--- /dev/null
+From c4843be46aee68b819009209ca0ce03acd98a852 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Sat, 20 Oct 2018 00:57:57 +0100
+Subject: afs: Handle EIO from delivery function
+
+[ Upstream commit 4ac15ea53622272c01954461b4814892b7481b40 ]
+
+Fix afs_deliver_to_call() to handle -EIO being returned by the operation
+delivery function, indicating that the call found itself in the wrong
+state, by printing an error and aborting the call.
+
+Currently, an assertion failure will occur. This can happen, say, if the
+delivery function falls off the end without calling afs_extract_data() with
+the want_more parameter set to false to collect the end of the Rx phase of
+a call.
+
+The assertion failure looks like:
+
+ AFS: Assertion failed
+ 4 == 7 is false
+ 0x4 == 0x7 is false
+ ------------[ cut here ]------------
+ kernel BUG at fs/afs/rxrpc.c:462!
+
+and is matched in the trace buffer by a line like:
+
+kworker/7:3-3226 [007] ...1 85158.030203: afs_io_error: c=0003be0c r=-5 CM_REPLY
+
+Fixes: 98bf40cd99fc ("afs: Protect call->state changes against signals")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/rxrpc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 77a83790a31f..2543f24d23f8 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -500,7 +500,6 @@ static void afs_deliver_to_call(struct afs_call *call)
+ case -EINPROGRESS:
+ case -EAGAIN:
+ goto out;
+- case -EIO:
+ case -ECONNABORTED:
+ ASSERTCMP(state, ==, AFS_CALL_COMPLETE);
+ goto done;
+@@ -509,6 +508,10 @@ static void afs_deliver_to_call(struct afs_call *call)
+ rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+ abort_code, ret, "KIV");
+ goto local_abort;
++ case -EIO:
++ pr_err("kAFS: Call %u in bad state %u\n",
++ call->debug_id, state);
++ /* Fall through */
+ case -ENODATA:
+ case -EBADMSG:
+ case -EMSGSIZE:
+--
+2.17.1
+
--- /dev/null
+From 1c81663c63a3ff691e2388b53fa93279529a79ad Mon Sep 17 00:00:00 2001
+From: Zubin Mithra <zsm@chromium.org>
+Date: Thu, 27 Sep 2018 14:49:17 -0700
+Subject: apparmor: Fix uninitialized value in aa_split_fqname
+
+[ Upstream commit 250f2da49cb8e582215a65c03f50e8ddf5cd119c ]
+
+Syzkaller reported a OOB-read with the stacktrace below. This occurs
+inside __aa_lookupn_ns as `n` is not initialized. `n` is obtained from
+aa_splitn_fqname. In cases where `name` is invalid, aa_splitn_fqname
+returns without initializing `ns_name` and `ns_len`.
+
+Fix this by always initializing `ns_name` and `ns_len`.
+
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
+ print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
+ kasan_report_error mm/kasan/report.c:354 [inline]
+ kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
+ __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
+ memcmp+0xe3/0x160 lib/string.c:861
+ strnstr+0x4b/0x70 lib/string.c:934
+ __aa_lookupn_ns+0xc1/0x570 security/apparmor/policy_ns.c:209
+ aa_lookupn_ns+0x88/0x1e0 security/apparmor/policy_ns.c:240
+ aa_fqlookupn_profile+0x1b9/0x1010 security/apparmor/policy.c:468
+ fqlookupn_profile+0x80/0xc0 security/apparmor/label.c:1844
+ aa_label_strn_parse+0xa3a/0x1230 security/apparmor/label.c:1908
+ aa_label_parse+0x42/0x50 security/apparmor/label.c:1943
+ aa_change_profile+0x513/0x3510 security/apparmor/domain.c:1362
+ apparmor_setprocattr+0xaa4/0x1150 security/apparmor/lsm.c:658
+ security_setprocattr+0x66/0xc0 security/security.c:1298
+ proc_pid_attr_write+0x301/0x540 fs/proc/base.c:2555
+ __vfs_write+0x119/0x9f0 fs/read_write.c:485
+ vfs_write+0x1fc/0x560 fs/read_write.c:549
+ ksys_write+0x101/0x260 fs/read_write.c:598
+ __do_sys_write fs/read_write.c:610 [inline]
+ __se_sys_write fs/read_write.c:607 [inline]
+ __x64_sys_write+0x73/0xb0 fs/read_write.c:607
+ do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: 3b0aaf5866bf ("apparmor: add lib fn to find the "split" for fqnames")
+Reported-by: syzbot+61e4b490d9d2da591b50@syzkaller.appspotmail.com
+Signed-off-by: Zubin Mithra <zsm@chromium.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/lib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
+index 974affe50531..76491e7f4177 100644
+--- a/security/apparmor/lib.c
++++ b/security/apparmor/lib.c
+@@ -90,10 +90,12 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
+ const char *end = fqname + n;
+ const char *name = skipn_spaces(fqname, n);
+
+- if (!name)
+- return NULL;
+ *ns_name = NULL;
+ *ns_len = 0;
++
++ if (!name)
++ return NULL;
++
+ if (name[0] == ':') {
+ char *split = strnchr(&name[1], end - &name[1], ':');
+ *ns_name = skipn_spaces(&name[1], end - &name[1]);
+--
+2.17.1
+
--- /dev/null
+From f6039c831038953257ec81f261ada35a2c8c23d3 Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Tue, 30 Oct 2018 20:02:30 -0500
+Subject: ARM: dts: fsl: Fix improperly quoted stdout-path values
+
+[ Upstream commit 1af6ab3bac8458fc2e92ad7bb97b62de4a1fddef ]
+
+A quoted label reference doesn't expand to the node path and is taken as
+a literal string. Dropping the quotes can fix this unless the baudrate
+string is appended in which case we have to use the alias.
+
+At least on VF610, the problem was masked by setting the console in
+bootargs. Use the alias syntax with baudrate parameter so we can drop
+setting the console in bootargs.
+
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-ppd.dts | 2 +-
+ arch/arm/boot/dts/vf610m4-colibri.dts | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index cdb90bee7b4a..f202396e3f2a 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -55,7 +55,7 @@
+ };
+
+ chosen {
+- stdout-path = "&uart1:115200n8";
++ stdout-path = "serial0:115200n8";
+ };
+
+ memory@70000000 {
+diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts
+index 41ec66a96990..ca6249558760 100644
+--- a/arch/arm/boot/dts/vf610m4-colibri.dts
++++ b/arch/arm/boot/dts/vf610m4-colibri.dts
+@@ -50,8 +50,8 @@
+ compatible = "fsl,vf610m4";
+
+ chosen {
+- bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw";
+- stdout-path = "&uart2";
++ bootargs = "clk_ignore_unused init=/linuxrc rw";
++ stdout-path = "serial2:115200";
+ };
+
+ memory@8c000000 {
+--
+2.17.1
+
--- /dev/null
+From 5b7e7844da7402e67d154b9e5734e5ac5536ab13 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Thu, 18 Oct 2018 13:26:13 +0200
+Subject: ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 438ad09af5581b7024850b5dbb6353c7f2f7d8a9 ]
+
+Fix the type of compatible string "fs,imx6sll-i2c" which should be
+"fsl,imx6sll-i2c".
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sll.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index 000e6136a9d6..3e6ffaf5f104 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -709,7 +709,7 @@
+ i2c1: i2c@21a0000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+- compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c";
++ compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c";
+ reg = <0x021a0000 0x4000>;
+ interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6SLL_CLK_I2C1>;
+--
+2.17.1
+
--- /dev/null
+From fd9da87bacf271b839f75e6dbf15a5e906968d75 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Thu, 18 Oct 2018 19:48:53 +0300
+Subject: arm64: dts: renesas: condor: switch from EtherAVB to GEther
+
+[ Upstream commit eab53fdfd60a84b0cc514d4f1f5d79226c76df01 ]
+
+The "official" Condor boards have always been wired to mount NFS via
+GEther, not EtherAVB -- the boards resoldered for EtherAVB were local
+to Cogent Embedded, so we've been having an unpleasant situation where
+a "normal" Condor board still can't mount NFS (unless an EtherAVB PHY
+extension board is plugged in). Switch from EtherAVB to GEther at last!
+
+Fixes: 8091788f3d38 ("arm64: dts: renesas: condor: add EtherAVB support")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/renesas/r8a77980-condor.dts | 47 ++++++++++---------
+ 1 file changed, 24 insertions(+), 23 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+index 9f25c407dfd7..e830b6162375 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+@@ -15,7 +15,7 @@
+
+ aliases {
+ serial0 = &scif0;
+- ethernet0 = &avb;
++ ethernet0 = &gether;
+ };
+
+ chosen {
+@@ -47,23 +47,6 @@
+ };
+ };
+
+-&avb {
+- pinctrl-0 = <&avb_pins>;
+- pinctrl-names = "default";
+-
+- phy-mode = "rgmii-id";
+- phy-handle = <&phy0>;
+- renesas,no-ether-link;
+- status = "okay";
+-
+- phy0: ethernet-phy@0 {
+- rxc-skew-ps = <1500>;
+- reg = <0>;
+- interrupt-parent = <&gpio1>;
+- interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
+- };
+-};
+-
+ &canfd {
+ pinctrl-0 = <&canfd0_pins>;
+ pinctrl-names = "default";
+@@ -82,6 +65,23 @@
+ clock-frequency = <32768>;
+ };
+
++&gether {
++ pinctrl-0 = <&gether_pins>;
++ pinctrl-names = "default";
++
++ phy-mode = "rgmii-id";
++ phy-handle = <&phy0>;
++ renesas,no-ether-link;
++ status = "okay";
++
++ phy0: ethernet-phy@0 {
++ rxc-skew-ps = <1500>;
++ reg = <0>;
++ interrupt-parent = <&gpio4>;
++ interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
++ };
++};
++
+ &i2c0 {
+ pinctrl-0 = <&i2c0_pins>;
+ pinctrl-names = "default";
+@@ -118,16 +118,17 @@
+ };
+
+ &pfc {
+- avb_pins: avb {
+- groups = "avb_mdio", "avb_rgmii";
+- function = "avb";
+- };
+-
+ canfd0_pins: canfd0 {
+ groups = "canfd0_data_a";
+ function = "canfd0";
+ };
+
++ gether_pins: gether {
++ groups = "gether_mdio_a", "gether_rgmii",
++ "gether_txcrefclk", "gether_txcrefclk_mega";
++ function = "gether";
++ };
++
+ i2c0_pins: i2c0 {
+ groups = "i2c0";
+ function = "i2c0";
+--
+2.17.1
+
--- /dev/null
+From 4a0979c371b6ad798ed681687881847059dfb2dc Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Fri, 28 Sep 2018 02:38:36 +0000
+Subject: arm64: dts: renesas: r8a7795: add missing dma-names on hscif2
+
+[ Upstream commit aab7a2414ba0d5c3d0571a90031b535adba7146a ]
+
+hscif2 has 4 dmas, but has only 2 dma-names.
+This patch add missing dma-names.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: e0f0bda79337701a ("arm64: dts: renesas: r8a7795: sort subnodes
+of the soc node")
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a7795.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+index fb9d08ad7659..c87eed77de2c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+@@ -662,7 +662,7 @@
+ clock-names = "fck", "brg_int", "scif_clk";
+ dmas = <&dmac1 0x35>, <&dmac1 0x34>,
+ <&dmac2 0x35>, <&dmac2 0x34>;
+- dma-names = "tx", "rx";
++ dma-names = "tx", "rx", "tx", "rx";
+ power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ resets = <&cpg 518>;
+ status = "disabled";
+--
+2.17.1
+
--- /dev/null
+From 3c42c37c1d007a773e2915983d23b295be702aad Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Tue, 30 Oct 2018 12:38:50 +0100
+Subject: arm64: kprobe: make page to RO mode when allocate it
+
+[ Upstream commit 966866892cf89d606544bca22d584ba2ef9ec208 ]
+
+Commit 1404d6f13e47 ("arm64: dump: Add checking for writable and exectuable pages")
+has successfully identified code that leaves a page with W+X
+permissions.
+
+[ 3.245140] arm64/mm: Found insecure W+X mapping at address (____ptrval____)/0xffff000000d90000
+[ 3.245771] WARNING: CPU: 0 PID: 1 at ../arch/arm64/mm/dump.c:232 note_page+0x410/0x420
+[ 3.246141] Modules linked in:
+[ 3.246653] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0-rc5-next-20180928-00001-ge70ae259b853-dirty #62
+[ 3.247008] Hardware name: linux,dummy-virt (DT)
+[ 3.247347] pstate: 80000005 (Nzcv daif -PAN -UAO)
+[ 3.247623] pc : note_page+0x410/0x420
+[ 3.247898] lr : note_page+0x410/0x420
+[ 3.248071] sp : ffff00000804bcd0
+[ 3.248254] x29: ffff00000804bcd0 x28: ffff000009274000
+[ 3.248578] x27: ffff00000921a000 x26: ffff80007dfff000
+[ 3.248845] x25: ffff0000093f5000 x24: ffff000009526f6a
+[ 3.249109] x23: 0000000000000004 x22: ffff000000d91000
+[ 3.249396] x21: ffff000000d90000 x20: 0000000000000000
+[ 3.249661] x19: ffff00000804bde8 x18: 0000000000000400
+[ 3.249924] x17: 0000000000000000 x16: 0000000000000000
+[ 3.250271] x15: ffffffffffffffff x14: 295f5f5f5f6c6176
+[ 3.250594] x13: 7274705f5f5f5f28 x12: 2073736572646461
+[ 3.250941] x11: 20746120676e6970 x10: 70616d20582b5720
+[ 3.251252] x9 : 6572756365736e69 x8 : 3039643030303030
+[ 3.251519] x7 : 306666666678302f x6 : ffff0000095467b2
+[ 3.251802] x5 : 0000000000000000 x4 : 0000000000000000
+[ 3.252060] x3 : 0000000000000000 x2 : ffffffffffffffff
+[ 3.252323] x1 : 4d151327adc50b00 x0 : 0000000000000000
+[ 3.252664] Call trace:
+[ 3.252953] note_page+0x410/0x420
+[ 3.253186] walk_pgd+0x12c/0x238
+[ 3.253417] ptdump_check_wx+0x68/0xf8
+[ 3.253637] mark_rodata_ro+0x68/0x98
+[ 3.253847] kernel_init+0x38/0x160
+[ 3.254103] ret_from_fork+0x10/0x18
+
+kprobes allocates a writable executable page with module_alloc() in
+order to store executable code.
+Reworked to that when allocate a page it sets mode RO. Inspired by
+commit 63fef14fc98a ("kprobes/x86: Make insn buffer always ROX and use text_poke()").
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+[catalin.marinas@arm.com: removed unnecessary casts]
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/probes/kprobes.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index e78c3ef04d95..b5a367d4bba6 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -23,7 +23,9 @@
+ #include <linux/slab.h>
+ #include <linux/stop_machine.h>
+ #include <linux/sched/debug.h>
++#include <linux/set_memory.h>
+ #include <linux/stringify.h>
++#include <linux/vmalloc.h>
+ #include <asm/traps.h>
+ #include <asm/ptrace.h>
+ #include <asm/cacheflush.h>
+@@ -42,10 +44,21 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
+ static void __kprobes
+ post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);
+
++static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++{
++ void *addrs[1];
++ u32 insns[1];
++
++ addrs[0] = addr;
++ insns[0] = opcode;
++
++ return aarch64_insn_patch_text(addrs, insns, 1);
++}
++
+ static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
+ {
+ /* prepare insn slot */
+- p->ainsn.api.insn[0] = cpu_to_le32(p->opcode);
++ patch_text(p->ainsn.api.insn, p->opcode);
+
+ flush_icache_range((uintptr_t) (p->ainsn.api.insn),
+ (uintptr_t) (p->ainsn.api.insn) +
+@@ -118,15 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ return 0;
+ }
+
+-static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++void *alloc_insn_page(void)
+ {
+- void *addrs[1];
+- u32 insns[1];
++ void *page;
+
+- addrs[0] = (void *)addr;
+- insns[0] = (u32)opcode;
++ page = vmalloc_exec(PAGE_SIZE);
++ if (page)
++ set_memory_ro((unsigned long)page, 1);
+
+- return aarch64_insn_patch_text(addrs, insns, 1);
++ return page;
+ }
+
+ /* arm kprobe: install breakpoint in text */
+--
+2.17.1
+
--- /dev/null
+From 6848d3bf5765c9b358adec5bdf570d59e223d573 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 25 Sep 2018 12:44:59 -0700
+Subject: arm64: percpu: Initialize ret in the default case
+
+[ Upstream commit b5bb425871186303e6936fa2581521bdd1964a58 ]
+
+Clang warns that if the default case is taken, ret will be
+uninitialized.
+
+./arch/arm64/include/asm/percpu.h:196:2: warning: variable 'ret' is used
+uninitialized whenever switch default is taken
+[-Wsometimes-uninitialized]
+ default:
+ ^~~~~~~
+./arch/arm64/include/asm/percpu.h:200:9: note: uninitialized use occurs
+here
+ return ret;
+ ^~~
+./arch/arm64/include/asm/percpu.h:157:19: note: initialize the variable
+'ret' to silence this warning
+ unsigned long ret, loop;
+ ^
+ = 0
+
+This warning appears several times while building the erofs filesystem.
+While it's not strictly wrong, the BUILD_BUG will prevent this from
+becoming a true problem. Initialize ret to 0 in the default case right
+before the BUILD_BUG to silence all of these warnings.
+
+Reported-by: Prasad Sodagudi <psodagud@codeaurora.org>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Dennis Zhou <dennis@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/percpu.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 9234013e759e..21a81b59a0cc 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -96,6 +96,7 @@ static inline unsigned long __percpu_##op(void *ptr, \
+ : [val] "Ir" (val)); \
+ break; \
+ default: \
++ ret = 0; \
+ BUILD_BUG(); \
+ } \
+ \
+@@ -125,6 +126,7 @@ static inline unsigned long __percpu_read(void *ptr, int size)
+ ret = READ_ONCE(*(u64 *)ptr);
+ break;
+ default:
++ ret = 0;
+ BUILD_BUG();
+ }
+
+@@ -194,6 +196,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ : [val] "r" (val));
+ break;
+ default:
++ ret = 0;
+ BUILD_BUG();
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 17c7e5f062e59266899834e94185118819e16dd6 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Fri, 2 Nov 2018 08:50:51 +0800
+Subject: block: brd: associate with queue until adding disk
+
+[ Upstream commit 153fcd5f6d93b8e1e4040b1337f564a10f8d93af ]
+
+brd_free() may be called in failure path on one brd instance which
+disk isn't added yet, so release handler of gendisk may free the
+associated request_queue early and causes the following use-after-free[1].
