
+
+--
+2.20.1
+
--- /dev/null
+From d8e653023467121c6c5e7c81d629de4f296cbd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:45:31 +0300
+Subject: RDMA/core: Rate limit MAD error messages
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit f9d08f1e1939ad4d92e38bd3dee6842512f5bee6 ]
+
+While registering a mad agent, a user space can trigger various errors
+and flood the logs.
+
+Therefore, decrease verbosity and rate limit such error messages.
+While we are at it, use __func__ to print function name.
+
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/mad.c | 72 ++++++++++++++++++-----------------
+ 1 file changed, 37 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 74aa3e651bc3c..218411282069b 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -223,30 +223,30 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate parameters */
+ qpn = get_spl_qp_index(qp_type);
+ if (qpn == -1) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid QP Type %d\n",
+- qp_type);
++ dev_dbg_ratelimited(&device->dev, "%s: invalid QP Type %d\n",
++ __func__, qp_type);
+ goto error1;
+ }
+
+ if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid RMPP Version %u\n",
+- rmpp_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid RMPP Version %u\n",
++ __func__, rmpp_version);
+ goto error1;
+ }
+
+ /* Validate MAD registration request if supplied */
+ if (mad_reg_req) {
+ if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid Class Version %u\n",
+- mad_reg_req->mgmt_class_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid Class Version %u\n",
++ __func__,
++ mad_reg_req->mgmt_class_version);
+ goto error1;
+ }
+ if (!recv_handler) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: no recv_handler\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: no recv_handler\n", __func__);
+ goto error1;
+ }
+ if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
+@@ -256,9 +256,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ */
+ if (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else if (mad_reg_req->mgmt_class == 0) {
+@@ -266,8 +266,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * Class 0 is reserved in IBA and is used for
+ * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
+ */
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0\n",
++ __func__);
+ goto error1;
+ } else if (is_vendor_class(mad_reg_req->mgmt_class)) {
+ /*
+@@ -275,18 +276,19 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * ensure supplied OUI is not zero
+ */
+ if (!is_vendor_oui(mad_reg_req->oui)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: No OUI specified for class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: No OUI specified for class 0x%x\n",
++ __func__,
++ mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+ /* Make sure class supplied is consistent with RMPP */
+ if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
+ if (rmpp_version) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: RMPP version for non-RMPP class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -297,9 +299,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
+ (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid SM QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else {
+@@ -307,9 +309,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
+ (mad_reg_req->mgmt_class ==
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid GS QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -324,18 +326,18 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate device and port */
+ port_priv = ib_get_mad_port(device, port_num);
+ if (!port_priv) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid port %d\n",
+- port_num);
++ dev_dbg_ratelimited(&device->dev, "%s: Invalid port %d\n",
++ __func__, port_num);
+ ret = ERR_PTR(-ENODEV);
+ goto error1;
+ }
+
+- /* Verify the QP requested is supported. For example, Ethernet devices
+- * will not have QP0 */
++ /* Verify the QP requested is supported. For example, Ethernet devices
++ * will not have QP0.
++ */
+ if (!port_priv->qp_info[qpn].qp) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: QP %d not supported\n", qpn);
++ dev_dbg_ratelimited(&device->dev, "%s: QP %d not supported\n",
++ __func__, qpn);
+ ret = ERR_PTR(-EPROTONOSUPPORT);
+ goto error1;
+ }
+--
+2.20.1
+
--- /dev/null
+From 37a295963cab1e521b34467d7e085cc55031fe36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 21:36:52 +0200
+Subject: RDMA: Fix dependencies for rdma_user_mmap_io
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 46bdf777685677c1cc6b3da9220aace9da690731 ]
+
+The mlx4 driver produces a link error when it is configured
+as built-in while CONFIG_INFINIBAND_USER_ACCESS is set to =m:
+
+drivers/infiniband/hw/mlx4/main.o: In function `mlx4_ib_mmap':
+main.c:(.text+0x1af4): undefined reference to `rdma_user_mmap_io'
+
+The same function is called from mlx5, which already has a
+dependency to ensure we can call it, and from hns, which
+appears to suffer from the same problem.
+
+This adds the same dependency that mlx5 uses to the other two.
+
+Fixes: 6745d356ab39 ("RDMA/hns: Use rdma_user_mmap_io")
+Fixes: c282da4109e4 ("RDMA/mlx4: Use rdma_user_mmap_io")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/Kconfig | 1 +
+ drivers/infiniband/hw/mlx4/Kconfig | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/Kconfig b/drivers/infiniband/hw/hns/Kconfig
+index fddb5fdf92de8..21c2100b2ea98 100644
+--- a/drivers/infiniband/hw/hns/Kconfig
++++ b/drivers/infiniband/hw/hns/Kconfig
+@@ -1,6 +1,7 @@
+ config INFINIBAND_HNS
+ tristate "HNS RoCE Driver"
+ depends on NET_VENDOR_HISILICON
++ depends on INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ depends on ARM64 || (COMPILE_TEST && 64BIT)
+ ---help---
+ This is a RoCE/RDMA driver for the Hisilicon RoCE engine. The engine
+diff --git a/drivers/infiniband/hw/mlx4/Kconfig b/drivers/infiniband/hw/mlx4/Kconfig
+index db4aa13ebae0c..d1de3285fd885 100644
+--- a/drivers/infiniband/hw/mlx4/Kconfig
++++ b/drivers/infiniband/hw/mlx4/Kconfig
+@@ -1,6 +1,7 @@
+ config MLX4_INFINIBAND
+ tristate "Mellanox ConnectX HCA support"
+ depends on NETDEVICES && ETHERNET && PCI && INET
++ depends on INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ depends on MAY_USE_DEVLINK
+ select NET_VENDOR_MELLANOX
+ select MLX4_CORE
+--
+2.20.1
+
--- /dev/null
+From e34e93461fe7b4f89e0253aa4c70692a808aa6d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:35:11 +0300
+Subject: RDMA/hns: Fix an error code in hns_roce_v2_init_eq_table()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f1a315420e79fe5c077fa119db9439ffabd2cda2 ]
+
+The error code isn't set on this path.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index cf878e1b71fc1..3f8e13190aa71 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5117,6 +5117,7 @@ static int hns_roce_v2_init_eq_table(struct hns_roce_dev *hr_dev)
+ create_singlethread_workqueue("hns_roce_irq_workqueue");
+ if (!hr_dev->irq_workq) {
+ dev_err(dev, "Create irq workqueue failed!\n");
++ ret = -ENOMEM;
+ goto err_request_irq_fail;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1ebbc30dc379461db55e105a7d5b5e27f4ab3d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 16:07:07 +0200
+Subject: RDMA/i40iw: Fix incorrect iterator type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <Haakon.Bugge@oracle.com>
+
+[ Upstream commit 802fa45cd320de319e86c93bca72abec028ba059 ]
+
+Commit f27b4746f378 ("i40iw: add connection management code") uses an
+incorrect rcu iterator, whilst holding the rtnl_lock. Since the
+critical region invokes i40iw_manage_qhash(), which is a sleeping
+function, the rcu locking and traversal cannot be used.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 423818a7d3330..771eb6bd07854 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1689,7 +1689,7 @@ static enum i40iw_status_code i40iw_add_mqh_6(struct i40iw_device *iwdev,
+ unsigned long flags;
+
+ rtnl_lock();
+- for_each_netdev_rcu(&init_net, ip_dev) {
++ for_each_netdev(&init_net, ip_dev) {
+ if ((((rdma_vlan_dev_vlan_id(ip_dev) < I40IW_NO_VLAN) &&
+ (rdma_vlan_dev_real_dev(ip_dev) == iwdev->netdev)) ||
+ (ip_dev == iwdev->netdev)) && (ip_dev->flags & IFF_UP)) {
+--
+2.20.1
+
--- /dev/null
+From 2dd48640b97aa499faed317217a31eb429f694dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 17:49:19 -0700
+Subject: remoteproc/davinci: Use %zx for formating size_t
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 1e28dbbeced6152b9ea7c417ff8cef3f7dcf0f19 ]
+
+da8xx_rproc_mem size is of type size_t, so use %zx to format the debug
+print of it to avoid a compile warning.
+
+Acked-by: Suman Anna <s-anna@ti.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/da8xx_remoteproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/da8xx_remoteproc.c b/drivers/remoteproc/da8xx_remoteproc.c
+index e230bef71be1c..d200334577f68 100644
+--- a/drivers/remoteproc/da8xx_remoteproc.c
++++ b/drivers/remoteproc/da8xx_remoteproc.c
+@@ -226,7 +226,7 @@ static int da8xx_rproc_get_internal_memories(struct platform_device *pdev,
+ res->start & DA8XX_RPROC_LOCAL_ADDRESS_MASK;
+ drproc->mem[i].size = resource_size(res);
+
+- dev_dbg(dev, "memory %8s: bus addr %pa size 0x%x va %p da 0x%x\n",
++ dev_dbg(dev, "memory %8s: bus addr %pa size 0x%zx va %p da 0x%x\n",
+ mem_names[i], &drproc->mem[i].bus_addr,
+ drproc->mem[i].size, drproc->mem[i].cpu_addr,
+ drproc->mem[i].dev_addr);
+--
+2.20.1
+
--- /dev/null
+From b49050726d3153185b36bb7e2440a1ddfdf90f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Sep 2018 16:25:34 +0200
+Subject: rtc: armada38x: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 7d61cbb945a753af08e247b5f10bdd5dbb8d6c80 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-armada38x.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
+index bde53c8ccee2c..b74338d6dde60 100644
+--- a/drivers/rtc/rtc-armada38x.c
++++ b/drivers/rtc/rtc-armada38x.c
+@@ -514,7 +514,6 @@ MODULE_DEVICE_TABLE(of, armada38x_rtc_of_match_table);
+
+ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ {
+- const struct rtc_class_ops *ops;
+ struct resource *res;
+ struct armada38x_rtc *rtc;
+ const struct of_device_id *match;
+@@ -551,6 +550,11 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "no irq\n");
+ return rtc->irq;
+ }
++
++ rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ if (devm_request_irq(&pdev->dev, rtc->irq, armada38x_rtc_alarm_irq,
+ 0, pdev->name, rtc) < 0) {
+ dev_warn(&pdev->dev, "Interrupt not available.\n");
+@@ -560,28 +564,24 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+
+ if (rtc->irq != -1) {
+ device_init_wakeup(&pdev->dev, 1);
+- ops = &armada38x_rtc_ops;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops;
+ } else {
+ /*
+ * If there is no interrupt available then we can't
+ * use the alarm
+ */
+- ops = &armada38x_rtc_ops_noirq;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops_noirq;
+ }
+ rtc->data = (struct armada38x_rtc_data *)match->data;
+
+-
+ /* Update RTC-MBUS bridge timing parameters */
+ rtc->data->update_mbus_timing(rtc);
+
+- rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, pdev->name,
+- ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
+- ret = PTR_ERR(rtc->rtc_dev);
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret)
+ dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
+- return ret;
+- }
+- return 0;
++
++ return ret;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+--
+2.20.1
+
--- /dev/null
+From e7c172f46d291a97392555e399d942b5f94443d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 13:29:56 +0200
+Subject: rtc: isl1208: avoid possible sysfs race
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 1b4c794fda583edabe864ac466e9cd43c707be80 ]
+
+Use rtc_add_group to add the common sysfs group to avoid a possible race
+condition.
+
+[Denis.Osterland@diehl.com: use to_i2c_client(dev->parent)]
+Signed-off-by: Denis Osterland <Denis.Osterland@diehl.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+The move of atrim, dtrim usr sysfs properties from i2c device
+to rtc device require to access them via dev->parent.
+This patch also aligns timestamp0.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-isl1208.c | 27 ++++++++++-----------------
+ 1 file changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
+index ea18a8f4bce06..033f65aef5788 100644
+--- a/drivers/rtc/rtc-isl1208.c
++++ b/drivers/rtc/rtc-isl1208.c
+@@ -518,7 +518,7 @@ static ssize_t timestamp0_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- struct i2c_client *client = dev_get_drvdata(dev);
++ struct i2c_client *client = to_i2c_client(dev->parent);
+ int sr;
+
+ sr = isl1208_i2c_get_sr(client);
+@@ -540,7 +540,7 @@ static ssize_t timestamp0_store(struct device *dev,
+ static ssize_t timestamp0_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- struct i2c_client *client = dev_get_drvdata(dev);
++ struct i2c_client *client = to_i2c_client(dev->parent);
+ u8 regs[ISL1219_EVT_SECTION_LEN] = { 0, };
+ struct rtc_time tm;
+ int sr;
+@@ -650,7 +650,7 @@ static ssize_t
+ isl1208_sysfs_show_atrim(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int atr = isl1208_i2c_get_atr(to_i2c_client(dev));
++ int atr = isl1208_i2c_get_atr(to_i2c_client(dev->parent));
+ if (atr < 0)
+ return atr;
+
+@@ -663,7 +663,7 @@ static ssize_t
+ isl1208_sysfs_show_dtrim(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int dtr = isl1208_i2c_get_dtr(to_i2c_client(dev));
++ int dtr = isl1208_i2c_get_dtr(to_i2c_client(dev->parent));
+ if (dtr < 0)
+ return dtr;
+
+@@ -676,7 +676,7 @@ static ssize_t
+ isl1208_sysfs_show_usr(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int usr = isl1208_i2c_get_usr(to_i2c_client(dev));
++ int usr = isl1208_i2c_get_usr(to_i2c_client(dev->parent));
+ if (usr < 0)
+ return usr;
+
+@@ -701,7 +701,10 @@ isl1208_sysfs_store_usr(struct device *dev,
+ if (usr < 0 || usr > 0xffff)
+ return -EINVAL;
+
+- return isl1208_i2c_set_usr(to_i2c_client(dev), usr) ? -EIO : count;
++ if (isl1208_i2c_set_usr(to_i2c_client(dev->parent), usr))
++ return -EIO;
++
++ return count;
+ }
+
+ static DEVICE_ATTR(usr, S_IRUGO | S_IWUSR, isl1208_sysfs_show_usr,
+@@ -765,7 +768,6 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ rtc->ops = &isl1208_rtc_ops;
+
+ i2c_set_clientdata(client, rtc);
+- dev_set_drvdata(&rtc->dev, client);
+
+ rc = isl1208_i2c_get_sr(client);
+ if (rc < 0) {
+@@ -804,7 +806,7 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ evdet_irq = of_irq_get_byname(np, "evdet");
+ }
+
+- rc = sysfs_create_group(&client->dev.kobj, &isl1208_rtc_sysfs_files);
++ rc = rtc_add_group(rtc, &isl1208_rtc_sysfs_files);
+ if (rc)
+ return rc;
+
+@@ -821,14 +823,6 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ return rtc_register_device(rtc);
+ }
+
+-static int
+-isl1208_remove(struct i2c_client *client)
+-{
+- sysfs_remove_group(&client->dev.kobj, &isl1208_rtc_sysfs_files);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id isl1208_id[] = {
+ { "isl1208", TYPE_ISL1208 },
+ { "isl1218", TYPE_ISL1218 },
+@@ -851,7 +845,6 @@ static struct i2c_driver isl1208_driver = {
+ .of_match_table = of_match_ptr(isl1208_of_match),
+ },
+ .probe = isl1208_probe,
+- .remove = isl1208_remove,
+ .id_table = isl1208_id,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0be5073dd79810a242e120feb935937c51c0bc5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:38:46 +0200
+Subject: rtc: mt6397: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit babab2f86440352d24e76118fdd7d40cab5fd7bf ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Acked-by: Eddie Huang <eddie.huang@mediatek.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mt6397.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index 385f8303bb412..e9a25ec4d434f 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -332,6 +332,10 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, rtc);
+
++ rtc->rtc_dev = devm_rtc_allocate_device(rtc->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ ret = request_threaded_irq(rtc->irq, NULL,
+ mtk_rtc_irq_handler_thread,
+ IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
+@@ -344,11 +348,11 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ device_init_wakeup(&pdev->dev, 1);
+
+- rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev,
+- &mtk_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
++ rtc->rtc_dev->ops = &mtk_rtc_ops;
++
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret) {
+ dev_err(&pdev->dev, "register rtc device failed\n");
+- ret = PTR_ERR(rtc->rtc_dev);
+ goto out_free_irq;
+ }
+
+@@ -365,7 +369,6 @@ static int mtk_rtc_remove(struct platform_device *pdev)
+ {
+ struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
+
+- rtc_device_unregister(rtc->rtc_dev);
+ free_irq(rtc->irq, rtc->rtc_dev);
+ irq_dispose_mapping(rtc->irq);
+
+--
+2.20.1
+
--- /dev/null
+From 25ce5cd95b2dee3a538953e5a00e6657ce57c243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:38:47 +0200
+Subject: rtc: pl030: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit c778ec85825dc895936940072aea9fe9037db684 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pl030.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pl030.c b/drivers/rtc/rtc-pl030.c
+index f85a1a93e669f..343bb6ed17839 100644
+--- a/drivers/rtc/rtc-pl030.c
++++ b/drivers/rtc/rtc-pl030.c
+@@ -112,6 +112,13 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ goto err_rtc;
+ }
+
++ rtc->rtc = devm_rtc_allocate_device(&dev->dev);
++ if (IS_ERR(rtc->rtc)) {
++ ret = PTR_ERR(rtc->rtc);
++ goto err_rtc;
++ }
++
++ rtc->rtc->ops = &pl030_ops;
+ rtc->base = ioremap(dev->res.start, resource_size(&dev->res));
+ if (!rtc->base) {
+ ret = -ENOMEM;
+@@ -128,12 +135,9 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ if (ret)
+ goto err_irq;
+
+- rtc->rtc = rtc_device_register("pl030", &dev->dev, &pl030_ops,
+- THIS_MODULE);
+- if (IS_ERR(rtc->rtc)) {
+- ret = PTR_ERR(rtc->rtc);
++ ret = rtc_register_device(rtc->rtc);
++ if (ret)
+ goto err_reg;
+- }
+
+ return 0;
+
+@@ -154,7 +158,6 @@ static int pl030_remove(struct amba_device *dev)
+ writel(0, rtc->base + RTC_CR);
+
+ free_irq(dev->irq[0], rtc);
+- rtc_device_unregister(rtc->rtc);
+ iounmap(rtc->base);
+ amba_release_regions(dev);
+
+--
+2.20.1
+
--- /dev/null
+From e81eb5aca43f7297dc924308104ed8814691c7a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 23:23:43 +0200
+Subject: rtc: rv8803: fix the rv8803 id in the OF table
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit c856618d20662695fcdb47bf4d560dc457662aec ]
+
+The ID for RV8803 must be rv_8803
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-rv8803.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-rv8803.c b/drivers/rtc/rtc-rv8803.c
+index 29fc3d2103923..17ccef5d5db1a 100644
+--- a/drivers/rtc/rtc-rv8803.c
++++ b/drivers/rtc/rtc-rv8803.c
+@@ -623,7 +623,7 @@ MODULE_DEVICE_TABLE(i2c, rv8803_id);
+ static const struct of_device_id rv8803_of_match[] = {
+ {
+ .compatible = "microcrystal,rv8803",
+- .data = (void *)rx_8900
++ .data = (void *)rv_8803
+ },
+ {
+ .compatible = "epson,rx8900",
+--
+2.20.1
+
--- /dev/null
+From 35c80e7465a8beda270ac57bd8b5afb11e0ef977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 12:22:34 +0300
+Subject: rtc: sysfs: fix NULL check in rtc_add_groups()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 777d8ae56da18fb6440acd941edb3597c1b02bf0 ]
+
+devm_kcalloc() returns NULL, it never returns error pointers. In the
+current code we would return PTR_ERR(NULL) which is success, instead of
+returning the -ENOMEM error code.
+
+Fixes: a0a1a1ba3032 ("rtc: sysfs: facilitate attribute add to rtc device")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-sysfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-sysfs.c b/drivers/rtc/rtc-sysfs.c
+index f1ff30ade5343..9746c32eee2eb 100644
+--- a/drivers/rtc/rtc-sysfs.c
++++ b/drivers/rtc/rtc-sysfs.c
+@@ -338,8 +338,8 @@ int rtc_add_groups(struct rtc_device *rtc, const struct attribute_group **grps)
+
+ new_cnt = old_cnt + add_cnt + 1;
+ groups = devm_kcalloc(&rtc->dev, new_cnt, sizeof(*groups), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(groups))
+- return PTR_ERR(groups);
++ if (!groups)
++ return -ENOMEM;
+ memcpy(groups, rtc->dev.groups, old_cnt * sizeof(*groups));
+ memcpy(groups + old_cnt, grps, add_cnt * sizeof(*groups));
+ groups[old_cnt + add_cnt] = NULL;
+--
+2.20.1
+
--- /dev/null
+From 030077385ae253dab47ccff3d198d477987c5e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 03:14:58 +0200
+Subject: rtc: tx4939: fixup nvmem name and register size
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 2ab78755e93a10f6216c860a2012f3592f395603 ]
+
+The default word_size and stride of 1 are correct for the tx4939. Also fix
+the nvmem folder name.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-tx4939.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/rtc/rtc-tx4939.c b/drivers/rtc/rtc-tx4939.c
+index 08dbefc79520e..61c110b2045f8 100644
+--- a/drivers/rtc/rtc-tx4939.c
++++ b/drivers/rtc/rtc-tx4939.c
+@@ -253,9 +253,7 @@ static int __init tx4939_rtc_probe(struct platform_device *pdev)
+ struct resource *res;
+ int irq, ret;
+ struct nvmem_config nvmem_cfg = {
+- .name = "rv8803_nvram",
+- .word_size = 4,
+- .stride = 4,
++ .name = "tx4939_nvram",
+ .size = TX4939_RTC_REG_RAMSIZE,
+ .reg_read = tx4939_nvram_read,
+ .reg_write = tx4939_nvram_write,
+--
+2.20.1
+
--- /dev/null
+From 830752a0749904eb9bd61d5e144b09e576331953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 13:48:31 -0500
+Subject: rtl8187: Fix warning generated when strncpy() destination length
+ matches the sixe argument
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ]
+
+In gcc8, when the 3rd argument (size) of a call to strncpy() matches the
+length of the first argument, the compiler warns of the possibility of an
+unterminated string. Using strlcpy() forces a null at the end.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+index c2d5b495c179a..c089540116fa7 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
+ led->dev = dev;
+ led->ledpin = ledpin;
+ led->is_radio = is_radio;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
+--
+2.20.1
+
--- /dev/null
+From 3f2227f411bf9806675e92f5e2d2216d11ac9363 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 21:53:51 +0200
+Subject: rtnetlink: move type calculation out of loop
+
+From: Christian Brauner <christian@brauner.io>
+
+[ Upstream commit 87ccbb1f943625884b824c5560f635dcea8e4510 ]
+
+I don't see how the type - which is one of
+RTM_{GETADDR,GETROUTE,GETNETCONF} - can change. So do the message type
+calculation once before entering the for loop.
+
+Signed-off-by: Christian Brauner <christian@brauner.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 95768a9fca06e..c0de73b125802 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3268,13 +3268,13 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ int idx;
+ int s_idx = cb->family;
++ int type = cb->nlh->nlmsg_type - RTM_BASE;
+
+ if (s_idx == 0)
+ s_idx = 1;
+
+ for (idx = 1; idx <= RTNL_FAMILY_MAX; idx++) {
+ struct rtnl_link **tab;
+- int type = cb->nlh->nlmsg_type-RTM_BASE;
+ struct rtnl_link *link;
+ rtnl_dumpit_func dumpit;
+
+--
+2.20.1
+
--- /dev/null
+From 21bb8ef79cd4fb9cebbd4ce0d810213536f8e4bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:36:06 +0200
+Subject: s390/qeth: invoke softirqs after napi_schedule()
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ]
+
+Calling napi_schedule() from process context does not ensure that the
+NET_RX softirq is run in a timely fashion. So trigger it manually.
+
+This is no big issue with current code. A call to ndo_open() is usually
+followed by a ndo_set_rx_mode() call, and for qeth this contains a
+spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out
+early.
+Nevertheless it's best to not depend on this behaviour, and just fix
+the issue at its source like all other drivers do. For instance see
+commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule").
+
+Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 3 +++
+ drivers/s390/net/qeth_l3_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c1c35eccd5b65..95669d47c389e 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -789,7 +789,10 @@ static int __qeth_l2_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 9c5e801b3f6cb..52e0ae4dc7241 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2414,7 +2414,10 @@ static int __qeth_l3_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 5f070cb8cfd942024c3569c679b06a991e9018a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:36:05 +0200
+Subject: s390/qeth: uninstall IRQ handler on device removal
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 121ca39aa5585def682a2c8592983442438b84dc ]
+
+When setting up, qeth installs its IRQ handler on the ccw devices. But
+the IRQ handler is not cleared on removal - so even after qeth yields
+control of the ccw devices, spurious interrupts would still be presented
+to us.
+
+Make (de-)installation of the IRQ handler part of the ccw channel
+setup/removal helpers, and while at it also add the appropriate locking.
+Shift around qeth_setup_channel() to avoid a forward declaration for
+qeth_irq().
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 102 ++++++++++++++++--------------
+ 1 file changed, 54 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 461afc276db72..81e2c591acb0b 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -901,44 +901,6 @@ out:
+ qeth_release_buffer(channel, iob);
+ }
+
+-static int qeth_setup_channel(struct qeth_channel *channel, bool alloc_buffers)
+-{
+- int cnt;
+-
+- QETH_DBF_TEXT(SETUP, 2, "setupch");
+-
+- channel->ccw = kmalloc(sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
+- if (!channel->ccw)
+- return -ENOMEM;
+- channel->state = CH_STATE_DOWN;
+- atomic_set(&channel->irq_pending, 0);
+- init_waitqueue_head(&channel->wait_q);
+-
+- if (!alloc_buffers)
+- return 0;
+-
+- for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++) {
+- channel->iob[cnt].data =
+- kzalloc(QETH_BUFSIZE, GFP_DMA|GFP_KERNEL);
+- if (channel->iob[cnt].data == NULL)
+- break;
+- channel->iob[cnt].state = BUF_STATE_FREE;
+- channel->iob[cnt].channel = channel;
+- channel->iob[cnt].callback = qeth_send_control_data_cb;
+- channel->iob[cnt].rc = 0;
+- }
+- if (cnt < QETH_CMD_BUFFER_NO) {
+- kfree(channel->ccw);
+- while (cnt-- > 0)
+- kfree(channel->iob[cnt].data);
+- return -ENOMEM;
+- }
+- channel->io_buf_no = 0;
+- spin_lock_init(&channel->iob_lock);
+-
+- return 0;
+-}
+-
+ static int qeth_set_thread_start_bit(struct qeth_card *card,
+ unsigned long thread)
+ {
+@@ -1339,14 +1301,61 @@ static void qeth_free_buffer_pool(struct qeth_card *card)
+
+ static void qeth_clean_channel(struct qeth_channel *channel)
+ {
++ struct ccw_device *cdev = channel->ccwdev;
+ int cnt;
+
+ QETH_DBF_TEXT(SETUP, 2, "freech");
++
++ spin_lock_irq(get_ccwdev_lock(cdev));
++ cdev->handler = NULL;
++ spin_unlock_irq(get_ccwdev_lock(cdev));
++
+ for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
+ kfree(channel->iob[cnt].data);
+ kfree(channel->ccw);
+ }
+
++static int qeth_setup_channel(struct qeth_channel *channel, bool alloc_buffers)
++{
++ struct ccw_device *cdev = channel->ccwdev;
++ int cnt;
++
++ QETH_DBF_TEXT(SETUP, 2, "setupch");
++
++ channel->ccw = kmalloc(sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
++ if (!channel->ccw)
++ return -ENOMEM;
++ channel->state = CH_STATE_DOWN;
++ atomic_set(&channel->irq_pending, 0);
++ init_waitqueue_head(&channel->wait_q);
++
++ spin_lock_irq(get_ccwdev_lock(cdev));
++ cdev->handler = qeth_irq;
++ spin_unlock_irq(get_ccwdev_lock(cdev));
++
++ if (!alloc_buffers)
++ return 0;
++
++ for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++) {
++ channel->iob[cnt].data =
++ kzalloc(QETH_BUFSIZE, GFP_DMA|GFP_KERNEL);
++ if (channel->iob[cnt].data == NULL)
++ break;
++ channel->iob[cnt].state = BUF_STATE_FREE;
++ channel->iob[cnt].channel = channel;
++ channel->iob[cnt].callback = qeth_send_control_data_cb;
++ channel->iob[cnt].rc = 0;
++ }
++ if (cnt < QETH_CMD_BUFFER_NO) {
++ qeth_clean_channel(channel);
++ return -ENOMEM;
++ }
++ channel->io_buf_no = 0;
++ spin_lock_init(&channel->iob_lock);
++
++ return 0;
++}
++
+ static void qeth_set_single_write_queues(struct qeth_card *card)
+ {
+ if ((atomic_read(&card->qdio.state) != QETH_QDIO_UNINITIALIZED) &&
+@@ -1498,7 +1507,7 @@ static void qeth_core_sl_print(struct seq_file *m, struct service_level *slr)
+ CARD_BUS_ID(card), card->info.mcl_level);
+ }
+
+-static struct qeth_card *qeth_alloc_card(void)
++static struct qeth_card *qeth_alloc_card(struct ccwgroup_device *gdev)
+ {
+ struct qeth_card *card;
+
+@@ -1507,6 +1516,11 @@ static struct qeth_card *qeth_alloc_card(void)
+ if (!card)
+ goto out;
+ QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
++
++ card->gdev = gdev;
++ CARD_RDEV(card) = gdev->cdev[0];
++ CARD_WDEV(card) = gdev->cdev[1];
++ CARD_DDEV(card) = gdev->cdev[2];
+ if (qeth_setup_channel(&card->read, true))
+ goto out_ip;
+ if (qeth_setup_channel(&card->write, true))
+@@ -5745,7 +5759,7 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
+
+ QETH_DBF_TEXT_(SETUP, 2, "%s", dev_name(&gdev->dev));
+
+- card = qeth_alloc_card();
++ card = qeth_alloc_card(gdev);
+ if (!card) {
+ QETH_DBF_TEXT_(SETUP, 2, "1err%d", -ENOMEM);
+ rc = -ENOMEM;
+@@ -5761,15 +5775,7 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
+ goto err_card;
+ }
+
+- card->read.ccwdev = gdev->cdev[0];
+- card->write.ccwdev = gdev->cdev[1];
+- card->data.ccwdev = gdev->cdev[2];
+ dev_set_drvdata(&gdev->dev, card);
+- card->gdev = gdev;
+- gdev->cdev[0]->handler = qeth_irq;
+- gdev->cdev[1]->handler = qeth_irq;
+- gdev->cdev[2]->handler = qeth_irq;
+-
+ qeth_setup_card(card);
+ rc = qeth_update_from_chp_desc(card);
+ if (rc)
+--
+2.20.1
+
--- /dev/null
+From cfd88237411913184c0bde654aa731102b93f06f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 17:29:39 +0200
+Subject: s390/vdso: avoid 64-bit vdso mapping for compat tasks
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit d1befa65823e9c6d013883b8a41d081ec338c489 ]
+
+vdso_fault used is_compat_task function (on s390 it tests "current"
+thread_info flags) to distinguish compat tasks and map 31-bit vdso
+pages. But "current" task might not correspond to mm context.