+
+This patch fixes this issue by associating gendisk with request_queue
+just before adding disk.
+
+[1] KASAN: use-after-free Read in del_timer_syncNon-volatile memory driver v1.3
+Linux agpgart interface v0.103
+[drm] Initialized vgem 1.0.0 20120112 for virtual device on minor 0
+usbcore: registered new interface driver udl
+==================================================================
+BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20
+kernel/locking/lockdep.c:3218
+Read of size 8 at addr ffff8801d1b6b540 by task swapper/0/1
+
+CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0+ #88
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x244/0x39d lib/dump_stack.c:113
+ print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256
+ kasan_report_error mm/kasan/report.c:354 [inline]
+ kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412
+ __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
+ __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218
+ lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
+ del_timer_sync+0xb7/0x270 kernel/time/timer.c:1283
+ blk_cleanup_queue+0x413/0x710 block/blk-core.c:809
+ brd_free+0x5d/0x71 drivers/block/brd.c:422
+ brd_init+0x2eb/0x393 drivers/block/brd.c:518
+ do_one_initcall+0x145/0x957 init/main.c:890
+ do_initcall_level init/main.c:958 [inline]
+ do_initcalls init/main.c:966 [inline]
+ do_basic_setup init/main.c:984 [inline]
+ kernel_init_freeable+0x5c6/0x6b9 init/main.c:1148
+ kernel_init+0x11/0x1ae init/main.c:1068
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:350
+
+Reported-by: syzbot+3701447012fe951dabb2@syzkaller.appspotmail.com
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/brd.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index df8103dd40ac..c18586fccb6f 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -396,15 +396,14 @@ static struct brd_device *brd_alloc(int i)
+ disk->first_minor = i * max_part;
+ disk->fops = &brd_fops;
+ disk->private_data = brd;
+- disk->queue = brd->brd_queue;
+ disk->flags = GENHD_FL_EXT_DEVT;
+ sprintf(disk->disk_name, "ram%d", i);
+ set_capacity(disk, rd_size * 2);
+- disk->queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
++ brd->brd_queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
+
+ /* Tell the block layer that this is not a rotational device */
+- blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue);
+- blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue);
++ blk_queue_flag_set(QUEUE_FLAG_NONROT, brd->brd_queue);
++ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, brd->brd_queue);
+
+ return brd;
+
+@@ -436,6 +435,7 @@ static struct brd_device *brd_init_one(int i, bool *new)
+
+ brd = brd_alloc(i);
+ if (brd) {
++ brd->brd_disk->queue = brd->brd_queue;
+ add_disk(brd->brd_disk);
+ list_add_tail(&brd->brd_list, &brd_devices);
+ }
+@@ -503,8 +503,14 @@ static int __init brd_init(void)
+
+ /* point of no return */
+
+- list_for_each_entry(brd, &brd_devices, brd_list)
++ list_for_each_entry(brd, &brd_devices, brd_list) {
++ /*
++ * associate with queue just before adding disk for
++ * avoiding to mess up failure path
++ */
++ brd->brd_disk->queue = brd->brd_queue;
+ add_disk(brd->brd_disk);
++ }
+
+ blk_register_region(MKDEV(RAMDISK_MAJOR, 0), 1UL << MINORBITS,
+ THIS_MODULE, brd_probe, NULL, NULL);
+--
+2.17.1
+
--- /dev/null
+From 00f148a94ad5dfb291904e167ffc6a87d87da631 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Wed, 7 Nov 2018 07:37:45 -0700
+Subject: block: Clear kernel memory before copying to user
+
+[ Upstream commit f3587d76da05f68098ddb1cb3c98cc6a9e8a402c ]
+
+If the kernel allocates a bounce buffer for user read data, this memory
+needs to be cleared before copying it to the user, otherwise it may leak
+kernel memory to user space.
+
+Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/bio.c b/block/bio.c
+index 0093bed81c0e..41173710430c 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1261,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ if (ret)
+ goto cleanup;
+ } else {
++ zero_fill_bio(bio);
+ iov_iter_advance(iter, bio->bi_iter.bi_size);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 66ddd04876824ffdcaab9b7f0679cda476e31d15 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 2 Nov 2018 11:35:46 +0100
+Subject: bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv
+
+[ Upstream commit 28c2fae726bf5003cd209b0d5910a642af98316f ]
+
+While dbecd7388476 ("bpf: get kernel symbol addresses via syscall")
+zeroed info.nr_jited_ksyms in bpf_prog_get_info_by_fd() for queries
+from unprivileged users, commit 815581c11cc2 ("bpf: get JITed image
+lengths of functions via syscall") forgot about doing so and therefore
+returns the #elems of the user set up buffer which is incorrect. It
+also needs to indicate a info.nr_jited_func_lens of zero.
+
+Fixes: 815581c11cc2 ("bpf: get JITed image lengths of functions via syscall")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Cc: Song Liu <songliubraving@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 675eb6d36e47..382c09dddf93 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1974,6 +1974,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ info.jited_prog_len = 0;
+ info.xlated_prog_len = 0;
+ info.nr_jited_ksyms = 0;
++ info.nr_jited_func_lens = 0;
+ goto done;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 5967a3e6b612cddf7e0abc6129f08300b0df5253 Mon Sep 17 00:00:00 2001
+From: Luis Henriques <lhenriques@suse.com>
+Date: Mon, 5 Nov 2018 19:00:52 +0000
+Subject: ceph: quota: fix null pointer dereference in quota check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 71f2cc64d027d712f29bf8d09d3e123302d5f245 ]
+
+This patch fixes a possible null pointer dereference in
+check_quota_exceeded, detected by the static checker smatch, with the
+following warning:
+
+ fs/ceph/quota.c:240 check_quota_exceeded()
+ error: we previously assumed 'realm' could be null (see line 188)
+
+Fixes: b7a2921765cf ("ceph: quota: support for ceph.quota.max_files")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Luis Henriques <lhenriques@suse.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/quota.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index 32d4f13784ba..03f4d24db8fe 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op,
+ ceph_put_snap_realm(mdsc, realm);
+ realm = next;
+ }
+- ceph_put_snap_realm(mdsc, realm);
++ if (realm)
++ ceph_put_snap_realm(mdsc, realm);
+ up_read(&mdsc->snap_rwsem);
+
+ return exceeded;
+--
+2.17.1
+
--- /dev/null
+From e12b02ede28bfcd5b4550ea6c3c6e47bed983879 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 1 Nov 2018 13:14:30 +0000
+Subject: cifs: don't dereference smb_file_target before null check
+
+[ Upstream commit 8c6c9bed8773375b1d54ccca2911ec892c59db5d ]
+
+There is a null check on dst_file->private data which suggests
+it can be potentially null. However, before this check, pointer
+smb_file_target is derived from dst_file->private and dereferenced
+in the call to tlink_tcon, hence there is a potential null pointer
+deference.
+
+Fix this by assigning smb_file_target and target_tcon after the
+null pointer sanity checks.
+
+Detected by CoverityScan, CID#1475302 ("Dereference before null check")
+
+Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsfs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 7065426b3280..fb32f3d6925e 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -981,8 +981,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ struct inode *src_inode = file_inode(src_file);
+ struct inode *target_inode = file_inode(dst_file);
+ struct cifsFileInfo *smb_file_src = src_file->private_data;
+- struct cifsFileInfo *smb_file_target = dst_file->private_data;
+- struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink);
++ struct cifsFileInfo *smb_file_target;
++ struct cifs_tcon *target_tcon;
+ unsigned int xid;
+ int rc;
+
+@@ -996,6 +996,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ goto out;
+ }
+
++ smb_file_target = dst_file->private_data;
++ target_tcon = tlink_tcon(smb_file_target->tlink);
++
+ /*
+ * Note: cifs case is easier than btrfs since server responsible for
+ * checks for proper open modes and file type and if it wants
+--
+2.17.1
+
--- /dev/null
+From 7a8bc3c4b821aaff843ef8d8f09b46994ac397bd Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Thu, 25 Oct 2018 15:43:36 +1000
+Subject: cifs: fix return value for cifs_listxattr
+
+[ Upstream commit 0c5d6cb6643f48ad3775322f3ebab6c7eb67484e ]
+
+If the application buffer was too small to fit all the names
+we would still count the number of bytes and return this for
+listxattr. This would then trigger a BUG in usercopy.c
+
+Fix the computation of the size so that we return -ERANGE
+correctly when the buffer is too small.
+
+This fixes the kernel BUG for xfstest generic/377
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 89985a0a6819..812da3e56a22 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -686,6 +686,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ int rc = 0;
+ unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0;
+ char *name, *value;
++ size_t buf_size = dst_size;
+ size_t name_len, value_len, user_name_len;
+
+ while (src_size > 0) {
+@@ -721,9 +722,10 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ /* 'user.' plus a terminating null */
+ user_name_len = 5 + 1 + name_len;
+
+- rc += user_name_len;
+-
+- if (dst_size >= user_name_len) {
++ if (buf_size == 0) {
++ /* skip copy - calc size only */
++ rc += user_name_len;
++ } else if (dst_size >= user_name_len) {
+ dst_size -= user_name_len;
+ memcpy(dst, "user.", 5);
+ dst += 5;
+@@ -731,8 +733,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ dst += name_len;
+ *dst = 0;
+ ++dst;
+- } else if (dst_size == 0) {
+- /* skip copy - calc size only */
++ rc += user_name_len;
+ } else {
+ /* stop before overrun buffer */
+ rc = -ERANGE;
+--
+2.17.1
+
--- /dev/null
+From 952cc26527530514ba6788ba32aea38a5ccf4ad1 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Thu, 1 Nov 2018 14:15:49 +0100
+Subject: clk: fixed-factor: fix of_node_get-put imbalance
+
+[ Upstream commit f98e8a572bddbf27032114127d2fcc78fa5e6a9d ]
+
+When the fixed factor clock is created by devicetree,
+of_clk_add_provider is called. Add a call to
+of_clk_del_provider in the remove function to balance
+it out.
+
+Reported-by: Alan Tull <atull@kernel.org>
+Fixes: 971451b3b15d ("clk: fixed-factor: Convert into a module platform driver")
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-fixed-factor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index 20724abd38bd..7df6b5b1e7ee 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev)
+ {
+ struct clk *clk = platform_get_drvdata(pdev);
+
++ of_clk_del_provider(pdev->dev.of_node);
+ clk_unregister_fixed_factor(clk);
+
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From 846af2bfc8b52e556892e58675e256e22ceb7b9f Mon Sep 17 00:00:00 2001
+From: Alan Tull <atull@kernel.org>
+Date: Thu, 18 Oct 2018 14:54:11 -0500
+Subject: clk: fixed-rate: fix of_node_get-put imbalance
+
+[ Upstream commit 52091c256bdcad0d01e2852a63f19cd2cce6af96 ]
+
+When the fixed rate clock is created by devicetree,
+of_clk_add_provider is called. Add a call to
+of_clk_del_provider in the remove function to balance
+it out.
+
+Signed-off-by: Alan Tull <atull@kernel.org>
+Fixes: 435779fe1336 ("clk: fixed-rate: Convert into a module platform driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-fixed-rate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c
+index b5c46b3f8764..6d6475c32ee5 100644
+--- a/drivers/clk/clk-fixed-rate.c
++++ b/drivers/clk/clk-fixed-rate.c
+@@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev)
+ {
+ struct clk *clk = platform_get_drvdata(pdev);
+
++ of_clk_del_provider(pdev->dev.of_node);
+ clk_unregister_fixed_rate(clk);
+
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From cdb0bb213c80582381090f2e9f174d46b92f2d11 Mon Sep 17 00:00:00 2001
+From: Yixun Lan <yixun.lan@amlogic.com>
+Date: Wed, 1 Aug 2018 12:16:24 +0000
+Subject: clk: meson-axg: pcie: drop the mpll3 clock parent
+
+[ Upstream commit 69b93104c7ec5668019caf5d2dbfd0e182df06db ]
+
+We found the PCIe driver doesn't really work with
+the mpll3 clock which is actually reserved for debug,
+So drop it from the mux list.
+
+Fixes: 33b89db68236 ("clk: meson-axg: add clocks required by pcie driver")
+Tested-by: Jianxin Qin <jianxin.qin@amlogic.com>
+Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 8cf74fc423e6..baabcf7c0a24 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -713,12 +713,14 @@ static struct clk_regmap axg_pcie_mux = {
+ .offset = HHI_PCIE_PLL_CNTL6,
+ .mask = 0x1,
+ .shift = 2,
++ /* skip the parent mpll3, reserved for debug */
++ .table = (u32[]){ 1 },
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "pcie_mux",
+ .ops = &clk_regmap_mux_ops,
+- .parent_names = (const char *[]){ "mpll3", "pcie_pll" },
+- .num_parents = 2,
++ .parent_names = (const char *[]){ "pcie_pll" },
++ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+--
+2.17.1
+
--- /dev/null
+From 2ccdef959392ac042d56a3fd4afe8fd09909890a Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Wed, 1 Aug 2018 16:00:51 +0200
+Subject: clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary
+
+[ Upstream commit 2303a9ca693e585a558497ad737728fec97e2b8a ]
+
+CLK_GET_RATE_NOCACHE should only be necessary when the registers
+controlling the rate of clock may change outside of CCF. On Amlogic,
+it should only be the case for the hdmi pll which is directly controlled
+by the display driver (WIP to fix this).
+
+The other plls should not require this flag.
+
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg.c | 1 -
+ drivers/clk/meson/gxbb.c | 12 ++++++++----
+ drivers/clk/meson/meson8b.c | 3 ---
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index baabcf7c0a24..02229d051d77 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -96,7 +96,6 @@ static struct clk_regmap axg_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 6435d86118f1..6628ffa31383 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -213,7 +213,6 @@ static struct clk_regmap gxbb_fixed_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -276,6 +275,10 @@ static struct clk_regmap gxbb_hdmi_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "hdmi_pll_pre_mult" },
+ .num_parents = 1,
++ /*
++ * Display directly handle hdmi pll registers ATM, we need
++ * NOCACHE to keep our view of the clock as accurate as possible
++ */
+ .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+@@ -334,6 +337,10 @@ static struct clk_regmap gxl_hdmi_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
++ /*
++ * Display directly handle hdmi pll registers ATM, we need
++ * NOCACHE to keep our view of the clock as accurate as possible
++ */
+ .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+@@ -371,7 +378,6 @@ static struct clk_regmap gxbb_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -418,7 +424,6 @@ static struct clk_regmap gxbb_gp0_pll = {
+ .ops = &meson_clk_pll_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -472,7 +477,6 @@ static struct clk_regmap gxl_gp0_pll = {
+ .ops = &meson_clk_pll_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 7447d96a265f..74697e145dde 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -132,7 +132,6 @@ static struct clk_regmap meson8b_fixed_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -169,7 +168,6 @@ static struct clk_regmap meson8b_vid_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -207,7 +205,6 @@ static struct clk_regmap meson8b_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+--
+2.17.1
+
--- /dev/null
+From fb4c3bbcb39199a7cf1e59ec6040c71e65d36887 Mon Sep 17 00:00:00 2001
+From: Phil Edworthy <phil.edworthy@renesas.com>
+Date: Fri, 31 Aug 2018 12:26:36 +0100
+Subject: clk: renesas: r9a06g032: Fix UART34567 clock rate
+
+[ Upstream commit ee02950d53eee0d4c7f1c08a35272b77d24b9459 ]
+
+The clock for UARTs 0 through 2 is UART012, the clock for UARTs 3 through
+7 is UART34567.
+For UART012, we stop the clock driver from changing the clock rate. This
+is because the Synopsys UART driver simply sets the reference clock to 16x
+the baud rate, but doesn't check if the actual rate is within the required
+tolerance. The RZ/N1 clock divider can't provide this (we have to rely on
+the UART's internal divider to set the correct clock rate), so you end up
+with a clock rate that is way off what you wanted.
+
+In addition, since the clock is shared between multiple UARTs, you don't
+want the driver trying to change the clock rate as it may affect the other
+UARTs (which may not have been configured yet, so you don't know what baud
+rate they will use). Normally, the clock rate is set early on before Linux
+to some very high rate that supports all of the clock rates you want.
+
+This change stops the UART34567 clock rate from changing for the same
+reasons.
+
+Signed-off-by: Phil Edworthy <phil.edworthy@renesas.com>
+Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r9a06g032-clocks.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index a0b6ecdc63dd..6d2b56891559 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -539,7 +539,8 @@ r9a06g032_div_round_rate(struct clk_hw *hw,
+ * several uarts attached to this divider, and changing this impacts
+ * everyone.
+ */
+- if (clk->index == R9A06G032_DIV_UART) {
++ if (clk->index == R9A06G032_DIV_UART ||
++ clk->index == R9A06G032_DIV_P2_PG) {
+ pr_devel("%s div uart hack!\n", __func__);
+ return clk_get_rate(hw->clk);
+ }
+--
+2.17.1
+
--- /dev/null
+From 60048167293c62d58ecc4ac6af32a356ddb2cb3f Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Mon, 24 Sep 2018 13:01:20 +0200
+Subject: clk: samsung: exynos5420: Enable PERIS clocks for suspend
+
+[ Upstream commit b33228029d842269e17bba591609e83ed422005d ]
+
+Ensure that clocks for core SoC modules (including TZPC0..9 modules)
+are enabled for suspend/resume cycle. This fixes suspend/resume
+support on Exynos5422-based Odroid XU3/XU4 boards.
+
+Suggested-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <snawrocki@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 95e1bf69449b..d4f77c4eb277 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -281,6 +281,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = {
+ { .offset = GATE_BUS_TOP, .value = 0xffffffff, },
+ { .offset = GATE_BUS_DISP1, .value = 0xffffffff, },
+ { .offset = GATE_IP_PERIC, .value = 0xffffffff, },
++ { .offset = GATE_IP_PERIS, .value = 0xffffffff, },
+ };
+
+ static int exynos5420_clk_suspend(void)
+--
+2.17.1
+
--- /dev/null
+From 8758186c636915c13be1fe2354a6d54a7677cc77 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 22 Aug 2018 11:03:19 +0200
+Subject: clk: ti: fix OF child-node lookup
+
+[ Upstream commit 00a461cc32ec27fa7bd9c874a7b36b0c6c542c12 ]
+
+Fix child-node lookup which by using the wrong OF helper was searching
+the whole tree depth-first, something which could end up matching an
+unrelated node.