+
+When 31-bit compat inferior is executed under gdb, gdb does
+PTRACE_PEEKTEXT on vdso page, causing vdso_fault with "current" being
+64-bit gdb process. So, 31-bit inferior ends up with 64-bit vdso mapped.
+
+To avoid this problem a new compat_mm flag has been introduced into
+mm context. This flag is used in vdso_fault and vdso_mremap instead
+of is_compat_task.
+
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/mmu.h | 2 ++
+ arch/s390/include/asm/mmu_context.h | 1 +
+ arch/s390/kernel/vdso.c | 8 +++++---
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
+index a8418e1379eb7..bcfb6371086f2 100644
+--- a/arch/s390/include/asm/mmu.h
++++ b/arch/s390/include/asm/mmu.h
+@@ -32,6 +32,8 @@ typedef struct {
+ unsigned int uses_cmm:1;
+ /* The gmaps associated with this context are allowed to use huge pages. */
+ unsigned int allow_gmap_hpage_1m:1;
++ /* The mmu context is for compat task */
++ unsigned int compat_mm:1;
+ } mm_context_t;
+
+ #define INIT_MM_CONTEXT(name) \
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index 09b61d0e491f6..e4462202200d7 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -25,6 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
+ atomic_set(&mm->context.flush_count, 0);
+ mm->context.gmap_asce = 0;
+ mm->context.flush_mm = 0;
++ mm->context.compat_mm = 0;
+ #ifdef CONFIG_PGSTE
+ mm->context.alloc_pgste = page_table_allocate_pgste ||
+ test_thread_flag(TIF_PGSTE) ||
+diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
+index 3031cc6dd0ab4..ec31b48a42a52 100644
+--- a/arch/s390/kernel/vdso.c
++++ b/arch/s390/kernel/vdso.c
+@@ -56,7 +56,7 @@ static vm_fault_t vdso_fault(const struct vm_special_mapping *sm,
+ vdso_pagelist = vdso64_pagelist;
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task()) {
++ if (vma->vm_mm->context.compat_mm) {
+ vdso_pagelist = vdso32_pagelist;
+ vdso_pages = vdso32_pages;
+ }
+@@ -77,7 +77,7 @@ static int vdso_mremap(const struct vm_special_mapping *sm,
+
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task())
++ if (vma->vm_mm->context.compat_mm)
+ vdso_pages = vdso32_pages;
+ #endif
+
+@@ -224,8 +224,10 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task())
++ if (is_compat_task()) {
+ vdso_pages = vdso32_pages;
++ mm->context.compat_mm = 1;
++ }
+ #endif
+ /*
+ * vDSO has a problem and was disabled, just don't "enable" it for
+--
+2.20.1
+
--- /dev/null
+From 713b80277d3c1a496705833dacb2724d1908504c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 18:08:10 +0200
+Subject: s390/vdso: correct CFI annotations of vDSO functions
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 26f4414a45b808f83d42d6fd2fbf4a59ef25e84b ]
+
+Correct stack frame overhead for 31-bit vdso, which should be 96 rather
+then 160. This is done by reusing STACK_FRAME_OVERHEAD definition which
+contains correct value based on build flags. This fixes stack unwinding
+within vdso code for 31-bit processes. While at it replace all hard coded
+stack frame overhead values with the same definition in vdso64 as well.
+
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vdso32/clock_gettime.S | 19 ++++++++++---------
+ arch/s390/kernel/vdso32/gettimeofday.S | 3 ++-
+ arch/s390/kernel/vdso64/clock_gettime.S | 25 +++++++++++++------------
+ arch/s390/kernel/vdso64/gettimeofday.S | 3 ++-
+ 4 files changed, 27 insertions(+), 23 deletions(-)
+
+diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
+index a9418bf975db5..ada5c11a16e5a 100644
+--- a/arch/s390/kernel/vdso32/clock_gettime.S
++++ b/arch/s390/kernel/vdso32/clock_gettime.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -18,8 +19,8 @@
+ __kernel_clock_gettime:
+ CFI_STARTPROC
+ ahi %r15,-16
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ basr %r5,0
+ 0: al %r5,21f-0b(%r5) /* get &_vdso_data */
+ chi %r2,__CLOCK_REALTIME_COARSE
+@@ -72,13 +73,13 @@ __kernel_clock_gettime:
+ st %r1,4(%r3) /* store tp->tv_nsec */
+ lhi %r2,0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CLOCK_MONOTONIC_COARSE */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 9: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */
+ tml %r4,0x0001 /* pending update ? loop */
+ jnz 9b
+@@ -158,17 +159,17 @@ __kernel_clock_gettime:
+ st %r1,4(%r3) /* store tp->tv_nsec */
+ lhi %r2,0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* Fallback to system call */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 19: lhi %r1,__NR_clock_gettime
+ svc 0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+ CFI_ENDPROC
+diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
+index 3c0db0fa6ad90..b23063fbc892c 100644
+--- a/arch/s390/kernel/vdso32/gettimeofday.S
++++ b/arch/s390/kernel/vdso32/gettimeofday.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -19,7 +20,7 @@ __kernel_gettimeofday:
+ CFI_STARTPROC
+ ahi %r15,-16
+ CFI_ADJUST_CFA_OFFSET 16
+- CFI_VAL_OFFSET 15, -160
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ basr %r5,0
+ 0: al %r5,13f-0b(%r5) /* get &_vdso_data */
+ 1: ltr %r3,%r3 /* check if tz is NULL */
+diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
+index fac3ab5ec83a9..9d2ee79b90f25 100644
+--- a/arch/s390/kernel/vdso64/clock_gettime.S
++++ b/arch/s390/kernel/vdso64/clock_gettime.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -18,8 +19,8 @@
+ __kernel_clock_gettime:
+ CFI_STARTPROC
+ aghi %r15,-16
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ larl %r5,_vdso_data
+ cghi %r2,__CLOCK_REALTIME_COARSE
+ je 4f
+@@ -56,13 +57,13 @@ __kernel_clock_gettime:
+ stg %r1,8(%r3) /* store tp->tv_nsec */
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CLOCK_MONOTONIC_COARSE */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 3: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */
+ tmll %r4,0x0001 /* pending update ? loop */
+ jnz 3b
+@@ -115,13 +116,13 @@ __kernel_clock_gettime:
+ stg %r1,8(%r3) /* store tp->tv_nsec */
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CPUCLOCK_VIRT for this thread */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 9: lghi %r4,0
+ icm %r0,15,__VDSO_ECTG_OK(%r5)
+ jz 12f
+@@ -142,17 +143,17 @@ __kernel_clock_gettime:
+ stg %r4,8(%r3)
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* Fallback to system call */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 12: lghi %r1,__NR_clock_gettime
+ svc 0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+ CFI_ENDPROC
+diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
+index 6e1f0b421695a..aebe10dc7c99a 100644
+--- a/arch/s390/kernel/vdso64/gettimeofday.S
++++ b/arch/s390/kernel/vdso64/gettimeofday.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -19,7 +20,7 @@ __kernel_gettimeofday:
+ CFI_STARTPROC
+ aghi %r15,-16
+ CFI_ADJUST_CFA_OFFSET 16
+- CFI_VAL_OFFSET 15, -160
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ larl %r5,_vdso_data
+ 0: ltgr %r3,%r3 /* check if tz is NULL */
+ je 1f
+--
+2.20.1
+
--- /dev/null
+From 7740ec601b1dcb009da47876eddcf5c5e793ce3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 13:43:22 +0100
+Subject: s390/vdso: correct vdso mapping for compat tasks
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 190f056fba230abee80712eb810939ef9a8c462f ]
+
+While "s390/vdso: avoid 64-bit vdso mapping for compat tasks" fixed
+64-bit vdso mapping for compat tasks under gdb it introduced another
+problem. "compat_mm" flag is not inherited during fork and when
+31-bit process forks a child (but does not perform exec) it ends up
+with 64-bit vdso. To address that, init_new_context (which is called
+during fork and exec) now initialize compat_mm based on thread TIF_31BIT
+flag. Later compat_mm is adjusted in arch_setup_additional_pages, which
+is called during exec.
+
+Fixes: d1befa65823e ("s390/vdso: avoid 64-bit vdso mapping for compat tasks")
+Reported-by: Stefan Liebler <stli@linux.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: <stable@vger.kernel.org> # v4.20+
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/mmu_context.h | 2 +-
+ arch/s390/kernel/vdso.c | 5 ++---
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index e4462202200d7..8d04e6f3f7964 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -25,7 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
+ atomic_set(&mm->context.flush_count, 0);
+ mm->context.gmap_asce = 0;
+ mm->context.flush_mm = 0;
+- mm->context.compat_mm = 0;
++ mm->context.compat_mm = test_thread_flag(TIF_31BIT);
+ #ifdef CONFIG_PGSTE
+ mm->context.alloc_pgste = page_table_allocate_pgste ||
+ test_thread_flag(TIF_PGSTE) ||
+diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
+index ec31b48a42a52..7ab7d256d1eb7 100644
+--- a/arch/s390/kernel/vdso.c
++++ b/arch/s390/kernel/vdso.c
+@@ -224,10 +224,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task()) {
++ mm->context.compat_mm = is_compat_task();
++ if (mm->context.compat_mm)
+ vdso_pages = vdso32_pages;
+- mm->context.compat_mm = 1;
+- }
+ #endif
+ /*
+ * vDSO has a problem and was disabled, just don't "enable" it for
+--
+2.20.1
+
--- /dev/null
+From c6b5e7d98ebc62937b152786f5654044aeaf1569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 15:23:03 +0200
+Subject: s390/zcrypt: enable AP bus scan without a valid default domain
+
+From: Halil Pasic <pasic@linux.ibm.com>
+
+[ Upstream commit 1c472d46283263497adccd7a0bec64ee2f9c09e5 ]
+
+The AP bus scan is aborted before doing anything worth mentioning if
+ap_select_domain() fails, e.g. if the ap_rights.aqm mask is all zeros.
+As the result of this the ap bus fails to manage (e.g. create and
+register) devices like it is supposed to.
+
+Let us make ap_scan_bus() work even if ap_select_domain() can't select a
+default domain. Let's also make ap_select_domain() return void, as there
+are no more callers interested in its return value.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Michael Mueller <mimu@linux.ibm.com>
+Fixes: 7e0bdbe5c21c "s390/zcrypt: AP bus support for alternate driver(s)"
+[freude@linux.ibm.com: title and patch header slightly modified]
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_bus.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 3be54651698a3..027a53eec42a5 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -1223,11 +1223,10 @@ static struct bus_attribute *const ap_bus_attrs[] = {
+ };
+
+ /**
+- * ap_select_domain(): Select an AP domain.
+- *
+- * Pick one of the 16 AP domains.
++ * ap_select_domain(): Select an AP domain if possible and we haven't
++ * already done so before.
+ */
+-static int ap_select_domain(void)
++static void ap_select_domain(void)
+ {
+ int count, max_count, best_domain;
+ struct ap_queue_status status;
+@@ -1242,7 +1241,7 @@ static int ap_select_domain(void)
+ if (ap_domain_index >= 0) {
+ /* Domain has already been selected. */
+ spin_unlock_bh(&ap_domain_lock);
+- return 0;
++ return;
+ }
+ best_domain = -1;
+ max_count = 0;
+@@ -1269,11 +1268,8 @@ static int ap_select_domain(void)
+ if (best_domain >= 0) {
+ ap_domain_index = best_domain;
+ AP_DBF(DBF_DEBUG, "new ap_domain_index=%d\n", ap_domain_index);
+- spin_unlock_bh(&ap_domain_lock);
+- return 0;
+ }
+ spin_unlock_bh(&ap_domain_lock);
+- return -ENODEV;
+ }
+
+ /*
+@@ -1351,8 +1347,7 @@ static void ap_scan_bus(struct work_struct *unused)
+ AP_DBF(DBF_DEBUG, "%s running\n", __func__);
+
+ ap_query_configuration(ap_configuration);
+- if (ap_select_domain() != 0)
+- goto out;
++ ap_select_domain();
+
+ for (id = 0; id < AP_DEVICES; id++) {
+ /* check if device is registered */
+@@ -1468,12 +1463,11 @@ static void ap_scan_bus(struct work_struct *unused)
+ }
+ } /* end device loop */
+
+- if (defdomdevs < 1)
++ if (ap_domain_index >= 0 && defdomdevs < 1)
+ AP_DBF(DBF_INFO,
+ "no queue device with default domain %d available\n",
+ ap_domain_index);
+
+-out:
+ mod_timer(&ap_config_timer, jiffies + ap_config_time * HZ);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 28fcc50ea2ec59433c686e1d9154d0658ae0a9a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 22:08:13 -0700
+Subject: samples/bpf: fix a compilation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 534e0e52bc23de588e81b5a6f75e10c8c4b189fc ]
+
+samples/bpf build failed with the following errors:
+
+ $ make samples/bpf/
+ ...
+ HOSTCC samples/bpf/sockex3_user.o
+ /data/users/yhs/work/net-next/samples/bpf/sockex3_user.c:16:8: error: redefinition of ‘struct bpf_flow_keys’
+ struct bpf_flow_keys {
+ ^
+ In file included from /data/users/yhs/work/net-next/samples/bpf/sockex3_user.c:4:0:
+ ./usr/include/linux/bpf.h:2338:9: note: originally defined here
+ struct bpf_flow_keys *flow_keys;
+ ^
+ make[3]: *** [samples/bpf/sockex3_user.o] Error 1
+
+Commit d58e468b1112d ("flow_dissector: implements flow dissector BPF hook")
+introduced struct bpf_flow_keys in include/uapi/linux/bpf.h and hence
+caused the naming conflict with samples/bpf/sockex3_user.c.
+
+The fix is to rename struct bpf_flow_keys in samples/bpf/sockex3_user.c
+to flow_keys to avoid the conflict.
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/sockex3_user.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/sockex3_user.c b/samples/bpf/sockex3_user.c
+index 5ba3ae9d180ba..22f74d0e14934 100644
+--- a/samples/bpf/sockex3_user.c
++++ b/samples/bpf/sockex3_user.c
+@@ -13,7 +13,7 @@
+ #define PARSE_IP_PROG_FD (prog_fd[0])
+ #define PROG_ARRAY_FD (map_fd[0])
+
+-struct bpf_flow_keys {
++struct flow_keys {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -64,7 +64,7 @@ int main(int argc, char **argv)
+ (void) f;
+
+ for (i = 0; i < 5; i++) {
+- struct bpf_flow_keys key = {}, next_key;
++ struct flow_keys key = {}, next_key;
+ struct pair value;
+
+ sleep(1);
+--
+2.20.1
+
--- /dev/null
+From 5f9c84309bca3e791ae18f2a1ac26ae89dc91a52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:52:03 +0900
+Subject: samples/bpf: fix compilation failure
+
+From: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
+
+[ Upstream commit 32c009798385ce21080beaa87a9b95faad3acd1e ]
+
+following commit:
+commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
+added struct bpf_flow_keys which conflicts with the struct with
+same name in sockex2_kern.c and sockex3_kern.c
+
+similar to commit:
+commit 534e0e52bc23 ("samples/bpf: fix a compilation failure")
+we tried the rename it "flow_keys" but it also conflicted with struct
+having same name in include/net/flow_dissector.h. Hence renaming the
+struct to "flow_key_record". Also, this commit doesn't fix the
+compilation error completely because the similar struct is present in
+sockex3_kern.c. Hence renaming it in both files sockex3_user.c and
+sockex3_kern.c
+
+Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/sockex2_kern.c | 11 ++++++-----
+ samples/bpf/sockex3_kern.c | 8 ++++----
+ samples/bpf/sockex3_user.c | 4 ++--
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/samples/bpf/sockex2_kern.c b/samples/bpf/sockex2_kern.c
+index f58acfc925561..f2f9dbc021b0d 100644
+--- a/samples/bpf/sockex2_kern.c
++++ b/samples/bpf/sockex2_kern.c
+@@ -14,7 +14,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -59,7 +59,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ __u64 verlen;
+
+@@ -83,7 +83,7 @@ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto
+ }
+
+ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ *ip_proto = load_byte(skb,
+ nhoff + offsetof(struct ipv6hdr, nexthdr));
+@@ -96,7 +96,8 @@ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_pro
+ return nhoff;
+ }
+
+-static inline bool flow_dissector(struct __sk_buff *skb, struct bpf_flow_keys *flow)
++static inline bool flow_dissector(struct __sk_buff *skb,
++ struct flow_key_record *flow)
+ {
+ __u64 nhoff = ETH_HLEN;
+ __u64 ip_proto;
+@@ -198,7 +199,7 @@ struct bpf_map_def SEC("maps") hash_map = {
+ SEC("socket2")
+ int bpf_prog2(struct __sk_buff *skb)
+ {
+- struct bpf_flow_keys flow = {};
++ struct flow_key_record flow = {};
+ struct pair *value;
+ u32 key;
+
+diff --git a/samples/bpf/sockex3_kern.c b/samples/bpf/sockex3_kern.c
+index 95907f8d2b17d..c527b57d3ec8a 100644
+--- a/samples/bpf/sockex3_kern.c
++++ b/samples/bpf/sockex3_kern.c
+@@ -61,7 +61,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -88,7 +88,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ struct globals {
+- struct bpf_flow_keys flow;
++ struct flow_key_record flow;
+ };
+
+ struct bpf_map_def SEC("maps") percpu_map = {
+@@ -114,14 +114,14 @@ struct pair {
+
+ struct bpf_map_def SEC("maps") hash_map = {
+ .type = BPF_MAP_TYPE_HASH,
+- .key_size = sizeof(struct bpf_flow_keys),
++ .key_size = sizeof(struct flow_key_record),
+ .value_size = sizeof(struct pair),
+ .max_entries = 1024,
+ };
+
+ static void update_stats(struct __sk_buff *skb, struct globals *g)
+ {
+- struct bpf_flow_keys key = g->flow;
++ struct flow_key_record key = g->flow;
+ struct pair *value;
+
+ value = bpf_map_lookup_elem(&hash_map, &key);
+diff --git a/samples/bpf/sockex3_user.c b/samples/bpf/sockex3_user.c
+index 22f74d0e14934..9d02e0404719a 100644
+--- a/samples/bpf/sockex3_user.c
++++ b/samples/bpf/sockex3_user.c
+@@ -13,7 +13,7 @@
+ #define PARSE_IP_PROG_FD (prog_fd[0])
+ #define PROG_ARRAY_FD (map_fd[0])
+
+-struct flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -64,7 +64,7 @@ int main(int argc, char **argv)
+ (void) f;
+
+ for (i = 0; i < 5; i++) {
+- struct flow_keys key = {}, next_key;
++ struct flow_key_record key = {}, next_key;
+ struct pair value;
+
+ sleep(1);
+--
+2.20.1
+
--- /dev/null
+From 2ea168801fa2f5487b54e9e88842b10e6183ee78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 11:45:21 +0200
+Subject: sched/debug: Explicitly cast sched_feat() to bool
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 7e6f4c5d600c1c8e2a1d900e65cab319d9b6782e ]
+
+LLVM has a warning that tags expressions like:
+
+ if (foo && non-bool-const)
+
+This pattern triggers for CONFIG_SCHED_DEBUG=n where sched_feat() ends
+up being whatever bit we select. Avoid the warning with an explicit
+cast to bool.
+
+Reported-by: Philipp Klocke <philipp97kl@gmail.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/sched.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 62058fd6dcf63..94bec97bd5e28 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1389,7 +1389,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features =
+ 0;
+ #undef SCHED_FEAT
+
+-#define sched_feat(x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
++#define sched_feat(x) !!(sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
+
+ #endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */
+
+--
+2.20.1
+
--- /dev/null
+From daa647d418615cf69081d90c2cbb498246df1572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 11:36:36 +0200
+Subject: sched/debug: Use symbolic names for task state constants
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ff28915fd31ccafc0d38e6f84b66df280ed9e86a ]
+
+include/trace/events/sched.h includes <linux/sched.h> (via
+<linux/sched/numa_balancing.h>) and so knows about the TASK_* constants
+used to interpret .prev_state. So instead of duplicating the magic
+numbers make use of the defined macros to ease understanding the
+mapping from state bits to letters which isn't completely intuitive for
+an outsider.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: kernel@pengutronix.de
+Link: http://lkml.kernel.org/r/20180905093636.24068-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/sched.h | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 5e1a7578c9edd..9a4bdfadab077 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -169,9 +169,14 @@ TRACE_EVENT(sched_switch,
+
+ (__entry->prev_state & (TASK_REPORT_MAX - 1)) ?
+ __print_flags(__entry->prev_state & (TASK_REPORT_MAX - 1), "|",
+- { 0x01, "S" }, { 0x02, "D" }, { 0x04, "T" },
+- { 0x08, "t" }, { 0x10, "X" }, { 0x20, "Z" },
+- { 0x40, "P" }, { 0x80, "I" }) :
++ { TASK_INTERRUPTIBLE, "S" },
++ { TASK_UNINTERRUPTIBLE, "D" },
++ { __TASK_STOPPED, "T" },
++ { __TASK_TRACED, "t" },
++ { EXIT_DEAD, "X" },
++ { EXIT_ZOMBIE, "Z" },
++ { TASK_PARKED, "P" },
++ { TASK_DEAD, "I" }) :
+ "R",
+
+ __entry->prev_state & TASK_REPORT_MAX ? "+" : "",
+--
+2.20.1
+
--- /dev/null
+From fde940ba8b585c30171d37aaec5c0b0a1877affc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 10:56:52 +0800
+Subject: scsi: libsas: always unregister the old device if going to discover
+ new
+
+From: Jason Yan <yanaijie@huawei.com>
+
+[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ]
+
+If we went into sas_rediscover_dev() the attached_sas_addr was already insured
+not to be zero. So it's unnecessary to check if the attached_sas_addr is zero.
+
+And although if the sas address is not changed, we always have to unregister
+the old device when we are going to register a new one. We cannot just leave
+the device there and bring up the new.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+CC: John Garry <john.garry@huawei.com>
+CC: Johannes Thumshirn <jthumshirn@suse.de>
+CC: Ewan Milne <emilne@redhat.com>
+CC: Christoph Hellwig <hch@lst.de>
+CC: Tomas Henzl <thenzl@redhat.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index b141d1061f38e..2ee9c4ec7a541 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2062,14 +2062,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ return res;
+ }
+
+- /* delete the old link */
+- if (SAS_ADDR(phy->attached_sas_addr) &&
+- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) {
+- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
+- SAS_ADDR(dev->sas_addr), phy_id,
+- SAS_ADDR(phy->attached_sas_addr));
+- sas_unregister_devs_sas_addr(dev, phy_id, last);
+- }
++ /* we always have to delete the old device when we went here */
++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
++ SAS_ADDR(dev->sas_addr), phy_id,
++ SAS_ADDR(phy->attached_sas_addr));
++ sas_unregister_devs_sas_addr(dev, phy_id, last);
+
+ return sas_discover_new(dev, phy_id);
+ }
+--
+2.20.1
+
--- /dev/null
+From 292b94f6234411b6b3113159c7645992c869623f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 10:30:47 -0700
+Subject: scsi: lpfc: Correct invalid EQ doorbell write on if_type=6
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit aad59d5d34738d6fd8c359df8048a84cd443e504 ]
+
+During attachment, the driver writes the EQ doorbell to disable potential
+interrupts from an EQ. The current EQ doorbell format used for clearing the
+interrupt is incorrect and uses an if_type=2 format, making the operation act
+on the wrong EQ.
+
+Correct the code to use the proper if_type=6 EQ doorbell format.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a490e63c94b67..e704297618e06 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -392,11 +392,7 @@ lpfc_sli4_if6_eq_clr_intr(struct lpfc_queue *q)
+ struct lpfc_register doorbell;
+
+ doorbell.word0 = 0;
+- bf_set(lpfc_eqcq_doorbell_eqci, &doorbell, 1);
+- bf_set(lpfc_eqcq_doorbell_qt, &doorbell, LPFC_QUEUE_TYPE_EVENT);
+- bf_set(lpfc_eqcq_doorbell_eqid_hi, &doorbell,
+- (q->queue_id >> LPFC_EQID_HI_FIELD_SHIFT));
+- bf_set(lpfc_eqcq_doorbell_eqid_lo, &doorbell, q->queue_id);
++ bf_set(lpfc_if6_eq_doorbell_eqid, &doorbell, q->queue_id);
+ writel(doorbell.word0, q->phba->sli4_hba.EQDBregaddr);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 083948e5653ffb4840bb761a93d71b13de196663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 10:30:48 -0700
+Subject: scsi: lpfc: Fix errors in log messages.
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 2879265f514b1f4154288243c91438ddbedb3ed4 ]
+
+Message 6408 is displayed for each entry in an array, but the cpu and queue
+numbers were incorrect for the entry. Message 6001 includes an extraneous
+character.
+
+Resolve both issues
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvme.c | 2 +-
+ drivers/scsi/lpfc/lpfc_nvmet.c | 7 +++----
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 645ffb5332b4a..8ee585e453dcf 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -282,7 +282,7 @@ lpfc_nvme_delete_queue(struct nvme_fc_local_port *pnvme_lport,
+ vport = lport->vport;
+
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME,
+- "6001 ENTER. lpfc_pnvme %p, qidx x%xi qhandle %p\n",
++ "6001 ENTER. lpfc_pnvme %p, qidx x%x qhandle %p\n",
+ lport, qidx, handle);
+ kfree(handle);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 22efefcc6cd84..768eba8c111d9 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1340,15 +1340,14 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+ idx = 0;
+ }
+
+- infop = phba->sli4_hba.nvmet_ctx_info;
+- for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
+- for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
++ infop = lpfc_get_ctx_list(phba, i, j);
+ lpfc_printf_log(phba, KERN_INFO, LOG_NVME | LOG_INIT,
+ "6408 TOTAL NVMET ctx for CPU %d "
+ "MRQ %d: cnt %d nextcpu %p\n",
+ i, j, infop->nvmet_ctx_list_cnt,
+ infop->nvmet_ctx_next_cpu);
+- infop++;
+ }
+ }
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 25a00e9174b3bbad9808ea92de8afeebf8cf6c02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 10:30:41 -0700
+Subject: scsi: lpfc: Fix GFT_ID and PRLI logic for RSCN
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 01a8aed6a009625282b6265880f6b20cbd7a9c70 ]
+
+Driver only sends NVME PRLI to a device that also supports FCP. This resuls
+in remote ports that don't have fc_remote_ports created for them. The driver
+is clearing the nlp_fc4_type for a ndlp at the wrong time.
+
+Fix by moving the nlp_fc4_type clearing to the discovery engine in the
+DEVICE_RECOVERY state. Also ensure that rport registration is done for all
+nlp_fc4_types.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_ct.c | 5 -----
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ drivers/scsi/lpfc/lpfc_nportdisc.c | 3 +++
+ 3 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index d909d90035bb2..384f5cd7c3c81 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -471,11 +471,6 @@ lpfc_prep_node_fc4type(struct lpfc_vport *vport, uint32_t Did, uint8_t fc4_type)
+ "Parse GID_FTrsp: did:x%x flg:x%x x%x",
+ Did, ndlp->nlp_flag, vport->fc_flag);
+
+- /* Don't assume the rport is always the previous
+- * FC4 type.
+- */
+- ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+-
+ /* By default, the driver expects to support FCP FC4 */
+ if (fc4_type == FC_TYPE_FCP)
+ ndlp->nlp_fc4_type |= NLP_FC4_FCP;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index ccdd82b1123f7..db183d1f34ab2 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4198,7 +4198,7 @@ lpfc_nlp_state_cleanup(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+
+ if (new_state == NLP_STE_MAPPED_NODE ||
+ new_state == NLP_STE_UNMAPPED_NODE) {
+- if (ndlp->nlp_fc4_type & NLP_FC4_FCP ||
++ if (ndlp->nlp_fc4_type ||
+ ndlp->nlp_DID == Fabric_DID ||
+ ndlp->nlp_DID == NameServer_DID ||
+ ndlp->nlp_DID == FDMI_DID) {
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index ae6301c796785..c15f3265eefeb 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -2323,6 +2323,7 @@ lpfc_device_recov_unmap_node(struct lpfc_vport *vport,
+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ lpfc_disc_set_adisc(vport, ndlp);
+
+@@ -2400,6 +2401,7 @@ lpfc_device_recov_mapped_node(struct lpfc_vport *vport,
+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ lpfc_disc_set_adisc(vport, ndlp);
+ return ndlp->nlp_state;
+@@ -2657,6 +2659,7 @@ lpfc_device_recov_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ lpfc_cancel_retry_delay_tmo(vport, ndlp);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ return ndlp->nlp_state;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0a0bcf9ed483728d0e174d3b5ac2104e69a9952f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Check for bus reset
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 6b0e87a6aafe12d75c2bea6fc8e49e88b98b3083 ]
+
+The SR_RST bit isn't latched. Hence, detecting a bus reset isn't reliable.
+When it is detected, the right thing to do is to drop all connected and
+disconnected commands. The code for that is already present so refactor it and
+call it when SR_RST is set.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 74 +++++++++++++++++++++++++-----------------
+ 1 file changed, 45 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index bce6c990d060a..8ec68dcc0cc4a 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -131,6 +131,7 @@
+
+ static int do_abort(struct Scsi_Host *);
+ static void do_reset(struct Scsi_Host *);
++static void bus_reset_cleanup(struct Scsi_Host *);
+
+ /**
+ * initialize_SCp - init the scsi pointer field
+@@ -885,7 +886,14 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ /* Probably Bus Reset */
+ NCR5380_read(RESET_PARITY_INTERRUPT_REG);
+
+- dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ if (sr & SR_RST) {
++ /* Certainly Bus Reset */
++ shost_printk(KERN_WARNING, instance,
++ "bus reset interrupt\n");
++ bus_reset_cleanup(instance);
++ } else {
++ dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ }
+ #ifdef SUN3_SCSI_VME
+ dregs->csr |= CSR_DMA_ENABLE;
+ #endif
+@@ -2297,31 +2305,12 @@ out:
+ }
+
+
+-/**
+- * NCR5380_host_reset - reset the SCSI host
+- * @cmd: SCSI command undergoing EH
+- *
+- * Returns SUCCESS
+- */
+-
+-static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++static void bus_reset_cleanup(struct Scsi_Host *instance)
+ {
+- struct Scsi_Host *instance = cmd->device->host;
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+ int i;
+- unsigned long flags;
+ struct NCR5380_cmd *ncmd;
+
+- spin_lock_irqsave(&hostdata->lock, flags);
+-
+-#if (NDEBUG & NDEBUG_ANY)
+- shost_printk(KERN_INFO, instance, __func__);
+-#endif
+- NCR5380_dprint(NDEBUG_ANY, instance);
+- NCR5380_dprint_phase(NDEBUG_ANY, instance);
+-
+- do_reset(instance);
+-
+ /* reset NCR registers */
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(TARGET_COMMAND_REG, 0);
+@@ -2333,14 +2322,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- list_for_each_entry(ncmd, &hostdata->unissued, list) {
+- struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+-
+- cmd->result = DID_RESET << 16;
+- cmd->scsi_done(cmd);
+- }
+- INIT_LIST_HEAD(&hostdata->unissued);
+-
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+ complete_cmd(instance, hostdata->selecting);
+@@ -2374,6 +2355,41 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
++}
++
++/**
++ * NCR5380_host_reset - reset the SCSI host
++ * @cmd: SCSI command undergoing EH
++ *
++ * Returns SUCCESS
++ */
++
++static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *instance = cmd->device->host;
++ struct NCR5380_hostdata *hostdata = shost_priv(instance);
++ unsigned long flags;
++ struct NCR5380_cmd *ncmd;
++
++ spin_lock_irqsave(&hostdata->lock, flags);
++
++#if (NDEBUG & NDEBUG_ANY)
++ shost_printk(KERN_INFO, instance, __func__);
++#endif
++ NCR5380_dprint(NDEBUG_ANY, instance);
++ NCR5380_dprint_phase(NDEBUG_ANY, instance);
++
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *scmd = NCR5380_to_scmd(ncmd);
++
++ scmd->result = DID_RESET << 16;
++ scmd->scsi_done(scmd);
++ }
++ INIT_LIST_HEAD(&hostdata->unissued);
++
++ do_reset(instance);
++ bus_reset_cleanup(instance);
++
+ spin_unlock_irqrestore(&hostdata->lock, flags);
+
+ return SUCCESS;
+--
+2.20.1
+
--- /dev/null
+From dd1826443b358cff960234fefddf2051637dd950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Check for invalid reselection target
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 7ef55f6744c45e3d7c85a3f74ada39b67ac741dd ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION", that "the
+initiator shall not respond to a RESELECTION phase if other than two SCSI ID
+bits are on the DATA BUS." This issue (too many bits set) has been observed in
+the wild, so add a check.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 90136942f4882..c67f476447372 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2008,6 +2008,11 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(MODE_REG, MR_BASE);
+
+ target_mask = NCR5380_read(CURRENT_SCSI_DATA_REG) & ~(hostdata->id_mask);
++ if (!target_mask || target_mask & (target_mask - 1)) {
++ shost_printk(KERN_WARNING, instance,
++ "reselect: bad target_mask 0x%02x\n", target_mask);
++ return;
++ }
+
+ dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+
+--
+2.20.1
+
--- /dev/null
+From d6e1e4ec718f166d845091f200ab14c7adee3a27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Clear all unissued commands on host reset
+
+From: Hannes Reinecke <hare@suse.com>
+
+[ Upstream commit 1aeeeed7f03c576f096eede7b0384f99a98f588c ]
+
+When doing a host reset we should be clearing all outstanding commands, not
+just the command triggering the reset.
+
+[mkp: adjusted Hannes' SoB address]
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Ondrey Zary <linux@rainbow-software.org>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 5160d6214a36b..d0bbb20518048 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2303,7 +2303,7 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ spin_lock_irqsave(&hostdata->lock, flags);
+
+ #if (NDEBUG & NDEBUG_ANY)
+- scmd_printk(KERN_INFO, cmd, __func__);
++ shost_printk(KERN_INFO, instance, __func__);
+ #endif
+ NCR5380_dprint(NDEBUG_ANY, instance);
+ NCR5380_dprint_phase(NDEBUG_ANY, instance);
+@@ -2321,10 +2321,13 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- if (list_del_cmd(&hostdata->unissued, cmd)) {
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
++
+ cmd->result = DID_RESET << 16;
+ cmd->scsi_done(cmd);
+ }
++ INIT_LIST_HEAD(&hostdata->unissued);
+
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+--
+2.20.1
+
--- /dev/null
+From 350d3c61a29402754c21dea2cdf3b3b09325567d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't call dsprintk() following reselection interrupt
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 08267216b3f8aa5adc204bdccf8deb72c1cd7665 ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION",
+
+ ... The reselected initiator shall then assert the BSY signal
+ within a selection abort time of its most recent detection of being
+ reselected; this is required for correct operation of the time-out
+ procedure.
+
+The selection abort time is only 200 us which may be insufficient time for a
+printk() call. Move the diagnostics to the error paths.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 227ceb5197555..5c3ffb466bb10 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2015,8 +2015,6 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ return;
+ }
+
+- dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+-
+ /*
+ * At this point, we have detected that our SCSI ID is on the bus,
+ * SEL is true and BSY was false for at least one bus settle delay
+@@ -2029,6 +2027,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_BSY);
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_SEL, 0, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: !SEL timeout\n");
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ return;
+ }
+@@ -2040,6 +2039,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From aad394d83ce64151470caa64d1c9c33c028ac5fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't clear busy flag when abort fails
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 45ddc1b24806cc8f1a09f23dd4e7b6e4a8ae36e1 ]
+
+When NCR5380_abort() returns FAILED, the driver forgets that the target is
+still busy. Hence, further commands may be sent to the target, which may fail
+during selection and produce the error message, "reselection after won
+arbitration?". Prevent this by leaving the busy flag set when NCR5380_abort()
+fails.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index c67f476447372..227ceb5197555 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -522,8 +522,6 @@ static void complete_cmd(struct Scsi_Host *instance,
+ hostdata->sensing = NULL;
+ }
+
+- hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+-
+ cmd->scsi_done(cmd);
+ }
+
+@@ -1711,6 +1709,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ return;
+ #endif
+ case PHASE_DATAIN:
+@@ -1793,6 +1792,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd, scmd_id(cmd), cmd->device->lun);
+
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+
+ cmd->result &= ~0xffff;
+ cmd->result |= cmd->SCp.Status;
+@@ -1946,6 +1946,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ NCR5380_transfer_pio(instance, &phase, &len, &data);
+ if (msgout == ABORT) {
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ maybe_release_dma_irq(instance);
+@@ -2100,13 +2101,16 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ dsprintk(NDEBUG_RESELECTION | NDEBUG_QUEUES, instance,
+ "reselect: removed %p from disconnected queue\n", tmp);
+ } else {
++ int target = ffs(target_mask) - 1;
++
+ shost_printk(KERN_ERR, instance, "target bitmask 0x%02x lun %d not in disconnected queue.\n",
+ target_mask, lun);
+ /*
+ * Since we have an established nexus that we can't do anything
+ * with, we must abort it.
+ */
+- do_abort(instance);
++ if (do_abort(instance) == 0)
++ hostdata->busy[target] &= ~(1 << lun);
+ return;
+ }
+
+@@ -2277,8 +2281,10 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ out:
+ if (result == FAILED)
+ dsprintk(NDEBUG_ABORT, instance, "abort: failed to abort %p\n", cmd);
+- else
++ else {
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ dsprintk(NDEBUG_ABORT, instance, "abort: successfully aborted %p\n", cmd);
++ }
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
+--
+2.20.1
+
--- /dev/null
+From a613b49162379f8d31f42b76f04d1f458aeff7e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Handle BUS FREE during reselection
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit ca694afad707cb3ae2fdef3b28454444d9ac726e ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.2 RESELECTION time-out
+procedure", that a target may assert RST or go to BUS FREE phase if the
+initiator does not respond within 200 us. Something like this has been
+observed with AztecMonster II target. When it happens, all we can do is wait
+for the target to try again.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 5c3ffb466bb10..bce6c990d060a 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2039,6 +2039,9 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ if ((NCR5380_read(STATUS_REG) & (SR_BSY | SR_SEL)) == 0)
++ /* BUS FREE phase */
++ return;
+ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 08c3948f7f15b3da6e77a4d11e28ed0ca44c3266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Have NCR5380_select() return a bool
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit dad8261e643849ea134c7cd5c8e794e31d93b9eb ]
+
+The return value is taken to mean "retry" or "don't retry". Change it to bool
+to improve readability. Fix related comments. No functional change.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 46 +++++++++++++++++++-----------------------
+ drivers/scsi/NCR5380.h | 2 +-
+ 2 files changed, 22 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index d0bbb20518048..d600d3e94ba4a 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -904,20 +904,16 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ return IRQ_RETVAL(handled);
+ }
+
+-/*
+- * Function : int NCR5380_select(struct Scsi_Host *instance,
+- * struct scsi_cmnd *cmd)
+- *
+- * Purpose : establishes I_T_L or I_T_L_Q nexus for new or existing command,
+- * including ARBITRATION, SELECTION, and initial message out for
+- * IDENTIFY and queue messages.
++/**
++ * NCR5380_select - attempt arbitration and selection for a given command
++ * @instance: the Scsi_Host instance
++ * @cmd: the scsi_cmnd to execute
+ *
+- * Inputs : instance - instantiation of the 5380 driver on which this
+- * target lives, cmd - SCSI command to execute.
++ * This routine establishes an I_T_L nexus for a SCSI command. This involves
++ * ARBITRATION, SELECTION and MESSAGE OUT phases and an IDENTIFY message.
+ *
+- * Returns cmd if selection failed but should be retried,
+- * NULL if selection failed and should not be retried, or
+- * NULL if selection succeeded (hostdata->connected == cmd).
++ * Returns true if the operation should be retried.
++ * Returns false if it should not be retried.
+ *
+ * Side effects :
+ * If bus busy, arbitration failed, etc, NCR5380_select() will exit
+@@ -925,16 +921,15 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ * SELECT_ENABLE will be set appropriately, the NCR5380
+ * will cease to drive any SCSI bus signals.
+ *
+- * If successful : I_T_L or I_T_L_Q nexus will be established,
+- * instance->connected will be set to cmd.
++ * If successful : the I_T_L nexus will be established, and
++ * hostdata->connected will be set to cmd.
+ * SELECT interrupt will be disabled.
+ *
+ * If failed (no target) : cmd->scsi_done() will be called, and the
+ * cmd->result host byte set to DID_BAD_TARGET.
+ */
+
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+- struct scsi_cmnd *cmd)
++static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ __releases(&hostdata->lock) __acquires(&hostdata->lock)
+ {
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+@@ -942,6 +937,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ unsigned char *data;
+ int len;
+ int err;
++ bool ret = true;
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+@@ -950,7 +946,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ /*
+ * Arbitration and selection phases are slow and involve dropping the
+ * lock, so we have to watch out for EH. An exception handler may
+- * change 'selecting' to NULL. This function will then return NULL
++ * change 'selecting' to NULL. This function will then return false
+ * so that the caller will forget about 'cmd'. (During information
+ * transfer phases, EH may change 'connected' to NULL.)
+ */
+@@ -986,7 +982,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ /* Command was aborted */
+ NCR5380_write(MODE_REG, MR_BASE);
+- return NULL;
++ return false;
+ }
+ if (err < 0) {
+ NCR5380_write(MODE_REG, MR_BASE);
+@@ -1035,7 +1031,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
+@@ -1118,13 +1114,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ /* Can't touch cmd if it has been reclaimed by the scsi ML */
+ if (!hostdata->selecting)
+- return NULL;
++ return false;
+
+ cmd->result = DID_BAD_TARGET << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance,
+ "target did not respond within 250ms\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1156,7 +1152,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ }
+ if (!hostdata->selecting) {
+ do_abort(instance);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+@@ -1172,7 +1168,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance, "IDENTIFY message transfer failed\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1187,13 +1183,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ initialize_SCp(cmd);
+
+- cmd = NULL;
++ ret = false;
+
+ out:
+ if (!hostdata->selecting)
+ return NULL;
+ hostdata->selecting = NULL;
+- return cmd;
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
+index 8a6d002e67894..5935fd6d1a058 100644
+--- a/drivers/scsi/NCR5380.h
++++ b/drivers/scsi/NCR5380.h
+@@ -275,7 +275,7 @@ static irqreturn_t NCR5380_intr(int irq, void *dev_id);
+ static void NCR5380_main(struct work_struct *work);
+ static const char *NCR5380_info(struct Scsi_Host *instance);
+ static void NCR5380_reselect(struct Scsi_Host *instance);
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
++static bool NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
+ static int NCR5380_transfer_dma(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_transfer_pio(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_poll_politely2(struct NCR5380_hostdata *,
+--
+2.20.1
+
--- /dev/null
+From e37c817bd1f26593d5ceb351c52434e60f2cbba9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 070356513963be6196142acff56acc8359069fa1 ]
+
+When sense data is valid, call set_driver_byte(cmd, DRIVER_SENSE). Otherwise
+some callers of scsi_execute() will ignore sense data. Don't set DID_ERROR or
+DID_RESET just because sense data is missing.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 144bb0c2b3064..90136942f4882 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -513,11 +513,12 @@ static void complete_cmd(struct Scsi_Host *instance,
+
+ if (hostdata->sensing == cmd) {
+ /* Autosense processing ends here */
+- if ((cmd->result & 0xff) != SAM_STAT_GOOD) {
++ if (status_byte(cmd->result) != GOOD) {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
+- set_host_byte(cmd, DID_ERROR);
+- } else
++ } else {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
++ set_driver_byte(cmd, DRIVER_SENSE);
++ }
+ hostdata->sensing = NULL;
+ }
+
+@@ -2265,7 +2266,6 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ if (list_del_cmd(&hostdata->autosense, cmd)) {
+ dsprintk(NDEBUG_ABORT, instance,
+ "abort: removed %p from sense queue\n", cmd);
+- set_host_byte(cmd, DID_ERROR);
+ complete_cmd(instance, cmd);
+ }
+
+@@ -2344,7 +2344,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ list_for_each_entry(ncmd, &hostdata->autosense, list) {
+ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+
+- set_host_byte(cmd, DID_RESET);
+ cmd->scsi_done(cmd);
+ }
+ INIT_LIST_HEAD(&hostdata->autosense);
+--
+2.20.1
+
--- /dev/null
+From be54fe2e05461a0499b6377a390274796c25162a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Withhold disconnect privilege for REQUEST SENSE
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 7c8ed783c2faa1e3f741844ffac41340338ea0f4 ]
+
+This is mostly needed because an AztecMonster II target has been observed
+disconnecting REQUEST SENSE commands and then failing to reselect properly.
+
+Suggested-by: Michael Schmitz <schmitzmic@gmail.com>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index d600d3e94ba4a..144bb0c2b3064 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -938,6 +938,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ int len;
+ int err;
+ bool ret = true;
++ bool can_disconnect = instance->irq != NO_IRQ &&
++ cmd->cmnd[0] != REQUEST_SENSE;
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+@@ -1157,7 +1159,7 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+ scmd_id(cmd));
+- tmp[0] = IDENTIFY(((instance->irq == NO_IRQ) ? 0 : 1), cmd->device->lun);
++ tmp[0] = IDENTIFY(can_disconnect, cmd->device->lun);
+
+ len = 1;
+ data = tmp;
+--
+2.20.1
+
--- /dev/null
+From f3427df0649a343fc0c7c708e6682366e41d0806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:03 +0530
+Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ]
+
+For the function dma_unmap_sg(), the <nents> parameter should be number of
+elements in the scatter list prior to the mapping, not after the mapping.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 947d6017d004c..576a0f091933b 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -466,7 +466,7 @@ err_out:
+ dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+ if (!sas_protocol_ata(t->task_proto))
+ if (n_elem)
+- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter,
+ t->data_dir);
+ out_done:
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 3c4125f4d7a17c59241c7853680dff8da96a579b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:04 +0530
+Subject: scsi: pm80xx: Fixed system hang issue during kexec boot
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ]
+
+When the firmware is not responding, execution of kexec boot causes a system
+hang. When firmware assertion happened, driver get notified with interrupt
+vector updated in MPI configuration table. Then, the driver will read
+scratchpad register and set controller_fatal_error flag to true.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 6 +++
+ drivers/scsi/pm8001/pm8001_sas.c | 7 +++
+ drivers/scsi/pm8001/pm8001_sas.h | 1 +
+ drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++---
+ drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++
+ 5 files changed, 91 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 4dd6cad330e8e..3e814c0469fbd 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+ } else {
+ u32 producer_index;
+ void *pi_virt = circularQ->pi_virt;
++ /* spurious interrupt during setup if
++ * kexec-ing and driver doing a doorbell access
++ * with the pre-kexec oq interrupt setup
++ */
++ if (!pi_virt)
++ break;
+ /* Update the producer index from SPC */
+ producer_index = pm8001_read_32(pi_virt);
+ circularQ->producer_index = cpu_to_le32(producer_index);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 576a0f091933b..59feda261e088 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -374,6 +374,13 @@ static int pm8001_task_exec(struct sas_task *task,
+ return 0;
+ }
+ pm8001_ha = pm8001_find_ha_by_dev(task->dev);
++ if (pm8001_ha->controller_fatal_error) {
++ struct task_status_struct *ts = &t->task_status;
++
++ ts->resp = SAS_TASK_UNDELIVERED;
++ t->task_done(t);
++ return 0;
++ }
+ PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ do {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 80b4dd6df0c25..1816e351071fa 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -538,6 +538,7 @@ struct pm8001_hba_info {
+ u32 logging_level;
+ u32 fw_status;
+ u32 smp_exp_mode;
++ bool controller_fatal_error;
+ const struct firmware *fw_image;
+ struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
+ u32 reset_in_progress;
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 42f0405601ad1..5021aed87f33a 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -577,6 +577,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size);
+ pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity);
++ /* Update Fatal error interrupt vector */
++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=
++ ((pm8001_ha->number_of_intr - 1) << 8);
+ pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt);
+ pm8001_mw32(address, MAIN_EVENT_CRC_CHECK,
+@@ -1110,6 +1113,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha)
+ return -EBUSY;
+ }
+
++ /* Initialize the controller fatal error flag */
++ pm8001_ha->controller_fatal_error = false;
++
+ /* Initialize pci space address eg: mpi offset */
+ init_pci_device_addresses(pm8001_ha);
+ init_default_table_values(pm8001_ha);
+@@ -1218,13 +1224,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha)
+ u32 bootloader_state;
+ u32 ibutton0, ibutton1;
+
+- /* Check if MPI is in ready state to reset */
+- if (mpi_uninit_check(pm8001_ha) != 0) {
+- PM8001_FAIL_DBG(pm8001_ha,
+- pm8001_printk("MPI state is not ready\n"));
+- return -1;
++ /* Process MPI table uninitialization only if FW is ready */
++ if (!pm8001_ha->controller_fatal_error) {
++ /* Check if MPI is in ready state to reset */
++ if (mpi_uninit_check(pm8001_ha) != 0) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "MPI state is not ready scratch1 :0x%x\n",
++ regval));
++ return -1;
++ }
+ }
+-
+ /* checked for reset register normal state; 0x0 */
+ regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET);
+ PM8001_INIT_DBG(pm8001_ha,
+@@ -3752,6 +3762,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ }
+ }
+
++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha)
++{
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7)));
++}
++
+ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+@@ -3759,10 +3809,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ u8 uninitialized_var(bc);
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
++ u32 regval;
+
++ if (vec == (pm8001_ha->number_of_intr - 1)) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ if ((regval & SCRATCH_PAD_MIPSALL_READY) !=
++ SCRATCH_PAD_MIPSALL_READY) {
++ pm8001_ha->controller_fatal_error = true;
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "Firmware Fatal error! Regval:0x%x\n", regval));
++ print_scratchpad_registers(pm8001_ha);
++ return ret;
++ }
++ }
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ circularQ = &pm8001_ha->outbnd_q_tbl[vec];
+ do {
++ /* spurious interrupt during setup if kexec-ing and
++ * driver doing a doorbell access w/ the pre-kexec oq
++ * interrupt setup.
++ */
++ if (!circularQ->pi_virt)
++ break;
+ ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+ if (MPI_IO_STATUS_SUCCESS == ret) {
+ /* process the outbound message */
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 889e69ce3689b..7dd2699d0efb5 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -1384,6 +1384,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
+ #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0
+ #define SCRATCH_PAD_IOP0_READY 0xC00
+ #define SCRATCH_PAD_IOP1_READY 0x3000
++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \
++ SCRATCH_PAD_IOP0_READY | \
++ SCRATCH_PAD_RAAE_READY)
+
+ /* boot loader state */
+ #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */
+--
+2.20.1
+
--- /dev/null
+From 376b4ebc991a2207d0e60e996c057c429433b48c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:14 -0700
+Subject: scsi: qla2xxx: Check for Register disconnect
+
+From: Sawan Chandak <sawan.chandak@cavium.com>
+
+[ Upstream commit f99c5d294b3653e6ae563eaac5db5b4138afe31c ]
+
+During adapter shutdown process check for register disconnect before
+proceeding to call PCI functions.
+
+Signed-off-by: Sawan Chandak <sawan.chandak@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index d978ea1344625..3e892e013658d 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1744,6 +1744,7 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
+ !ha->flags.eeh_busy &&
+ (!test_bit(ABORT_ISP_ACTIVE,
+ &vha->dpc_flags)) &&
++ !qla2x00_isp_reg_stat(ha) &&
+ (sp->type == SRB_SCSI_CMD)) {
+ /*
+ * Don't abort commands in
+--
+2.20.1
+
--- /dev/null
+From d118ff085eb79d663c58d6666d5f7be09db94fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:37 -0700
+Subject: scsi: qla2xxx: Defer chip reset until target mode is enabled
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 93eca6135183f7a71e36acd47655a085ed11bcdc ]
+
+For target mode, any chip reset triggered before target mode is enabled will
+be held off until user is ready to enable. This prevents the chip from
+starting or running before it is intended.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 18ee614fe07f5..d978ea1344625 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6059,12 +6059,27 @@ qla2x00_do_dpc(void *data)
+ if (test_and_clear_bit
+ (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+ !test_bit(UNLOADING, &base_vha->dpc_flags)) {
++ bool do_reset = true;
++
++ switch (ql2x_ini_mode) {
++ case QLA2XXX_INI_MODE_ENABLED:
++ break;
++ case QLA2XXX_INI_MODE_DISABLED:
++ if (!qla_tgt_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ case QLA2XXX_INI_MODE_DUAL:
++ if (!qla_dual_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ default:
++ break;
++ }
+
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
+- "ISP abort scheduled.\n");
+- if (!(test_and_set_bit(ABORT_ISP_ACTIVE,
++ if (do_reset && !(test_and_set_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags))) {
+-
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
++ "ISP abort scheduled.\n");
+ if (ha->isp_ops->abort_isp(base_vha)) {
+ /* failed. retry later */
+ set_bit(ISP_ABORT_NEEDED,
+@@ -6072,10 +6087,9 @@ qla2x00_do_dpc(void *data)
+ }
+ clear_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags);
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
++ "ISP abort end.\n");
+ }
+-
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
+- "ISP abort end.\n");
+ }
+
+ if (test_and_clear_bit(FCPORT_UPDATE_NEEDED,
+--
+2.20.1
+
--- /dev/null
+From 993a99cb607ffa3155bddc53b6a79c6979186002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 14:19:10 -0700
+Subject: scsi: qla2xxx: Fix deadlock between ATIO and HW lock
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 1073daa470d906f1853ed4b828f16e2350a5875c ]
+
+Move ATIO queue processing out of hardware_lock to prevent deadlock.
+
+Fixes: 3bb67df5b5f8 ("qla2xxx: Check for online flag instead of active reset when transmitting responses")
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 17 +++---------
+ drivers/scsi/qla2xxx/qla_isr.c | 48 +++++++++++++++------------------
+ 2 files changed, 26 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index e5ecef94aebdb..733a55c09b1ca 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4869,19 +4869,10 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
+ */
+ if (qla_tgt_mode_enabled(vha) ||
+ qla_dual_mode_enabled(vha)) {
+- if (IS_QLA27XX(ha) || IS_QLA83XX(ha)) {
+- spin_lock_irqsave(&ha->tgt.atio_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 0);
+- spin_unlock_irqrestore(
+- &ha->tgt.atio_lock, flags);
+- } else {
+- spin_lock_irqsave(&ha->hardware_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(
+- &ha->hardware_lock, flags);
+- }
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock,
++ flags);
+ }
+ }
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 88d8acf86a2a4..f559beda8d5ad 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3121,6 +3121,7 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ uint16_t mb[8];
+ struct rsp_que *rsp;
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3181,22 +3182,13 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x504f,
+ "Unrecognized interrupt type (%d).\n", stat * 0xff);
+@@ -3210,6 +3202,12 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+@@ -3256,6 +3254,7 @@ qla24xx_msix_default(int irq, void *dev_id)
+ uint32_t hccr;
+ uint16_t mb[8];
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3312,22 +3311,13 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x5051,
+ "Unrecognized interrupt type (%d).\n", stat & 0xff);
+@@ -3338,6 +3328,12 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 83a6d3d018324725952aef393077ac7925035cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:16 -0700
+Subject: scsi: qla2xxx: Fix dropped srb resource.