+
+Also fix the related node-reference leaks.
+
+Fixes: 5b385a45e001 ("clk: ti: add support for clkctrl aliases")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 7d22e1af2247..27e0979b3158 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -129,7 +129,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops)
+ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ {
+ struct ti_dt_clk *c;
+- struct device_node *node;
++ struct device_node *node, *parent;
+ struct clk *clk;
+ struct of_phandle_args clkspec;
+ char buf[64];
+@@ -164,8 +164,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ continue;
+
+ node = of_find_node_by_name(NULL, buf);
+- if (num_args)
+- node = of_find_node_by_name(node, "clk");
++ if (num_args) {
++ parent = node;
++ node = of_get_child_by_name(parent, "clk");
++ of_node_put(parent);
++ }
++
+ clkspec.np = node;
+ clkspec.args_count = num_args;
+ for (i = 0; i < num_args; i++) {
+@@ -173,11 +177,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ if (ret) {
+ pr_warn("Bad tag in %s at %d: %s\n",
+ c->node_name, i, tags[i]);
++ of_node_put(node);
+ return;
+ }
+ }
+ clk = of_clk_get_from_provider(&clkspec);
+-
++ of_node_put(node);
+ if (!IS_ERR(clk)) {
+ c->lk.clk = clk;
+ clkdev_add(&c->lk);
+--
+2.17.1
+
--- /dev/null
+From d0300243cc7b218d03edb058c5fb638ed8325450 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 1 Nov 2018 21:51:49 -0400
+Subject: drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
+
+[ Upstream commit 63237f8748bdf46dccf79ef8f98f05e9fe799162 ]
+
+[why]
+Removing connector reusage from DM to match the rest of the tree ended
+up revealing an issue that was surprisingly subtle. The original amdgpu
+code for DC that was submitted appears to have left a chunk in
+dm_dp_create_fake_mst_encoder() that tries to find a "master encoder",
+the likes of which isn't actually used or stored anywhere. It does so at
+the wrong time as well by trying to access parts of the drm_connector
+from the encoder init before it's actually been initialized. This
+results in a NULL pointer deref on MST hotplugs:
+
+[ 160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+[ 160.697234] PGD 0 P4D 0
+[ 160.697814] Oops: 0010 [#1] SMP PTI
+[ 160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G O 4.19.0Lyude-Test+ #2
+[ 160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018
+[ 160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
+[ 160.700322] RIP: 0010: (null)
+[ 160.700920] Code: Bad RIP value.
+[ 160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206
+[ 160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158
+[ 160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000
+[ 160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25
+[ 160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000
+[ 160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000
+[ 160.705260] FS: 0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000
+[ 160.705854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0
+[ 160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 160.708372] Call Trace:
+[ 160.708998] ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu]
+[ 160.709625] ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper]
+[ 160.710284] ? wake_up_q+0x54/0x70
+[ 160.710877] ? __mutex_unlock_slowpath.isra.18+0xb3/0x110
+[ 160.711512] ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper]
+[ 160.712161] ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper]
+[ 160.712762] ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper]
+[ 160.713408] ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper]
+[ 160.714013] ? process_one_work+0x1a1/0x3a0
+[ 160.714667] ? worker_thread+0x30/0x380
+[ 160.715326] ? wq_update_unbound_numa+0x10/0x10
+[ 160.715939] ? kthread+0x112/0x130
+[ 160.716591] ? kthread_create_worker_on_cpu+0x70/0x70
+[ 160.717262] ? ret_from_fork+0x35/0x40
+[ 160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu]
+[ 160.720141] CR2: 0000000000000000
+
+Somehow the connector reusage DM was using for MST connectors managed to
+paper over this issue entirely; hence why this was never caught until
+now.
+
+[how]
+Since this code isn't used anywhere and seems useless anyway, we can
+just drop it entirely. This appears to fix the issue on my HP ZBook with
+an AMD WX4150.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 4b08359e18bd..4cc45a1d21db 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -317,12 +317,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector)
+ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_encoder *amdgpu_encoder;
+ struct drm_encoder *encoder;
+- const struct drm_connector_helper_funcs *connector_funcs =
+- connector->base.helper_private;
+- struct drm_encoder *enc_master =
+- connector_funcs->best_encoder(&connector->base);
+
+- DRM_DEBUG_KMS("enc master is %p\n", enc_master);
+ amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
+ if (!amdgpu_encoder)
+ return NULL;
+--
+2.17.1
+
--- /dev/null
+From a54bbeb5a5adda47d97ac30ad584f32387e24d3d Mon Sep 17 00:00:00 2001
+From: "Jerry (Fangzhi) Zuo" <Jerry.Zuo@amd.com>
+Date: Tue, 30 Oct 2018 14:37:16 -0400
+Subject: drm/amd/display: Drop reusing drm connector for MST
+
+[ Upstream commit 0e6613e46fed29316f33acf86e1d1568288638b5 ]
+
+[why]
+It is not safe to keep existing connector while entire topology
+has been removed. Could lead potential impact to uapi.
+Entirely unregister all the connectors on the topology,
+and use a new set of connectors when the topology is plugged back
+on.
+
+[How]
+Remove the drm connector entirely each time when the
+corresponding MST topology is gone.
+When hotunplug a connector (e.g., DP2)
+1. Remove connector from userspace.
+2. Drop it's reference.
+When hotplug back on:
+1. Detect new topology, and create new connectors.
+2. Notify userspace with sysfs hotplug event.
+3. Reprobe new connectors, and reassign CRTC from old (e.g., DP2)
+to new (e.g., DP3) connector.
+
+Signed-off-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 -
+ .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 40 ++++---------------
+ 2 files changed, 7 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index a29dc35954c9..aba2c5c1d2f8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -173,8 +173,6 @@ struct amdgpu_dm_connector {
+ struct mutex hpd_lock;
+
+ bool fake_enable;
+-
+- bool mst_connected;
+ };
+
+ #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 9a300732ba37..4b08359e18bd 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -352,25 +352,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_dm_connector *aconnector;
+ struct drm_connector *connector;
+- struct drm_connector_list_iter conn_iter;
+-
+- drm_connector_list_iter_begin(dev, &conn_iter);
+- drm_for_each_connector_iter(connector, &conn_iter) {
+- aconnector = to_amdgpu_dm_connector(connector);
+- if (aconnector->mst_port == master
+- && !aconnector->port) {
+- DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n",
+- aconnector, connector->base.id, aconnector->mst_port);
+-
+- aconnector->port = port;
+- drm_connector_set_path_property(connector, pathprop);
+-
+- drm_connector_list_iter_end(&conn_iter);
+- aconnector->mst_connected = true;
+- return &aconnector->base;
+- }
+- }
+- drm_connector_list_iter_end(&conn_iter);
+
+ aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
+ if (!aconnector)
+@@ -419,8 +400,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ */
+ amdgpu_dm_connector_funcs_reset(connector);
+
+- aconnector->mst_connected = true;
+-
+ DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
+ aconnector, connector->base.id, aconnector->mst_port);
+
+@@ -432,6 +411,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_connector *connector)
+ {
++ struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr);
++ struct drm_device *dev = master->base.dev;
++ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n",
+@@ -445,7 +427,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ aconnector->dc_sink = NULL;
+ }
+
+- aconnector->mst_connected = false;
++ drm_connector_unregister(connector);
++ if (adev->mode_info.rfbdev)
++ drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector);
++ drm_connector_put(connector);
+ }
+
+ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+@@ -456,18 +441,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+ drm_kms_helper_hotplug_event(dev);
+ }
+
+-static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
+-{
+- mutex_lock(&connector->dev->mode_config.mutex);
+- drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
+- mutex_unlock(&connector->dev->mode_config.mutex);
+-}
+-
+ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ {
+ struct drm_device *dev = connector->dev;
+ struct amdgpu_device *adev = dev->dev_private;
+- struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ if (adev->mode_info.rfbdev)
+ drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
+@@ -475,9 +452,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ DRM_ERROR("adev->mode_info.rfbdev is NULL\n");
+
+ drm_connector_register(connector);
+-
+- if (aconnector->mst_connected)
+- dm_dp_mst_link_status_reset(connector);
+ }
+
+ static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
+--
+2.17.1
+
--- /dev/null
+From a3cf2f0be83c26907abbb2523b946d2a3bd4ca80 Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Sun, 7 Oct 2018 10:01:23 -0400
+Subject: drm/amd/display: Stop leaking planes
+
+[ Upstream commit 02680efbb10be0d2c867fe722ae23d588f6bebef ]
+
+[Why]
+drm_plane_cleanup does not free the plane.
+
+[How]
+Call drm_primary_helper_destroy which will also free the plane.
+
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 6903fe6c894b..ef5c6af4d964 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3167,7 +3167,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane,
+ static const struct drm_plane_funcs dm_plane_funcs = {
+ .update_plane = drm_atomic_helper_update_plane,
+ .disable_plane = drm_atomic_helper_disable_plane,
+- .destroy = drm_plane_cleanup,
++ .destroy = drm_primary_helper_destroy,
+ .reset = dm_drm_plane_reset,
+ .atomic_duplicate_state = dm_drm_plane_duplicate_state,
+ .atomic_destroy_state = dm_drm_plane_destroy_state,
+--
+2.17.1
+
--- /dev/null
+From b8fea58273027054bd612f066db5668ba67c732b Mon Sep 17 00:00:00 2001
+From: "Lee, Shawn C" <shawn.c.lee@intel.com>
+Date: Sun, 28 Oct 2018 22:49:33 -0700
+Subject: drm/edid: Add 6 bpc quirk for BOE panel.
+
+[ Upstream commit 922dceff8dc1fb4dafc9af78139ba65671408103 ]
+
+BOE panel (ID: 0x0771) that reports "DFP 1.x compliant TMDS".
+But it's 6bpc panel only instead of 8 bpc.
+
+Add panel ID to edid quirk list and set 6 bpc as default to
+work around this issue.
+
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Gustavo Padovan <gustavo@padovan.org>
+Cc: Cooper Chiou <cooper.chiou@intel.com>
+Signed-off-by: Lee, Shawn C <shawn.c.lee@intel.com>>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/1540792173-7288-1-git-send-email-shawn.c.lee@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index ff0bfc65a8c1..b506e3622b08 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -122,6 +122,9 @@ static const struct edid_quirk {
+ /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */
+ { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC },
+
++ /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */
++ { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC },
++
+ /* Belinea 10 15 55 */
+ { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+--
+2.17.1
+
--- /dev/null
+From b44b35a01c98e3a0b54738cc670974c1c20664d6 Mon Sep 17 00:00:00 2001
+From: Chengguang Xu <cgxu519@gmx.com>
+Date: Wed, 13 Jun 2018 12:05:13 +0800
+Subject: fs/exofs: fix potential memory leak in mount option parsing
+
+[ Upstream commit 515f1867addaba49c1c6ac73abfaffbc192c1db4 ]
+
+There are some cases can cause memory leak when parsing
+option 'osdname'.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exofs/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 41cf2fbee50d..7d61e3fa378c 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -101,6 +101,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts)
+ token = match_token(p, tokens, args);
+ switch (token) {
+ case Opt_name:
++ kfree(opts->dev_name);
+ opts->dev_name = match_strdup(&args[0]);
+ if (unlikely(!opts->dev_name)) {
+ EXOFS_ERR("Error allocating dev_name");
+@@ -866,8 +867,10 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ int ret;
+
+ ret = parse_options(data, &opts);
+- if (ret)
++ if (ret) {
++ kfree(opts.dev_name);
+ return ERR_PTR(ret);
++ }
+
+ if (!opts.dev_name)
+ opts.dev_name = dev_name;
+--
+2.17.1
+
--- /dev/null
+From 6265c924b716794df1fd72b73f4977b4d009229e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?=
+ <ernesto.mnd.fernandez@gmail.com>
+Date: Tue, 30 Oct 2018 15:06:07 -0700
+Subject: hfs: prevent btree data loss on root split
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit d057c036672f33d43a5f7344acbb08cf3a8a0c09 ]
+
+This bug is triggered whenever hfs_brec_update_parent() needs to split
+the root node. The height of the btree is not increased, which leaves
+the new node orphaned and its records lost. It is not possible for this
+to happen on a valid hfs filesystem because the index nodes have fixed
+length keys.
+
+For reasons I ignore, the hfs module does have support for a number of
+hfsplus features. A corrupt btree header may report variable length
+keys and trigger this bug, so it's better to fix it.
+
+Link: http://lkml.kernel.org/r/9750b1415685c4adca10766895f6d5ef12babdb0.1535682463.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/brec.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 9a8772465a90..da25c49203cc 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -425,6 +425,10 @@ skip:
+ if (new_node) {
+ __be32 cnid;
+
++ if (!new_node->parent) {
++ hfs_btree_inc_height(tree);
++ new_node->parent = tree->root;
++ }
+ fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ /* create index key and entry */
+ hfs_bnode_read_key(new_node, fd->search_key, 14);
+--
+2.17.1
+
--- /dev/null
+From a493f31781a5c186243b9e53a9f0ee9e5746c240 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?=
+ <ernesto.mnd.fernandez@gmail.com>
+Date: Tue, 30 Oct 2018 15:06:00 -0700
+Subject: hfsplus: prevent btree data loss on root split
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 0a3021d4f5295aa073c7bf5c5e4de60a2e292578 ]
+
+Creating, renaming or deleting a file may cause catalog corruption and
+data loss. This bug is randomly triggered by xfstests generic/027, but
+here is a faster reproducer:
+
+ truncate -s 50M fs.iso
+ mkfs.hfsplus fs.iso
+ mount fs.iso /mnt
+ i=100
+ while [ $i -le 150 ]; do
+ touch /mnt/$i &>/dev/null
+ ((++i))
+ done
+ i=100
+ while [ $i -le 150 ]; do
+ mv /mnt/$i /mnt/$(perl -e "print $i x82") &>/dev/null
+ ((++i))
+ done
+ umount /mnt
+ fsck.hfsplus -n fs.iso
+
+The bug is triggered whenever hfs_brec_update_parent() needs to split the
+root node. The height of the btree is not increased, which leaves the new
+node orphaned and its records lost.
+
+Link: http://lkml.kernel.org/r/26d882184fc43043a810114258f45277752186c7.1535682461.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/brec.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index ed8eacb34452..aa17a392b414 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -429,6 +429,10 @@ skip:
+ if (new_node) {
+ __be32 cnid;
+
++ if (!new_node->parent) {
++ hfs_btree_inc_height(tree);
++ new_node->parent = tree->root;
++ }
+ fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ /* create index key and entry */
+ hfs_bnode_read_key(new_node, fd->search_key, 14);
+--
+2.17.1
+
--- /dev/null
+From b163b31a53eaa14f25cb71a6b59fd12b03c1d860 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Fri, 12 Oct 2018 16:05:25 +0200
+Subject: HID: alps: allow incoming reports when only the trackstick is opened
+
+[ Upstream commit 7dd8db68949a7acc5bd528ee0ecb8f8720f49921 ]
+
+If userspace only reads the trackstick node, and no one is listening to
+the touchpad nor the hidraw node then, the device is not powered on.
+
+Add open/close callbacks to allow users to disable the touchpad in Gnome
+while keeping the trackstick active.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1559632
+Link: https://gitlab.gnome.org/GNOME/mutter/issues/128
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-alps.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index aec253b44156..3cd7229b6e54 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -660,6 +660,20 @@ exit:
+ return ret;
+ }
+
++static int alps_sp_open(struct input_dev *dev)
++{
++ struct hid_device *hid = input_get_drvdata(dev);
++
++ return hid_hw_open(hid);
++}
++
++static void alps_sp_close(struct input_dev *dev)
++{
++ struct hid_device *hid = input_get_drvdata(dev);
++
++ hid_hw_close(hid);
++}
++
+ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ {
+ struct alps_dev *data = hid_get_drvdata(hdev);
+@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ input2->id.version = input->id.version;
+ input2->dev.parent = input->dev.parent;
+
++ input_set_drvdata(input2, hdev);
++ input2->open = alps_sp_open;
++ input2->close = alps_sp_close;
++
+ __set_bit(EV_KEY, input2->evbit);
+ data->sp_btn_cnt = (data->sp_btn_info & 0x0F);
+ for (i = 0; i < data->sp_btn_cnt; i++)
+--
+2.17.1
+
--- /dev/null
+From 2f3fe5151b95202cd889b96234dc5f5af7bc0eb5 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Fri, 5 Oct 2018 12:46:29 +0800
+Subject: HID: i2c-hid: Add a small delay after sleep command for Raydium
+ touchpanel
+
+[ Upstream commit 00b790ea545b6ef30221adef6e9c3707e03b82b5 ]
+
+Raydium touchpanel (2386:4B33) sometimes does not work in desktop session
+although it works in display manager.
+
+During user logging, the display manager exits, close the HID device,
+then the device gets runtime suspended and powered off. The desktop
+session begins shortly after, opens the HID device, then the device gets
+runtime resumed and powered on.