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 527b8ae3948bb59c13ebaa7d657ced56ea25ab05 ]
+
+When FW rejects a command due to "entry_status" error (malform IOCB), the srb
+resource needs to be returned back for cleanup. The filter to catch this is
+in the wrong location.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index f559beda8d5ad..8fa7242dbb437 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2837,6 +2837,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ELS_IOCB_TYPE:
+ case ABORT_IOCB_TYPE:
+ case MBX_IOCB_TYPE:
++ default:
+ sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
+ if (sp) {
+ sp->done(sp, res);
+@@ -2847,7 +2848,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ABTS_RESP_24XX:
+ case CTIO_TYPE7:
+ case CTIO_CRC2:
+- default:
+ return 1;
+ }
+ fatal:
+--
+2.20.1
+
--- /dev/null
+From c9408f1001e3ce1b1a31ffde40016cb9646726a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:25 -0700
+Subject: scsi: qla2xxx: Fix duplicate switch's Nport ID entries
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit f3a03ee1102a44ccbd2c5de80a6e862ba23e9b55 ]
+
+Current code relies on switch to provide a unique combination of WWPN +
+NPORTID to tract an FC port. This patch tries to detect a case where switch
+data base can get corrupted where multiple WWPNs can have the same Nport ID.
+The 1st Nport ID on the list will be kept while the duplicate Nport ID will be
+discarded.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index d611cf722244c..b8d3403c3c85a 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3902,9 +3902,10 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ fc_port_t *fcport;
+ u32 i, rc;
+ bool found;
+- struct fab_scan_rp *rp;
++ struct fab_scan_rp *rp, *trp;
+ unsigned long flags;
+ u8 recheck = 0;
++ u16 dup = 0, dup_cnt = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s enter\n", __func__);
+@@ -3935,6 +3936,7 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+
+ for (i = 0; i < vha->hw->max_fibre_devices; i++) {
+ u64 wwn;
++ int k;
+
+ rp = &vha->scan.l[i];
+ found = false;
+@@ -3943,6 +3945,20 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ if (wwn == 0)
+ continue;
+
++ /* Remove duplicate NPORT ID entries from switch data base */
++ for (k = i + 1; k < vha->hw->max_fibre_devices; k++) {
++ trp = &vha->scan.l[k];
++ if (rp->id.b24 == trp->id.b24) {
++ dup = 1;
++ dup_cnt++;
++ ql_dbg(ql_dbg_disc + ql_dbg_verbose,
++ vha, 0xffff,
++ "Detected duplicate NPORT ID from switch data base: ID %06x WWN %8phN WWN %8phN\n",
++ rp->id.b24, rp->port_name, trp->port_name);
++ memset(trp, 0, sizeof(*trp));
++ }
++ }
++
+ if (!memcmp(rp->port_name, vha->port_name, WWN_SIZE))
+ continue;
+
+@@ -3982,6 +3998,12 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ }
+ }
+
++ if (dup) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "Detected %d duplicate NPORT ID(s) from switch data base\n",
++ dup_cnt);
++ }
++
+ /*
+ * Logout all previous fabric dev marked lost, except FCP2 devices.
+ */
+--
+2.20.1
+
--- /dev/null
+From 131076235882f41cf50583ca59bee4a97f12cfd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:36 -0700
+Subject: scsi: qla2xxx: Fix iIDMA error
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 8d9bf0a9a268f7ca0b811d6e6a1fc783afa5c746 ]
+
+When switch responds with error for Get Port Speed Command (GPSC), driver
+should not proceed with telling FW about the speed of the remote port.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 34ff4bbc8de10..d611cf722244c 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3277,7 +3277,7 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ ql_dbg(ql_dbg_disc, vha, 0x2019,
+ "GPSC command unsupported, disabling query.\n");
+ ha->flags.gpsc_supported = 0;
+- res = QLA_SUCCESS;
++ goto done;
+ }
+ } else {
+ switch (be16_to_cpu(ct_rsp->rsp.gpsc.speed)) {
+@@ -3310,7 +3310,6 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ be16_to_cpu(ct_rsp->rsp.gpsc.speeds),
+ be16_to_cpu(ct_rsp->rsp.gpsc.speed));
+ }
+-done:
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPSC_DONE;
+ ea.rc = res;
+@@ -3318,6 +3317,7 @@ done:
+ ea.sp = sp;
+ qla2x00_fcport_event_handler(vha, &ea);
+
++done:
+ sp->free(sp);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9d5d5df3fa54529a10102435d6323f2bcf853be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:15 -0700
+Subject: scsi: qla2xxx: Fix port speed display on chip reset
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 5d74c87a20adcc77b19753c315ad9c320b2288be ]
+
+Clear port speed value on chip reset.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 8f502505aa796..653d535e3052f 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -6502,6 +6502,7 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
+ if (!(IS_P3P_TYPE(ha)))
+ ha->isp_ops->reset_chip(vha);
+
++ ha->link_data_rate = PORT_SPEED_UNKNOWN;
+ SAVE_TOPO(ha);
+ ha->flags.rida_fmt2 = 0;
+ ha->flags.n2n_ae = 0;
+--
+2.20.1
+
--- /dev/null
+From 6d94db208949541a2f733a341b88abdc7a8c12e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:13 -0700
+Subject: scsi: qla2xxx: Increase abort timeout value
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 8bccfe0d21b5adbba6ec4fe1776160b80d09f78a ]
+
+Abort IOCB request can take up to 40s or 2 ABTS timeout. We will wait for
+ABTS response for 20s. On a timeout, second ABTS can go out with another 20s
+timeout. On 2nd ABTS timeout FW will automatically do Logout.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 733a55c09b1ca..8f502505aa796 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1789,7 +1789,8 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+
+ abt_iocb->timeout = qla24xx_abort_iocb_timeout;
+ init_completion(&abt_iocb->u.abt.comp);
+- qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha));
++ /* FW can send 2 x ABTS's timeout/20s */
++ qla2x00_init_timer(sp, 42);
+
+ abt_iocb->u.abt.cmd_hndl = cmd_sp->handle;
+ abt_iocb->u.abt.req_que_no = cpu_to_le16(cmd_sp->qpair->req->id);
+--
+2.20.1
+
--- /dev/null
+From 54a18748cbb3519f565382f254e192d20fa84e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:38 -0700
+Subject: scsi: qla2xxx: Terminate Plogi/PRLI if WWN is 0
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit aa9e6d7b9643fc50a88c7b7aa1e34be8dc032749 ]
+
+When driver receive PLOGI/PRLI from FW, the WWPN value will be provided. If
+it is not, then driver will terminate it. The WWPN allows driver to locate
+the session or create a new session.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index d6dc320f81a7a..078d124533247 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -4703,6 +4703,12 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
+ sess = qlt_find_sess_invalidate_other(vha, wwn,
+ port_id, loop_id, &conflict_sess);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++ } else {
++ ql_dbg(ql_dbg_disc, vha, 0xffff,
++ "%s %d Term INOT due to WWN=0 lid=%d, NportID %06X ",
++ __func__, __LINE__, loop_id, port_id.b24);
++ qlt_send_term_imm_notif(vha, iocb, 1);
++ goto out;
+ }
+
+ if (IS_SW_RESV_ADDR(port_id)) {
+--
+2.20.1
+
--- /dev/null
+From 924810b02c292ef850afaf979e22151448dbc744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:28 -0700
+Subject: scsi: qla2xxx: Use correct qpair for ABTS/CMD
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 49cecca7dd49e2950ed6d973acfa84e7c8c7a480 ]
+
+On Abort of initiator scsi command, the abort needs to follow the same qpair
+as the the scsi command to prevent out of order processing.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 15 +++++----------
+ drivers/scsi/qla2xxx/qla_iocb.c | 12 +++++++-----
+ 2 files changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index bee9cfb291529..e5ecef94aebdb 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1772,18 +1772,18 @@ int
+ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+ {
+ scsi_qla_host_t *vha = cmd_sp->vha;
+- fc_port_t *fcport = cmd_sp->fcport;
+ struct srb_iocb *abt_iocb;
+ srb_t *sp;
+ int rval = QLA_FUNCTION_FAILED;
+
+- sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
++ sp = qla2xxx_get_qpair_sp(cmd_sp->qpair, cmd_sp->fcport, GFP_KERNEL);
+ if (!sp)
+ goto done;
+
+ abt_iocb = &sp->u.iocb_cmd;
+ sp->type = SRB_ABT_CMD;
+ sp->name = "abort";
++ sp->qpair = cmd_sp->qpair;
+ if (wait)
+ sp->flags = SRB_WAKEUP_ON_COMP;
+
+@@ -1792,18 +1792,13 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha));
+
+ abt_iocb->u.abt.cmd_hndl = cmd_sp->handle;
+-
+- if (vha->flags.qpairs_available && cmd_sp->qpair)
+- abt_iocb->u.abt.req_que_no =
+- cpu_to_le16(cmd_sp->qpair->req->id);
+- else
+- abt_iocb->u.abt.req_que_no = cpu_to_le16(vha->req->id);
++ abt_iocb->u.abt.req_que_no = cpu_to_le16(cmd_sp->qpair->req->id);
+
+ sp->done = qla24xx_abort_sp_done;
+
+ ql_dbg(ql_dbg_async, vha, 0x507c,
+- "Abort command issued - hdl=%x, target_id=%x\n",
+- cmd_sp->handle, fcport->tgt_id);
++ "Abort command issued - hdl=%x, type=%x\n",
++ cmd_sp->handle, cmd_sp->type);
+
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS)
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 119927220299e..c699bbb8485bb 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -3297,19 +3297,21 @@ qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
+ {
+ struct srb_iocb *aio = &sp->u.iocb_cmd;
+ scsi_qla_host_t *vha = sp->vha;
+- struct req_que *req = vha->req;
++ struct req_que *req = sp->qpair->req;
+
+ memset(abt_iocb, 0, sizeof(struct abort_entry_24xx));
+ abt_iocb->entry_type = ABORT_IOCB_TYPE;
+ abt_iocb->entry_count = 1;
+ abt_iocb->handle = cpu_to_le32(MAKE_HANDLE(req->id, sp->handle));
+- abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
++ if (sp->fcport) {
++ abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
++ abt_iocb->port_id[0] = sp->fcport->d_id.b.al_pa;
++ abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
++ abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
++ }
+ abt_iocb->handle_to_abort =
+ cpu_to_le32(MAKE_HANDLE(aio->u.abt.req_que_no,
+ aio->u.abt.cmd_hndl));
+- abt_iocb->port_id[0] = sp->fcport->d_id.b.al_pa;
+- abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
+- abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
+ abt_iocb->vp_index = vha->vp_idx;
+ abt_iocb->req_que_no = cpu_to_le16(aio->u.abt.req_que_no);
+ /* Send the command to the firmware */
+--
+2.20.1
+
--- /dev/null
+From 07973e9c959ba7bd73fdb564462bc9a7a5070da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 11:38:16 -0400
+Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ]
+
+sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before
+using it in debug message prints.
+
+Suggested-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Acked-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index bd3f6e2d68344..0a2a54517b151 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -4370,6 +4370,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym
+ OUTB(np, HS_PRT, HS_BUSY);
+ }
+
++#define sym_printk(lvl, tp, cp, fmt, v...) do { \
++ if (cp) \
++ scmd_printk(lvl, cp->cmd, fmt, ##v); \
++ else \
++ starget_printk(lvl, tp->starget, fmt, ##v); \
++} while (0)
++
+ /*
+ * chip exception handler for programmed interrupts.
+ */
+@@ -4415,7 +4422,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * been selected with ATN. We do not want to handle that.
+ */
+ case SIR_SEL_ATN_NO_MSG_OUT:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG OUT phase after selection with ATN\n");
+ goto out_stuck;
+ /*
+@@ -4423,7 +4430,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * having reselected the initiator.
+ */
+ case SIR_RESEL_NO_MSG_IN:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG IN phase after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4431,7 +4438,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * an IDENTIFY.
+ */
+ case SIR_RESEL_NO_IDENTIFY:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No IDENTIFY after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4460,7 +4467,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ case SIR_RESEL_ABORTED:
+ np->lastmsg = np->msgout[0];
+ np->msgout[0] = M_NOOP;
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ goto out;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 7378e510b631cd9120114472e1f0499146dbc6ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 23:17:39 +0530
+Subject: scsi: ufshcd: Fix NULL pointer dereference for in ufshcd_init
+
+From: Vivek Gautam <vivek.gautam@codeaurora.org>
+
+[ Upstream commit eebcc19646489b68399ce7b35d9c38eb9f4ec40f ]
+
+Error paths in ufshcd_init() ufshcd_hba_exit() killed clk_scaling workqueue
+when the workqueue is actually created quite late in ufshcd_init(). So, we
+end up getting NULL pointer dereference in such error paths. Fix this by
+moving clk_scaling initialization and kill codes to two separate methods, and
+call them at required places.
+
+Fixes: 401f1e4490ee ("scsi: ufs: don't suspend clock scaling during clock
+gating")
+
+Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Subhash Jadavani <subhashj@codeaurora.org>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Cc: Evan Green <evgreen@chromium.org>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Evan Green <evgreen@chromium.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 53 +++++++++++++++++++++++++--------------
+ 1 file changed, 34 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 4aaba3e030554..8bce755e0f5bc 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1772,6 +1772,34 @@ out:
+ return count;
+ }
+
++static void ufshcd_init_clk_scaling(struct ufs_hba *hba)
++{
++ char wq_name[sizeof("ufs_clkscaling_00")];
++
++ if (!ufshcd_is_clkscaling_supported(hba))
++ return;
++
++ INIT_WORK(&hba->clk_scaling.suspend_work,
++ ufshcd_clk_scaling_suspend_work);
++ INIT_WORK(&hba->clk_scaling.resume_work,
++ ufshcd_clk_scaling_resume_work);
++
++ snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",
++ hba->host->host_no);
++ hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);
++
++ ufshcd_clkscaling_init_sysfs(hba);
++}
++
++static void ufshcd_exit_clk_scaling(struct ufs_hba *hba)
++{
++ if (!ufshcd_is_clkscaling_supported(hba))
++ return;
++
++ destroy_workqueue(hba->clk_scaling.workq);
++ ufshcd_devfreq_remove(hba);
++}
++
+ static void ufshcd_init_clk_gating(struct ufs_hba *hba)
+ {
+ char wq_name[sizeof("ufs_clk_gating_00")];
+@@ -6676,6 +6704,7 @@ out:
+ */
+ if (ret && !ufshcd_eh_in_progress(hba) && !hba->pm_op_in_progress) {
+ pm_runtime_put_sync(hba->dev);
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_hba_exit(hba);
+ }
+
+@@ -7223,12 +7252,9 @@ static void ufshcd_hba_exit(struct ufs_hba *hba)
+ ufshcd_variant_hba_exit(hba);
+ ufshcd_setup_vreg(hba, false);
+ ufshcd_suspend_clkscaling(hba);
+- if (ufshcd_is_clkscaling_supported(hba)) {
++ if (ufshcd_is_clkscaling_supported(hba))
+ if (hba->devfreq)
+ ufshcd_suspend_clkscaling(hba);
+- destroy_workqueue(hba->clk_scaling.workq);
+- ufshcd_devfreq_remove(hba);
+- }
+ ufshcd_setup_clocks(hba, false);
+ ufshcd_setup_hba_vreg(hba, false);
+ hba->is_powered = false;
+@@ -7908,6 +7934,7 @@ void ufshcd_remove(struct ufs_hba *hba)
+ ufshcd_disable_intr(hba, hba->intr_mask);
+ ufshcd_hba_stop(hba, true);
+
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_exit_clk_gating(hba);
+ if (ufshcd_is_clkscaling_supported(hba))
+ device_remove_file(hba->dev, &hba->clk_scaling.enable_attr);
+@@ -8079,6 +8106,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+
+ ufshcd_init_clk_gating(hba);
+
++ ufshcd_init_clk_scaling(hba);
++
+ /*
+ * In order to avoid any spurious interrupt immediately after
+ * registering UFS controller interrupt handler, clear any pending UFS
+@@ -8117,21 +8146,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ goto out_remove_scsi_host;
+ }
+
+- if (ufshcd_is_clkscaling_supported(hba)) {
+- char wq_name[sizeof("ufs_clkscaling_00")];
+-
+- INIT_WORK(&hba->clk_scaling.suspend_work,
+- ufshcd_clk_scaling_suspend_work);
+- INIT_WORK(&hba->clk_scaling.resume_work,
+- ufshcd_clk_scaling_resume_work);
+-
+- snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",
+- host->host_no);
+- hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);
+-
+- ufshcd_clkscaling_init_sysfs(hba);
+- }
+-
+ /*
+ * Set the default power management level for runtime and system PM.
+ * Default power saving mode is to keep UFS link in Hibern8 state
+@@ -8169,6 +8183,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ out_remove_scsi_host:
+ scsi_remove_host(hba->host);
+ exit_gating:
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_exit_clk_gating(hba);
+ out_disable:
+ hba->is_irq_enabled = false;
+--
+2.20.1
+
--- /dev/null
+From b1652cf4e92cecdea8454973febf5d2fe6e1373c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 17:31:05 -0300
+Subject: selftests/powerpc: Do not fail with reschedule
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 44d947eff19d64384efc06069509db7a0a1103b0 ]
+
+There are cases where the test is not expecting to have the transaction
+aborted, but, the test process might have been rescheduled, either in the
+OS level or by KVM (if it is running on a KVM guest machine). The process
+reschedule will cause a treclaim/recheckpoint which will cause the
+transaction to doom, aborting the transaction as soon as the process is
+rescheduled back to the CPU. This might cause the test to fail, but this is
+not a failure in essence.
+
+If that is the case, TEXASR[FC] is indicated with either
+TM_CAUSE_RESCHEDULE or TM_CAUSE_KVM_RESCHEDULE for KVM interruptions.
+
+In this scenario, ignore these two failures and avoid the whole test to
+return failure.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Gustavo Romero <gromero@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/tm/tm-unavailable.c | 9 ++++++---
+ tools/testing/selftests/powerpc/tm/tm.h | 9 +++++++++
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/tm/tm-unavailable.c b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
+index 156c8e750259b..09894f4ff62e6 100644
+--- a/tools/testing/selftests/powerpc/tm/tm-unavailable.c
++++ b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
+@@ -236,7 +236,8 @@ void *tm_una_ping(void *input)
+ }
+
+ /* Check if we were not expecting a failure and a it occurred. */
+- if (!expecting_failure() && is_failure(cr_)) {
++ if (!expecting_failure() && is_failure(cr_) &&
++ !failure_is_reschedule()) {
+ printf("\n\tUnexpected transaction failure 0x%02lx\n\t",
+ failure_code());
+ return (void *) -1;
+@@ -244,9 +245,11 @@ void *tm_una_ping(void *input)
+
+ /*
+ * Check if TM failed due to the cause we were expecting. 0xda is a
+- * TM_CAUSE_FAC_UNAV cause, otherwise it's an unexpected cause.
++ * TM_CAUSE_FAC_UNAV cause, otherwise it's an unexpected cause, unless
++ * it was caused by a reschedule.
+ */
+- if (is_failure(cr_) && !failure_is_unavailable()) {
++ if (is_failure(cr_) && !failure_is_unavailable() &&
++ !failure_is_reschedule()) {
+ printf("\n\tUnexpected failure cause 0x%02lx\n\t",
+ failure_code());
+ return (void *) -1;
+diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
+index df4204247d45c..5518b1d4ef8b2 100644
+--- a/tools/testing/selftests/powerpc/tm/tm.h
++++ b/tools/testing/selftests/powerpc/tm/tm.h
+@@ -52,6 +52,15 @@ static inline bool failure_is_unavailable(void)
+ return (failure_code() & TM_CAUSE_FAC_UNAV) == TM_CAUSE_FAC_UNAV;
+ }
+
++static inline bool failure_is_reschedule(void)
++{
++ if ((failure_code() & TM_CAUSE_RESCHED) == TM_CAUSE_RESCHED ||
++ (failure_code() & TM_CAUSE_KVM_RESCHED) == TM_CAUSE_KVM_RESCHED)
++ return true;
++
++ return false;
++}
++
+ static inline bool failure_is_nesting(void)
+ {
+ return (__builtin_get_texasru() & 0x400000);
+--
+2.20.1
+
--- /dev/null
+From c10e9aa59a8ad14f3a8a543d35cfdf10bbce2287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:59:05 +0300
+Subject: serial: mxs-auart: Fix potential infinite loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anton Vasilyev <vasilyev@ispras.ru>
+
+[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ]
+
+On the error path of mxs_auart_request_gpio_irq() is performed
+backward iterating with index i of enum type. Underline enum type
+may be unsigned char. In this case check (--i >= 0) will be always
+true and error handling goes into infinite loop.
+
+The patch changes the check so that it is valid for signed and unsigned
+types.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/mxs-auart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 34acdf29713d7..4c188f4079b3e 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1634,8 +1634,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)
+
+ /*
+ * If something went wrong, rollback.
++ * Be careful: i may be unsigned.
+ */
+- while (err && (--i >= 0))
++ while (err && (i-- > 0))
+ if (irq[i] >= 0)
+ free_irq(irq[i], s);
+
+--
+2.20.1
+
--- /dev/null
+From 62a9f0a745e7e632b43f672b8f7d0c2cee5f2c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 10:21:25 +0200
+Subject: serial: samsung: Enable baud clock for UART reset procedure in resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1ff3652bc7111df26b5807037f624be294cf69d5 ]
+
+Ensure that the baud clock is also enabled for UART register writes in
+driver resume. On Exynos5433 SoC this is needed to avoid external abort
+issue.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/samsung.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index c6058b52d5d59..2a49b6d876b87 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1944,7 +1944,11 @@ static int s3c24xx_serial_resume(struct device *dev)
+
+ if (port) {
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ s3c24xx_serial_resetport(port, s3c24xx_port_to_cfg(port));
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+
+ uart_resume_port(&s3c24xx_uart_drv, port);
+@@ -1967,7 +1971,11 @@ static int s3c24xx_serial_resume_noirq(struct device *dev)
+ if (rx_enabled(port))
+ uintm &= ~S3C64XX_UINTM_RXD_MSK;
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ wr_regl(port, S3C64XX_UINTM, uintm);
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 6e685348ccdbaa01a8aca6045972dee291db21e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 15:10:51 +0200
+Subject: serial: uartps: Fix suspend functionality
+
+From: Nava kishore Manne <nava.manne@xilinx.com>
+
+[ Upstream commit 4b9d33c6a30688344a3e95179654ea31b07f59b7 ]
+
+The driver's suspend/resume functions were buggy.
+If UART node contains any child node in the DT and
+the child is established a communication path with
+the parent UART. The relevant /dev/ttyPS* node will
+be not available for other operations.
+If the driver is trying to do any operations like
+suspend/resume without checking the tty->dev status
+it leads to the kernel crash/hang.
+
+This patch fix this issue by call the device_may_wake()
+with the generic parameter of type struct device.
+in the uart suspend and resume paths.
+
+It also fixes a race condition in the uart suspend
+path(i.e uart_suspend_port() should be called at the
+end of cdns_uart_suspend API this path updates the same)
+
+Signed-off-by: Nava kishore Manne <navam@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/xilinx_uartps.c | 41 +++++++++---------------------
+ 1 file changed, 12 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 77efa0a43fe76..66d49d5118853 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1279,24 +1279,11 @@ static struct uart_driver cdns_uart_uart_driver = {
+ static int cdns_uart_suspend(struct device *device)
+ {
+ struct uart_port *port = dev_get_drvdata(device);
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
+
+- /*
+- * Call the API provided in serial_core.c file which handles
+- * the suspend.
+- */
+- uart_suspend_port(&cdns_uart_uart_driver, port);
+- if (!(console_suspend_enabled && !may_wake)) {
++ may_wake = device_may_wakeup(device);
++
++ if (console_suspend_enabled && may_wake) {
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(&port->lock, flags);
+@@ -1311,7 +1298,11 @@ static int cdns_uart_suspend(struct device *device)
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+- return 0;
++ /*
++ * Call the API provided in serial_core.c file which handles
++ * the suspend.
++ */
++ return uart_suspend_port(&cdns_uart_uart_driver, port);
+ }
+
+ /**
+@@ -1325,17 +1316,9 @@ static int cdns_uart_resume(struct device *device)
+ struct uart_port *port = dev_get_drvdata(device);
+ unsigned long flags = 0;
+ u32 ctrl_reg;
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
++
++ may_wake = device_may_wakeup(device);
+
+ if (console_suspend_enabled && !may_wake) {
+ struct cdns_uart *cdns_uart = port->private_data;
+--
+2.20.1
+
mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch
mm-page_io.c-do-not-free-shared-swap-slots.patch
mmc-sdhci-of-at91-fix-quirk2-overwrite.patch
+iio-adc-max9611-explicitly-cast-gain_selectors.patch
+tee-optee-take-dt-status-property-into-account.patch
+ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch
+iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch
+clk-sunxi-ng-h6-fix-pwm-gate-reset-offset.patch
+soundwire-initialize-completion-for-defer-messages.patch
+soundwire-intel-fix-uninitialized-adev-deref.patch
+arm64-dts-allwinner-a64-orange-pi-win-fix-sd-card-no.patch
+arm64-dts-allwinner-a64-olinuxino-fix-dram-voltage.patch
+arm64-dts-allwinner-a64-nanopi-a64-fix-dcdc1-voltage.patch
+alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch
+soc-tegra-pmc-fix-pad-voltage-configuration-for-tegr.patch
+arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch
+y2038-make-do_gettimeofday-and-get_seconds-inline.patch
+arm-dts-rcar-correct-sata-device-sizes-to-2-mib.patch
+arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch
+rtc-sysfs-fix-null-check-in-rtc_add_groups.patch
+rtc-rv8803-fix-the-rv8803-id-in-the-of-table.patch
+remoteproc-davinci-use-zx-for-formating-size_t.patch
+extcon-cht-wc-return-from-default-case-to-avoid-warn.patch
+cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch
+alsa-seq-do-error-checks-at-creating-system-ports.patch
+ath10k-skip-resetting-rx-filter-for-wcn3990.patch
+ath9k-fix-tx99-with-monitor-mode-interface.patch
+wil6210-drop-rx-multicast-packets-that-are-looped-ba.patch
+wil6210-set-edma-variables-only-for-talyn-mb-devices.patch
+wil6210-prevent-usage-of-tx-ring-0-for-edma.patch
+wil6210-fix-invalid-memory-access-for-rx_buff_mgmt-d.patch
+ath10k-limit-available-channels-via-dt-ieee80211-fre.patch
+ice-update-request-resource-command-to-latest-specif.patch
+ice-prevent-control-queue-operations-during-reset.patch
+gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch
+ice-fix-and-update-driver-version-string.patch
+asoc-dapm-don-t-fail-creating-new-dapm-control-on-nu.patch
+asoc-dpcm-properly-initialise-hw-rate_max.patch
+asoc-meson-axg-fifo-report-interrupt-request-failure.patch
+asoc-amd-change-mclk-to-48mhz.patch
+pinctrl-ingenic-probe-driver-at-subsys_initcall.patch
+mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch
+arm-dts-exynos-use-i2c-gpio-for-hdmi-ddc-on-arndale.patch
+arm-dts-exynos-fix-hdmi-hpd-line-handling-on-arndale.patch
+arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch
+liquidio-fix-race-condition-in-instruction-completio.patch
+arm64-dts-stratix10-i2c-clock-running-out-of-spec.patch
+arm-dts-exynos-fix-regulators-configuration-on-peach.patch
+i40evf-validate-the-number-of-queues-a-pf-sends.patch
+i40e-use-correct-length-for-strncpy.patch
+i40evf-set-iff_unicast_flt-flag-for-the-vf.patch
+i40e-check-and-correct-speed-values-for-link-on-open.patch
+i40evf-don-t-enable-vlan-stripping-when-rx-offload-i.patch
+i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch
+i40evf-cancel-workqueue-sync-for-adminq-when-a-vf-is.patch
+i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch
+ib-rxe-avoid-back-to-back-retries.patch
+ib-rxe-fixes-for-rdma-read-retry.patch
+iwlwifi-drop-packets-with-bad-status-in-cd.patch
+iwlwifi-don-t-warn-on-trying-to-dump-dead-firmware.patch
+iwlwifi-mvm-avoid-sending-too-many-bars.patch
+media-vicodec-fix-out-of-range-values-when-decoding.patch
+media-i2c-fix-pm_runtime_get_if_in_use-usage-in-sens.patch
+media-ov772x-disable-clk-on-error-path.patch
+arm-dts-pxa-fix-the-rtc-controller.patch
+arm-dts-pxa-fix-power-i2c-base-address.patch
+rtl8187-fix-warning-generated-when-strncpy-destinati.patch
+mwifiex-do-no-submit-urb-in-suspended-state.patch
+mwifex-free-rx_cmd-skb-in-suspended-state.patch
+brcmfmac-fix-wrong-strnchr-usage.patch
+mt76-fix-comparisons-with-invalid-hardware-key-index.patch
+soc-imx-gpc-fix-pdn-delay.patch
+asoc-rsnd-ssi-fix-issue-in-dma-data-address-assignme.patch
+net-hns3-fix-for-multicast-failure.patch
+net-hns3-fix-error-of-checking-used-vlan-id.patch
+net-hns3-fix-for-loopback-selftest-failed-problem.patch
+net-hns3-change-the-dst-mac-addr-of-loopback-packet.patch
+net-mlx5-fix-atomic_mode-enum-values.patch
+net-phy-mscc-read-vsc8531-vddmac-as-an-u32.patch
+net-phy-mscc-read-vsc8531-edge-slowdown-as-an-u32.patch
+arm-dts-meson8-fix-the-clock-controller-register-siz.patch
+arm-dts-meson8b-fix-the-clock-controller-register-si.patch
+mtd-rawnand-marvell-use-regmap_update_bits-for-sysco.patch
+mtd-rawnand-fsl_ifc-check-result-of-sram-initializat.patch
+mtd-rawnand-fsl_ifc-fixup-sram-init-for-newer-ctrl-v.patch
+mtd-rawnand-qcom-don-t-include-dma-direct.h.patch
+ib-mlx5-change-tx-affinity-assignment-in-roce-lag-mo.patch
+qxl-fix-null-pointer-crash-during-suspend.patch
+mac80211-fix-saving-a-few-he-values.patch
+cfg80211-validate-wmm-rule-when-setting.patch
+f2fs-avoid-wrong-decrypted-data-from-disk.patch
+net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch
+rtnetlink-move-type-calculation-out-of-loop.patch
+asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch
+ath10k-avoid-possible-memory-access-violation.patch
+arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch
+ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch
+i2c-mediatek-use-dma-safe-buffers-for-i2c-transactio.patch
+ib-mlx5-don-t-hold-spin-lock-while-checking-device-s.patch
+ib-ipoib-ensure-that-mtu-isn-t-less-than-minimum-per.patch
+rdma-core-rate-limit-mad-error-messages.patch
+rdma-core-follow-correct-unregister-order-between-sy.patch
+mips-txx9-fix-iounmap-related-issue.patch
+udf-fix-crash-during-mount.patch
+asoc-dapm-avoid-uninitialised-variable-warning.patch
+asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch
+ata-disable-ahci-alpm-feature-for-ampere-computing-e.patch
+of-make-powermac-cache-node-search-conditional-on-co.patch
+arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch
+arm-dts-omap3-gta04-fixes-for-tvout-venc.patch
+arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch
+arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch
+arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch
+arm-dts-omap3-gta04-keep-vpll2-always-on.patch
+f2fs-submit-bio-after-shutdown.patch
+failover-fix-error-return-code-in-net_failover_creat.patch
+sched-debug-explicitly-cast-sched_feat-to-bool.patch
+sched-debug-use-symbolic-names-for-task-state-consta.patch
+firmware-arm_scmi-use-strlcpy-to-ensure-null-termina.patch
+arm64-dts-rockchip-fix-vcc5v0_host_en-on-rk3399-sapp.patch
+tty-serial-atmel-change-the-driver-to-work-under-at9.patch
+arm-dts-exynos-disable-pull-control-for-pmic-irq-lin.patch
+usb-mtu3-disable-vbus-rise-fall-interrupts-of-ltssm.patch
+dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch
+dmaengine-dma-jz4780-further-residue-status-fix.patch
+edac-sb_edac-return-early-on-addrv-bit-and-address-t.patch
+rtc-mt6397-fix-possible-race-condition.patch
+rtc-pl030-fix-possible-race-condition.patch
+ath9k-add-back-support-for-using-active-monitor-inte.patch
+dmaengine-at_xdmac-remove-a-stray-bottom-half-unlock.patch
+rdma-hns-fix-an-error-code-in-hns_roce_v2_init_eq_ta.patch
+ib-hfi1-missing-return-value-in-error-path-for-user-.patch
+signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch
+signal-properly-deliver-sigill-from-uprobes.patch
+signal-properly-deliver-sigsegv-from-x86-uprobes.patch
+f2fs-fix-memory-leak-of-write_io-in-fill_super.patch
+f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch
+f2fs-fix-setattr-project-check-upon-fssetxattr-ioctl.patch
+scsi-qla2xxx-use-correct-qpair-for-abts-cmd.patch
+scsi-qla2xxx-fix-iidma-error.patch
+scsi-qla2xxx-defer-chip-reset-until-target-mode-is-e.patch
+scsi-qla2xxx-terminate-plogi-prli-if-wwn-is-0.patch
+scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch
+scsi-qla2xxx-increase-abort-timeout-value.patch
+scsi-qla2xxx-check-for-register-disconnect.patch
+scsi-qla2xxx-fix-port-speed-display-on-chip-reset.patch
+scsi-qla2xxx-fix-dropped-srb-resource.patch
+scsi-qla2xxx-fix-duplicate-switch-s-nport-id-entries.patch
+scsi-lpfc-fix-gft_id-and-prli-logic-for-rscn.patch
+scsi-lpfc-correct-invalid-eq-doorbell-write-on-if_ty.patch
+scsi-lpfc-fix-errors-in-log-messages.patch
+scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch
+arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch
+scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch
+scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch
+kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch
+net-aquantia-fix-hw_atl_utils_fw_upload_dwords.patch
+drivers-hv-vmbus-fix-synic-per-cpu-context-initializ.patch
+nvmem-core-return-error-code-instead-of-null-from-nv.patch
+media-dt-bindings-adv748x-fix-decimal-unit-addresses.patch
+alsa-hda-fix-implicit-definition-of-pci_iomap-on-sh.patch
+media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch
+media-dvb-fix-compat-ioctl-translation.patch
+net-bcmgenet-fix-speed-selection-for-reverse-mii.patch
+arm64-dts-meson-libretech-update-board-model.patch
+arm64-dts-meson-axg-use-the-proper-compatible-for-et.patch
+alsa-intel8x0m-register-irq-handler-after-register-i.patch
+arm64-dts-renesas-salvator-common-adv748x-override-s.patch
+arm64-dts-renesas-r8a77965-attach-the-sys-dmac-to-th.patch
+arm64-dts-renesas-r8a77965-fix-hs-usb-compatible.patch
+arm64-dts-renesas-r8a77965-fix-clock-reset-for-usb2_.patch
+pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch
+mips-lantiq-do-not-enable-irqs-in-dma-open.patch
+llc-avoid-blocking-in-llc_sap_close.patch
+arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch
+soc-qcom-geni-don-t-ignore-clk_round_rate-errors-in-.patch
+soc-qcom-geni-geni_se_clk_freq_match-should-always-a.patch
+soc-qcom-wcnss_ctrl-avoid-string-overflow.patch
+soc-qcom-apr-avoid-string-overflow.patch
+drivers-qcom-rpmh-rsc-clear-wait_for_compl-after-use.patch
+arm64-dts-broadcom-fix-i2c-and-spi-bus-warnings.patch
+arm-dts-bcm-fix-spi-bus-warnings.patch
+arm-dts-aspeed-fix-i2c-bus-warnings.patch
+powerpc-vdso-correct-call-frame-information.patch
+arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch
+arm-dts-sunxi-fix-i2c-bus-warnings.patch
+pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch
+arm-dts-sun9i-fix-i2c-bus-warnings.patch
+android-binder-no-outgoing-transaction-when-thread-t.patch
+cxgb4-fix-endianness-issue-in-t4_fwcache.patch
+arm64-fix-for-bad_mode-handler-to-always-result-in-p.patch
+block-bfq-inject-other-queue-i-o-into-seeky-idle-que.patch
+blok-bfq-do-not-plug-i-o-if-all-queues-are-weight-ra.patch
+arm64-dts-meson-fix-erroneous-spi-bus-warnings.patch
+power-supply-ab8500_fg-silence-uninitialized-variabl.patch
+power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch
+power-supply-max8998-charger-fix-platform-data-retri.patch
+component-fix-loop-condition-to-call-unbind-if-bind-.patch
+kernfs-fix-range-checks-in-kernfs_get_target_path.patch
+ip_gre-fix-parsing-gre-header-in-ipgre_err.patch
+scsi-ufshcd-fix-null-pointer-dereference-for-in-ufsh.patch
+arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch
+arm64-dts-rockchip-fix-i2c-bus-unit-address-error-on.patch
+acpi-lpss-exclude-i2c-busses-shared-with-punit-from-.patch
+netfilter-nf_tables-avoid-bug_on-usage.patch
+ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch
+s390-qeth-uninstall-irq-handler-on-device-removal.patch
+s390-qeth-invoke-softirqs-after-napi_schedule.patch
+media-vsp1-fix-vsp1_regs.h-license-header.patch
+media-vsp1-fix-ycbcr-planar-formats-pitch-calculatio.patch
+media-ov2680-don-t-register-the-v4l2-subdevice-befor.patch
+pci-acpi-correct-error-message-for-aspm-disabling.patch
+net-socionext-fix-two-sleep-in-atomic-context-bugs-i.patch
+pci-mediatek-fix-unchecked-return-value.patch
+arm-dts-xilinx-fix-i2c-and-spi-bus-warnings.patch
+serial-uartps-fix-suspend-functionality.patch
+serial-samsung-enable-baud-clock-for-uart-reset-proc.patch
+serial-mxs-auart-fix-potential-infinite-loop.patch
+tty-serial-qcom_geni_serial-fix-serial-when-not-used.patch
+arm64-dts-ti-k3-am65-change-address-cells-and-size-c.patch
+samples-bpf-fix-a-compilation-failure.patch
+spi-bcm63xx-hsspi-keep-pll-clk-enabled.patch
+spi-mediatek-don-t-modify-spi_transfer-when-transfer.patch
+asoc-rt5682-fix-the-boost-volume-at-the-begining-of-.patch
+ipmi_si_pci-fix-null-device-in-ipmi_si-error-message.patch
+ipmi_si-fix-potential-integer-overflow-on-large-shif.patch
+ipmi-dmi-ignore-ipmi-smbios-entries-with-a-zero-base.patch
+ipmi-fix-return-value-of-ipmi_set_my_lun.patch
+net-hns3-fix-return-type-of-ndo_start_xmit-function.patch
+net-cavium-fix-return-type-of-ndo_start_xmit-functio.patch
+net-ibm-fix-return-type-of-ndo_start_xmit-function.patch
+powerpc-iommu-avoid-derefence-before-pointer-check.patch
+selftests-powerpc-do-not-fail-with-reschedule.patch
+powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch
+powerpc-pseries-memory-hotplug-only-update-dt-once-p.patch
+powerpc-pseries-disable-cpu-hotplug-across-migration.patch
+powerpc-fix-duplicate-const-clang-warning-in-user-ac.patch
+rdma-i40iw-fix-incorrect-iterator-type.patch
+arm-dts-atmel-fix-i2c-and-spi-bus-warnings.patch
+opp-protect-dev_list-with-opp_table-lock.patch
+of-unittest-fix-i2c-bus-unit-address-error.patch
+libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch
+power-supply-twl4030_charger-fix-charging-current-ou.patch
+power-supply-twl4030_charger-disable-eoc-interrupt-o.patch
+net-mvpp2-fix-the-number-of-queues-per-cpu-for-ppv2..patch
+net-marvell-fix-return-type-of-ndo_start_xmit-functi.patch
+net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch
+net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch
+net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch
+net-amd-fix-return-type-of-ndo_start_xmit-function.patch
+net-sun-fix-return-type-of-ndo_start_xmit-function.patch
+net-hns3-fix-for-setting-speed-for-phy-failed-proble.patch
+net-hns3-fix-cmdq-registers-initialization-issue-for.patch
+net-hns3-clear-client-pointer-when-initialize-client.patch
+net-hns3-fix-client-initialize-state-issue-when-roce.patch
+net-hns3-fix-parameter-type-for-q_id-in-hclge_tm_q_t.patch
+nfp-provide-a-better-warning-when-ring-allocation-fa.patch
+usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch
+usb-chipidea-fix-otg-event-handler.patch
+usb-usbtmc-fix-ioctl-usbtmc_ioctl_abort_bulk_out.patch
+s390-zcrypt-enable-ap-bus-scan-without-a-valid-defau.patch
+s390-vdso-avoid-64-bit-vdso-mapping-for-compat-tasks.patch
+s390-vdso-correct-cfi-annotations-of-vdso-functions.patch
+brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
+brcmsmac-use-kvmalloc-for-ucode-allocations.patch
+mlxsw-spectrum-init-shaper-for-tcs-8.15.patch
+pci-portdrv-initialize-service-drivers-directly.patch
+arm-dts-am335x-evm-fix-number-of-cpsw.patch
+arm-dts-ti-fix-spi-and-i2c-bus-warnings.patch
+f2fs-avoid-infinite-loop-in-f2fs_alloc_nid.patch
+f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch
+arm-dts-ux500-correct-scu-unit-address.patch
+arm-dts-ux500-fix-lcda-clock-line-muxing.patch
+arm-dts-ste-fix-spi-controller-node-names.patch
+spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch
+crypto-chacha20-fix-chacha20_block-keystream-alignme.patch
+cpufeature-avoid-warning-when-compiling-with-clang.patch
+crypto-arm-crc32-avoid-warning-when-compiling-with-c.patch
+arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch
+x86-mce-inject-reset-injection-struct-after-injectio.patch
+arm-dts-stm32-enable-display-on-stm32mp157c-ev1-boar.patch
+arm-dts-clearfog-fix-sdhci-supply-property-name.patch
+arm-dts-stm32-fix-spi-controller-node-names.patch
+bnx2x-ignore-bandwidth-attention-in-single-function-.patch
+pci-aer-take-reference-on-error-devices.patch
+pci-aer-don-t-read-upstream-ports-below-fatal-errors.patch
+pci-err-use-slot-reset-if-available.patch
+samples-bpf-fix-compilation-failure.patch
+net-phy-mdio-bcm-unimac-allow-configuring-mdio-clock.patch
+net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch
+net-freescale-fix-return-type-of-ndo_start_xmit-func.patch
+x86-cpu-use-correct-macros-for-cyrix-calls.patch
+x86-cpu-change-query-logic-so-cpuid-is-enabled-befor.patch
+edac-correct-dimm-capacity-unit-symbol.patch
+mips-kexec-relax-memory-restriction.patch
+arm64-dts-rockchip-fix-microsd-in-rk3399-sapphire-bo.patch
+mlxsw-make-mlxsw_sp1_fwrev_minor-a-hard-requirement.patch
+media-imx-work-around-false-positive-warning-again.patch
+media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch
+media-au0828-fix-incorrect-error-messages.patch
+media-davinci-fix-implicit-enum-conversion-warning.patch
+arm-dts-rockchip-explicitly-set-vcc_sd0-pin-to-gpio-.patch
+usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch
+usb-gadget-uvc-configfs-prevent-format-changes-after.patch
+usb-gadget-uvc-configfs-sort-frame-intervals-upon-wr.patch
+arm-dts-exynos-correct-audio-subsystem-parent-clock-.patch
+i2c-aspeed-fix-invalid-clock-parameters-for-very-lar.patch
+gpiolib-fix-gpio_direction_-for-single-direction-gpi.patch
+arm-at91-pm-call-put_device-instead-of-of_node_put-i.patch
+phy-brcm-sata-allow-phy_brcm_sata-driver-to-be-built.patch
+phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
+phy-phy-twl4030-usb-fix-denied-runtime-access.patch
+arm-dts-imx6ull-update-vdd_soc-voltage-for-900mhz-op.patch
+usb-gadget-uvc-factor-out-video-usb-request-queueing.patch
+usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch
+coresight-use-err_cast-instead-of-err_ptr.patch
+coresight-fix-handling-of-sinks.patch
+coresight-perf-fix-per-cpu-path-management.patch
+coresight-perf-disable-trace-path-upon-source-error.patch
+coresight-tmc-etr-handle-driver-mode-specific-etr-bu.patch
+coresight-etm4x-configure-el2-exception-level-when-k.patch
+coresight-tmc-fix-byte-address-alignment-for-rrp.patch
+coresight-dynamic-replicator-handle-multiple-connect.patch
+slimbus-ngd-register-ngd-driver-only-once.patch
+slimbus-ngd-return-proper-error-code-instead-of-zero.patch
+silmbus-ngd-register-controller-after-power-up.patch
+misc-kgdbts-fix-restrict-error.patch
+misc-genwqe-should-return-proper-error-value.patch
+vmbus-keep-pointer-to-ring-buffer-page.patch
+vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch
+vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch
+iw_cxgb4-use-proper-enumerated-type-in-c4iw_bar2_add.patch
+scsi-libsas-always-unregister-the-old-device-if-goin.patch
+f2fs-fix-remount-problem-of-option-io_bits.patch
+phy-lantiq-fix-compile-warning.patch
+arm-dts-meson8b-odroidc1-enable-the-sar-adc.patch
+arm64-dts-fsl-fix-i2c-and-spi-bus-warnings.patch
+arm-dts-imx51-zii-rdu1-fix-the-rtc-compatible-string.patch
+arm64-tegra-i2c-on-tegra194-is-not-compatible-with-t.patch
+arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch
+arm-dts-tegra20-restore-address-order.patch
+arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch
+arm-tegra-apalis_t30-fix-mcp2515-can-controller-inte.patch
+arm-tegra-colibri_t30-fix-mcp2515-can-controller-int.patch
+arm-dts-paz00-fix-wakeup-gpio-keycode.patch
+net-smsc-fix-return-type-of-ndo_start_xmit-function.patch
+net-faraday-fix-return-type-of-ndo_start_xmit-functi.patch
+pci-err-run-error-recovery-callbacks-for-all-affecte.patch
+f2fs-update-i_size-after-dio-completion.patch
+f2fs-fix-to-recover-inode-s-project-id-during-por.patch
+f2fs-mark-inode-dirty-explicitly-in-recover_inode.patch
+rdma-fix-dependencies-for-rdma_user_mmap_io.patch
+edac-raise-the-maximum-number-of-memory-controllers.patch
+arm-dts-realview-fix-spi-controller-node-names.patch
+firmware-dell_rbu-make-payload-memory-uncachable.patch
+bluetooth-hci_serdev-clear-hci_uart_proto_ready-to-a.patch
+bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch
+bluetooth-btrsi-fix-bt-tx-timeout-issue.patch
+x86-hyperv-suppress-pci-fatal-no-config-space-access.patch
+crypto-s5p-sss-fix-race-in-error-handling.patch
+crypto-s5p-sss-fix-fix-argument-list-alignment.patch
+crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch
+iwlwifi-dbg-don-t-crash-if-the-firmware-crashes-in-t.patch
+iwlwifi-fix-non_shared_ant-for-22000-devices.patch
+iwlwifi-pcie-read-correct-prph-address-for-newer-dev.patch
+iwlwifi-api-annotate-compressed-ba-notif-array-sizes.patch
+iwlwifi-pcie-gen2-build-a-msdu-only-for-gso.patch
+iwlwifi-pcie-fit-reclaim-msg-to-max_msg_len.patch
+iwlwifi-mvm-use-correct-fifo-length.patch
+iwlwifi-mvm-allow-tkip-for-ap-mode.patch
+scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch
+scsi-ncr5380-have-ncr5380_select-return-a-bool.patch
+scsi-ncr5380-withhold-disconnect-privilege-for-reque.patch
+scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch
+scsi-ncr5380-check-for-invalid-reselection-target.patch
+scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch
+scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch
+scsi-ncr5380-handle-bus-free-during-reselection.patch
+scsi-ncr5380-check-for-bus-reset.patch
+arm64-dts-amd-fix-spi-bus-warnings.patch
+arm64-dts-lg-fix-spi-controller-node-names.patch
+arm-dts-lpc32xx-fix-spi-controller-node-names.patch
+rtc-isl1208-avoid-possible-sysfs-race.patch
+rtc-tx4939-fixup-nvmem-name-and-register-size.patch
+rtc-armada38x-fix-possible-race-condition.patch
+netfilter-masquerade-don-t-flush-all-conntracks-if-o.patch
+usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch
+usb-usbtmc-uninitialized-symbol-actual-in-usbtmc_ioc.patch
+fuse-use-read_once-on-congestion_threshold-and-max_b.patch
+ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch
+media-ov2680-fix-null-dereference-at-power-on.patch
+s390-vdso-correct-vdso-mapping-for-compat-tasks.patch
+net-phy-mdio-bcm-unimac-mark-pm-functions-as-__maybe.patch
--- /dev/null
+From 03d2da8d241abf9b22fee1d99d15c74940ab7dea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 19:47:27 -0500
+Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ]
+
+If the first process started (aka /sbin/init) receives a SIGKILL it
+will panic the system if it is delivered. Making the system unusable
+and undebugable. It isn't much better if the first process started
+receives SIGSTOP.
+
+So always ignore SIGSTOP and SIGKILL sent to init.
+
+This is done in a separate clause in sig_task_ignored as force_sig_info
+can clear SIG_UNKILLABLE and this protection should work even then.
+
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 0e6bc3049427e..7278302e34850 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -78,6 +78,10 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
+
+ handler = sig_handler(t, sig);
+
++ /* SIGKILL and SIGSTOP may not be sent to the global init */
++ if (unlikely(is_global_init(t) && sig_kernel_only(sig)))
++ return true;
++
+ if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return true;
+--
+2.20.1
+
--- /dev/null
+From f058d09604dc4469c0d7875ed102572c45dae8d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:33:53 -0500
+Subject: signal: Properly deliver SIGILL from uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ]
+
+For userspace to tell the difference between a random signal and an
+exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result
+in userspace seeing si_code == SI_USER (like a random signal) instead
+of si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current)
+with force_sig(SIG_ILL, current) which gets this right and is
+shorter and easier to type.
+
+Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails")
+Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 578d4ac54484f..c173e4131df88 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1858,7 +1858,7 @@ static void handle_trampoline(struct pt_regs *regs)
+
+ sigill:
+ uprobe_warn(current, "handle uretprobe, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+
+ }
+
+@@ -1974,7 +1974,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
+
+ if (unlikely(err)) {
+ uprobe_warn(current, "execute the probed insn, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e4c6a7c96c38a71a2aed672ebe29cae125d907a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:48:30 -0500
+Subject: signal: Properly deliver SIGSEGV from x86 uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ]
+
+For userspace to tell the difference between an random signal
+and an exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in
+userspace seeing si_code == SI_USER (like a random signal) instead of
+si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current)
+with force_sig(SIG_SEGV, current) which gets this right and is shorter
+and easier to type.
+
+Fixes: 791eca10107f ("uretprobes/x86: Hijack return address")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 9119859ba7871..420aa7d3a2e6b 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -1089,7 +1089,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
+ pr_err("return address clobbered: pid=%d, %%sp=%#lx, %%ip=%#lx\n",
+ current->pid, regs->sp, regs->ip);
+
+- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
++ force_sig(SIGSEGV, current);
+ }
+
+ return -1;
+--
+2.20.1
+
--- /dev/null
+From 80be060d9d14b5f9c9a457f24cbbbeec70868654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Sep 2018 16:45:44 -0700
+Subject: silmbus: ngd: register controller after power up.
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 94fe5f2b45c4108885e4b71f6b181068632ec904 ]
+
+Register slimbus controller only after finishing powerup sequnce so that we
+do not endup in situation where core starts sending transactions before
+the controller is ready.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index e587be9064e74..d72f8eed2e8b7 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1234,8 +1234,17 @@ static int qcom_slim_ngd_enable(struct qcom_slim_ngd_ctrl *ctrl, bool enable)
+ pm_runtime_resume(ctrl->dev);
+ pm_runtime_mark_last_busy(ctrl->dev);
+ pm_runtime_put(ctrl->dev);
++
++ ret = slim_register_controller(&ctrl->ctrl);
++ if (ret) {
++ dev_err(ctrl->dev, "error adding slim controller\n");
++ return ret;
++ }
++
++ dev_info(ctrl->dev, "SLIM controller Registered\n");
+ } else {
+ qcom_slim_qmi_exit(ctrl);
++ slim_unregister_controller(&ctrl->ctrl);
+ }
+
+ return 0;
+@@ -1360,11 +1369,6 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ int ret;
+
+ ctrl->ctrl.dev = dev;
+- ret = slim_register_controller(&ctrl->ctrl);
+- if (ret) {
+- dev_err(dev, "error adding slim controller\n");
+- return ret;
+- }
+
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, QCOM_SLIM_NGD_AUTOSUSPEND);
+@@ -1374,7 +1378,7 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ ret = qcom_slim_ngd_qmi_svc_event_init(ctrl);
+ if (ret) {
+ dev_err(&pdev->dev, "QMI service registration failed:%d", ret);
+- goto err;
++ return ret;
+ }
+
+ INIT_WORK(&ctrl->m_work, qcom_slim_ngd_master_worker);
+@@ -1386,8 +1390,6 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ }
+
+ return 0;
+-err:
+- slim_unregister_controller(&ctrl->ctrl);
+ wq_err:
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+ if (ctrl->mwq)
+@@ -1460,7 +1462,7 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+ pm_runtime_disable(&pdev->dev);
+- slim_unregister_controller(&ctrl->ctrl);
++ qcom_slim_ngd_enable(ctrl, false);
+ qcom_slim_ngd_exit_dma(ctrl);
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+ if (ctrl->mwq)
+--
+2.20.1
+
--- /dev/null
+From 92cfd217c031de9cf8daa0b0ca911c8ad5fbf99b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Sep 2018 16:45:46 -0700
+Subject: slimbus: ngd: register ngd driver only once.
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 1830dad34c070161fda2ff1db77b39ffa78aa380 ]
+
+Move ngd platform driver out of loop so that it registers only once.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index f63d1b8a09335..a9abde2f4088b 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1346,7 +1346,6 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ ngd->base = ctrl->base + ngd->id * data->offset +
+ (ngd->id - 1) * data->size;
+ ctrl->ngd = ngd;
+- platform_driver_register(&qcom_slim_ngd_driver);
+
+ return 0;
+ }
+@@ -1445,6 +1444,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ init_completion(&ctrl->reconf);
+ init_completion(&ctrl->qmi.qmi_comp);
+
++ platform_driver_register(&qcom_slim_ngd_driver);
+ return of_qcom_slim_ngd_register(dev, ctrl);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4cec605e66979fb0ac566244551da6604b634bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Sep 2018 16:45:45 -0700
+Subject: slimbus: ngd: return proper error code instead of zero
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 9652e6aa62a1836494ebb8dbd402587c083b568c ]
+
+It looks like there is a typo in probe return. Fix it.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index a9abde2f4088b..e587be9064e74 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1393,7 +1393,7 @@ wq_err:
+ if (ctrl->mwq)
+ destroy_workqueue(ctrl->mwq);
+
+- return 0;
++ return ret;
+ }
+
+ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From d69fd5ffe96ea83f83e69413416c666dacc479bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jul 2018 09:46:03 +0000
+Subject: soc: imx: gpc: fix PDN delay
+
+From: Sven Schmitt <Sven.Schmitt@mixed-mode.de>
+
+[ Upstream commit 9f4d61d531e0efc9c3283963ae5ef7e314579191 ]
+
+imx6_pm_domain_power_off() reads iso and iso2sw from GPC_PGC_PUPSCR_OFFS
+which stores the power up delays.
+So use GPC_PGC_PDNSCR_OFFS for the correct delays.
+
+Signed-off-by: Sven Schmitt <sven.schmitt@mixed-mode.de>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/gpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index b3da635970ea7..d160fc2a7b7a2 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -69,7 +69,7 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd)
+ u32 val;
+
+ /* Read ISO and ISO2SW power down delays */
+- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val);
++ regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PDNSCR_OFFS, &val);
+ iso = val & 0x3f;
+ iso2sw = (val >> 8) & 0x3f;
+
+--
+2.20.1
+
--- /dev/null
+From b2f3810d7619c5ad71f83cd40855f81c6de83ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 09:57:22 +0200
+Subject: soc: qcom: apr: Avoid string overflow
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit 4fadb26574cb74e5de079dd384f25f44f4fb3ec3 ]
+
+'adev->name' is used as a NUL-terminated string, but using strncpy() with the
+length equal to the buffer size may result in lack of the termination:
+
+In function 'apr_add_device',
+ inlined from 'of_register_apr_devices' at drivers//soc/qcom/apr.c:264:7,
+ inlined from 'apr_probe' at drivers//soc/qcom/apr.c:290:2:
+drivers//soc/qcom/apr.c:222:3: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+ strncpy(adev->name, np->name, APR_NAME_SIZE);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This changes it to use the safer strscpy() instead.