+
+If the trasition from display manager to desktop sesesion is fast, the
+touchpanel cannot switch from powered off to powered on in short
+timeframe. So add a small delay to workaround the issue.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/i2c-hid/i2c-hid.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bc49909aba8e..636b9d903b26 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -921,6 +921,9 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
+
++#define I2C_VENDOR_ID_RAYDIUM 0x2386
++#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
++
+ #define USB_VENDOR_ID_RAZER 0x1532
+ #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 4e3592e7a3f7..88daa388e1f6 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -48,6 +48,7 @@
+ #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0)
+ #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -157,6 +158,8 @@ struct i2c_hid {
+
+ bool irq_wake_enabled;
+ struct mutex reset_lock;
++
++ unsigned long sleep_delay;
+ };
+
+ static const struct i2c_hid_quirks {
+@@ -171,6 +174,8 @@ static const struct i2c_hid_quirks {
+ { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
+ I2C_HID_QUIRK_NO_RUNTIME_PM },
++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
++ I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+ { 0, 0 }
+ };
+
+@@ -386,6 +391,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ {
+ struct i2c_hid *ihid = i2c_get_clientdata(client);
+ int ret;
++ unsigned long now, delay;
+
+ i2c_hid_dbg(ihid, "%s\n", __func__);
+
+@@ -403,9 +409,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ goto set_pwr_exit;
+ }
+
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_ON) {
++ now = jiffies;
++ if (time_after(ihid->sleep_delay, now)) {
++ delay = jiffies_to_usecs(ihid->sleep_delay - now);
++ usleep_range(delay, delay + 1);
++ }
++ }
++
+ ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
+ 0, NULL, 0, NULL, 0);
+
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_SLEEP)
++ ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
++
+ if (ret)
+ dev_err(&client->dev, "failed to change power setting.\n");
+
+--
+2.17.1
+
--- /dev/null
+From 2efe380bf0d96610f62a1d16aa125f25d3a088dc Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Sun, 28 Oct 2018 18:16:51 +0100
+Subject: hwmon: (ibmpowernv) Remove bogus __init annotations
+
+[ Upstream commit e3e61f01d755188cb6c2dcf5a244b9c0937c258e ]
+
+If gcc decides not to inline make_sensor_label():
+
+ WARNING: vmlinux.o(.text+0x4df549c): Section mismatch in reference from the function .create_device_attrs() to the function .init.text:.make_sensor_label()
+ The function .create_device_attrs() references
+ the function __init .make_sensor_label().
+ This is often because .create_device_attrs lacks a __init
+ annotation or the annotation of .make_sensor_label is wrong.
+
+As .probe() can be called after freeing of __init memory, all __init
+annotiations in the driver are bogus, and should be removed.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ibmpowernv.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
+index 83472808c816..64d05edff130 100644
+--- a/drivers/hwmon/ibmpowernv.c
++++ b/drivers/hwmon/ibmpowernv.c
+@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr,
+ return sprintf(buf, "%s\n", sdata->label);
+ }
+
+-static int __init get_logical_cpu(int hwcpu)
++static int get_logical_cpu(int hwcpu)
+ {
+ int cpu;
+
+@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu)
+ return -ENOENT;
+ }
+
+-static void __init make_sensor_label(struct device_node *np,
+- struct sensor_data *sdata,
+- const char *label)
++static void make_sensor_label(struct device_node *np,
++ struct sensor_data *sdata, const char *label)
+ {
+ u32 id;
+ size_t n;
+--
+2.17.1
+
--- /dev/null
+From f375d6526ea7159c9a29509b08f1ea084ddd8987 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Fri, 9 Nov 2018 16:44:11 +0530
+Subject: i2c: omap: Enable for ARCH_K3
+
+[ Upstream commit 5b277402deac0691226a947df71c581686bd4020 ]
+
+Allow I2C_OMAP to be built for K3 platforms.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 451d4ae50e66..ac4b09642f63 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -751,7 +751,7 @@ config I2C_OCORES
+
+ config I2C_OMAP
+ tristate "OMAP I2C adapter"
+- depends on ARCH_OMAP
++ depends on ARCH_OMAP || ARCH_K3
+ default y if MACH_OMAP_H3 || MACH_OMAP_OSK
+ help
+ If you say yes to this option, support will be included for the
+--
+2.17.1
+
--- /dev/null
+From 6869d7a8040b6fe687af120968c439811fb81e3d Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <swboyd@chromium.org>
+Date: Fri, 2 Nov 2018 13:57:32 -0700
+Subject: i2c: qcom-geni: Fix runtime PM mismatch with child devices
+
+[ Upstream commit 848bd3f3de9d44950c00eda6c115e8e9785440da ]
+
+We need to enable runtime PM on this i2c controller before populating
+child devices with i2c_add_adapter(). Otherwise, if a child device uses
+runtime PM and stays runtime PM enabled we'll get the following warning
+at boot.
+
+ Enabling runtime PM for inactive device (a98000.i2c) with active children
+
+[...]
+
+ Call trace:
+ pm_runtime_enable+0xd8/0xf8
+ geni_i2c_probe+0x440/0x460
+ platform_drv_probe+0x74/0xc8
+[...]
+
+Let's move the runtime PM enabling and setup to before we add the
+adapter, so that this device can respond to runtime PM requests from
+children.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 9f2eb02481d3..d7329177b0ea 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -590,18 +590,19 @@ static int geni_i2c_probe(struct platform_device *pdev)
+
+ dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
+
+- ret = i2c_add_adapter(&gi2c->adap);
+- if (ret) {
+- dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
+- return ret;
+- }
+-
+ gi2c->suspended = 1;
+ pm_runtime_set_suspended(gi2c->se.dev);
+ pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY);
+ pm_runtime_use_autosuspend(gi2c->se.dev);
+ pm_runtime_enable(gi2c->se.dev);
+
++ ret = i2c_add_adapter(&gi2c->adap);
++ if (ret) {
++ dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
++ pm_runtime_disable(gi2c->se.dev);
++ return ret;
++ }
++
+ return 0;
+ }
+
+@@ -609,8 +610,8 @@ static int geni_i2c_remove(struct platform_device *pdev)
+ {
+ struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
+
+- pm_runtime_disable(gi2c->se.dev);
+ i2c_del_adapter(&gi2c->adap);
++ pm_runtime_disable(gi2c->se.dev);
+ return 0;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From f0b25607fbe9b7c589a4e13564c13e1dd15b980c Mon Sep 17 00:00:00 2001
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Mon, 29 Oct 2018 10:52:42 -0700
+Subject: i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
+
+[ Upstream commit ba766b8b99c30ad3c55ed8cf224d1185ecff1476 ]
+
+Since commit bacd75cfac8a ("i40e/i40evf: Add capability exchange for
+outer checksum", 2017-04-06) the i40e driver has not reported support
+for IP-in-IP offloads. This likely occurred due to a bad rebase, as the
+commit extracts hw_enc_features into its own variable. As part of this
+change, it dropped the NETIF_F_FSO_IPXIP flags from the
+netdev->hw_enc_features. This was unfortunately not caught during code
+review.
+
+Fix this by adding back the missing feature flags.
+
+For reference, NETIF_F_GSO_IPXIP4 was added in commit 7e13318daa4a
+("net: define gso types for IPx over IPv4 and IPv6", 2016-05-20),
+replacing NETIF_F_GSO_IPIP and NETIF_F_GSO_SIT.
+
+NETIF_F_GSO_IPXIP6 was added in commit bf2d1df39502 ("intel: Add support
+for IPv6 IP-in-IP offload", 2016-05-20).
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index ac685ad4d877..6eccfa82ca94 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11926,6 +11926,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
+ NETIF_F_GSO_GRE |
+ NETIF_F_GSO_GRE_CSUM |
+ NETIF_F_GSO_PARTIAL |
++ NETIF_F_GSO_IPXIP4 |
++ NETIF_F_GSO_IPXIP6 |
+ NETIF_F_GSO_UDP_TUNNEL |
+ NETIF_F_GSO_UDP_TUNNEL_CSUM |
+ NETIF_F_SCTP_CRC |
+--
+2.17.1
+
--- /dev/null
+From 8b535a73a40220374f468447cf6051bec36bf8b2 Mon Sep 17 00:00:00 2001
+From: Chinh T Cao <chinh.t.cao@intel.com>
+Date: Mon, 5 Nov 2018 12:18:35 -0800
+Subject: ice: Change req_speeds to be u16
+
+[ Upstream commit ffe498237b36ee42624e139b21efa05da4ff1f48 ]
+
+Since the req_speeds field in struct ice_link_status is a u8,
+req_speeds & ICE_AQ_LINK_SPEED_40GB always returns 0. This was caught
+by a coverity scan.
+
+Fix this by changing req_speeds to be u16.
+
+Reported-by: Bruce Allan <bruce.w.allan@intel.com>
+Signed-off-by: Chinh T Cao <chinh.t.cao@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_type.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index 97c366e0ca59..ba11b5898833 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -83,12 +83,12 @@ struct ice_link_status {
+ u64 phy_type_low;
+ u16 max_frame_size;
+ u16 link_speed;
++ u16 req_speeds;
+ u8 lse_ena; /* Link Status Event notification */
+ u8 link_info;
+ u8 an_info;
+ u8 ext_info;
+ u8 pacing;
+- u8 req_speeds;
+ /* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of
+ * ice_aqc_get_phy_caps structure
+ */
+--
+2.17.1
+
--- /dev/null
+From ad0f741158aee440dd7fd8fc468ebb205fa55d57 Mon Sep 17 00:00:00 2001
+From: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Date: Fri, 26 Oct 2018 10:40:52 -0700
+Subject: ice: Fix dead device link issue with flow control
+
+[ Upstream commit 0f5d4c21a50716f8bd4e220544b82dca7408d113 ]
+
+Setting Rx or Tx pause parameter currently results in link loss on the
+interface, requiring the platform/host to be cold power cycled. Fix it.
+
+Signed-off-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 9d6754f65a1a..4c5c87b158f5 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -797,10 +797,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
+ }
+
+ if (!test_bit(__ICE_DOWN, pf->state)) {
+- /* Give it a little more time to try to come back */
++ /* Give it a little more time to try to come back. If still
++ * down, restart autoneg link or reinitialize the interface.
++ */
+ msleep(75);
+ if (!test_bit(__ICE_DOWN, pf->state))
+ return ice_nway_reset(netdev);
++
++ ice_down(vsi);
++ ice_up(vsi);
+ }
+
+ return err;
+--
+2.17.1
+
--- /dev/null
+From fd297df63a0a2bcff13cd9a692bd9051ec667b91 Mon Sep 17 00:00:00 2001
+From: Brett Creeley <brett.creeley@intel.com>
+Date: Fri, 26 Oct 2018 10:40:59 -0700
+Subject: ice: Fix the bytecount sent to netdev_tx_sent_queue
+
+[ Upstream commit d944b46992f8e99b6bdc721e44b02e5ca294fa2b ]
+
+Currently if the driver does a TSO offload the bytecount sent to
+netdev_tx_sent_queue will be incorrect. This is because in ice_tso we
+overwrite the initial value that we set in ice_tx_map. This creates a
+mismatch between the Tx and Tx clean flow. In the Tx clean flow we
+calculate the bytecount (called total_bytes) as we clean the
+descriptors so the value used in the Tx clean path is correct. Fix this
+by using += in ice_tso instead of =. This fixes the mismatch in
+bytecount mentioned above.
+
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 6481e3d86374..0c95c8f83432 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1519,7 +1519,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
+
+ /* update gso_segs and bytecount */
+ first->gso_segs = skb_shinfo(skb)->gso_segs;
+- first->bytecount = (first->gso_segs - 1) * off->header_len;
++ first->bytecount += (first->gso_segs - 1) * off->header_len;
+
+ cd_tso_len = skb->len - off->header_len;
+ cd_mss = skb_shinfo(skb)->gso_size;
+--
+2.17.1
+
--- /dev/null
+From 10d22dcbed9f66ca6186907491021bbb1d6be404 Mon Sep 17 00:00:00 2001
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Date: Mon, 22 Oct 2018 08:44:31 +0200
+Subject: ixgbe: fix MAC anti-spoofing filter after VFLR
+
+[ Upstream commit 6702185c1ffec3421181b5e24491e3fac920cb61 ]
+
+This change resolves a driver bug where the driver is logging a
+message that says "Spoofed packets detected". This can occur on the PF
+(host) when a VF has VLAN+MACVLAN enabled and is re-started with a
+different MAC address.
+
+MAC and VLAN anti-spoofing filters are to be enabled together.
+
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Acked-by: Piotr Skajewski <piotrx.skajewski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 3c6f01c41b78..eea63a99f29c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -721,8 +721,10 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ ixgbe_set_vmvir(adapter, vfinfo->pf_vlan,
+ adapter->default_up, vf);
+
+- if (vfinfo->spoofchk_enabled)
++ if (vfinfo->spoofchk_enabled) {
+ hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf);
++ hw->mac.ops.set_mac_anti_spoofing(hw, true, vf);
++ }
+ }
+
+ /* reset multicast table array for vf */
+--
+2.17.1
+
--- /dev/null
+From b6a35eb1d428cb7b005b7354de21357833b39db0 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 6 Nov 2018 13:18:05 +0900
+Subject: kbuild: deb-pkg: fix too low build version number
+
+[ Upstream commit bbcde0a7241261cd0ca8d8e6b94a4113a4b71443 ]
+
+Since commit b41d920acff8 ("kbuild: deb-pkg: split generating packaging
+and build"), the build version of the kernel contained in a deb package
+is too low by 1.
+
+Prior to the bad commit, the kernel was built first, then the number
+in .version file was read out, and written into the debian control file.
+
+Now, the debian control file is created before the kernel is actually
+compiled, which is causing the version number mismatch.
+
+Let the mkdebian script pass KBUILD_BUILD_VERSION=${revision} to require
+the build system to use the specified version number.
+
+Fixes: b41d920acff8 ("kbuild: deb-pkg: split generating packaging and build")
+Reported-by: Doug Smythies <dsmythies@telus.net>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Tested-by: Doug Smythies <dsmythies@telus.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/package/mkdebian | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+index 663a7f343b42..edcad61fe3cd 100755
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -88,6 +88,7 @@ set_debarch() {
+ version=$KERNELRELEASE
+ if [ -n "$KDEB_PKGVERSION" ]; then
+ packageversion=$KDEB_PKGVERSION
++ revision=${packageversion##*-}
+ else
+ revision=$(cat .version 2>/dev/null||echo 1)
+ packageversion=$version-$revision
+@@ -205,10 +206,12 @@ cat <<EOF > debian/rules
+ #!$(command -v $MAKE) -f
+
+ build:
+- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC=
++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC=
+
+ binary-arch:
+- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg
++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg
+
+ clean:
+ rm -rf debian/*tmp debian/files
+--
+2.17.1
+
--- /dev/null
+From 51b7cbc382f37f81d5764af60f6ee682c7838c29 Mon Sep 17 00:00:00 2001
+From: Jeremy Linton <jeremy.linton@arm.com>
+Date: Mon, 5 Nov 2018 18:14:41 -0600
+Subject: lib/raid6: Fix arm64 test build
+
+[ Upstream commit 313a06e636808387822af24c507cba92703568b1 ]
+
+The lib/raid6/test fails to build the neon objects
+on arm64 because the correct machine type is 'aarch64'.
+
+Once this is correctly enabled, the neon recovery objects
+need to be added to the build.
+
+Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/test/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index 5d73f5cb4d8a..79777645cac9 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm)
+ CFLAGS += -I../../../arch/arm/include -mfpu=neon
+ HAS_NEON = yes
+ endif
+-ifeq ($(ARCH),arm64)
++ifeq ($(ARCH),aarch64)
+ CFLAGS += -I../../../arch/arm64/include
+ HAS_NEON = yes
+ endif
+@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes)
+ gcc -c -x assembler - >&/dev/null && \
+ rm ./-.o && echo -DCONFIG_AS_AVX512=1)
+ else ifeq ($(HAS_NEON),yes)
+- OBJS += neon.o neon1.o neon2.o neon4.o neon8.o
++ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+ CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+ HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
+--
+2.17.1
+
--- /dev/null
+From 7cf54720d9241a9e259ac1077a8a4164ad4491ce Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+Date: Tue, 6 Nov 2018 17:25:37 +0100
+Subject: mtd: nand: Fix nanddev_pos_next_page() kernel-doc header
+
+[ Upstream commit 98ee3fc7ef8395f8b7a379e6608aee91efc66d48 ]
+
+Function name is wrong in the kernel-doc header.
+
+Fixes: 9c3736a3de21 ("mtd: nand: Add core infrastructure to deal with NAND devices")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mtd/nand.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index 78b86dea2f29..7f53ece2c039 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -568,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand,
+ }
+
+ /**
+- * nanddev_pos_next_eraseblock() - Move a position to the next page
++ * nanddev_pos_next_page() - Move a position to the next page
+ * @nand: NAND device
+ * @pos: the position to update
+ *
+--
+2.17.1
+
--- /dev/null
+From ee294a8ae4de0b18fe0515300debb08aad03d3e1 Mon Sep 17 00:00:00 2001
+From: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Date: Fri, 9 Nov 2018 11:53:57 +0000
+Subject: net: aquantia: fix potential IOMMU fault after driver unbind
+
+[ Upstream commit 7a1bb49461b12b2e6332a4d054256835f45203f3 ]
+
+IOMMU fault may occurr on unbind/bind or if_down/if_up sequence.
+
+Although driver disables the rings on down, this is not enough.
+Due to internal HW design, during subsequent initialization
+NIC sometimes may reuse RX descriptors cache and write to the
+host memory from the descriptor cache.
+That's get catched by IOMMU on host.
+
+This patch invalidates the descriptor cache in NIC on interface down
+to prevent writing to the cached descriptors and to the memory pointed
+in those descriptors.
+
+Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 6 ++++++
+ .../aquantia/atlantic/hw_atl/hw_atl_llh.c | 8 ++++++++
+ .../aquantia/atlantic/hw_atl/hw_atl_llh.h | 3 +++
+ .../atlantic/hw_atl/hw_atl_llh_internal.h | 18 ++++++++++++++++++
+ 4 files changed, 35 insertions(+)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 1d44a386e7d3..0271a0fdfee8 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -915,6 +915,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
+ static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
+ {
+ hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
++
++ /* Invalidate Descriptor Cache to prevent writing to the cached
++ * descriptors and to the data pointer of those descriptors
++ */
++ hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
++
+ return aq_hw_err_from_flags(self);
+ }
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 10ba035dadb1..10ec5dc88e24 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode
+ HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
+ }
+
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
++{
++ aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
++ init);
++}
++
+ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ u32 rx_pkt_buff_size_per_tc, u32 buffer)
+ {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index dfb426f2dc2c..b3bf64b48b93 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ u32 rx_pkt_buff_size_per_tc,
+ u32 buffer);
+
++/* set rdm rx dma descriptor cache init */
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
++
+ /* set rx xoff enable (per tc) */
+ void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
+ u32 buffer);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index e0cf70120f1d..e2ecdb1c5a5c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -293,6 +293,24 @@
+ /* default value of bitfield desc{d}_reset */
+ #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0
+
++/* rdm_desc_init_i bitfield definitions
++ * preprocessor definitions for the bitfield rdm_desc_init_i.
++ * port="pif_rdm_desc_init_i"
++ */
++
++/* register address for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00
++/* bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff
++/* inverted bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000
++/* lower bit position of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0
++/* width of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32
++/* default value of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
++
+ /* rx int_desc_wrb_en bitfield definitions
+ * preprocessor definitions for the bitfield "int_desc_wrb_en".