+
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/apr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
+index 57af8a5373325..ee9197f5aae96 100644
+--- a/drivers/soc/qcom/apr.c
++++ b/drivers/soc/qcom/apr.c
+@@ -219,9 +219,9 @@ static int apr_add_device(struct device *dev, struct device_node *np,
+ adev->domain_id = id->domain_id;
+ adev->version = id->svc_version;
+ if (np)
+- strncpy(adev->name, np->name, APR_NAME_SIZE);
++ strscpy(adev->name, np->name, APR_NAME_SIZE);
+ else
+- strncpy(adev->name, id->name, APR_NAME_SIZE);
++ strscpy(adev->name, id->name, APR_NAME_SIZE);
+
+ dev_set_name(&adev->dev, "aprsvc:%s:%x:%x", adev->name,
+ id->domain_id, id->svc_id);
+--
+2.20.1
+
--- /dev/null
+From be833cd69cac398978ea14f86a0c2e05839206fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 15:49:05 -0700
+Subject: soc: qcom: geni: Don't ignore clk_round_rate() errors in
+ geni_se_clk_tbl_get()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit e11bbcedecae85ce60a5d99ea03528c2d6f867e0 ]
+
+The function clk_round_rate() is defined to return a "long", not an
+"unsigned long". That's because it might return a negative error
+code. Change the call in geni_se_clk_tbl_get() to check for errors.
+
+While we're at it, get rid of a useless init of "freq".
+
+NOTE: overall the idea that we should iterate over clk_round_rate() to
+try to reconstruct a table already present in the clock driver is
+questionable. Specifically:
+- This method relies on "clk_round_rate()" rounding up.
+- This method only works if the table is sorted and has no duplicates.
+...this patch doesn't try to fix those problems, it just makes the
+error handling more correct.
+
+Fixes: eddac5af0654 ("soc: qcom: Add GENI based QUP Wrapper driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom-geni-se.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index feed3db21c108..1b19b8428c4ac 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -513,7 +513,7 @@ EXPORT_SYMBOL(geni_se_resources_on);
+ */
+ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)
+ {
+- unsigned long freq = 0;
++ long freq = 0;
+ int i;
+
+ if (se->clk_perf_tbl) {
+@@ -529,7 +529,7 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)
+
+ for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) {
+ freq = clk_round_rate(se->clk, freq + 1);
+- if (!freq || freq == se->clk_perf_tbl[i - 1])
++ if (freq <= 0 || freq == se->clk_perf_tbl[i - 1])
+ break;
+ se->clk_perf_tbl[i] = freq;
+ }
+--
+2.20.1
+
--- /dev/null
+From d9859839fa58eefda8c9e5e1913f9e593d76f4cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 15:49:06 -0700
+Subject: soc: qcom: geni: geni_se_clk_freq_match() should always accept
+ multiples
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 867d4aa7013fdee8b962cde1711f96c8dd86d926 ]
+
+The geni_se_clk_freq_match() has some strange semantics. Specifically
+it is defined with two modes:
+1. It can find a clock that's an exact multiple of the requested rate
+2. It can find a non-exact match but it can't handle multiples then
+
+...but callers should always be able to handle a clock that is a
+multiple of the requested clock so mode #2 doesn't really make sense.
+Let's change the semantics so that the non-exact match can also accept
+multiples and then change the code to handle that.
+
+The only caller of this code is the unlanded SPI driver [1] which
+currently passes "exact = True", thus it should be safe to change the
+semantics in this way. ...and, in fact, the SPI driver should likely
+be modified to pass "exact = False" (with the new semantics) since
+that will allow it to work with SPI devices that request a clock rate
+that doesn't exactly match a rate we can make.
+
+[1] https://lkml.kernel.org/r/1535107336-2214-1-git-send-email-dkota@codeaurora.org
+
+Fixes: eddac5af0654 ("soc: qcom: Add GENI based QUP Wrapper driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom-geni-se.c | 37 ++++++++++++++++++++-------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index 1b19b8428c4ac..ee89ffb6dde84 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -544,16 +544,17 @@ EXPORT_SYMBOL(geni_se_clk_tbl_get);
+ * @se: Pointer to the concerned serial engine.
+ * @req_freq: Requested clock frequency.
+ * @index: Index of the resultant frequency in the table.
+- * @res_freq: Resultant frequency which matches or is closer to the
+- * requested frequency.
++ * @res_freq: Resultant frequency of the source clock.
+ * @exact: Flag to indicate exact multiple requirement of the requested
+ * frequency.
+ *
+- * This function is called by the protocol drivers to determine the matching
+- * or exact multiple of the requested frequency, as provided by the serial
+- * engine clock in order to meet the performance requirements. If there is
+- * no matching or exact multiple of the requested frequency found, then it
+- * selects the closest floor frequency, if exact flag is not set.
++ * This function is called by the protocol drivers to determine the best match
++ * of the requested frequency as provided by the serial engine clock in order
++ * to meet the performance requirements.
++ *
++ * If we return success:
++ * - if @exact is true then @res_freq / <an_integer> == @req_freq
++ * - if @exact is false then @res_freq / <an_integer> <= @req_freq
+ *
+ * Return: 0 on success, standard Linux error codes on failure.
+ */
+@@ -564,6 +565,9 @@ int geni_se_clk_freq_match(struct geni_se *se, unsigned long req_freq,
+ unsigned long *tbl;
+ int num_clk_levels;
+ int i;
++ unsigned long best_delta;
++ unsigned long new_delta;
++ unsigned int divider;
+
+ num_clk_levels = geni_se_clk_tbl_get(se, &tbl);
+ if (num_clk_levels < 0)
+@@ -572,18 +576,21 @@ int geni_se_clk_freq_match(struct geni_se *se, unsigned long req_freq,
+ if (num_clk_levels == 0)
+ return -EINVAL;
+
+- *res_freq = 0;
++ best_delta = ULONG_MAX;
+ for (i = 0; i < num_clk_levels; i++) {
+- if (!(tbl[i] % req_freq)) {
++ divider = DIV_ROUND_UP(tbl[i], req_freq);
++ new_delta = req_freq - tbl[i] / divider;
++ if (new_delta < best_delta) {
++ /* We have a new best! */
+ *index = i;
+ *res_freq = tbl[i];
+- return 0;
+- }
+
+- if (!(*res_freq) || ((tbl[i] > *res_freq) &&
+- (tbl[i] < req_freq))) {
+- *index = i;
+- *res_freq = tbl[i];
++ /* If the new best is exact then we're done */
++ if (new_delta == 0)
++ return 0;
++
++ /* Record how close we got */
++ best_delta = new_delta;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c4006231552a5ed934180df60303dbf0789e46d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 09:57:21 +0200
+Subject: soc: qcom: wcnss_ctrl: Avoid string overflow
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit 4c96ed170d658d8826d94edec8ac93ee777981a2 ]
+
+'chinfo.name' is used as a NUL-terminated string, but using strncpy() with
+the length equal to the buffer size may result in lack of the termination:
+
+drivers//soc/qcom/wcnss_ctrl.c: In function 'qcom_wcnss_open_channel':
+drivers//soc/qcom/wcnss_ctrl.c:284:2: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+ strncpy(chinfo.name, name, sizeof(chinfo.name));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This changes it to use the safer strscpy() instead.
+
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/wcnss_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c
+index df3ccb30bc2dd..373400dd816d6 100644
+--- a/drivers/soc/qcom/wcnss_ctrl.c
++++ b/drivers/soc/qcom/wcnss_ctrl.c
+@@ -281,7 +281,7 @@ struct rpmsg_endpoint *qcom_wcnss_open_channel(void *wcnss, const char *name, rp
+ struct rpmsg_channel_info chinfo;
+ struct wcnss_ctrl *_wcnss = wcnss;
+
+- strncpy(chinfo.name, name, sizeof(chinfo.name));
++ strscpy(chinfo.name, name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+
+--
+2.20.1
+
--- /dev/null
+From 450bfebd4197643afed76f98381133de2ac1ebcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 21:08:07 +0300
+Subject: soc/tegra: pmc: Fix pad voltage configuration for Tegra186
+
+From: Aapo Vienamo <avienamo@nvidia.com>
+
+[ Upstream commit 13136a47a061c01c91df78b37f7708dd5ce7035f ]
+
+Implement support for the PMC_IMPL_E_33V_PWR register which replaces
+PMC_PWR_DET register interface of the SoC generations preceding
+Tegra186. Also add the voltage bit offsets to the tegra186_io_pads[]
+table and the AO_HV pad.
+
+Signed-off-by: Aapo Vienamo <avienamo@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/pmc.c | 55 +++++++++++++++++++++++++++++------------
+ include/soc/tegra/pmc.h | 1 +
+ 2 files changed, 40 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 4b452f36f0547..f17a678154047 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -65,6 +65,8 @@
+
+ #define PWRGATE_STATUS 0x38
+
++#define PMC_IMPL_E_33V_PWR 0x40
++
+ #define PMC_PWR_DET 0x48
+
+ #define PMC_SCRATCH0_MODE_RECOVERY BIT(31)
+@@ -154,6 +156,7 @@ struct tegra_pmc_soc {
+ bool has_tsense_reset;
+ bool has_gpu_clamps;
+ bool needs_mbist_war;
++ bool has_impl_33v_pwr;
+
+ const struct tegra_io_pad_soc *io_pads;
+ unsigned int num_io_pads;
+@@ -1067,20 +1070,31 @@ int tegra_io_pad_set_voltage(enum tegra_io_pad id,
+
+ mutex_lock(&pmc->powergates_lock);
+
+- /* write-enable PMC_PWR_DET_VALUE[pad->voltage] */
+- value = tegra_pmc_readl(PMC_PWR_DET);
+- value |= BIT(pad->voltage);
+- tegra_pmc_writel(value, PMC_PWR_DET);
++ if (pmc->soc->has_impl_33v_pwr) {
++ value = tegra_pmc_readl(PMC_IMPL_E_33V_PWR);
+
+- /* update I/O voltage */
+- value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
++ if (voltage == TEGRA_IO_PAD_1800000UV)
++ value &= ~BIT(pad->voltage);
++ else
++ value |= BIT(pad->voltage);
+
+- if (voltage == TEGRA_IO_PAD_1800000UV)
+- value &= ~BIT(pad->voltage);
+- else
++ tegra_pmc_writel(value, PMC_IMPL_E_33V_PWR);
++ } else {
++ /* write-enable PMC_PWR_DET_VALUE[pad->voltage] */
++ value = tegra_pmc_readl(PMC_PWR_DET);
+ value |= BIT(pad->voltage);
++ tegra_pmc_writel(value, PMC_PWR_DET);
++
++ /* update I/O voltage */
++ value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
+
+- tegra_pmc_writel(value, PMC_PWR_DET_VALUE);
++ if (voltage == TEGRA_IO_PAD_1800000UV)
++ value &= ~BIT(pad->voltage);
++ else
++ value |= BIT(pad->voltage);
++
++ tegra_pmc_writel(value, PMC_PWR_DET_VALUE);
++ }
+
+ mutex_unlock(&pmc->powergates_lock);
+
+@@ -1102,7 +1116,10 @@ int tegra_io_pad_get_voltage(enum tegra_io_pad id)
+ if (pad->voltage == UINT_MAX)
+ return -ENOTSUPP;
+
+- value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
++ if (pmc->soc->has_impl_33v_pwr)
++ value = tegra_pmc_readl(PMC_IMPL_E_33V_PWR);
++ else
++ value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
+
+ if ((value & BIT(pad->voltage)) == 0)
+ return TEGRA_IO_PAD_1800000UV;
+@@ -1561,6 +1578,7 @@ static const struct tegra_pmc_soc tegra30_pmc_soc = {
+ .cpu_powergates = tegra30_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = 0,
+ .io_pads = NULL,
+ .regs = &tegra20_pmc_regs,
+@@ -1603,6 +1621,7 @@ static const struct tegra_pmc_soc tegra114_pmc_soc = {
+ .cpu_powergates = tegra114_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = 0,
+ .io_pads = NULL,
+ .regs = &tegra20_pmc_regs,
+@@ -1683,6 +1702,7 @@ static const struct tegra_pmc_soc tegra124_pmc_soc = {
+ .cpu_powergates = tegra124_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = true,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = ARRAY_SIZE(tegra124_io_pads),
+ .io_pads = tegra124_io_pads,
+ .regs = &tegra20_pmc_regs,
+@@ -1772,6 +1792,7 @@ static const struct tegra_pmc_soc tegra210_pmc_soc = {
+ .cpu_powergates = tegra210_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = true,
++ .has_impl_33v_pwr = false,
+ .needs_mbist_war = true,
+ .num_io_pads = ARRAY_SIZE(tegra210_io_pads),
+ .io_pads = tegra210_io_pads,
+@@ -1800,7 +1821,7 @@ static const struct tegra_io_pad_soc tegra186_io_pads[] = {
+ { .id = TEGRA_IO_PAD_HDMI_DP0, .dpd = 28, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_HDMI_DP1, .dpd = 29, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_PEX_CNTRL, .dpd = 32, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC2_HV, .dpd = 34, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_SDMMC2_HV, .dpd = 34, .voltage = 5 },
+ { .id = TEGRA_IO_PAD_SDMMC4, .dpd = 36, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_CAM, .dpd = 38, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_DSIB, .dpd = 40, .voltage = UINT_MAX },
+@@ -1812,12 +1833,13 @@ static const struct tegra_io_pad_soc tegra186_io_pads[] = {
+ { .id = TEGRA_IO_PAD_CSIF, .dpd = 46, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_SPI, .dpd = 47, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_UFS, .dpd = 49, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_DMIC_HV, .dpd = 52, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_DMIC_HV, .dpd = 52, .voltage = 2 },
+ { .id = TEGRA_IO_PAD_EDP, .dpd = 53, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC1_HV, .dpd = 55, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC3_HV, .dpd = 56, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_SDMMC1_HV, .dpd = 55, .voltage = 4 },
++ { .id = TEGRA_IO_PAD_SDMMC3_HV, .dpd = 56, .voltage = 6 },
+ { .id = TEGRA_IO_PAD_CONN, .dpd = 60, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_AUDIO_HV, .dpd = 61, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_AUDIO_HV, .dpd = 61, .voltage = 1 },
++ { .id = TEGRA_IO_PAD_AO_HV, .dpd = UINT_MAX, .voltage = 0 },
+ };
+
+ static const struct tegra_pmc_regs tegra186_pmc_regs = {
+@@ -1870,6 +1892,7 @@ static const struct tegra_pmc_soc tegra186_pmc_soc = {
+ .cpu_powergates = NULL,
+ .has_tsense_reset = false,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = true,
+ .num_io_pads = ARRAY_SIZE(tegra186_io_pads),
+ .io_pads = tegra186_io_pads,
+ .regs = &tegra186_pmc_regs,
+diff --git a/include/soc/tegra/pmc.h b/include/soc/tegra/pmc.h
+index c32bf91c23e6f..445aa66514e90 100644
+--- a/include/soc/tegra/pmc.h
++++ b/include/soc/tegra/pmc.h
+@@ -134,6 +134,7 @@ enum tegra_io_pad {
+ TEGRA_IO_PAD_USB2,
+ TEGRA_IO_PAD_USB3,
+ TEGRA_IO_PAD_USB_BIAS,
++ TEGRA_IO_PAD_AO_HV,
+ };
+
+ /* deprecated, use TEGRA_IO_PAD_{HDMI,LVDS} instead */
+--
+2.20.1
+
--- /dev/null
+From 2c0a409a3b24bd119884cd55009c212242782d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jul 2018 14:44:12 +0530
+Subject: soundwire: Initialize completion for defer messages
+
+From: Shreyas NC <shreyas.nc@intel.com>
+
+[ Upstream commit a306a0e4a5326269b6c78d136407f08433ab5ece ]
+
+Deferred messages are async messages used to synchronize
+transitions mostly while doing a bank switch on multi links.
+On successful transitions these messages are marked complete
+and thereby confirming that all the buses performed bank switch
+successfully.
+
+So, initialize the completion structure for the same.
+
+Signed-off-by: Sanyog Kale <sanyog.r.kale@intel.com>
+Signed-off-by: Shreyas NC <shreyas.nc@intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 83576810eee65..df172bf3925f6 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -175,6 +175,7 @@ static inline int do_transfer_defer(struct sdw_bus *bus,
+
+ defer->msg = msg;
+ defer->length = msg->len;
++ init_completion(&defer->complete);
+
+ for (i = 0; i <= retry; i++) {
+ resp = bus->ops->xfer_msg_defer(bus, msg, defer);
+--
+2.20.1
+
--- /dev/null
+From b10a6cabf4b10886b87c474b668d3a804d96c78c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 11:54:50 +0530
+Subject: soundwire: intel: Fix uninitialized adev deref
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit e1c815f4b24a305e5bc9eceb541674bf4d02b709 ]
+
+In case of error, we can dereference uninitialized 'adev'
+
+drivers/soundwire/intel_init.c:154 sdw_intel_acpi_cb()
+error: uninitialized symbol 'adev'.
+
+Fix that by not using adev for warn print and make it pr_err.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/intel_init.c b/drivers/soundwire/intel_init.c
+index d1ea6b4d0ad30..5c8a20d998786 100644
+--- a/drivers/soundwire/intel_init.c
++++ b/drivers/soundwire/intel_init.c
+@@ -151,7 +151,7 @@ static acpi_status sdw_intel_acpi_cb(acpi_handle handle, u32 level,
+ struct acpi_device *adev;
+
+ if (acpi_bus_get_device(handle, &adev)) {
+- dev_err(&adev->dev, "Couldn't find ACPI handle\n");
++ pr_err("%s: Couldn't find ACPI handle\n", __func__);
+ return AE_NOT_FOUND;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d315eb51b6cd98133050ff4050fbcbc69ae26c51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 13:44:11 +0200
+Subject: spi/bcm63xx-hsspi: keep pll clk enabled
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 0fd85869c2a9c8723a98bc1f56a876e8383649f4 ]
+
+If the pll clock needs to be enabled to get its rate, it will also need
+to be enabled to provide it. So ensure it is kept enabled through the
+lifetime of the device.
+
+Fixes: 0d7412ed1f5dc ("spi/bcm63xx-hspi: Enable the clock before calling clk_get_rate().")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx-hsspi.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index c23849f7aa7bc..9a06ffdb73b88 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -101,6 +101,7 @@ struct bcm63xx_hsspi {
+
+ struct platform_device *pdev;
+ struct clk *clk;
++ struct clk *pll_clk;
+ void __iomem *regs;
+ u8 __iomem *fifo;
+
+@@ -332,7 +333,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ struct resource *res_mem;
+ void __iomem *regs;
+ struct device *dev = &pdev->dev;
+- struct clk *clk;
++ struct clk *clk, *pll_clk = NULL;
+ int irq, ret;
+ u32 reg, rate, num_cs = HSSPI_SPI_MAX_CS;
+
+@@ -358,7 +359,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+
+ rate = clk_get_rate(clk);
+ if (!rate) {
+- struct clk *pll_clk = devm_clk_get(dev, "pll");
++ pll_clk = devm_clk_get(dev, "pll");
+
+ if (IS_ERR(pll_clk)) {
+ ret = PTR_ERR(pll_clk);
+@@ -373,19 +374,20 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ clk_disable_unprepare(pll_clk);
+ if (!rate) {
+ ret = -EINVAL;
+- goto out_disable_clk;
++ goto out_disable_pll_clk;
+ }
+ }
+
+ master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master) {
+ ret = -ENOMEM;
+- goto out_disable_clk;
++ goto out_disable_pll_clk;
+ }
+
+ bs = spi_master_get_devdata(master);
+ bs->pdev = pdev;
+ bs->clk = clk;
++ bs->pll_clk = pll_clk;
+ bs->regs = regs;
+ bs->speed_hz = rate;
+ bs->fifo = (u8 __iomem *)(bs->regs + HSSPI_FIFO_REG(0));
+@@ -440,6 +442,8 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+
+ out_put_master:
+ spi_master_put(master);
++out_disable_pll_clk:
++ clk_disable_unprepare(pll_clk);
+ out_disable_clk:
+ clk_disable_unprepare(clk);
+ return ret;
+@@ -453,6 +457,7 @@ static int bcm63xx_hsspi_remove(struct platform_device *pdev)
+
+ /* reset the hardware and block queue progress */
+ __raw_writel(0, bs->regs + HSSPI_INT_MASK_REG);
++ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+
+ return 0;
+@@ -465,6 +470,7 @@ static int bcm63xx_hsspi_suspend(struct device *dev)
+ struct bcm63xx_hsspi *bs = spi_master_get_devdata(master);
+
+ spi_master_suspend(master);
++ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+
+ return 0;
+@@ -480,6 +486,12 @@ static int bcm63xx_hsspi_resume(struct device *dev)
+ if (ret)
+ return ret;
+
++ if (bs->pll_clk) {
++ ret = clk_prepare_enable(bs->pll_clk);
++ if (ret)
++ return ret;
++ }
++
+ spi_master_resume(master);
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 6da4db862ccf6ee53d2cc0ea5831f85e6a256805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:54:21 +0800
+Subject: spi: mediatek: Don't modify spi_transfer when transfer.
+
+From: Peter Shih <pihsun@chromium.org>
+
+[ Upstream commit 00bca73bfca4fb0ab089b94cad0fc83d8b49c25f ]
+
+Mediatek SPI driver modifies some fields (tx_buf, rx_buf, len, tx_dma,
+rx_dma) of the spi_transfer* passed in when doing transfer_one and in
+interrupt handler. This is somewhat unexpected, and there are some
+caller (e.g. Cr50 spi driver) that reuse the spi_transfer for multiple
+messages. Add a field to record how many bytes have been transferred,
+and calculate the right len / buffer based on it instead.
+
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+
+Change-Id: I23e218cd964f16c0b2b26127d4a5ca6529867673
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 86bf45667a040..3dc31627c6558 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -98,6 +98,7 @@ struct mtk_spi {
+ struct clk *parent_clk, *sel_clk, *spi_clk;
+ struct spi_transfer *cur_transfer;
+ u32 xfer_len;
++ u32 num_xfered;
+ struct scatterlist *tx_sgl, *rx_sgl;
+ u32 tx_sgl_len, rx_sgl_len;
+ const struct mtk_spi_compatible *dev_comp;
+@@ -385,6 +386,7 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,
+
+ mdata->cur_transfer = xfer;
+ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, xfer->len);
++ mdata->num_xfered = 0;
+ mtk_spi_prepare_transfer(master, xfer);
+ mtk_spi_setup_packet(master);
+
+@@ -415,6 +417,7 @@ static int mtk_spi_dma_transfer(struct spi_master *master,
+ mdata->tx_sgl_len = 0;
+ mdata->rx_sgl_len = 0;
+ mdata->cur_transfer = xfer;
++ mdata->num_xfered = 0;
+
+ mtk_spi_prepare_transfer(master, xfer);
+
+@@ -482,7 +485,7 @@ static int mtk_spi_setup(struct spi_device *spi)
+
+ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ {
+- u32 cmd, reg_val, cnt, remainder;
++ u32 cmd, reg_val, cnt, remainder, len;
+ struct spi_master *master = dev_id;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+ struct spi_transfer *trans = mdata->cur_transfer;
+@@ -497,36 +500,38 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ if (trans->rx_buf) {
+ cnt = mdata->xfer_len / 4;
+ ioread32_rep(mdata->base + SPI_RX_DATA_REG,
+- trans->rx_buf, cnt);
++ trans->rx_buf + mdata->num_xfered, cnt);
+ remainder = mdata->xfer_len % 4;
+ if (remainder > 0) {
+ reg_val = readl(mdata->base + SPI_RX_DATA_REG);
+- memcpy(trans->rx_buf + (cnt * 4),
+- ®_val, remainder);
++ memcpy(trans->rx_buf +
++ mdata->num_xfered +
++ (cnt * 4),
++ ®_val,
++ remainder);
+ }
+ }
+
+- trans->len -= mdata->xfer_len;
+- if (!trans->len) {
++ mdata->num_xfered += mdata->xfer_len;
++ if (mdata->num_xfered == trans->len) {
+ spi_finalize_current_transfer(master);
+ return IRQ_HANDLED;
+ }
+
+- if (trans->tx_buf)
+- trans->tx_buf += mdata->xfer_len;
+- if (trans->rx_buf)
+- trans->rx_buf += mdata->xfer_len;
+-
+- mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, trans->len);
++ len = trans->len - mdata->num_xfered;
++ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
+ mtk_spi_setup_packet(master);
+
+- cnt = trans->len / 4;
+- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, trans->tx_buf, cnt);
++ cnt = len / 4;
++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
++ trans->tx_buf + mdata->num_xfered, cnt);
+
+- remainder = trans->len % 4;
++ remainder = len % 4;
+ if (remainder > 0) {
+ reg_val = 0;
+- memcpy(®_val, trans->tx_buf + (cnt * 4), remainder);
++ memcpy(®_val,
++ trans->tx_buf + (cnt * 4) + mdata->num_xfered,
++ remainder);
+ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 94f598e37ad925d012506e3269b133880fafe502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:13:37 -0700
+Subject: spi: pic32: Use proper enum in dmaengine_prep_slave_rg
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8cfde7847d5ed0bb77bace41519572963e43cd17 ]
+
+Clang warns when one enumerated type is converted implicitly to another:
+
+drivers/spi/spi-pic32.c:323:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_FROM_DEVICE,
+ ^~~~~~~~~~~~~~~
+drivers/spi/spi-pic32.c:333:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_TO_DEVICE,
+ ^~~~~~~~~~~~~
+2 warnings generated.
+
+Use the proper enums from dma_transfer_direction (DMA_FROM_DEVICE =
+DMA_DEV_TO_MEM = 2, DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1) to satify Clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/159
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pic32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index f8a45af1fa9f2..288002f6c613e 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -320,7 +320,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_rx = dmaengine_prep_slave_sg(master->dma_rx,
+ xfer->rx_sg.sgl,
+ xfer->rx_sg.nents,
+- DMA_FROM_DEVICE,
++ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_rx) {
+ ret = -EINVAL;
+@@ -330,7 +330,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_tx = dmaengine_prep_slave_sg(master->dma_tx,
+ xfer->tx_sg.sgl,
+ xfer->tx_sg.nents,
+- DMA_TO_DEVICE,
++ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+ ret = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 33acf957a46e538b0dd5bfa2d87852bc9450ffb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Aug 2018 11:48:33 +0200
+Subject: tee: optee: take DT status property into account
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit db878f76b9ff7487da9bb0f686153f81829f1230 ]
+
+DT nodes may have a 'status' property which, if set to anything other
+than 'ok' or 'okay', indicates to the OS that the DT node should be
+treated as if it was not present. So add that missing logic to the
+OP-TEE driver.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index e1aafe842d660..34dce850067b9 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -696,7 +696,7 @@ static int __init optee_driver_init(void)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+- if (!np)
++ if (!np || !of_device_is_available(np))
+ return -ENODEV;
+
+ optee = optee_probe(np);
+--
+2.20.1
+
--- /dev/null
+From a84aa9f23f872176bcd5ce01eaad97a3dd8900d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jul 2018 19:47:36 +0300
+Subject: tty/serial: atmel: Change the driver to work under at91-usart MFD
+
+From: Radu Pirea <radu.pirea@microchip.com>
+
+[ Upstream commit c24d25317a7c6bb3053d4c193b3cf57d1e9a3e4b ]
+
+This patch modifies the place where resources and device tree properties
+are searched.
+
+Signed-off-by: Radu Pirea <radu.pirea@microchip.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/Kconfig | 1 +
+ drivers/tty/serial/atmel_serial.c | 42 ++++++++++++++++++++-----------
+ 2 files changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
+index df8bd0c7b97db..32886c3046413 100644
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -118,6 +118,7 @@ config SERIAL_ATMEL
+ depends on ARCH_AT91 || COMPILE_TEST
+ select SERIAL_CORE
+ select SERIAL_MCTRL_GPIO if GPIOLIB
++ select MFD_AT91_USART
+ help
+ This enables the driver for the on-chip UARTs of the Atmel
+ AT91 processors.