+ * port="pif_rdm_int_desc_wrb_en_i"
+--
+2.17.1
+
--- /dev/null
+From 1caf287359877cf9f849f64276cdd20f97c78b11 Mon Sep 17 00:00:00 2001
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+Date: Fri, 9 Nov 2018 11:53:59 +0000
+Subject: net: aquantia: fixed enable unicast on 32 macvlan
+
+[ Upstream commit bfaa9f8553d5c20703781e63f4fc8cb4792f18fd ]
+
+Fixed a condition mistake due to which macvlans unicast
+item number 32 was not added in the unicast filter.
+
+The consequence is that when exactly 32 macvlans are created
+on NIC, the last created macvlan receives no traffic because
+its MAC was not registered in HW.
+
+Fixes: 94b3b542303f ("net: aquantia: vlan unicast address list correct handling")
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Tested-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 26dc6782b475..4f34808f1e06 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -590,7 +590,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ }
+ }
+
+- if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
++ if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) {
+ packet_filter |= IFF_MULTICAST;
+ self->mc_list.count = i;
+ self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+--
+2.17.1
+
--- /dev/null
+From 81558db486f097ba3a251514fd4ae3c0cafee5bb Mon Sep 17 00:00:00 2001
+From: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Date: Fri, 9 Nov 2018 11:54:01 +0000
+Subject: net: aquantia: invalid checksumm offload implementation
+
+[ Upstream commit ad703c2b9127f9acdef697ec4755f6da4beaa266 ]
+
+Packets with marked invalid IP/UDP/TCP checksums were considered as good
+by the driver. The error was in a logic, processing offload bits in
+RX descriptor.
+
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/aquantia/atlantic/aq_ring.c | 35 +++++++++++-------
+ .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 36 +++++++++----------
+ 2 files changed, 41 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index d1e1a0ba8615..7134d0d4cdf7 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
+ return !!budget;
+ }
+
++static void aq_rx_checksum(struct aq_ring_s *self,
++ struct aq_ring_buff_s *buff,
++ struct sk_buff *skb)
++{
++ if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM))
++ return;
++
++ if (unlikely(buff->is_cso_err)) {
++ ++self->stats.rx.errors;
++ skb->ip_summed = CHECKSUM_NONE;
++ return;
++ }
++ if (buff->is_ip_cso) {
++ __skb_incr_checksum_unnecessary(skb);
++ if (buff->is_udp_cso || buff->is_tcp_cso)
++ __skb_incr_checksum_unnecessary(skb);
++ } else {
++ skb->ip_summed = CHECKSUM_NONE;
++ }
++}
++
+ #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
+ int aq_ring_rx_clean(struct aq_ring_s *self,
+ struct napi_struct *napi,
+@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ }
+
+ skb->protocol = eth_type_trans(skb, ndev);
+- if (unlikely(buff->is_cso_err)) {
+- ++self->stats.rx.errors;
+- skb->ip_summed = CHECKSUM_NONE;
+- } else {
+- if (buff->is_ip_cso) {
+- __skb_incr_checksum_unnecessary(skb);
+- if (buff->is_udp_cso || buff->is_tcp_cso)
+- __skb_incr_checksum_unnecessary(skb);
+- } else {
+- skb->ip_summed = CHECKSUM_NONE;
+- }
+- }
++
++ aq_rx_checksum(self, buff, skb);
+
+ skb_set_hash(skb, buff->rss_hash,
+ buff->is_hash_l4 ? PKT_HASH_TYPE_L4 :
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 0271a0fdfee8..88705dee5b95 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -655,9 +655,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+ struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *)
+ &ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE];
+
+- unsigned int is_err = 1U;
+ unsigned int is_rx_check_sum_enabled = 0U;
+ unsigned int pkt_type = 0U;
++ u8 rx_stat = 0U;
+
+ if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */
+ break;
+@@ -665,35 +665,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+
+ buff = &ring->buff_ring[ring->hw_head];
+
+- is_err = (0x0000003CU & rxd_wb->status);
++ rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
+
+ is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
+- is_err &= ~0x20U; /* exclude validity bit */
+
+ pkt_type = 0xFFU & (rxd_wb->type >> 4);
+
+- if (is_rx_check_sum_enabled) {
+- if (0x0U == (pkt_type & 0x3U))
+- buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U;
++ if (is_rx_check_sum_enabled & BIT(0) &&
++ (0x0U == (pkt_type & 0x3U)))
++ buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U;
+
++ if (is_rx_check_sum_enabled & BIT(1)) {
+ if (0x4U == (pkt_type & 0x1CU))
+- buff->is_udp_cso = buff->is_cso_err ? 0U : 1U;
++ buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U :
++ !!(rx_stat & BIT(3));
+ else if (0x0U == (pkt_type & 0x1CU))
+- buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U;
+-
+- /* Checksum offload workaround for small packets */
+- if (rxd_wb->pkt_len <= 60) {
+- buff->is_ip_cso = 0U;
+- buff->is_cso_err = 0U;
+- }
++ buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U :
++ !!(rx_stat & BIT(3));
++ }
++ buff->is_cso_err = !!(rx_stat & 0x6);
++ /* Checksum offload workaround for small packets */
++ if (unlikely(rxd_wb->pkt_len <= 60)) {
++ buff->is_ip_cso = 0U;
++ buff->is_cso_err = 0U;
+ }
+-
+- is_err &= ~0x18U;
+
+ dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE);
+
+- if (is_err || rxd_wb->type & 0x1000U) {
+- /* status error or DMA error */
++ if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) {
++ /* MAC error or DMA error */
+ buff->is_error = 1U;
+ } else {
+ if (self->aq_nic_cfg->is_rss) {
+--
+2.17.1
+
--- /dev/null
+From ec784e6849aab6b8d28bbf3e0be0123f21a657fd Mon Sep 17 00:00:00 2001
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Tue, 30 Oct 2018 21:50:51 +0800
+Subject: net: hns3: bugfix for handling mailbox while the command queue
+ reinitialized
+
+[ Upstream commit 3c88ed1d798da355859ca083d3884a16ce0841f2 ]
+
+In a multi-core machine, the mailbox service and reset service
+will be executed at the same time. The reset service will re-initialize
+the command queue, before that, the mailbox handler can only get some
+invalid messages.
+
+The HCLGE_STATE_CMD_DISABLE flag means that the command queue is not
+available and needs to be reinitialized. Therefore, when the mailbox
+handler recognizes this flag, it should not process the command.
+
+Fixes: dde1a86e93ca ("net: hns3: Add mailbox support to PF driver")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index f34851c91eb3..e08e82020402 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -458,6 +458,12 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
+
+ /* handle all the mailbox requests in the queue */
+ while (!hclge_cmd_crq_empty(&hdev->hw)) {
++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state)) {
++ dev_warn(&hdev->pdev->dev,
++ "command queue needs re-initializing\n");
++ return;
++ }
++
+ desc = &crq->desc[crq->next_to_use];
+ req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
+
+--
+2.17.1
+
--- /dev/null
+From 691446aad65abb5622ff54f27304f4e4448cffb0 Mon Sep 17 00:00:00 2001
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Tue, 30 Oct 2018 21:50:52 +0800
+Subject: net: hns3: bugfix for rtnl_lock's range in the hclge_reset()
+
+[ Upstream commit a963052e539887df481d4d3a6ad4c92ca6461852 ]
+
+Since hclge_reset_wait() is used to wait for the hardware to complete
+the reset, it is not necessary to hold the rtnl_lock during
+hclge_reset_wait(). So this patch releases the lock for the duration
+of hclge_reset_wait().
+
+Fixes: 6d4fab39533f ("net: hns3: Reset net device with rtnl_lock")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index db763450e5e3..340baf6a470c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2804,14 +2804,17 @@ static void hclge_reset(struct hclge_dev *hdev)
+ handle = &hdev->vport[0].nic;
+ rtnl_lock();
+ hclge_notify_client(hdev, HNAE3_DOWN_CLIENT);
++ rtnl_unlock();
+
+ if (!hclge_reset_wait(hdev)) {
++ rtnl_lock();
+ hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+ hclge_reset_ae_dev(hdev->ae_dev);
+ hclge_notify_client(hdev, HNAE3_INIT_CLIENT);
+
+ hclge_clear_reset_cause(hdev);
+ } else {
++ rtnl_lock();
+ /* schedule again to check pending resets later */
+ set_bit(hdev->reset_type, &hdev->reset_pending);
+ hclge_reset_task_schedule(hdev);
+--
+2.17.1
+
--- /dev/null
+From 31cdf923231b0da3e23e2529086e73c051e5cc0e Mon Sep 17 00:00:00 2001
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Tue, 30 Oct 2018 21:50:53 +0800
+Subject: net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset()
+
+[ Upstream commit 29118ab962d5476fdc65fae312ac38db68092d78 ]
+
+Since hclgevf_reset_wait() is used to wait for the hardware to complete
+the reset, it is not necessary to hold the rtnl_lock during
+hclgevf_reset_wait(). So this patch releases the lock for the duration
+of hclgevf_reset_wait().
+
+Fixes: 6988eb2a9b77 ("net: hns3: Add support to reset the enet/ring mgmt layer")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 320043e87fc6..5570fb5dc2eb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1065,6 +1065,8 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ /* bring down the nic to stop any ongoing TX/RX */
+ hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT);
+
++ rtnl_unlock();
++
+ /* check if VF could successfully fetch the hardware reset completion
+ * status from the hardware
+ */
+@@ -1076,12 +1078,15 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ ret);
+
+ dev_warn(&hdev->pdev->dev, "VF reset failed, disabling VF!\n");
++ rtnl_lock();
+ hclgevf_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+
+ rtnl_unlock();
+ return ret;
+ }
+
++ rtnl_lock();
++
+ /* now, re-initialize the nic client and ae device*/
+ ret = hclgevf_reset_stack(hdev);
+ if (ret)
+--
+2.17.1
+
--- /dev/null
+From 0861d1b4a85475a62ce6d232b4727970263584a3 Mon Sep 17 00:00:00 2001
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Tue, 30 Oct 2018 21:50:46 +0800
+Subject: net: hns3: bugfix for the initialization of command queue's spin lock
+
+[ Upstream commit b2f74dbaf12bf59ff35d451005b3cdee78232ff0 ]
+
+The spin lock of the command queue only need to be initialized once
+when the driver initializes the command queue. It is not necessary to
+initialize the spin lock when resetting. At the same time, the
+modification of the queue member should be performed after acquiring
+the lock.
+
+Fixes: 3efb960f056d ("net: hns3: Refactor the initialization of command queue")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index ac13cb2b168e..68026a5ad7e7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -304,6 +304,10 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev)
+ {
+ int ret;
+
++ /* Setup the lock for command queue */
++ spin_lock_init(&hdev->hw.cmq.csq.lock);
++ spin_lock_init(&hdev->hw.cmq.crq.lock);
++
+ /* Setup the queue entries for use cmd queue */
+ hdev->hw.cmq.csq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+ hdev->hw.cmq.crq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+@@ -337,18 +341,20 @@ int hclge_cmd_init(struct hclge_dev *hdev)
+ u32 version;
+ int ret;
+
++ spin_lock_bh(&hdev->hw.cmq.csq.lock);
++ spin_lock_bh(&hdev->hw.cmq.crq.lock);
++
+ hdev->hw.cmq.csq.next_to_clean = 0;
+ hdev->hw.cmq.csq.next_to_use = 0;
+ hdev->hw.cmq.crq.next_to_clean = 0;
+ hdev->hw.cmq.crq.next_to_use = 0;
+
+- /* Setup the lock for command queue */
+- spin_lock_init(&hdev->hw.cmq.csq.lock);
+- spin_lock_init(&hdev->hw.cmq.crq.lock);
+-
+ hclge_cmd_init_regs(&hdev->hw);
+ clear_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
+
++ spin_unlock_bh(&hdev->hw.cmq.crq.lock);
++ spin_unlock_bh(&hdev->hw.cmq.csq.lock);
++
+ ret = hclge_cmd_query_firmware_version(&hdev->hw, &version);
+ if (ret) {
+ dev_err(&hdev->pdev->dev,
+--
+2.17.1
+
--- /dev/null
+From 81253370b2ddfabd9a772ef0fc73a6fd8de17cf6 Mon Sep 17 00:00:00 2001
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Fri, 2 Nov 2018 17:47:48 +0800
+Subject: net: hns3: Fix for out-of-bounds access when setting pfc back
+ pressure
+
+[ Upstream commit e8ccbb7d2f53c62e14b889faaa3f6f809b657278 ]
+
+The vport should be initialized to hdev->vport for each bp group,
+otherwise it will cause out-of-bounds access and bp setting not
+correct problem.
+
+[ 35.254124] BUG: KASAN: slab-out-of-bounds in hclge_pause_setup_hw+0x2a0/0x3f8 [hclge]
+[ 35.254126] Read of size 2 at addr ffff803b6651581a by task kworker/0:1/14
+
+[ 35.254132] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.0-rc7-hulk+ #85
+[ 35.254133] Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI RC0 - B052 (V0.52) 09/14/2018
+[ 35.254141] Workqueue: events work_for_cpu_fn
+[ 35.254144] Call trace:
+[ 35.254147] dump_backtrace+0x0/0x2f0
+[ 35.254149] show_stack+0x24/0x30
+[ 35.254154] dump_stack+0x110/0x184
+[ 35.254157] print_address_description+0x168/0x2b0
+[ 35.254160] kasan_report+0x184/0x310
+[ 35.254162] __asan_load2+0x7c/0xa0
+[ 35.254170] hclge_pause_setup_hw+0x2a0/0x3f8 [hclge]
+[ 35.254177] hclge_tm_init_hw+0x794/0x9f0 [hclge]
+[ 35.254184] hclge_tm_schd_init+0x48/0x58 [hclge]
+[ 35.254191] hclge_init_ae_dev+0x778/0x1168 [hclge]
+[ 35.254196] hnae3_register_ae_dev+0x14c/0x298 [hnae3]
+[ 35.254206] hns3_probe+0x88/0xa8 [hns3]
+[ 35.254210] local_pci_probe+0x7c/0xf0
+[ 35.254212] work_for_cpu_fn+0x34/0x50
+[ 35.254214] process_one_work+0x4d4/0xa38
+[ 35.254216] worker_thread+0x55c/0x8d8
+[ 35.254219] kthread+0x1b0/0x1b8
+[ 35.254222] ret_from_fork+0x10/0x1c
+
+[ 35.254224] The buggy address belongs to the page:
+[ 35.254228] page:ffff7e00ed994400 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
+[ 35.273835] flags: 0xfffff8000008000(head)
+[ 35.282007] raw: 0fffff8000008000 dead000000000100 dead000000000200 0000000000000000
+[ 35.282010] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
+[ 35.282012] page dumped because: kasan: bad access detected
+
+[ 35.282014] Memory state around the buggy address:
+[ 35.282017] ffff803b66515700: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
+[ 35.282019] ffff803b66515780: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
+[ 35.282021] >ffff803b66515800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
+[ 35.282022] ^
+[ 35.282024] ffff803b66515880: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
+[ 35.282026] ffff803b66515900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
+[ 35.282028] ==================================================================
+[ 35.282029] Disabling lock debugging due to kernel taint
+[ 35.282747] hclge driver initialization finished.
+
+Fixes: 67bf2541f4b9 ("net: hns3: Fixes the back pressure setting when sriov is enabled")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 5db70a1451c5..48235dc2dd56 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1167,14 +1167,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+ */
+ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ {
+- struct hclge_vport *vport = hdev->vport;
+- u32 i, k, qs_bitmap;
+- int ret;
++ int i;
+
+ for (i = 0; i < HCLGE_BP_GRP_NUM; i++) {
+- qs_bitmap = 0;
++ u32 qs_bitmap = 0;
++ int k, ret;
+
+ for (k = 0; k < hdev->num_alloc_vport; k++) {
++ struct hclge_vport *vport = &hdev->vport[k];
+ u16 qs_id = vport->qs_offset + tc;
+ u8 grp, sub_grp;
+
+@@ -1184,8 +1184,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ HCLGE_BP_SUB_GRP_ID_S);
+ if (i == grp)
+ qs_bitmap |= (1 << sub_grp);
+-
+- vport++;
+ }
+
+ ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap);
+--
+2.17.1
+
--- /dev/null
+From dfc566f6ec0ac43624afa9866b934c9cbd761270 Mon Sep 17 00:00:00 2001
+From: Thor Thayer <thor.thayer@linux.intel.com>
+Date: Thu, 8 Nov 2018 11:42:14 -0600
+Subject: net: stmmac: Fix RX packet size > 8191
+
+[ Upstream commit 8137b6ef0ce469154e5cf19f8e7fe04d9a72ac5e ]
+
+Ping problems with packets > 8191 as shown:
+
+PING 192.168.1.99 (192.168.1.99) 8150(8178) bytes of data.
+8158 bytes from 192.168.1.99: icmp_seq=1 ttl=64 time=0.669 ms
+wrong data byte 8144 should be 0xd0 but was 0x0
+16 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+ 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
+%< ---------------snip--------------------------------------
+8112 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf
+ c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf
+8144 0 0 0 0 d0 d1
+ ^^^^^^^
+Notice the 4 bytes of 0 before the expected byte of d0.
+
+Databook notes that the RX buffer must be a multiple of 4/8/16
+bytes [1].
+
+Update the DMA Buffer size define to 8188 instead of 8192. Remove
+the -1 from the RX buffer size allocations and use the new
+DMA Buffer size directly.
+
+[1] Synopsys DesignWare Cores Ethernet MAC Universal v3.70a
+ [section 8.4.2 - Table 8-24]
+
+Tested on SoCFPGA Stratix10 with ping sweep from 100 to 8300 byte packets.
+
+Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)")
+Suggested-by: Jose Abreu <jose.abreu@synopsys.com>
+Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h | 3 ++-
+ drivers/net/ethernet/stmicro/stmmac/descs_com.h | 2 +-
+ drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 2 +-
+ drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +-
+ 4 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index b1b305f8f414..272b9ca66314 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -365,7 +365,8 @@ struct dma_features {
+
+ /* GMAC TX FIFO is 8K, Rx FIFO is 16K */
+ #define BUF_SIZE_16KiB 16384
+-#define BUF_SIZE_8KiB 8192
++/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */
++#define BUF_SIZE_8KiB 8188
+ #define BUF_SIZE_4KiB 4096
+ #define BUF_SIZE_2KiB 2048
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+index ca9d7e48034c..40d6356a7e73 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+@@ -31,7 +31,7 @@
+ /* Enhanced descriptors */
+ static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+ {
+- p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1)
++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+ << ERDES1_BUFFER2_SIZE_SHIFT)
+ & ERDES1_BUFFER2_SIZE_MASK);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index 77914c89d749..5ef91a790f9d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+ int mode, int end)
+ {
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK);
++ p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ehn_desc_rx_set_on_chain(p);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+index a7ffc73fffe8..bc83ced94e1b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p)
+ static int set_16kib_bfsize(int mtu)
+ {
+ int ret = 0;
+- if (unlikely(mtu >= BUF_SIZE_8KiB))
++ if (unlikely(mtu > BUF_SIZE_8KiB))
+ ret = BUF_SIZE_16KiB;
+ return ret;
+ }
+--
+2.17.1
+
--- /dev/null
+From 072552f5d8390596453f2b239852e54d0e37b602 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 24 Oct 2018 13:54:03 +0200
+Subject: netfilter: bridge: define INT_MIN & INT_MAX in userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 5a8de47b3c250521dd632cdedaac6db88367defa ]
+
+With 4.19, programs like ebtables fail to build when they include
+"linux/netfilter_bridge.h". It is caused by commit 94276fa8a2a4 which
+added a use of INT_MIN and INT_MAX to the header:
+: In file included from /usr/include/linux/netfilter_bridge/ebtables.h:18,
+: from include/ebtables_u.h:28,
+: from communication.c:23:
+: /usr/include/linux/netfilter_bridge.h:30:20: error: 'INT_MIN' undeclared here (not in a function)
+: NF_BR_PRI_FIRST = INT_MIN,
+: ^~~~~~~
+
+Define these constants by including "limits.h" when !__KERNEL__ (the
+same way as for other netfilter_* headers).
+
+Fixes: 94276fa8a2a4 ("netfilter: bridge: Expose nf_tables bridge hook priorities through uapi")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Acked-by: Máté Eckl <ecklm94@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 156ccd089df1..1610fdbab98d 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -11,6 +11,10 @@
+ #include <linux/if_vlan.h>
+ #include <linux/if_pppox.h>
+
++#ifndef __KERNEL__
++#include <limits.h> /* for INT_MIN, INT_MAX */
++#endif
++
+ /* Bridge Hooks */
+ /* After promisc drops, checksum checks. */
+ #define NF_BR_PRE_ROUTING 0
+--
+2.17.1
+
--- /dev/null
+From 5361d4011cf0dc629fc991ce1366ce0dd1584919 Mon Sep 17 00:00:00 2001
+From: Eric Westbrook <eric@westbrook.io>
+Date: Tue, 28 Aug 2018 15:14:42 -0600
+Subject: netfilter: ipset: actually allow allowable CIDR 0 in
+ hash:net,port,net
+
+[ Upstream commit 886503f34d63e681662057448819edb5b1057a97 ]
+
+Allow /0 as advertised for hash:net,port,net sets.
+
+For "hash:net,port,net", ipset(8) says that "either subnet
+is permitted to be a /0 should you wish to match port
+between all destinations."
+
+Make that statement true.
+
+Before:
+
+ # ipset create cidrzero hash:net,port,net
+ # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0
+ ipset v6.34: The value of the CIDR parameter of the IP address is invalid
+
+ # ipset create cidrzero6 hash:net,port,net family inet6
+ # ipset add cidrzero6 ::/0,12345,::/0
+ ipset v6.34: The value of the CIDR parameter of the IP address is invalid
+
+After:
+
+ # ipset create cidrzero hash:net,port,net
+ # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0
+ # ipset test cidrzero 192.168.205.129,12345,172.16.205.129
+ 192.168.205.129,tcp:12345,172.16.205.129 is in set cidrzero.
+
+ # ipset create cidrzero6 hash:net,port,net family inet6
+ # ipset add cidrzero6 ::/0,12345,::/0
+ # ipset test cidrzero6 fe80::1,12345,ff00::1
+ fe80::1,tcp:12345,ff00::1 is in set cidrzero6.
+
+See also:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=200897
+ https://github.com/ewestbrook/linux/commit/df7ff6efb0934ab6acc11f003ff1a7580d6c1d9c
+
+Signed-off-by: Eric Westbrook <linux@westbrook.io>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
+index d391485a6acd..613e18e720a4 100644
+--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
+@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
+
+ if (tb[IPSET_ATTR_CIDR]) {
+ e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+- if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++ if (e.cidr[0] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+ if (tb[IPSET_ATTR_CIDR2]) {
+ e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+- if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++ if (e.cidr[1] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
+
+ if (tb[IPSET_ATTR_CIDR]) {
+ e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+- if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++ if (e.cidr[0] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+ if (tb[IPSET_ATTR_CIDR2]) {
+ e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+- if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++ if (e.cidr[1] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 285c4f9167eb1e4536bcc7867416d515bd5570a1 Mon Sep 17 00:00:00 2001
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Fri, 19 Oct 2018 19:35:19 +0200
+Subject: netfilter: ipset: Correct rcu_dereference() call in
+ ip_set_put_comment()
+
+[ Upstream commit 17b8b74c0f8dbf9b9e3301f9ca5b65dd1c079951 ]
+
+The function is called when rcu_read_lock() is held and not
+when rcu_read_lock_bh() is held.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/ipset/ip_set_comment.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h
+index 8e2bab1e8e90..70877f8de7e9 100644
+--- a/include/linux/netfilter/ipset/ip_set_comment.h
++++ b/include/linux/netfilter/ipset/ip_set_comment.h
+@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
+ rcu_assign_pointer(comment->c, c);
+ }
+
+-/* Used only when dumping a set, protected by rcu_read_lock_bh() */
++/* Used only when dumping a set, protected by rcu_read_lock() */
+ static inline int
+ ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
+ {
+- struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c);
++ struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
+
+ if (!c)
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From 6ddec6a83123c3aafb5282c637c845ec5c29eddc Mon Sep 17 00:00:00 2001
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Tue, 30 Oct 2018 22:43:42 +0100
+Subject: netfilter: ipset: Fix calling ip_set() macro at dumping
+
+[ Upstream commit 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 ]
+
+The ip_set() macro is called when either ip_set_ref_lock held only
+or no lock/nfnl mutex is held at dumping. Take this into account
+properly. Also, use Pablo's suggestion to use rcu_dereference_raw(),
+the ref_netlink protects the set.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_core.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 68db946df151..1577f2f76060 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
+ MODULE_DESCRIPTION("core IP set support");
+ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
+
+-/* When the nfnl mutex is held: */
++/* When the nfnl mutex or ip_set_ref_lock is held: */
+ #define ip_set_dereference(p) \
+- rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
++ rcu_dereference_protected(p, \
++ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
++ lockdep_is_held(&ip_set_ref_lock))
+ #define ip_set(inst, id) \
+ ip_set_dereference((inst)->ip_set_list)[id]
++#define ip_set_ref_netlink(inst,id) \
++ rcu_dereference_raw((inst)->ip_set_list)[id]
+
+ /* The set types are implemented in modules and registered set types
+ * can be found in ip_set_type_list. Adding/deleting types is
+@@ -1251,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb)
+ struct ip_set_net *inst =
+ (struct ip_set_net *)cb->args[IPSET_CB_NET];
+ ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
+- struct ip_set *set = ip_set(inst, index);
++ struct ip_set *set = ip_set_ref_netlink(inst, index);
+
+ if (set->variant->uref)
+ set->variant->uref(set, cb, false);
+@@ -1440,7 +1444,7 @@ next_set:
+ release_refcount:
+ /* If there was an error or set is done, release set */
+ if (ret || !cb->args[IPSET_CB_ARG0]) {
+- set = ip_set(inst, index);
++ set = ip_set_ref_netlink(inst, index);
+ if (set->variant->uref)
+ set->variant->uref(set, cb, false);
+ pr_debug("release set %s\n", set->name);
+--
+2.17.1
+
--- /dev/null
+From dcd440dae67976b1599fc5cc1b7263027f769311 Mon Sep 17 00:00:00 2001
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Date: Mon, 22 Oct 2018 23:30:40 +0200
+Subject: netfilter: ipset: fix ip_set_list allocation failure
+
+[ Upstream commit ed956f3947a01ff9875cd908d7c1ef1fe7f47bf0 ]
+
+ip_set_create() and ip_set_net_init() attempt to allocate physically
+contiguous memory for ip_set_list. If memory is fragmented, the
+allocations could easily fail:
+
+ vzctl: page allocation failure: order:7, mode:0xc0d0
+
+ Call Trace:
+ dump_stack+0x19/0x1b
+ warn_alloc_failed+0x110/0x180
+ __alloc_pages_nodemask+0x7bf/0xc60
+ alloc_pages_current+0x98/0x110
+ kmalloc_order+0x18/0x40
+ kmalloc_order_trace+0x26/0xa0
+ __kmalloc+0x279/0x290
+ ip_set_net_init+0x4b/0x90 [ip_set]
+ ops_init+0x3b/0xb0
+ setup_net+0xbb/0x170
+ copy_net_ns+0xf1/0x1c0
+ create_new_namespaces+0xf9/0x180
+ copy_namespaces+0x8e/0xd0
+ copy_process+0xb61/0x1a00
+ do_fork+0x91/0x320
+
+Use kvcalloc() to fallback to 0-order allocations if high order
+page isn't available.
+
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index fa15a831aeee..68db946df151 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -960,7 +960,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ /* Wraparound */
+ goto cleanup;
+
+- list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
++ list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
+ if (!list)
+ goto cleanup;
+ /* nfnl mutex is held, both lists are valid */
+@@ -972,7 +972,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ /* Use new list */
+ index = inst->ip_set_max;
+ inst->ip_set_max = i;
+- kfree(tmp);
++ kvfree(tmp);
+ ret = 0;
+ } else if (ret) {
+ goto cleanup;
+@@ -2058,7 +2058,7 @@ ip_set_net_init(struct net *net)
+ if (inst->ip_set_max >= IPSET_INVALID_ID)
+ inst->ip_set_max = IPSET_INVALID_ID - 1;
+
+- list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
++ list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
+ if (!list)
+ return -ENOMEM;
+ inst->is_deleted = false;
+@@ -2086,7 +2086,7 @@ ip_set_net_exit(struct net *net)
+ }
+ }
+ nfnl_unlock(NFNL_SUBSYS_IPSET);
+- kfree(rcu_dereference_protected(inst->ip_set_list, 1));
++ kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
+ }
+
+ static struct pernet_operations ip_set_net_ops = {
+--
+2.17.1
+
--- /dev/null
+From 90d7474a400f3f7125bdd4c91db6e6d91a458035 Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Sat, 14 Jul 2018 21:59:43 +0200
+Subject: netfilter: ipset: list:set: Decrease refcount synchronously on
+ deletion and replace
+
+[ Upstream commit 439cd39ea136d2c026805264d58a91f36b6b64ca ]
+
+Commit 45040978c899 ("netfilter: ipset: Fix set:list type crash
+when flush/dump set in parallel") postponed decreasing set
+reference counters to the RCU callback.
+
+An 'ipset del' command can terminate before the RCU grace period
+is elapsed, and if sets are listed before then, the reference
+counter shown in userspace will be wrong:
+
+ # ipset create h hash:ip; ipset create l list:set; ipset add l
+ # ipset del l h; ipset list h
+ Name: h
+ Type: hash:ip
+ Revision: 4
+ Header: family inet hashsize 1024 maxelem 65536
+ Size in memory: 88
+ References: 1
+ Number of entries: 0
+ Members:
+ # sleep 1; ipset list h
+ Name: h
+ Type: hash:ip
+ Revision: 4
+ Header: family inet hashsize 1024 maxelem 65536
+ Size in memory: 88
+ References: 0
+ Number of entries: 0
+ Members:
+
+Fix this by making the reference count update synchronous again.
+
+As a result, when sets are listed, ip_set_name_byindex() might
+now fetch a set whose reference count is already zero. Instead
+of relying on the reference count to protect against concurrent
+set renaming, grab ip_set_ref_lock as reader and copy the name,
+while holding the same lock in ip_set_rename() as writer
+instead.
+
+Reported-by: Li Shuang <shuali@redhat.com>
+Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/ipset/ip_set.h | 2 +-
+ net/netfilter/ipset/ip_set_core.c | 23 +++++++++++------------
+ net/netfilter/ipset/ip_set_list_set.c | 17 +++++++++++------
+ 3 files changed, 23 insertions(+), 19 deletions(-)
+
+diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
+index 34fc80f3eb90..1d100efe74ec 100644
+--- a/include/linux/netfilter/ipset/ip_set.h
++++ b/include/linux/netfilter/ipset/ip_set.h
+@@ -314,7 +314,7 @@ enum {
+ extern ip_set_id_t ip_set_get_byname(struct net *net,
+ const char *name, struct ip_set **set);
+ extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
+-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index);
++extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
+ extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
+ extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index bc4bd247bb7d..fa15a831aeee 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -693,21 +693,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index)
+ EXPORT_SYMBOL_GPL(ip_set_put_byindex);
+
+ /* Get the name of a set behind a set index.
+- * We assume the set is referenced, so it does exist and
+- * can't be destroyed. The set cannot be renamed due to
+- * the referencing either.
+- *
++ * Set itself is protected by RCU, but its name isn't: to protect against
++ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
++ * name.
+ */
+-const char *
+-ip_set_name_byindex(struct net *net, ip_set_id_t index)
++void
++ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
+ {
+- const struct ip_set *set = ip_set_rcu_get(net, index);
++ struct ip_set *set = ip_set_rcu_get(net, index);
+
+ BUG_ON(!set);
+- BUG_ON(set->ref == 0);
+
+- /* Referenced, so it's safe */
+- return set->name;
++ read_lock_bh(&ip_set_ref_lock);
++ strncpy(name, set->name, IPSET_MAXNAMELEN);
++ read_unlock_bh(&ip_set_ref_lock);
+ }
+ EXPORT_SYMBOL_GPL(ip_set_name_byindex);
+
+@@ -1153,7 +1152,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ if (!set)
+ return -ENOENT;
+
+- read_lock_bh(&ip_set_ref_lock);
++ write_lock_bh(&ip_set_ref_lock);
+ if (set->ref != 0) {
+ ret = -IPSET_ERR_REFERENCED;
+ goto out;
+@@ -1170,7 +1169,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ strncpy(set->name, name2, IPSET_MAXNAMELEN);
+
+ out:
+- read_unlock_bh(&ip_set_ref_lock);
++ write_unlock_bh(&ip_set_ref_lock);
+ return ret;
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 072a658fde04..4eef55da0878 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ {
+ struct set_elem *e = container_of(rcu, struct set_elem, rcu);
+ struct ip_set *set = e->set;
+- struct list_set *map = set->data;
+
+- ip_set_put_byindex(map->net, e->id);
+ ip_set_ext_destroy(set, e);
+ kfree(e);
+ }
+@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ static inline void
+ list_set_del(struct ip_set *set, struct set_elem *e)
+ {
++ struct list_set *map = set->data;
++
+ set->elements--;
+ list_del_rcu(&e->list);
++ ip_set_put_byindex(map->net, e->id);
+ call_rcu(&e->rcu, __list_set_del_rcu);
+ }
+
+ static inline void
+-list_set_replace(struct set_elem *e, struct set_elem *old)
++list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
+ {
++ struct list_set *map = set->data;
++
+ list_replace_rcu(&old->list, &e->list);
++ ip_set_put_byindex(map->net, old->id);
+ call_rcu(&old->rcu, __list_set_del_rcu);
+ }
+
+@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ INIT_LIST_HEAD(&e->list);
+ list_set_init_extensions(set, ext, e);
+ if (n)
+- list_set_replace(e, n);
++ list_set_replace(set, e, n);
+ else if (next)
+ list_add_tail_rcu(&e->list, &next->list);
+ else if (prev)
+@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set,
+ const struct list_set *map = set->data;
+ struct nlattr *atd, *nested;
+ u32 i = 0, first = cb->args[IPSET_CB_ARG0];
++ char name[IPSET_MAXNAMELEN];
+ struct set_elem *e;
+ int ret = 0;
+
+@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set,
+ nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+ if (!nested)
+ goto nla_put_failure;
+- if (nla_put_string(skb, IPSET_ATTR_NAME,
+- ip_set_name_byindex(map->net, e->id)))
++ ip_set_name_byindex(map->net, e->id, name);
++ if (nla_put_string(skb, IPSET_ATTR_NAME, name))
+ goto nla_put_failure;
+ if (ip_set_put_extensions(skb, set, e, true))
+ goto nla_put_failure;
+--
+2.17.1
+
--- /dev/null
+From c61346045b7b00ff8c2f29468d8a8b31e50f4a5a Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 23 Oct 2018 16:47:16 +0200
+Subject: netfilter: ipv6: fix oops when defragmenting locally generated
+ fragments
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 61792b677415b77c8db04991c22966bb8de7603e ]
+
+Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
+not save/restore skb->dst.
+
+This causes oops when handling locally generated ipv6 fragments, as
+output path needs a valid dst.
+
+Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
+Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 8f68a518d9db..f76bd4d15704 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ */
+ ret = -EINPROGRESS;
+ if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+- fq->q.meat == fq->q.len &&
+- nf_ct_frag6_reasm(fq, skb, dev))
+- ret = 0;
+- else
++ fq->q.meat == fq->q.len) {
++ unsigned long orefdst = skb->_skb_refdst;
++
++ skb->_skb_refdst = 0UL;
++ if (nf_ct_frag6_reasm(fq, skb, dev))
++ ret = 0;
++ skb->_skb_refdst = orefdst;
++ } else {
+ skb_dst_drop(skb);
++ }
+
+ out_unlock:
+ spin_unlock_bh(&fq->q.lock);
+--
+2.17.1
+
--- /dev/null
+From 7b1197491a6f34af0c7f31c6ac6b86f0b2176dd4 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 2 Nov 2018 11:33:37 +0100
+Subject: netfilter: nft_compat: ebtables 'nat' table is normal chain type
+
+[ Upstream commit e4844c9c62a0fe47980d6c3d4b7a096a5d755925 ]
+
+Unlike ip(6)tables, the ebtables nat table has no special properties.