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index dd8949e8fcd7a..251f708f47f76 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -195,8 +195,7 @@ static struct console atmel_console;
+
+ #if defined(CONFIG_OF)
+ static const struct of_device_id atmel_serial_dt_ids[] = {
+- { .compatible = "atmel,at91rm9200-usart" },
+- { .compatible = "atmel,at91sam9260-usart" },
++ { .compatible = "atmel,at91rm9200-usart-serial" },
+ { /* sentinel */ }
+ };
+ #endif
+@@ -926,6 +925,7 @@ static void atmel_tx_dma(struct uart_port *port)
+ static int atmel_prepare_tx_dma(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++ struct device *mfd_dev = port->dev->parent;
+ dma_cap_mask_t mask;
+ struct dma_slave_config config;
+ int ret, nent;
+@@ -933,7 +933,7 @@ static int atmel_prepare_tx_dma(struct uart_port *port)
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+
+- atmel_port->chan_tx = dma_request_slave_channel(port->dev, "tx");
++ atmel_port->chan_tx = dma_request_slave_channel(mfd_dev, "tx");
+ if (atmel_port->chan_tx == NULL)
+ goto chan_err;
+ dev_info(port->dev, "using %s for tx DMA transfers\n",
+@@ -1104,6 +1104,7 @@ static void atmel_rx_from_dma(struct uart_port *port)
+ static int atmel_prepare_rx_dma(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++ struct device *mfd_dev = port->dev->parent;
+ struct dma_async_tx_descriptor *desc;
+ dma_cap_mask_t mask;
+ struct dma_slave_config config;
+@@ -1115,7 +1116,7 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_CYCLIC, mask);
+
+- atmel_port->chan_rx = dma_request_slave_channel(port->dev, "rx");
++ atmel_port->chan_rx = dma_request_slave_channel(mfd_dev, "rx");
+ if (atmel_port->chan_rx == NULL)
+ goto chan_err;
+ dev_info(port->dev, "using %s for rx DMA transfers\n",
+@@ -2246,8 +2247,8 @@ static const char *atmel_type(struct uart_port *port)
+ */
+ static void atmel_release_port(struct uart_port *port)
+ {
+- struct platform_device *pdev = to_platform_device(port->dev);
+- int size = pdev->resource[0].end - pdev->resource[0].start + 1;
++ struct platform_device *mpdev = to_platform_device(port->dev->parent);
++ int size = resource_size(mpdev->resource);
+
+ release_mem_region(port->mapbase, size);
+
+@@ -2262,8 +2263,8 @@ static void atmel_release_port(struct uart_port *port)
+ */
+ static int atmel_request_port(struct uart_port *port)
+ {
+- struct platform_device *pdev = to_platform_device(port->dev);
+- int size = pdev->resource[0].end - pdev->resource[0].start + 1;
++ struct platform_device *mpdev = to_platform_device(port->dev->parent);
++ int size = resource_size(mpdev->resource);
+
+ if (!request_mem_region(port->mapbase, size, "atmel_serial"))
+ return -EBUSY;
+@@ -2365,27 +2366,28 @@ static int atmel_init_port(struct atmel_uart_port *atmel_port,
+ {
+ int ret;
+ struct uart_port *port = &atmel_port->uart;
++ struct platform_device *mpdev = to_platform_device(pdev->dev.parent);
+
+ atmel_init_property(atmel_port, pdev);
+ atmel_set_ops(port);
+
+- uart_get_rs485_mode(&pdev->dev, &port->rs485);
++ uart_get_rs485_mode(&mpdev->dev, &port->rs485);
+
+ port->iotype = UPIO_MEM;
+ port->flags = UPF_BOOT_AUTOCONF | UPF_IOREMAP;
+ port->ops = &atmel_pops;
+ port->fifosize = 1;
+ port->dev = &pdev->dev;
+- port->mapbase = pdev->resource[0].start;
+- port->irq = pdev->resource[1].start;
++ port->mapbase = mpdev->resource[0].start;
++ port->irq = mpdev->resource[1].start;
+ port->rs485_config = atmel_config_rs485;
+- port->membase = NULL;
++ port->membase = NULL;
+
+ memset(&atmel_port->rx_ring, 0, sizeof(atmel_port->rx_ring));
+
+ /* for console, the clock could already be configured */
+ if (!atmel_port->clk) {
+- atmel_port->clk = clk_get(&pdev->dev, "usart");
++ atmel_port->clk = clk_get(&mpdev->dev, "usart");
+ if (IS_ERR(atmel_port->clk)) {
+ ret = PTR_ERR(atmel_port->clk);
+ atmel_port->clk = NULL;
+@@ -2718,13 +2720,22 @@ static void atmel_serial_probe_fifos(struct atmel_uart_port *atmel_port,
+ static int atmel_serial_probe(struct platform_device *pdev)
+ {
+ struct atmel_uart_port *atmel_port;
+- struct device_node *np = pdev->dev.of_node;
++ struct device_node *np = pdev->dev.parent->of_node;
+ void *data;
+ int ret = -ENODEV;
+ bool rs485_enabled;
+
+ BUILD_BUG_ON(ATMEL_SERIAL_RINGSIZE & (ATMEL_SERIAL_RINGSIZE - 1));
+
++ /*
++ * In device tree there is no node with "atmel,at91rm9200-usart-serial"
++ * as compatible string. This driver is probed by at91-usart mfd driver
++ * which is just a wrapper over the atmel_serial driver and
++ * spi-at91-usart driver. All attributes needed by this driver are
++ * found in of_node of parent.
++ */
++ pdev->dev.of_node = np;
++
+ ret = of_alias_get_id(np, "serial");
+ if (ret < 0)
+ /* port id not found in platform data nor device-tree aliases:
+@@ -2860,6 +2871,7 @@ static int atmel_serial_remove(struct platform_device *pdev)
+
+ clk_put(atmel_port->clk);
+ atmel_port->clk = NULL;
++ pdev->dev.of_node = NULL;
+
+ return ret;
+ }
+@@ -2870,7 +2882,7 @@ static struct platform_driver atmel_serial_driver = {
+ .suspend = atmel_serial_suspend,
+ .resume = atmel_serial_resume,
+ .driver = {
+- .name = "atmel_usart",
++ .name = "atmel_usart_serial",
+ .of_match_table = of_match_ptr(atmel_serial_dt_ids),
+ },
+ };
+--
+2.20.1
+
--- /dev/null
+From 02cd99a81c76ad0fe6872b02b6a7e7ef37244c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 13:11:46 -0700
+Subject: tty: serial: qcom_geni_serial: Fix serial when not used as console
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit c362272bdea32bf048d6916b0a2dc485eb9cf787 ]
+
+If you've got the "console" serial port setup to use just as a UART
+(AKA there is no "console=ttyMSMX" on the kernel command line) then
+certain initialization is skipped. When userspace later tries to do
+something with the port then things go boom (specifically, on my
+system, some sort of exception hit that caused the system to reboot
+itself w/ no error messages).
+
+Let's cleanup / refactor the init so that we always run the same init
+code regardless of whether we're using the console.
+
+To make this work, we make rely on qcom_geni_serial_pm doing its job
+to turn resources on.
+
+For the record, here is a trace of the order of things (after this
+patch) when console= is specified on the command line and we have an
+agetty on the port:
+ qcom_geni_serial_pm: 4 (undefined) => 0 (on)
+ qcom_geni_console_setup
+ qcom_geni_serial_port_setup
+ qcom_geni_serial_console_write
+ qcom_geni_serial_startup
+ qcom_geni_serial_start_tx
+
+...and here is the order of things (after this patch) when console= is
+_NOT_ specified on the command line and we have an agetty port:
+ qcom_geni_serial_pm: 4 => 0
+ qcom_geni_serial_pm: 0 => 3
+ qcom_geni_serial_pm: 3 => 0
+ qcom_geni_serial_startup
+ qcom_geni_serial_port_setup
+ qcom_geni_serial_pm: 0 => 3
+ qcom_geni_serial_pm: 3 => 0
+ qcom_geni_serial_startup
+ qcom_geni_serial_start_tx
+
+Fixes: c4f528795d1a ("tty: serial: msm_geni_serial: Add serial driver support for GENI based QUP")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 55 +++++++++++++--------------
+ 1 file changed, 26 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 5b96df4ad5b30..69b980bb8ac29 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -851,6 +851,23 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+ unsigned int rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT;
++ u32 proto;
++
++ if (uart_console(uport))
++ port->tx_bytes_pw = 1;
++ else
++ port->tx_bytes_pw = 4;
++ port->rx_bytes_pw = RX_BYTES_PW;
++
++ proto = geni_se_read_proto(&port->se);
++ if (proto != GENI_SE_UART) {
++ dev_err(uport->dev, "Invalid FW loaded, proto: %d\n", proto);
++ return -ENXIO;
++ }
++
++ qcom_geni_serial_stop_rx(uport);
++
++ get_tx_fifo_size(port);
+
+ set_rfr_wm(port);
+ writel_relaxed(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
+@@ -874,30 +891,19 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+ return -ENOMEM;
+ }
+ port->setup = true;
++
+ return 0;
+ }
+
+ static int qcom_geni_serial_startup(struct uart_port *uport)
+ {
+ int ret;
+- u32 proto;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
+ scnprintf(port->name, sizeof(port->name),
+ "qcom_serial_%s%d",
+ (uart_console(uport) ? "console" : "uart"), uport->line);
+
+- if (!uart_console(uport)) {
+- port->tx_bytes_pw = 4;
+- port->rx_bytes_pw = RX_BYTES_PW;
+- }
+- proto = geni_se_read_proto(&port->se);
+- if (proto != GENI_SE_UART) {
+- dev_err(uport->dev, "Invalid FW loaded, proto: %d\n", proto);
+- return -ENXIO;
+- }
+-
+- get_tx_fifo_size(port);
+ if (!port->setup) {
+ ret = qcom_geni_serial_port_setup(uport);
+ if (ret)
+@@ -1056,6 +1062,7 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
+ int bits = 8;
+ int parity = 'n';
+ int flow = 'n';
++ int ret;
+
+ if (co->index >= GENI_UART_CONS_PORTS || co->index < 0)
+ return -ENXIO;
+@@ -1071,21 +1078,10 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
+ if (unlikely(!uport->membase))
+ return -ENXIO;
+
+- if (geni_se_resources_on(&port->se)) {
+- dev_err(port->se.dev, "Error turning on resources\n");
+- return -ENXIO;
+- }
+-
+- if (unlikely(geni_se_read_proto(&port->se) != GENI_SE_UART)) {
+- geni_se_resources_off(&port->se);
+- return -ENXIO;
+- }
+-
+ if (!port->setup) {
+- port->tx_bytes_pw = 1;
+- port->rx_bytes_pw = RX_BYTES_PW;
+- qcom_geni_serial_stop_rx(uport);
+- qcom_geni_serial_port_setup(uport);
++ ret = qcom_geni_serial_port_setup(uport);
++ if (ret)
++ return ret;
+ }
+
+ if (options)
+@@ -1203,11 +1199,12 @@ static void qcom_geni_serial_pm(struct uart_port *uport,
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
++ /* If we've never been called, treat it as off */
++ if (old_state == UART_PM_STATE_UNDEFINED)
++ old_state = UART_PM_STATE_OFF;
++
+ if (new_state == UART_PM_STATE_ON && old_state == UART_PM_STATE_OFF)
+ geni_se_resources_on(&port->se);
+- else if (!uart_console(uport) && (new_state == UART_PM_STATE_ON &&
+- old_state == UART_PM_STATE_UNDEFINED))
+- geni_se_resources_on(&port->se);
+ else if (new_state == UART_PM_STATE_OFF &&
+ old_state == UART_PM_STATE_ON)
+ geni_se_resources_off(&port->se);
+--
+2.20.1
+
--- /dev/null
+From df7f23a55ce71fb4de4f2c6c52cafc9575240dbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 15:46:17 +0200
+Subject: udf: Fix crash during mount
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit b085fbe2ef7fa7489903c45271ae7b7a52b0f9ab ]
+
+Fix a crash during an attempt to mount a filesystem that has both
+Unallocated Space Table and Unallocated Space Bitmap. Such filesystem
+actually violates the UDF standard so we just have to properly detect
+such situation and refuse to mount such filesystem read-write. When we
+are at it, verify also other constraints on the allocation information
+mandated by the standard.
+
+Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 60 insertions(+), 5 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index c495db7165aee..7af011dc9ae8a 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -989,12 +989,62 @@ static struct udf_bitmap *udf_sb_alloc_bitmap(struct super_block *sb, u32 index)
+ return bitmap;
+ }
+
++static int check_partition_desc(struct super_block *sb,
++ struct partitionDesc *p,
++ struct udf_part_map *map)
++{
++ bool umap, utable, fmap, ftable;
++ struct partitionHeaderDesc *phd;
++
++ switch (le32_to_cpu(p->accessType)) {
++ case PD_ACCESS_TYPE_READ_ONLY:
++ case PD_ACCESS_TYPE_WRITE_ONCE:
++ case PD_ACCESS_TYPE_REWRITABLE:
++ case PD_ACCESS_TYPE_NONE:
++ goto force_ro;
++ }
++
++ /* No Partition Header Descriptor? */
++ if (strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR02) &&
++ strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR03))
++ goto force_ro;
++
++ phd = (struct partitionHeaderDesc *)p->partitionContentsUse;
++ utable = phd->unallocSpaceTable.extLength;
++ umap = phd->unallocSpaceBitmap.extLength;
++ ftable = phd->freedSpaceTable.extLength;
++ fmap = phd->freedSpaceBitmap.extLength;
++
++ /* No allocation info? */
++ if (!utable && !umap && !ftable && !fmap)
++ goto force_ro;
++
++ /* We don't support blocks that require erasing before overwrite */
++ if (ftable || fmap)
++ goto force_ro;
++ /* UDF 2.60: 2.3.3 - no mixing of tables & bitmaps, no VAT. */
++ if (utable && umap)
++ goto force_ro;
++
++ if (map->s_partition_type == UDF_VIRTUAL_MAP15 ||
++ map->s_partition_type == UDF_VIRTUAL_MAP20)
++ goto force_ro;
++
++ return 0;
++force_ro:
++ if (!sb_rdonly(sb))
++ return -EACCES;
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
++ return 0;
++}
++
+ static int udf_fill_partdesc_info(struct super_block *sb,
+ struct partitionDesc *p, int p_index)
+ {
+ struct udf_part_map *map;
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct partitionHeaderDesc *phd;
++ int err;
+
+ map = &sbi->s_partmaps[p_index];
+
+@@ -1014,8 +1064,16 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ p_index, map->s_partition_type,
+ map->s_partition_root, map->s_partition_len);
+
+- if (strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR02) &&
+- strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR03))
++ err = check_partition_desc(sb, p, map);
++ if (err)
++ return err;
++
++ /*
++ * Skip loading allocation info it we cannot ever write to the fs.
++ * This is a correctness thing as we may have decided to force ro mount
++ * to avoid allocation info we don't support.
++ */
++ if (UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT))
+ return 0;
+
+ phd = (struct partitionHeaderDesc *)p->partitionContentsUse;
+@@ -1051,9 +1109,6 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ p_index, bitmap->s_extPosition);
+ }
+
+- if (phd->partitionIntegrityTable.extLength)
+- udf_debug("partitionIntegrityTable (part %d)\n", p_index);
+-
+ if (phd->freedSpaceTable.extLength) {
+ struct kernel_lb_addr loc = {
+ .logicalBlockNum = le32_to_cpu(
+--
+2.20.1
+
--- /dev/null
+From 592d5b17e606b05aee5c02e7a7fcd025c8008245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 17:18:58 +0200
+Subject: usb: chipidea: Fix otg event handler
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ]
+
+At OTG work running time, it's possible that several events need to be
+addressed (e.g. ID and VBUS events). The current implementation handles
+only one event at a time which leads to ignoring the other one. Fix it.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/otg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index db4ceffcf2a61..f25d4827fd49c 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -203,14 +203,17 @@ static void ci_otg_work(struct work_struct *work)
+ }
+
+ pm_runtime_get_sync(ci->dev);
++
+ if (ci->id_event) {
+ ci->id_event = false;
+ ci_handle_id_switch(ci);
+- } else if (ci->b_sess_valid_event) {
++ }
++
++ if (ci->b_sess_valid_event) {
+ ci->b_sess_valid_event = false;
+ ci_handle_vbus_change(ci);
+- } else
+- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__);
++ }
++
+ pm_runtime_put_sync(ci->dev);
+
+ enable_irq(ci->irq);
+--
+2.20.1
+
--- /dev/null
+From 465d6433505f4cdaec358f16e6fc86814baeeb8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:59:56 +0200
+Subject: usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is
+ already started
+
+From: Nicolas Adell <nicolas.adell@actia.fr>
+
+[ Upstream commit 1dedbdf2bbb1ede8d96f35f9845ecae179dc1988 ]
+
+When initializing the USB subsystem before starting the kernel,
+OTG overcurrent detection is disabled. In case the OTG polarity of
+overcurrent is low active, the overcurrent detection is never enabled
+again and events cannot be reported as expected. Because imx usb
+overcurrent polarity is low active by default, only detection needs
+to be enable in usbmisc init function.
+
+Signed-off-by: Nicolas Adell <nicolas.adell@actia.fr>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/usbmisc_imx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index 34ad5bf8acd8d..424ecb1f003fe 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -343,6 +343,8 @@ static int usbmisc_imx6q_init(struct imx_usbmisc_data *data)
+ } else if (data->oc_polarity == 1) {
+ /* High active */
+ reg &= ~(MX6_BM_OVER_CUR_DIS | MX6_BM_OVER_CUR_POLARITY);
++ } else {
++ reg &= ~(MX6_BM_OVER_CUR_DIS);
+ }
+ writel(reg, usbmisc->base + data->index * 4);
+
+--
+2.20.1
+
--- /dev/null
+From 7d29ef6f0120ed802f1e35f7d2a8010e7dca0290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 00:14:00 +0300
+Subject: usb: gadget: uvc: configfs: Drop leaked references to config items
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ]
+
+Some of the .allow_link() and .drop_link() operations implementations
+call config_group_find_item() and then leak the reference to the
+returned item. Fix this by dropping those references where needed.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index b51f0d2788269..dc4edba95a478 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -544,6 +544,7 @@ static int uvcg_control_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -579,6 +580,7 @@ static void uvcg_control_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+@@ -2038,6 +2040,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2078,6 +2081,7 @@ static void uvcg_streaming_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ff854a3c75a3251cf5123a67f524fa1712310fbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 21:02:12 +0200
+Subject: usb: gadget: uvc: configfs: Prevent format changes after linking
+ header
+
+From: Joel Pepper <joel.pepper@rwth-aachen.de>
+
+[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ]
+
+While checks are in place to avoid attributes and children of a format
+being manipulated after the format is linked into the streaming header,
+the linked flag was never actually set, invalidating the protections.
+Update the flag as appropriate in the header link calls.
+
+Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index dc4edba95a478..9478a7cdb1433 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -766,6 +766,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src,
+ format_ptr->fmt = target_fmt;
+ list_add_tail(&format_ptr->entry, &src_hdr->formats);
+ ++src_hdr->num_fmt;
++ ++target_fmt->linked;
+
+ out:
+ mutex_unlock(&opts->lock);
+@@ -803,6 +804,8 @@ static void uvcg_streaming_header_drop_link(struct config_item *src,
+ break;
+ }
+
++ --target_fmt->linked;
++
+ out:
+ mutex_unlock(&opts->lock);
+ mutex_unlock(su_mutex);
+--
+2.20.1
+
--- /dev/null
+From 8ac8e5b604be4c8691bbe259f0410fe5dd50df90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Sep 2018 19:46:03 -0400
+Subject: usb: gadget: uvc: configfs: Sort frame intervals upon writing
+
+From: Paul Elder <paul.elder@ideasonboard.com>
+
+[ Upstream commit 89969a842e72b1b653140a4bbddd927b242736d0 ]
+
+There is an issue where the host is unable to tell the gadget what frame
+rate it wants if the dwFrameIntervals in the interface descriptors are
+not in ascending order. This means that when instantiating a uvc gadget
+via configfs the user must make sure the dwFrameIntervals are in
+ascending order.
+
+Instead of silently failing the breaking of this rule, we sort the
+dwFrameIntervals upon writing to configfs.
+
+Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index 9478a7cdb1433..2e4c0391b5836 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -9,6 +9,9 @@
+ *
+ * Author: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+ */
++
++#include <linux/sort.h>
++
+ #include "u_uvc.h"
+ #include "uvc_configfs.h"
+
+@@ -31,6 +34,14 @@ static struct configfs_attribute prefix##attr_##cname = { \
+ .show = prefix##cname##_show, \
+ }
+
++static int uvcg_config_compare_u32(const void *l, const void *r)
++{
++ u32 li = *(const u32 *)l;
++ u32 ri = *(const u32 *)r;
++
++ return li < ri ? -1 : li == ri ? 0 : 1;
++}
++
+ static inline struct f_uvc_opts *to_f_uvc_opts(struct config_item *item)
+ {
+ return container_of(to_config_group(item), struct f_uvc_opts,
+@@ -1134,6 +1145,8 @@ static ssize_t uvcg_frame_dw_frame_interval_store(struct config_item *item,
+ kfree(ch->dw_frame_interval);
+ ch->dw_frame_interval = frm_intrv;
+ ch->frame.b_frame_interval_type = n;
++ sort(ch->dw_frame_interval, n, sizeof(*ch->dw_frame_interval),
++ uvcg_config_compare_u32, NULL);
+ ret = len;
+
+ end:
+--
+2.20.1
+
--- /dev/null
+From 8035bc092ec20901641d69bd3e73e7b37548f888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:42:03 +0300
+Subject: usb: gadget: uvc: Factor out video USB request queueing
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ]
+
+USB requests for video data are queued from two different locations in
+the driver, with the same code block occurring twice. Factor it out to a
+function.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index d3567b90343a4..a95c8e2364edc 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -125,6 +125,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
+ * Request handling
+ */
+
++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
++{
++ int ret;
++
++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ if (ret < 0) {
++ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
++ usb_ep_set_halt(video->ep);
++ }
++
++ return ret;
++}
++
+ /*
+ * I somehow feel that synchronisation won't be easy to achieve here. We have
+ * three events that control USB requests submission:
+@@ -189,14 +202,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+
+ video->encode(req, video, buf);
+
+- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) {
+- printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(ep);
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&video->queue.irqlock, flags);
++
++ if (ret < 0) {
+ uvcg_queue_cancel(queue, 0);
+ goto requeue;
+ }
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
+
+ return;
+
+@@ -316,15 +328,13 @@ int uvcg_video_pump(struct uvc_video *video)
+ video->encode(req, video, buf);
+
+ /* Queue the USB request */
+- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&queue->irqlock, flags);
++
+ if (ret < 0) {
+- printk(KERN_INFO "Failed to queue request (%d)\n", ret);
+- usb_ep_set_halt(video->ep);
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ uvcg_queue_cancel(queue, 0);
+ break;
+ }
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ }
+
+ spin_lock_irqsave(&video->req_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 27c569721ab26d617b5d6b36c9ef37c0d4055888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:44:57 +0300
+Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ]
+
+When USB requests for video data fail to be submitted, the driver
+signals a problem to the host by halting the video streaming endpoint.
+This is only valid in bulk mode, as isochronous transfers have no
+handshake phase and can't thus report a stall. The usb_ep_set_halt()
+call returns an error when using isochronous endpoints, which we happily
+ignore, but some UDCs complain in the kernel log. Fix this by only
+trying to halt the endpoint in bulk mode.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index a95c8e2364edc..2c9821ec836e7 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -132,7 +132,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
+ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
+ if (ret < 0) {
+ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(video->ep);
++ /* Isochronous endpoints can't be halted. */
++ if (usb_endpoint_xfer_bulk(video->ep->desc))
++ usb_ep_set_halt(video->ep);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 7ad22a92186d9f8efdc6a689291bc24ec6c6cb92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 10:36:50 +0800
+Subject: usb: mtu3: disable vbus rise/fall interrupts of ltssm
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 0eae49582b4dee1a0e96007e1dea5122db98371a ]
+
+The vbus rise & fall interrupts are used to enable and disable
+U3 function of device automatically, this cause some issues when
+class driver is initialized as deactivated, and will skip over
+software-controlled connect by pullup(), but UDC wants to keep
+disconnect until usb_gadget_activate() is called which calls
+pullup() if needed. So we disable vbus rise & fall interrupts
+and just use pullup() to enable & disable U3 function, and reset
+mtu3 state when disconnect instead when vbus fall.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_core.c | 4 ++--
+ drivers/usb/mtu3/mtu3_gadget.c | 22 ++++++++++++++--------
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index 48d10a61e271c..8606935201326 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -185,8 +185,8 @@ static void mtu3_intr_enable(struct mtu3 *mtu)
+
+ if (mtu->is_u3_ip) {
+ /* Enable U3 LTSSM interrupts */
+- value = HOT_RST_INTR | WARM_RST_INTR | VBUS_RISE_INTR |
+- VBUS_FALL_INTR | ENTER_U3_INTR | EXIT_U3_INTR;
++ value = HOT_RST_INTR | WARM_RST_INTR |
++ ENTER_U3_INTR | EXIT_U3_INTR;
+ mtu3_writel(mbase, U3D_LTSSM_INTR_ENABLE, value);
+ }
+
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index 5c60a8c5a0b5c..bbcd3332471dc 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -585,6 +585,17 @@ static const struct usb_gadget_ops mtu3_gadget_ops = {
+ .udc_stop = mtu3_gadget_stop,
+ };
+
++static void mtu3_state_reset(struct mtu3 *mtu)
++{
++ mtu->address = 0;
++ mtu->ep0_state = MU3D_EP0_STATE_SETUP;
++ mtu->may_wakeup = 0;
++ mtu->u1_enable = 0;
++ mtu->u2_enable = 0;
++ mtu->delayed_status = false;
++ mtu->test_mode = false;
++}
++
+ static void init_hw_ep(struct mtu3 *mtu, struct mtu3_ep *mep,
+ u32 epnum, u32 is_in)
+ {
+@@ -702,6 +713,7 @@ void mtu3_gadget_disconnect(struct mtu3 *mtu)
+ spin_lock(&mtu->lock);
+ }
+
++ mtu3_state_reset(mtu);
+ usb_gadget_set_state(&mtu->g, USB_STATE_NOTATTACHED);
+ }
+
+@@ -712,12 +724,6 @@ void mtu3_gadget_reset(struct mtu3 *mtu)
+ /* report disconnect, if we didn't flush EP state */
+ if (mtu->g.speed != USB_SPEED_UNKNOWN)
+ mtu3_gadget_disconnect(mtu);
+-
+- mtu->address = 0;
+- mtu->ep0_state = MU3D_EP0_STATE_SETUP;
+- mtu->may_wakeup = 0;
+- mtu->u1_enable = 0;
+- mtu->u2_enable = 0;
+- mtu->delayed_status = false;
+- mtu->test_mode = false;
++ else
++ mtu3_state_reset(mtu);
+ }
+--
+2.20.1
+
--- /dev/null
+From bb06fadc8223df7d18f9c3b355a824b05873b230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 10:51:05 +0200
+Subject: usb: usbtmc: Fix ioctl USBTMC_IOCTL_ABORT_BULK_OUT
+
+From: Guido Kiener <guido@kiener-muenchen.de>
+
+[ Upstream commit 0e59088e7ff7aeda49dedadbf0e967761b909ad8 ]
+
+Add parameter 'tag' to function usbtmc_ioctl_abort_bulk_out_tag()
+for future versions.
+
+Use USBTMC_BUFSIZE (4k) instead of USBTMC_SIZE_IOBUFFER (2k).
+Using USBTMC_SIZE_IOBUFFER is deprecated.
+
+Insert a sleep of 50 ms between subsequent
+CHECK_ABORT_BULK_OUT_STATUS control requests to avoid stressing
+the instrument with repeated requests.
+
+Use common macro USB_CTRL_GET_TIMEOUT instead of USBTMC_TIMEOUT.
+
+Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com>
+Reviewed-by: Steve Bayless <steve_bayless@keysight.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/usbtmc.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 83ffa5a14c3db..3ce45c9e9d20d 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -342,7 +342,8 @@ exit:
+
+ }
+
+-static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
++static int usbtmc_ioctl_abort_bulk_out_tag(struct usbtmc_device_data *data,
++ u8 tag)
+ {
+ struct device *dev;
+ u8 *buffer;
+@@ -359,8 +360,8 @@ static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
+ usb_rcvctrlpipe(data->usb_dev, 0),
+ USBTMC_REQUEST_INITIATE_ABORT_BULK_OUT,
+ USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
+- data->bTag_last_write, data->bulk_out,
+- buffer, 2, USBTMC_TIMEOUT);
++ tag, data->bulk_out,
++ buffer, 2, USB_CTRL_GET_TIMEOUT);
+
+ if (rv < 0) {
+ dev_err(dev, "usb_control_msg returned %d\n", rv);
+@@ -379,12 +380,14 @@ static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
+ n = 0;
+
+ usbtmc_abort_bulk_out_check_status:
++ /* do not stress device with subsequent requests */
++ msleep(50);
+ rv = usb_control_msg(data->usb_dev,
+ usb_rcvctrlpipe(data->usb_dev, 0),
+ USBTMC_REQUEST_CHECK_ABORT_BULK_OUT_STATUS,
+ USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
+ 0, data->bulk_out, buffer, 0x08,
+- USBTMC_TIMEOUT);
++ USB_CTRL_GET_TIMEOUT);
+ n++;
+ if (rv < 0) {
+ dev_err(dev, "usb_control_msg returned %d\n", rv);
+@@ -418,6 +421,11 @@ exit:
+ return rv;
+ }
+
++static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
++{
++ return usbtmc_ioctl_abort_bulk_out_tag(data, data->bTag_last_write);
++}
++
+ static int usbtmc488_ioctl_read_stb(struct usbtmc_file_data *file_data,
+ void __user *arg)
+ {
+--
+2.20.1
+
--- /dev/null
+From 3c10785dbf075721a7b87e9c27ea94502dda8a1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 01:30:31 +0200
+Subject: usb: usbtmc: uninitialized symbol 'actual' in usbtmc_ioctl_clear
+
+From: Guido Kiener <guido.kiener@rohde-schwarz.com>
+
+[ Upstream commit 9a83190300867fb024d53f47c31088e34188efc1 ]
+
+Fix uninitialized symbol 'actual' in function usbtmc_ioctl_clear.