+This bug causes 'ebtables -A' to fail when using a target such as
+'snat' (ebt_snat target sets ".table = "nat"'). Targets that have
+no table restrictions work fine.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_compat.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 32535eea51b2..ad2fe6a7e47d 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
+ return false;
+ }
+
+-static int nft_compat_chain_validate_dependency(const char *tablename,
+- const struct nft_chain *chain)
++static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
++ const char *tablename)
+ {
++ enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
++ const struct nft_chain *chain = ctx->chain;
+ const struct nft_base_chain *basechain;
+
+ if (!tablename ||
+@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
+ return 0;
+
+ basechain = nft_base_chain(chain);
+- if (strcmp(tablename, "nat") == 0 &&
+- basechain->type->type != NFT_CHAIN_T_NAT)
+- return -EINVAL;
++ if (strcmp(tablename, "nat") == 0) {
++ if (ctx->family != NFPROTO_BRIDGE)
++ type = NFT_CHAIN_T_NAT;
++ if (basechain->type->type != type)
++ return -EINVAL;
++ }
+
+ return 0;
+ }
+@@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
+ if (target->hooks && !(hook_mask & target->hooks))
+ return -EINVAL;
+
+- ret = nft_compat_chain_validate_dependency(target->table,
+- ctx->chain);
++ ret = nft_compat_chain_validate_dependency(ctx, target->table);
+ if (ret < 0)
+ return ret;
+ }
+@@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
+ if (match->hooks && !(hook_mask & match->hooks))
+ return -EINVAL;
+
+- ret = nft_compat_chain_validate_dependency(match->table,
+- ctx->chain);
++ ret = nft_compat_chain_validate_dependency(ctx, match->table);
+ if (ret < 0)
+ return ret;
+ }
+--
+2.17.1
+
--- /dev/null
+From 717561792b6a79467acbfa5758cd4f4c5e7ef771 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sun, 21 Oct 2018 00:00:08 +0900
+Subject: netfilter: xt_IDLETIMER: add sysfs filename checking routine
+
+[ Upstream commit 54451f60c8fa061af9051a53be9786393947367c ]
+
+When IDLETIMER rule is added, sysfs file is created under
+/sys/class/xt_idletimer/timers/
+But some label name shouldn't be used.
+".", "..", "power", "uevent", "subsystem", etc...
+So that sysfs filename checking routine is needed.
+
+test commands:
+ %iptables -I INPUT -j IDLETIMER --timeout 1 --label "power"
+
+splat looks like:
+[95765.423132] sysfs: cannot create duplicate filename '/devices/virtual/xt_idletimer/timers/power'
+[95765.433418] CPU: 0 PID: 8446 Comm: iptables Not tainted 4.19.0-rc6+ #20
+[95765.449755] Call Trace:
+[95765.449755] dump_stack+0xc9/0x16b
+[95765.449755] ? show_regs_print_info+0x5/0x5
+[95765.449755] sysfs_warn_dup+0x74/0x90
+[95765.449755] sysfs_add_file_mode_ns+0x352/0x500
+[95765.449755] sysfs_create_file_ns+0x179/0x270
+[95765.449755] ? sysfs_add_file_mode_ns+0x500/0x500
+[95765.449755] ? idletimer_tg_checkentry+0x3e5/0xb1b [xt_IDLETIMER]
+[95765.449755] ? rcu_read_lock_sched_held+0x114/0x130
+[95765.449755] ? __kmalloc_track_caller+0x211/0x2b0
+[95765.449755] ? memcpy+0x34/0x50
+[95765.449755] idletimer_tg_checkentry+0x4e2/0xb1b [xt_IDLETIMER]
+[ ... ]
+
+Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_IDLETIMER.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
+index 5ee859193783..25453a16385e 100644
+--- a/net/netfilter/xt_IDLETIMER.c
++++ b/net/netfilter/xt_IDLETIMER.c
+@@ -116,6 +116,22 @@ static void idletimer_tg_expired(struct timer_list *t)
+ schedule_work(&timer->work);
+ }
+
++static int idletimer_check_sysfs_name(const char *name, unsigned int size)
++{
++ int ret;
++
++ ret = xt_check_proc_name(name, size);
++ if (ret < 0)
++ return ret;
++
++ if (!strcmp(name, "power") ||
++ !strcmp(name, "subsystem") ||
++ !strcmp(name, "uevent"))
++ return -EINVAL;
++
++ return 0;
++}
++
+ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ {
+ int ret;
+@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ goto out;
+ }
+
++ ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
++ if (ret < 0)
++ goto out_free_timer;
++
+ sysfs_attr_init(&info->timer->attr.attr);
+ info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
+ if (!info->timer->attr.attr.name) {
+--
+2.17.1
+
--- /dev/null
+From abe1043e83dc129aeb30ceb6cb78406531e4ffa7 Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Fri, 2 Nov 2018 11:22:13 -0700
+Subject: nvme: make sure ns head inherits underlying device limits
+
+[ Upstream commit 8f676b8508c250bbe255096522fdefb73f1ea0b9 ]
+
+Whenever we update ns_head info, we need to make sure it is still
+compatible with all underlying backing devices because although nvme
+multipath doesn't have any explicit use of these limits, other devices
+can still be stacked on top of it which may rely on the underlying limits.
+Start with unlimited stacking limits, and every info update iterate over
+siblings and adjust queue limits.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 4 +++-
+ drivers/nvme/host/multipath.c | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 6bb9908bf46f..0ba301f7e8b4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ if (ns->ndev)
+ nvme_nvm_update_nvm_info(ns);
+ #ifdef CONFIG_NVME_MULTIPATH
+- if (ns->head->disk)
++ if (ns->head->disk) {
+ nvme_update_disk_info(ns->head->disk, ns, id);
++ blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
++ }
+ #endif
+ }
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index b71c9ad1bf45..c27af277e14e 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -257,6 +257,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
+ blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+ /* set to a default value for 512 until disk is validated */
+ blk_queue_logical_block_size(q, 512);
++ blk_set_stacking_limits(&q->limits);
+
+ /* we need to propagate up the VMC settings */
+ if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
+--
+2.17.1
+
--- /dev/null
+From 7fda1c39674aff4b743da6cdca41c82cef741f40 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Wed, 31 Oct 2018 13:15:29 -0600
+Subject: nvme-pci: fix conflicting p2p resource adds
+
+[ Upstream commit 9fe5c59ff6a1e5e26a39b75489a1420e7eaaf0b1 ]
+
+The nvme pci driver had been adding its CMB resource to the P2P DMA
+subsystem everytime on on a controller reset. This results in the
+following warning:
+
+ ------------[ cut here ]------------
+ nvme 0000:00:03.0: Conflicting mapping in same section
+ WARNING: CPU: 7 PID: 81 at kernel/memremap.c:155 devm_memremap_pages+0xa6/0x380
+ ...
+ Call Trace:
+ pci_p2pdma_add_resource+0x153/0x370
+ nvme_reset_work+0x28c/0x17b1 [nvme]
+ ? add_timer+0x107/0x1e0
+ ? dequeue_entity+0x81/0x660
+ ? dequeue_entity+0x3b0/0x660
+ ? pick_next_task_fair+0xaf/0x610
+ ? __switch_to+0xbc/0x410
+ process_one_work+0x1cf/0x350
+ worker_thread+0x215/0x3d0
+ ? process_one_work+0x350/0x350
+ kthread+0x107/0x120
+ ? kthread_park+0x80/0x80
+ ret_from_fork+0x1f/0x30
+ ---[ end trace f7ea76ac6ee72727 ]---
+ nvme nvme0: failed to register the CMB
+
+This patch fixes this by registering the CMB with P2P only once.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index d668682f91df..da18e0ac9fa2 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1647,6 +1647,9 @@ static void nvme_map_cmb(struct nvme_dev *dev)
+ struct pci_dev *pdev = to_pci_dev(dev->dev);
+ int bar;
+
++ if (dev->cmb_size)
++ return;
++
+ dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
+ if (!dev->cmbsz)
+ return;
+@@ -2129,7 +2132,6 @@ static void nvme_pci_disable(struct nvme_dev *dev)
+ {
+ struct pci_dev *pdev = to_pci_dev(dev->dev);
+
+- nvme_release_cmb(dev);
+ pci_free_irq_vectors(pdev);
+
+ if (pci_is_enabled(pdev)) {
+@@ -2577,6 +2579,7 @@ static void nvme_remove(struct pci_dev *pdev)
+ nvme_stop_ctrl(&dev->ctrl);
+ nvme_remove_namespaces(&dev->ctrl);
+ nvme_dev_disable(dev, true);
++ nvme_release_cmb(dev);
+ nvme_free_host_mem(dev);
+ nvme_dev_remove_admin(dev);
+ nvme_free_queues(dev, 0);
+--
+2.17.1
+
--- /dev/null
+From 6eafc68e2c3145eae7c7ecb64d977664a1539919 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Wed, 7 Nov 2018 16:30:32 +0000
+Subject: of/device: Really only set bus DMA mask when appropriate
+
+[ Upstream commit 6778be4e520959659b27a441c06a84c9cb009085 ]
+
+of_dma_configure() was *supposed* to be following the same logic as
+acpi_dma_configure() and only setting bus_dma_mask if some range was
+specified by the firmware. However, it seems that subtlety got lost in
+the process of fitting it into the differently-shaped control flow, and
+as a result the force_dma==true case ends up always setting the bus mask
+to the 32-bit default, which is not what anyone wants.
+
+Make sure we only touch it if the DT actually said so.
+
+Fixes: 6c2fb2ea7636 ("of/device: Set bus DMA mask as appropriate")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Reported-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Robert Richter <robert.richter@cavium.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 5957cd4fa262..40b9051a7fce 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
+ * set by the driver.
+ */
+ mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+- dev->bus_dma_mask = mask;
+ dev->coherent_dma_mask &= mask;
+ *dev->dma_mask &= mask;
++ /* ...but only set bus mask if we found valid dma-ranges earlier */
++ if (!ret)
++ dev->bus_dma_mask = mask;
+
+ coherent = of_dma_is_coherent(np);
+ dev_dbg(dev, "device is%sdma coherent\n",
+--
+2.17.1
+
--- /dev/null
+From 480ba6b056e2bd701bbc0985119fab1adead4d64 Mon Sep 17 00:00:00 2001
+From: David Miller <davem@davemloft.net>
+Date: Wed, 17 Oct 2018 12:08:59 -0700
+Subject: perf symbols: Set PLT entry/header sizes properly on Sparc
+
+[ Upstream commit d6afa561e1471ccfdaf7191230c0c59a37e45a5b ]
+
+Using the sh_entsize for both values isn't correct. It happens to be
+correct on x86...
+
+For both 32-bit and 64-bit sparc, there are four PLT entries in the PLT
+section.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexis Berlemont <alexis.berlemont@gmail.com>
+Cc: David Tolnay <dtolnay@gmail.com>
+Cc: Hanjun Guo <guohanjun@huawei.com>
+Cc: Hemant Kumar <hemant@linux.vnet.ibm.com>
+Cc: Li Bin <huawei.libin@huawei.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Milian Wolff <milian.wolff@kdab.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: zhangmengting@huawei.com
+Fixes: b2f7605076d6 ("perf symbols: Fix plt entry calculation for ARM and AARCH64")
+Link: http://lkml.kernel.org/r/20181017.120859.2268840244308635255.davem@davemloft.net
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 29770ea61768..6e70cc00c161 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -324,7 +324,17 @@ int dso__synthesize_plt_symbols(struct dso *dso, struct symsrc *ss)
+ plt_entry_size = 16;
+ break;
+
+- default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/sparc/xtensa need to be checked */
++ case EM_SPARC:
++ plt_header_size = 48;
++ plt_entry_size = 12;
++ break;
++
++ case EM_SPARCV9:
++ plt_header_size = 128;
++ plt_entry_size = 32;
++ break;
++
++ default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/xtensa need to be checked */
+ plt_header_size = shdr_plt.sh_entsize;
+ plt_entry_size = shdr_plt.sh_entsize;
+ break;
+--
+2.17.1
+
--- /dev/null
+From c5371021eea9795a69cbddc67d84cf1a86feab52 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Sun, 23 Sep 2018 17:04:20 +0200
+Subject: perf tools: Do not zero sample_id_all for group members
+
+[ Upstream commit 8e88c29b351ed4e09dd63f825f1c8260b0cb0ab3 ]
+
+Andi reported following malfunction:
+
+ # perf record -e '{ref-cycles,cycles}:S' -a sleep 1
+ # perf script
+ non matching sample_id_all
+
+That's because we disable sample_id_all bit for non-sampling group
+members. We can't do that, because it needs to be the same over the
+whole event list. This patch keeps it untouched again.
+
+Reported-by: Andi Kleen <andi@firstfloor.org>
+Tested-by: Andi Kleen <andi@firstfloor.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180923150420.27327-1-jolsa@kernel.org
+Fixes: e9add8bac6c6 ("perf evsel: Disable write_backward for leader sampling group events")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/attr/test-record-group-sampling | 1 -
+ tools/perf/util/evsel.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
+index 8a33ca4f9e1f..f0729c454f16 100644
+--- a/tools/perf/tests/attr/test-record-group-sampling
++++ b/tools/perf/tests/attr/test-record-group-sampling
+@@ -37,4 +37,3 @@ sample_freq=0
+ sample_period=0
+ freq=0
+ write_backward=0
+-sample_id_all=0
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index e596ae358c4d..03a72310315f 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -952,7 +952,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
+ attr->sample_freq = 0;
+ attr->sample_period = 0;
+ attr->write_backward = 0;
+- attr->sample_id_all = 0;
+ }
+
+ if (opts->no_samples)
+--
+2.17.1
+
--- /dev/null
+From 23d720ab8f56ba87689b46c76274535a30d5709b Mon Sep 17 00:00:00 2001
+From: Gustavo Romero <gromero@linux.vnet.ibm.com>
+Date: Thu, 1 Nov 2018 20:13:21 -0400
+Subject: perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so
+
+[ Upstream commit 6ac2226229d931153331a93d90655a3de05b9290 ]
+
+Currently jvmti agent can not be used because function scnprintf is not
+present in the agent libperf-jvmti.so. As a result the JVM when using
+such agent to record JITed code profiling information will fail on
+looking up scnprintf:
+
+ java: symbol lookup error: lib/libperf-jvmti.so: undefined symbol: scnprintf
+
+This commit fixes that by reverting to the use of snprintf, that can be
+looked up, instead of scnprintf, adding a proper check for the returned
+value in order to print a better error message when the jitdump file
+pathname is too long. Checking the returned value also helps to comply
+with some recent gcc versions, like gcc8, which will fail due to
+truncated writing checks related to the -Werror=format-truncation= flag.
+
+Signed-off-by: Gustavo Romero <gromero@linux.vnet.ibm.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+LPU-Reference: 1541117601-18937-2-git-send-email-gromero@linux.vnet.ibm.com
+Link: https://lkml.kernel.org/n/tip-mvpxxxy7wnzaj74cq75muw3f@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/jvmti/jvmti_agent.c | 49 ++++++++++++++++++++++++++--------
+ 1 file changed, 38 insertions(+), 11 deletions(-)
+
+diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
+index ac1bcdc17dae..f7eb63cbbc65 100644
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -125,7 +125,7 @@ perf_get_timestamp(void)
+ }
+
+ static int
+-debug_cache_init(void)
++create_jit_cache_dir(void)
+ {
+ char str[32];
+ char *base, *p;
+@@ -144,8 +144,13 @@ debug_cache_init(void)
+
+ strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm);
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base);
+-
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because %s/.debug/"
++ " is too long, please check the cwd, JITDUMPDIR, and"
++ " HOME variables", base);
++ return -1;
++ }
+ ret = mkdir(jit_path, 0755);
+ if (ret == -1) {
+ if (errno != EEXIST) {
+@@ -154,20 +159,32 @@ debug_cache_init(void)
+ }
+ }
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base);
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because"
++ " %s/.debug/jit is too long, please check the cwd,"
++ " JITDUMPDIR, and HOME variables", base);
++ return -1;
++ }
+ ret = mkdir(jit_path, 0755);
+ if (ret == -1) {
+ if (errno != EEXIST) {
+- warn("cannot create jit cache dir %s", jit_path);
++ warn("jvmti: cannot create jit cache dir %s", jit_path);
+ return -1;
+ }
+ }
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str);
+-
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because"
++ " %s/.debug/jit/%s.XXXXXXXX is too long, please check"
++ " the cwd, JITDUMPDIR, and HOME variables",
++ base, str);
++ return -1;
++ }
+ p = mkdtemp(jit_path);
+ if (p != jit_path) {
+- warn("cannot create jit cache dir %s", jit_path);
++ warn("jvmti: cannot create jit cache dir %s", jit_path);
+ return -1;
+ }
+
+@@ -228,7 +245,7 @@ void *jvmti_open(void)
+ {
+ char dump_path[PATH_MAX];
+ struct jitheader header;
+- int fd;
++ int fd, ret;
+ FILE *fp;
+
+ init_arch_timestamp();
+@@ -245,12 +262,22 @@ void *jvmti_open(void)
+
+ memset(&header, 0, sizeof(header));
+
+- debug_cache_init();
++ /*
++ * jitdump file dir
++ */
++ if (create_jit_cache_dir() < 0)
++ return NULL;
+
+ /*
+ * jitdump file name
+ */
+- scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++ ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jitdump file full path because"
++ " %s/jit-%i.dump is too long, please check the cwd,"
++ " JITDUMPDIR, and HOME variables", jit_path, getpid());
++ return NULL;
++ }
+
+ fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
+ if (fd == -1)
+--
+2.17.1
+
--- /dev/null
+From 59bb8b38758e9dfb2f7980b009361b3aa926f8d5 Mon Sep 17 00:00:00 2001
+From: Milian Wolff <milian.wolff@kdab.com>
+Date: Mon, 29 Oct 2018 15:16:44 +0100
+Subject: perf unwind: Take pgoff into account when reporting elf to libdwfl
+
+[ Upstream commit 1fe627da30331024f453faef04d500079b901107 ]
+
+libdwfl parses an ELF file itself and creates mappings for the
+individual sections. perf on the other hand sees raw mmap events which
+represent individual sections. When we encounter an address pointing
+into a mapping with pgoff != 0, we must take that into account and
+report the file at the non-offset base address.