+
+When symbol 'actual' is not initialized and usb_bulk_msg() fails,
+the subsequent kernel debug message shows a random value.
+
+Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com>
+Fixes: dfee02ac4bce ("usb: usbtmc: Fix ioctl USBTMC_IOCTL_CLEAR")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/usbtmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 3ce45c9e9d20d..e6a7c86b70f25 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -1016,6 +1016,7 @@ usbtmc_clear_check_status:
+ do {
+ dev_dbg(dev, "Reading from bulk in EP\n");
+
++ actual = 0;
+ rv = usb_bulk_msg(data->usb_dev,
+ usb_rcvbulkpipe(data->usb_dev,
+ data->bulk_in),
+--
+2.20.1
+
--- /dev/null
+From 9bbf8d4c55eaf34afaea2f5d91f052efd9918bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 19:13:32 +0300
+Subject: usb: xhci-mtk: fix ISOC error when interval is zero
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 87173acc0d8f0987bda8827da35fff67f52ad15d ]
+
+If the interval equal zero, needn't round up to power of two
+for the number of packets in each ESIT, so fix it.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mtk-sch.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index fa33d6e5b1cbd..d04fdd173ed2e 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -113,7 +113,9 @@ static void setup_sch_info(struct usb_device *udev,
+ }
+
+ if (ep_type == ISOC_IN_EP || ep_type == ISOC_OUT_EP) {
+- if (esit_pkts <= sch_ep->esit)
++ if (sch_ep->esit == 1)
++ sch_ep->pkts = esit_pkts;
++ else if (esit_pkts <= sch_ep->esit)
+ sch_ep->pkts = 1;
+ else
+ sch_ep->pkts = roundup_pow_of_two(esit_pkts)
+--
+2.20.1
+
--- /dev/null
+From 212df41e5f0221ac29ba2c066ab2bd640c14660a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len
+
+From: Li Qiang <liq3ea@gmail.com>
+
+[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ]
+
+Free allocated vdev->msi_perm in error path.
+
+Signed-off-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 115a36f6f4039..62023b4a373b4 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
+ return -ENOMEM;
+
+ ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
+- if (ret)
++ if (ret) {
++ kfree(vdev->msi_perm);
+ return ret;
++ }
+
+ return len;
+ }
+--
+2.20.1
+
--- /dev/null
+From 6e80d675a8926307ac36ee6faf395f365a95513a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Mask buggy SR-IOV VF INTx support
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit db04264fe9bc0f2b62e036629f9afb530324b693 ]
+
+The SR-IOV spec requires that VFs must report zero for the INTx pin
+register as VFs are precluded from INTx support. It's much easier for
+the host kernel to understand whether a device is a VF and therefore
+whether a non-zero pin register value is bogus than it is to do the
+same in userspace. Override the INTx count for such devices and
+virtualize the pin register to provide a consistent view of the device
+to the user.
+
+As this is clearly a spec violation, warn about it to support hardware
+validation, but also provide a known whitelist as it doesn't do much
+good to continue complaining if the hardware vendor doesn't plan to
+fix it.
+
+Known devices with this issue: 8086:270c
+
+Tested-by: Gage Eads <gage.eads@intel.com>
+Reviewed-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 8 ++++++--
+ drivers/vfio/pci/vfio_pci_config.c | 27 +++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a92c2868d9021..0a6eb53e79fbf 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -443,10 +443,14 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type)
+ {
+ if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) {
+ u8 pin;
++
++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) ||
++ vdev->nointx || vdev->pdev->is_virtfn)
++ return 0;
++
+ pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin);
+- if (IS_ENABLED(CONFIG_VFIO_PCI_INTX) && !vdev->nointx && pin)
+- return 1;
+
++ return pin ? 1 : 0;
+ } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) {
+ u8 pos;
+ u16 flags;
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 62023b4a373b4..423ea1f98441a 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1611,6 +1611,15 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
+ return 0;
+ }
+
++/*
++ * Nag about hardware bugs, hopefully to have vendors fix them, but at least
++ * to collect a list of dependencies for the VF INTx pin quirk below.
++ */
++static const struct pci_device_id known_bogus_vf_intx_pin[] = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x270c) },
++ {}
++};
++
+ /*
+ * For each device we allocate a pci_config_map that indicates the
+ * capability occupying each dword and thus the struct perm_bits we
+@@ -1676,6 +1685,24 @@ int vfio_config_init(struct vfio_pci_device *vdev)
+ if (pdev->is_virtfn) {
+ *(__le16 *)&vconfig[PCI_VENDOR_ID] = cpu_to_le16(pdev->vendor);
+ *(__le16 *)&vconfig[PCI_DEVICE_ID] = cpu_to_le16(pdev->device);
++
++ /*
++ * Per SR-IOV spec rev 1.1, 3.4.1.18 the interrupt pin register
++ * does not apply to VFs and VFs must implement this register
++ * as read-only with value zero. Userspace is not readily able
++ * to identify whether a device is a VF and thus that the pin
++ * definition on the device is bogus should it violate this
++ * requirement. We already virtualize the pin register for
++ * other purposes, so we simply need to replace the bogus value
++ * and consider VFs when we determine INTx IRQ count.
++ */
++ if (vconfig[PCI_INTERRUPT_PIN] &&
++ !pci_match_id(known_bogus_vf_intx_pin, pdev))
++ pci_warn(pdev,
++ "Hardware bug: VF reports bogus INTx pin %d\n",
++ vconfig[PCI_INTERRUPT_PIN]);
++
++ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */
+ }
+
+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx)
+--
+2.20.1
+
--- /dev/null
+From 24d910ea155929ebe62cdc5535d97c72eec2fa22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 09:10:16 -0700
+Subject: vmbus: keep pointer to ring buffer page
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 52a42c2a90226dc61c99bbd0cb096deeb52c334b ]
+
+Avoid going from struct page to virt address (and back) by just
+keeping pointer to the allocated pages instead of virt address.
+
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel.c | 20 +++++++++-----------
+ drivers/uio/uio_hv_generic.c | 5 +++--
+ include/linux/hyperv.h | 2 +-
+ 3 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index fdb0f832fadef..5e515533e9cdb 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -91,11 +91,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ unsigned long flags;
+ int ret, err = 0;
+ struct page *page;
++ unsigned int order;
+
+ if (send_ringbuffer_size % PAGE_SIZE ||
+ recv_ringbuffer_size % PAGE_SIZE)
+ return -EINVAL;
+
++ order = get_order(send_ringbuffer_size + recv_ringbuffer_size);
++
+ spin_lock_irqsave(&newchannel->lock, flags);
+ if (newchannel->state == CHANNEL_OPEN_STATE) {
+ newchannel->state = CHANNEL_OPENING_STATE;
+@@ -110,21 +113,17 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ /* Allocate the ring buffer */
+ page = alloc_pages_node(cpu_to_node(newchannel->target_cpu),
+- GFP_KERNEL|__GFP_ZERO,
+- get_order(send_ringbuffer_size +
+- recv_ringbuffer_size));
++ GFP_KERNEL|__GFP_ZERO, order);
+
+ if (!page)
+- page = alloc_pages(GFP_KERNEL|__GFP_ZERO,
+- get_order(send_ringbuffer_size +
+- recv_ringbuffer_size));
++ page = alloc_pages(GFP_KERNEL|__GFP_ZERO, order);
+
+ if (!page) {
+ err = -ENOMEM;
+ goto error_set_chnstate;
+ }
+
+- newchannel->ringbuffer_pages = page_address(page);
++ newchannel->ringbuffer_page = page;
+ newchannel->ringbuffer_pagecount = (send_ringbuffer_size +
+ recv_ringbuffer_size) >> PAGE_SHIFT;
+
+@@ -239,8 +238,7 @@ error_free_gpadl:
+ error_free_pages:
+ hv_ringbuffer_cleanup(&newchannel->outbound);
+ hv_ringbuffer_cleanup(&newchannel->inbound);
+- __free_pages(page,
+- get_order(send_ringbuffer_size + recv_ringbuffer_size));
++ __free_pages(page, order);
+ error_set_chnstate:
+ newchannel->state = CHANNEL_OPEN_STATE;
+ return err;
+@@ -666,8 +664,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ hv_ringbuffer_cleanup(&channel->outbound);
+ hv_ringbuffer_cleanup(&channel->inbound);
+
+- free_pages((unsigned long)channel->ringbuffer_pages,
+- get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
++ __free_pages(channel->ringbuffer_page,
++ get_order(channel->ringbuffer_pagecount << PAGE_SHIFT));
+
+ out:
+ return ret;
+diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
+index e401be8321ab5..170fa1f8f00e0 100644
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -131,11 +131,12 @@ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+ = container_of(kobj, struct vmbus_channel, kobj);
+ struct hv_device *dev = channel->primary_channel->device_obj;
+ u16 q_idx = channel->offermsg.offer.sub_channel_index;
++ void *ring_buffer = page_address(channel->ringbuffer_page);
+
+ dev_dbg(&dev->device, "mmap channel %u pages %#lx at %#lx\n",
+ q_idx, vma_pages(vma), vma->vm_pgoff);
+
+- return vm_iomap_memory(vma, virt_to_phys(channel->ringbuffer_pages),
++ return vm_iomap_memory(vma, virt_to_phys(ring_buffer),
+ channel->ringbuffer_pagecount << PAGE_SHIFT);
+ }
+
+@@ -224,7 +225,7 @@ hv_uio_probe(struct hv_device *dev,
+ /* mem resources */
+ pdata->info.mem[TXRX_RING_MAP].name = "txrx_rings";
+ pdata->info.mem[TXRX_RING_MAP].addr
+- = (uintptr_t)dev->channel->ringbuffer_pages;
++ = (uintptr_t)page_address(dev->channel->ringbuffer_page);
+ pdata->info.mem[TXRX_RING_MAP].size
+ = dev->channel->ringbuffer_pagecount << PAGE_SHIFT;
+ pdata->info.mem[TXRX_RING_MAP].memtype = UIO_MEM_LOGICAL;
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index bbde887ed3931..c43e694fef7dd 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -739,7 +739,7 @@ struct vmbus_channel {
+ u32 ringbuffer_gpadlhandle;
+
+ /* Allocated memory for ring buffer */
+- void *ringbuffer_pages;
++ struct page *ringbuffer_page;
+ u32 ringbuffer_pagecount;
+ struct hv_ring_buffer_info outbound; /* send to parent */
+ struct hv_ring_buffer_info inbound; /* receive from parent */
+--
+2.20.1
+
--- /dev/null
+From e108828b3c2ff032b0cfff28eae9687b2a61adb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 14:47:07 +0300
+Subject: wil6210: drop Rx multicast packets that are looped-back to STA
+
+From: Dedy Lansky <dlansky@codeaurora.org>
+
+[ Upstream commit 9a65064abdf82934e0ed4744125f9f466f421f57 ]
+
+Delivering a looped-back multicast packet to network stack can cause
+higher layer protocols to fail like for example IPv6 DAD.
+In STA mode, upon receiving Rx multicast packet, check if the source
+MAC address is equal to our own MAC address and if so drop the packet.
+
+Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/txrx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 1b1b58e0129a3..25a65ca424c84 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -766,7 +766,14 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+ return;
+ }
+
+- if (wdev->iftype == NL80211_IFTYPE_AP && !vif->ap_isolate) {
++ if (wdev->iftype == NL80211_IFTYPE_STATION) {
++ if (mcast && ether_addr_equal(eth->h_source, ndev->dev_addr)) {
++ /* mcast packet looped back to us */
++ rc = GRO_DROP;
++ dev_kfree_skb(skb);
++ goto stats;
++ }
++ } else if (wdev->iftype == NL80211_IFTYPE_AP && !vif->ap_isolate) {
+ if (mcast) {
+ /* send multicast frames both to higher layers in
+ * local net stack and back to the wireless medium
+--
+2.20.1
+
--- /dev/null
+From d00af64307a504a9e481e7046c7e5a6594707c8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 14:47:13 +0300
+Subject: wil6210: fix invalid memory access for rx_buff_mgmt debugfs
+
+From: Dedy Lansky <dlansky@codeaurora.org>
+
+[ Upstream commit 4405b632e3da839defec966e4b0be44d0c5e3102 ]
+
+Check rx_buff_mgmt is allocated before accessing its internal fields.
+
+Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/debugfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 51c3330bc316f..ceace95b1595c 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -1263,6 +1263,9 @@ static int wil_rx_buff_mgmt_debugfs_show(struct seq_file *s, void *data)
+ int num_active;
+ int num_free;
+
++ if (!rbm->buff_arr)
++ return -EINVAL;
++
+ seq_printf(s, " size = %zu\n", rbm->size);
+ seq_printf(s, " free_list_empty_cnt = %lu\n",
+ rbm->free_list_empty_cnt);
+--
+2.20.1
+
--- /dev/null
+From 46fbb33be649754f8f22850eece8f0bfaa9ba17a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 14:47:10 +0300
+Subject: wil6210: prevent usage of tx ring 0 for eDMA
+
+From: Maya Erez <merez@codeaurora.org>
+
+[ Upstream commit df2b53884a5a454bf441ca78e5b57307262c73f4 ]
+
+In enhanced DMA ring 0 is used for RX ring, hence TX ring 0
+is an unused element in ring_tx and ring2cid_tid arrays.
+Initialize ring2cid_tid CID to WIL6210_MAX_CID to prevent a false
+match of CID 0.
+Go over the ring_tx and ring2cid_tid from wil_get_min_tx_ring_id
+and on to prevent access to index 0 in eDMA.
+
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/main.c | 7 +++++--
+ drivers/net/wireless/ath/wil6210/txrx.c | 6 ++++--
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index d186b6886c6bf..920cb233f4db7 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -223,6 +223,7 @@ __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+ struct net_device *ndev = vif_to_ndev(vif);
+ struct wireless_dev *wdev = vif_to_wdev(vif);
+ struct wil_sta_info *sta = &wil->sta[cid];
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+ might_sleep();
+ wil_dbg_misc(wil, "disconnect_cid: CID %d, MID %d, status %d\n",
+@@ -273,7 +274,7 @@ __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+ memset(sta->tid_crypto_rx, 0, sizeof(sta->tid_crypto_rx));
+ memset(&sta->group_crypto_rx, 0, sizeof(sta->group_crypto_rx));
+ /* release vrings */
+- for (i = 0; i < ARRAY_SIZE(wil->ring_tx); i++) {
++ for (i = min_ring_id; i < ARRAY_SIZE(wil->ring_tx); i++) {
+ if (wil->ring2cid_tid[i][0] == cid)
+ wil_ring_fini_tx(wil, i);
+ }
+@@ -604,8 +605,10 @@ int wil_priv_init(struct wil6210_priv *wil)
+ wil->sta[i].mid = U8_MAX;
+ }
+
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++)
++ for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+ spin_lock_init(&wil->ring_tx_data[i].lock);
++ wil->ring2cid_tid[i][0] = WIL6210_MAX_CID;
++ }
+
+ mutex_init(&wil->mutex);
+ mutex_init(&wil->vif_mutex);
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 25a65ca424c84..73cdf54521f9b 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -77,8 +77,9 @@ bool wil_is_tx_idle(struct wil6210_priv *wil)
+ {
+ int i;
+ unsigned long data_comp_to;
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
++ for (i = min_ring_id; i < WIL6210_MAX_TX_RINGS; i++) {
+ struct wil_ring *vring = &wil->ring_tx[i];
+ int vring_index = vring - wil->ring_tx;
+ struct wil_ring_tx_data *txdata =
+@@ -1945,6 +1946,7 @@ static inline void __wil_update_net_queues(struct wil6210_priv *wil,
+ bool check_stop)
+ {
+ int i;
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+ if (unlikely(!vif))
+ return;
+@@ -1977,7 +1979,7 @@ static inline void __wil_update_net_queues(struct wil6210_priv *wil,
+ return;
+
+ /* check wake */
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
++ for (i = min_ring_id; i < WIL6210_MAX_TX_RINGS; i++) {
+ struct wil_ring *cur_ring = &wil->ring_tx[i];
+ struct wil_ring_tx_data *txdata = &wil->ring_tx_data[i];
+
+--
+2.20.1
+
--- /dev/null
+From 52fbe133cf7e0d5090dee68ab044ad5f0fb57e60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Aug 2018 14:47:08 +0300
+Subject: wil6210: set edma variables only for Talyn-MB devices
+
+From: Maya Erez <merez@codeaurora.org>
+
+[ Upstream commit 596bdbcce90fa93f43ebcb99cefea34bd2e27707 ]
+
+use_rx_hw_reordering is already set to true in wil_set_capabilities
+for Talyn-MB devices. Remove its setting from wil_priv_init to
+prevent its activation for older chips.
+Similarly, move the setting of use_compressed_rx_status to
+wil_set_capabilities.
+
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/main.c | 2 --
+ drivers/net/wireless/ath/wil6210/pcie_bus.c | 1 +
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index a0fe8cbad104f..d186b6886c6bf 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -653,8 +653,6 @@ int wil_priv_init(struct wil6210_priv *wil)
+
+ /* edma configuration can be updated via debugfs before allocation */
+ wil->num_rx_status_rings = WIL_DEFAULT_NUM_RX_STATUS_RINGS;
+- wil->use_compressed_rx_status = true;
+- wil->use_rx_hw_reordering = true;
+ wil->tx_status_ring_order = WIL_TX_SRING_SIZE_ORDER_DEFAULT;
+
+ /* Rx status ring size should be bigger than the number of RX buffers
+diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
+index 89119e7facd00..c8c6613371d1b 100644
+--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
++++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
+@@ -108,6 +108,7 @@ int wil_set_capabilities(struct wil6210_priv *wil)
+ set_bit(hw_capa_no_flash, wil->hw_capa);
+ wil->use_enhanced_dma_hw = true;
+ wil->use_rx_hw_reordering = true;
++ wil->use_compressed_rx_status = true;
+ wil_fw_name = ftm_mode ? WIL_FW_NAME_FTM_TALYN :
+ WIL_FW_NAME_TALYN;
+ if (wil_fw_verify_file_exists(wil, wil_fw_name))
+--
+2.20.1
+
--- /dev/null
+From bc3afdddf0f2ea65e10c7353468f2ec7aea12ef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:41 -0400
+Subject: x86/CPU: Change query logic so CPUID is enabled before testing
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 2893cc8ff892fa74972d8dc0e1d0dc65116daaa3 ]
+
+Presently we check first if CPUID is enabled. If it is not already
+enabled, then we next call identify_cpu_without_cpuid() and clear
+X86_FEATURE_CPUID.
+
+Unfortunately, identify_cpu_without_cpuid() is the function where CPUID
+becomes _enabled_ on Cyrix 6x86/6x86L CPUs.
+
+Reverse the calling sequence so that CPUID is first enabled, and then
+check a second time to see if the feature has now been activated.
+
+[ bp: Massage commit message and remove trailing whitespace. ]
+
+Suggested-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-3-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 1e07814f02bc6..a6458ab499c21 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1133,6 +1133,9 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ memset(&c->x86_capability, 0, sizeof c->x86_capability);
+ c->extended_cpuid_level = 0;
+
++ if (!have_cpuid_p())
++ identify_cpu_without_cpuid(c);
++
+ /* cyrix could have cpuid enabled via c_identify()*/
+ if (have_cpuid_p()) {
+ cpu_detect(c);
+@@ -1150,7 +1153,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ if (this_cpu->c_bsp_init)
+ this_cpu->c_bsp_init(c);
+ } else {
+- identify_cpu_without_cpuid(c);
+ setup_clear_cpu_cap(X86_FEATURE_CPUID);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8819c5a9c05c3973efc5c604daf2308075e76fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:40 -0400
+Subject: x86/CPU: Use correct macros for Cyrix calls
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ]
+
+There are comments in processor-cyrix.h advising you to _not_ make calls
+using the deprecated macros in this style:
+
+ setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
+
+This is because it expands the macro into a non-functioning calling
+sequence. The calling order must be:
+
+ outb(CX86_CCR2, 0x22);
+ inb(0x23);
+
+From the comments:
+
+ * When using the old macros a line like
+ * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+ * gets expanded to:
+ * do {
+ * outb((CX86_CCR2), 0x22);
+ * outb((({
+ * outb((CX86_CCR2), 0x22);
+ * inb(0x23);
+ * }) | 0x88), 0x23);
+ * } while (0);
+
+The new macros fix this problem, so use them instead.
+
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jia Zhang <qianyue.zj@alibaba-inc.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/cyrix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index fa61c870ada94..1d9b8aaea06c8 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -437,7 +437,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c)
+ /* enable MAPEN */
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);
+ /* enable cpuid */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80);
+ /* disable MAPEN */
+ setCx86(CX86_CCR3, ccr3);
+ local_irq_restore(flags);
+--
+2.20.1
+
--- /dev/null
+From b7f63c9b8f56601dc534284eb74bafa1650e52fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 22:29:50 +0000
+Subject: x86/hyperv: Suppress "PCI: Fatal: No config space access function
+ found"
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 2f285f46240d67060061d153786740d4df53cd78 ]
+
+A Generation-2 Linux VM on Hyper-V doesn't have the legacy PCI bus, and
+users always see the scary warning, which is actually harmless.
+
+Suppress it.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: KY Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: "devel@linuxdriverproject.org" <devel@linuxdriverproject.org>
+Cc: Olaf Aepfle <olaf@aepfle.de>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Cc: Marcelo Cerri <marcelo.cerri@canonical.com>
+Cc: Josh Poulson <jopoulso@microsoft.com>
+Link: https://lkml.kernel.org/r/ <KU1P153MB0166D977DC930996C4BF538ABF1D0@KU1P153MB0166.APCP153.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/hv_init.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 3fb8551552862..8a9cff1f129dc 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -17,6 +17,7 @@
+ *
+ */
+
++#include <linux/efi.h>
+ #include <linux/types.h>
+ #include <asm/apic.h>
+ #include <asm/desc.h>
+@@ -257,6 +258,22 @@ static int hv_cpu_die(unsigned int cpu)
+ return 0;
+ }
+
++static int __init hv_pci_init(void)
++{
++ int gen2vm = efi_enabled(EFI_BOOT);
++
++ /*
++ * For Generation-2 VM, we exit from pci_arch_init() by returning 0.
++ * The purpose is to suppress the harmless warning:
++ * "PCI: Fatal: No config space access function found"
++ */
++ if (gen2vm)
++ return 0;
++
++ /* For Generation-1 VM, we'll proceed in pci_arch_init(). */
++ return 1;
++}
++
+ /*
+ * This function is to be invoked early in the boot sequence after the
+ * hypervisor has been detected.
+@@ -333,6 +350,8 @@ void __init hyperv_init(void)
+
+ hv_apic_init();
+
++ x86_init.pci.arch_init = hv_pci_init;
++
+ /*
+ * Register Hyper-V specific clocksource.
+ */
+--
+2.20.1
+
--- /dev/null
+From aff78928d7d3bb9d465bdd870306473b1f03e3f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 11:22:12 +0200
+Subject: x86/mce-inject: Reset injection struct after injection
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 7401a633c34adc7aefd3edfec60074cb0475a3e8 ]
+
+Clear the MCE struct which is used for collecting the injection details
+after injection.
+
+Also, populate it with more details from the machine.
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20180905081954.10391-1-bp@alien8.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce-inject.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index ff1c00b695aed..1ceccc4a5472c 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -106,6 +106,9 @@ static void setup_inj_struct(struct mce *m)
+ memset(m, 0, sizeof(struct mce));
+
+ m->cpuvendor = boot_cpu_data.x86_vendor;
++ m->time = ktime_get_real_seconds();
++ m->cpuid = cpuid_eax(1);
++ m->microcode = boot_cpu_data.microcode;
+ }
+
+ /* Update fake mce registers on current CPU. */
+@@ -580,6 +583,9 @@ static int inj_bank_set(void *data, u64 val)
+ m->bank = val;
+ do_inject();
+
++ /* Reset injection struct */
++ setup_inj_struct(&i_mce);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 629eca0ad9f950fa00c823cd991db167dd140156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Aug 2018 15:18:20 +0200
+Subject: y2038: make do_gettimeofday() and get_seconds() inline
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 33e26418193f58d1895f2f968e1953b1caf8deb7 ]
+
+get_seconds() and do_gettimeofday() are only used by a few modules now any
+more (waiting for the respective patches to get accepted), and they are
+among the last holdouts of code that is not y2038 safe in the core kernel.
+
+Move the implementation into the timekeeping32.h header to clean up
+the core kernel and isolate the old interfaces further.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/timekeeping32.h | 15 +++++++++++++--
+ kernel/time/time.c | 15 +++++++++------
+ kernel/time/timekeeping.c | 24 ------------------------
+ 3 files changed, 22 insertions(+), 32 deletions(-)
+
+diff --git a/include/linux/timekeeping32.h b/include/linux/timekeeping32.h
+index 8762c2f45f8bf..479da36be8c82 100644
+--- a/include/linux/timekeeping32.h
++++ b/include/linux/timekeeping32.h
+@@ -6,8 +6,19 @@
+ * over time so we can remove the file here.
+ */
+
+-extern void do_gettimeofday(struct timeval *tv);
+-unsigned long get_seconds(void);
++static inline void do_gettimeofday(struct timeval *tv)
++{
++ struct timespec64 now;
++
++ ktime_get_real_ts64(&now);
++ tv->tv_sec = now.tv_sec;
++ tv->tv_usec = now.tv_nsec/1000;
++}
++
++static inline unsigned long get_seconds(void)
++{
++ return ktime_get_real_seconds();
++}
+
+ static inline struct timespec current_kernel_time(void)
+ {
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index be057d6579f13..f7d4fa5ddb9e2 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -144,9 +144,11 @@ SYSCALL_DEFINE2(gettimeofday, struct timeval __user *, tv,
+ struct timezone __user *, tz)
+ {
+ if (likely(tv != NULL)) {
+- struct timeval ktv;
+- do_gettimeofday(&ktv);
+- if (copy_to_user(tv, &ktv, sizeof(ktv)))
++ struct timespec64 ts;
++
++ ktime_get_real_ts64(&ts);
++ if (put_user(ts.tv_sec, &tv->tv_sec) ||
++ put_user(ts.tv_nsec / 1000, &tv->tv_usec))
+ return -EFAULT;
+ }
+ if (unlikely(tz != NULL)) {
+@@ -227,10 +229,11 @@ COMPAT_SYSCALL_DEFINE2(gettimeofday, struct compat_timeval __user *, tv,
+ struct timezone __user *, tz)
+ {
+ if (tv) {
+- struct timeval ktv;
++ struct timespec64 ts;
+
+- do_gettimeofday(&ktv);
+- if (compat_put_timeval(&ktv, tv))
++ ktime_get_real_ts64(&ts);
++ if (put_user(ts.tv_sec, &tv->tv_sec) ||
++ put_user(ts.tv_nsec / 1000, &tv->tv_usec))
+ return -EFAULT;
+ }
+ if (tz) {
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index c2708e1f0c69f..81ee5b83c9200 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1214,22 +1214,6 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ }
+ EXPORT_SYMBOL_GPL(get_device_system_crosststamp);
+
+-/**
+- * do_gettimeofday - Returns the time of day in a timeval
+- * @tv: pointer to the timeval to be set
+- *
+- * NOTE: Users should be converted to using getnstimeofday()
+- */
+-void do_gettimeofday(struct timeval *tv)
+-{
+- struct timespec64 now;
+-
+- getnstimeofday64(&now);
+- tv->tv_sec = now.tv_sec;
+- tv->tv_usec = now.tv_nsec/1000;
+-}
+-EXPORT_SYMBOL(do_gettimeofday);
+-
+ /**
+ * do_settimeofday64 - Sets the time of day.
+ * @ts: pointer to the timespec64 variable containing the new time
+@@ -2177,14 +2161,6 @@ void getboottime64(struct timespec64 *ts)
+ }
+ EXPORT_SYMBOL_GPL(getboottime64);
+
+-unsigned long get_seconds(void)
+-{
+- struct timekeeper *tk = &tk_core.timekeeper;
+-
+- return tk->xtime_sec;
+-}
+-EXPORT_SYMBOL(get_seconds);
+-
+ void ktime_get_coarse_real_ts64(struct timespec64 *ts)
+ {
+ struct timekeeper *tk = &tk_core.timekeeper;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