+
+This fixes unwinding with libdwfl in some cases. E.g. for a file like:
+
+```
+
+using namespace std;
+
+mutex g_mutex;
+
+double worker()
+{
+ lock_guard<mutex> guard(g_mutex);
+ uniform_real_distribution<double> uniform(-1E5, 1E5);
+ default_random_engine engine;
+ double s = 0;
+ for (int i = 0; i < 1000; ++i) {
+ s += norm(complex<double>(uniform(engine), uniform(engine)));
+ }
+ cout << s << endl;
+ return s;
+}
+
+int main()
+{
+ vector<std::future<double>> results;
+ for (int i = 0; i < 10000; ++i) {
+ results.push_back(async(launch::async, worker));
+ }
+ return 0;
+}
+```
+
+Compile it with `g++ -g -O2 -lpthread cpp-locking.cpp -o cpp-locking`,
+then record it with `perf record --call-graph dwarf -e
+sched:sched_switch`.
+
+When you analyze it with `perf script` and libunwind, you should see:
+
+```
+cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so)
+ 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so)
+ 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so)
+ 7f38e42569e5 __GI___libc_malloc+0x115 (inlined)
+ 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined)
+ 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined)
+ 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined)
+ 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined)
+ 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined)
+ 7f38e463fa6d std::basic_streambuf<char, std::char_traits<char> >::sputn(char const*, long)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> >::_M_put(char const*, long)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> > std::__write<char>(std::ostreambuf_iterator<char, std::char_traits<char> >, char const*, int)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> > std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::_M_insert_float<double>(std::ostreambuf_iterator<c>
+ 7f38e464bd70 std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::put(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, double) const+0x90 (inl>
+ 7f38e464bd70 std::ostream& std::ostream::_M_insert<double>(double)+0x90 (/usr/lib/libstdc++.so.6.0.25)
+ 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined)
+ 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking)
+ 563b9cb506fb double std::__invoke_impl<double, double (*)()>(std::__invoke_other, double (*&&)())+0x2b (inlined)
+ 563b9cb506fb std::__invoke_result<double (*)()>::type std::__invoke<double (*)()>(double (*&&)())+0x2b (inlined)
+ 563b9cb506fb decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker<std::tuple<double (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>)+0x2b (inlined)
+ 563b9cb506fb std::thread::_Invoker<std::tuple<double (*)()> >::operator()()+0x2b (inlined)
+ 563b9cb506fb std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<double>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<double (*)()> >, dou>
+ 563b9cb506fb std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_>
+ 563b9cb507e8 std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>::operator()() const+0x28 (inlined)
+ 563b9cb507e8 std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*)+0x28 (/ssd/milian/>
+ 7f38e46d24fe __pthread_once_slow+0xbe (/usr/lib/libpthread-2.28.so)
+ 563b9cb51149 __gthread_once+0xe9 (inlined)
+ 563b9cb51149 void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*)>
+ 563b9cb51149 std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool)+0xe9 (inlined)
+ 563b9cb51149 std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_impl(std::thread::_Invoker<std::tuple<double (*)()> >&&)::{lambda()#1}::op>
+ 563b9cb51149 void std::__invoke_impl<void, std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_impl(std::thread::_Invoker<std::tuple<double>
+ 563b9cb51149 std::__invoke_result<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_impl(std::thread::_Invoker<std::tuple<double (*)()> >>
+ 563b9cb51149 decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_>
+ 563b9cb51149 std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_impl(std::thread::_Invoker<std::tuple<dou>
+ 563b9cb51149 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<double (*)()> >, double>::_Async_state_impl(std::thread>
+ 7f38e45f0062 execute_native_thread_routine+0x12 (/usr/lib/libstdc++.so.6.0.25)
+ 7f38e46caa9c start_thread+0xfc (/usr/lib/libpthread-2.28.so)
+ 7f38e42ccb22 __GI___clone+0x42 (inlined)
+```
+
+Before this patch, using libdwfl, you would see:
+
+```
+cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so)
+ a041161e77950c5c [unknown] ([unknown])
+```
+
+With this patch applied, we get a bit further in unwinding:
+
+```
+cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux)
+ 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so)
+ 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so)
+ 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so)
+ 7f38e42569e5 __GI___libc_malloc+0x115 (inlined)
+ 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined)
+ 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined)
+ 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined)
+ 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined)
+ 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined)
+ 7f38e463fa6d std::basic_streambuf<char, std::char_traits<char> >::sputn(char const*, long)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> >::_M_put(char const*, long)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> > std::__write<char>(std::ostreambuf_iterator<char, std::char_traits<char> >, char const*, int)+0x1cd (inlined)
+ 7f38e463fa6d std::ostreambuf_iterator<char, std::char_traits<char> > std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::_M_insert_float<double>(std::ostreambuf_iterator<c>
+ 7f38e464bd70 std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::put(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, double) const+0x90 (inl>
+ 7f38e464bd70 std::ostream& std::ostream::_M_insert<double>(double)+0x90 (/usr/lib/libstdc++.so.6.0.25)
+ 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined)
+ 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking)
+ 6eab825c1ee3e4ff [unknown] ([unknown])
+```
+
+Note that the backtrace is still stopping too early, when compared to
+the nice results obtained via libunwind. It's unclear so far what the
+reason for that is.
+
+Committer note:
+
+Further comment by Milian on the thread started on the Link: tag below:
+
+ ---
+The remaining issue is due to a bug in elfutils:
+
+https://sourceware.org/ml/elfutils-devel/2018-q4/msg00089.html
+
+With both patches applied, libunwind and elfutils produce the same output for
+the above scenario.
+ ---
+
+Signed-off-by: Milian Wolff <milian.wolff@kdab.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: http://lkml.kernel.org/r/20181029141644.3907-1-milian.wolff@kdab.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 6f318b15950e..5eff9bfc5758 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -45,13 +45,13 @@ static int __report_module(struct addr_location *al, u64 ip,
+ Dwarf_Addr s;
+
+ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+- if (s != al->map->start)
++ if (s != al->map->start - al->map->pgoff)
+ mod = 0;
+ }
+
+ if (!mod)
+ mod = dwfl_report_elf(ui->dwfl, dso->short_name,
+- (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start,
++ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff,
+ false);
+
+ return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
+--
+2.17.1
+
--- /dev/null
+From 8a0b59921f985fc484d4b3c1b871ef60410f22c1 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Thu, 20 Sep 2018 21:44:19 -0400
+Subject: platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
+
+[ Upstream commit 684238d79ad85c5e19a71bb5818e77e329912fbc ]
+
+To fix:
+
+ acerhdf: unknown (unsupported) BIOS version Gateway /LT31 /v1.3307 , please report, aborting!
+
+As can be seen in the context, the BIOS registers haven't changed in
+the previous versions, so the assumption is they won't have changed
+in this last update for this somewhat older platform either.
+
+Cc: Peter Feuerer <peter@piie.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: Andy Shevchenko <andy@infradead.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Peter Feuerer <peter@piie.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acerhdf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
+index ea22591ee66f..53dfe67807e3 100644
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = {
+ {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0},
+ {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0},
+ {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0},
++ {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0},
+ /* Packard Bell */
+ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0},
+ {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0},
+--
+2.17.1
+
--- /dev/null
+From 40119a31096a035630085d80ee3c14640470bb73 Mon Sep 17 00:00:00 2001
+From: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+Date: Sat, 6 Oct 2018 12:21:13 +0530
+Subject: platform/x86: intel_telemetry: report debugfs failure
+
+[ Upstream commit 8d98b1ef368feeb7720b8b9b6f3bd93f2ad892bc ]
+
+On some Goldmont based systems such as ASRock J3455M the BIOS may not
+enable the IPC1 device that provides access to the PMC and PUNIT. In
+such scenarios, the IOSS and PSS resources from the platform device can
+not be obtained and result in a invalid telemetry_plt_config which is an
+internal data structure that holds platform config and is maintained by
+the telemetry platform driver.
+
+This is also applicable to the platforms where the BIOS supports IPC1
+device under debug configurations but IPC1 is disabled by user or the
+policy.
+
+This change allows user to know the reason for not seeing entries under
+/sys/kernel/debug/telemetry/* when there is no apparent failure at boot.
+
+Cc: Matt Turner <matt.turner@intel.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Souvik Kumar Chakravarty <souvik.k.chakravarty@intel.com>
+Cc: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@intel.com>
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=198779
+Acked-by: Matt Turner <matt.turner@intel.com>
+Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_telemetry_debugfs.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
+index ffd0474b0531..1423fa8710fd 100644
+--- a/drivers/platform/x86/intel_telemetry_debugfs.c
++++ b/drivers/platform/x86/intel_telemetry_debugfs.c
+@@ -951,12 +951,16 @@ static int __init telemetry_debugfs_init(void)
+ debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data;
+
+ err = telemetry_pltconfig_valid();
+- if (err < 0)
++ if (err < 0) {
++ pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n");
+ return -ENODEV;
++ }
+
+ err = telemetry_debugfs_check_evts();
+- if (err < 0)
++ if (err < 0) {
++ pr_info("telemetry_debugfs_check_evts failed\n");
+ return -EINVAL;
++ }
+
+ register_pm_notifier(&pm_notifier);
+
+--
+2.17.1
+
--- /dev/null
+From db355e4ed765bb298b241c7fceceb4fc96c95e16 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <denis.bolotin@cavium.com>
+Date: Thu, 8 Nov 2018 16:46:09 +0200
+Subject: qed: Fix blocking/unlimited SPQ entries leak
+
+[ Upstream commit 2632f22ebd08da249c2017962a199a0cfb2324bf ]
+
+When there are no SPQ entries left in the free_pool, new entries are
+allocated and are added to the unlimited list. When an entry in the pool
+is available, the content is copied from the original entry, and the new
+entry is sent to the device. qed_spq_post() is not aware of that, so the
+additional entry is stored in the original entry as p_post_ent, which can
+later be returned to the pool.
+
+Signed-off-by: Denis Bolotin <denis.bolotin@cavium.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_sp.h | 3 ++
+ drivers/net/ethernet/qlogic/qed/qed_spq.c | 57 ++++++++++++-----------
+ 2 files changed, 33 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+index e95431f6acd4..04259df8a5c2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -167,6 +167,9 @@ struct qed_spq_entry {
+ enum spq_mode comp_mode;
+ struct qed_spq_comp_cb comp_cb;
+ struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */
++
++ /* Posted entry for unlimited list entry in EBLOCK mode */
++ struct qed_spq_entry *post_ent;
+ };
+
+ struct qed_eq {
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+index 1673fc90027f..43619b6bb232 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -685,6 +685,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn,
+ /* EBLOCK responsible to free the allocated p_ent */
+ if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
+ kfree(p_ent);
++ else
++ p_ent->post_ent = p_en2;
+
+ p_ent = p_en2;
+ }
+@@ -768,6 +770,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+ SPQ_HIGH_PRI_RESERVE_DEFAULT);
+ }
+
++/* Avoid overriding of SPQ entries when getting out-of-order completions, by
++ * marking the completions in a bitmap and increasing the chain consumer only
++ * for the first successive completed entries.
++ */
++static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo)
++{
++ u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
++ struct qed_spq *p_spq = p_hwfn->p_spq;
++
++ __set_bit(pos, p_spq->p_comp_bitmap);
++ while (test_bit(p_spq->comp_bitmap_idx,
++ p_spq->p_comp_bitmap)) {
++ __clear_bit(p_spq->comp_bitmap_idx,
++ p_spq->p_comp_bitmap);
++ p_spq->comp_bitmap_idx++;
++ qed_chain_return_produced(&p_spq->chain);
++ }
++}
++
+ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry *p_ent, u8 *fw_return_code)
+ {
+@@ -825,11 +846,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ p_ent->queue == &p_spq->unlimited_pending);
+
+ if (p_ent->queue == &p_spq->unlimited_pending) {
+- /* This is an allocated p_ent which does not need to
+- * return to pool.
+- */
++ struct qed_spq_entry *p_post_ent = p_ent->post_ent;
++
+ kfree(p_ent);
+- return rc;
++
++ /* Return the entry which was actually posted */
++ p_ent = p_post_ent;
+ }
+
+ if (rc)
+@@ -843,7 +865,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ spq_post_fail2:
+ spin_lock_bh(&p_spq->lock);
+ list_del(&p_ent->list);
+- qed_chain_return_produced(&p_spq->chain);
++ qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo);
+
+ spq_post_fail:
+ /* return to the free pool */
+@@ -875,25 +897,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ spin_lock_bh(&p_spq->lock);
+ list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) {
+ if (p_ent->elem.hdr.echo == echo) {
+- u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+-
+ list_del(&p_ent->list);
+-
+- /* Avoid overriding of SPQ entries when getting
+- * out-of-order completions, by marking the completions
+- * in a bitmap and increasing the chain consumer only
+- * for the first successive completed entries.
+- */
+- __set_bit(pos, p_spq->p_comp_bitmap);
+-
+- while (test_bit(p_spq->comp_bitmap_idx,
+- p_spq->p_comp_bitmap)) {
+- __clear_bit(p_spq->comp_bitmap_idx,
+- p_spq->p_comp_bitmap);
+- p_spq->comp_bitmap_idx++;
+- qed_chain_return_produced(&p_spq->chain);
+- }
+-
++ qed_spq_comp_bmap_update(p_hwfn, echo);
+ p_spq->comp_count++;
+ found = p_ent;
+ break;
+@@ -932,11 +937,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ QED_MSG_SPQ,
+ "Got a completion without a callback function\n");
+
+- if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
+- (found->queue == &p_spq->unlimited_pending))
++ if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
+ /* EBLOCK is responsible for returning its own entry into the
+- * free list, unless it originally added the entry into the
+- * unlimited pending list.
++ * free list.
+ */
+ qed_spq_return_entry(p_hwfn, found);
+
+--
+2.17.1
+
--- /dev/null
+From f1a5ed0e6d08ef47bf07ce3a8ef6acae081ba3e6 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <denis.bolotin@cavium.com>
+Date: Thu, 8 Nov 2018 16:46:08 +0200
+Subject: qed: Fix memory/entry leak in qed_init_sp_request()
+
+[ Upstream commit 39477551df940ddb1339203817de04f5caaacf7a ]
+
+Free the allocated SPQ entry or return the acquired SPQ entry to the free
+list in error flows.
+
+Signed-off-by: Denis Bolotin <denis.bolotin@cavium.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/qlogic/qed/qed_sp_commands.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+index 77b6248ad3b9..e86a1ea23613 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+@@ -80,7 +80,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+
+ case QED_SPQ_MODE_BLOCK:
+ if (!p_data->p_comp_data)
+- return -EINVAL;
++ goto err;
+
+ p_ent->comp_cb.cookie = p_data->p_comp_data->cookie;
+ break;
+@@ -95,7 +95,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ default:
+ DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n",
+ p_ent->comp_mode);
+- return -EINVAL;
++ goto err;
+ }
+
+ DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+@@ -109,6 +109,18 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod));
+
+ return 0;
++
++err:
++ /* qed_spq_get_entry() can either get an entry from the free_pool,
++ * or, if no entries are left, allocate a new entry and add it to
++ * the unlimited_pending list.
++ */
++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
++ kfree(p_ent);
++ else
++ qed_spq_return_entry(p_hwfn, p_ent);
++
++ return -EINVAL;
+ }
+
+ static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type)
+--
+2.17.1
+
--- /dev/null
+From 03521501d8b60d44c6f5b428c1409131fc6626ef Mon Sep 17 00:00:00 2001
+From: Sagiv Ozeri <sagiv.ozeri@cavium.com>
+Date: Thu, 8 Nov 2018 16:46:11 +0200
+Subject: qed: Fix potential memory corruption
+
+[ Upstream commit fa5c448d98f0df660bfcad3dd5facc027ef84cd3 ]
+
+A stuck ramrod should be deleted from the completion_pending list,
+otherwise it will be added again in the future and corrupt the list.
+
+Return error value to inform that ramrod is stuck and should be deleted.
+
+Signed-off-by: Sagiv Ozeri <sagiv.ozeri@cavium.com>
+Signed-off-by: Denis Bolotin <denis.bolotin@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_spq.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+index 43619b6bb232..7106ad17afe2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+
+ DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n");
+ rc = qed_mcp_drain(p_hwfn, p_ptt);
++ qed_ptt_release(p_hwfn, p_ptt);
+ if (rc) {
+ DP_NOTICE(p_hwfn, "MCP drain failed\n");
+ goto err;
+@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+ /* Retry after drain */
+ rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true);
+ if (!rc)
+- goto out;
++ return 0;
+
+ comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie;
+- if (comp_done->done == 1)
++ if (comp_done->done == 1) {
+ if (p_fw_ret)
+ *p_fw_ret = comp_done->fw_return_code;
+-out:
+- qed_ptt_release(p_hwfn, p_ptt);
+- return 0;
+-
++ return 0;
++ }
+ err:
+- qed_ptt_release(p_hwfn, p_ptt);
+ DP_NOTICE(p_hwfn,
+ "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n",
+ le32_to_cpu(p_ent->elem.hdr.cid),
+--
+2.17.1
+
--- /dev/null
+From 8ed8a0f4e8bb1a935857990f55d3c6f131ac0555 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <denis.bolotin@cavium.com>
+Date: Thu, 8 Nov 2018 16:46:10 +0200
+Subject: qed: Fix SPQ entries not returned to pool in error flows
+
+[ Upstream commit fb5e7438e7a3c8966e04ccb0760170e9e06f3699 ]
+
+qed_sp_destroy_request() API was added for SPQ users that need to
+free/return the entry they acquired in their error flows.
+
+Signed-off-by: Denis Bolotin <denis.bolotin@cavium.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_fcoe.c | 11 +++++++---
+ drivers/net/ethernet/qlogic/qed/qed_iscsi.c | 1 +
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 12 ++++++----
+ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 1 +
+ drivers/net/ethernet/qlogic/qed/qed_roce.c | 1 +
+ drivers/net/ethernet/qlogic/qed/qed_sp.h | 11 ++++++++++
+ .../net/ethernet/qlogic/qed/qed_sp_commands.c | 22 ++++++++++++-------
+ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 +
+ 8 files changed, 45 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+index cc1b373c0ace..46dc93d3b9b5 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n",
+ fcoe_pf_params->num_cqs,
+ p_hwfn->hw_info.feat_num[QED_FCOE_CQ]);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto err;
+ }
+
+ p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu);
+@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+
+ rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid);
+ if (rc)
+- return rc;
++ goto err;
+
+ cxt_info.iid = dummy_cid;
+ rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info);
+ if (rc) {
+ DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n",
+ dummy_cid);
+- return rc;
++ goto err;
+ }
+ p_cxt = cxt_info.p_cxt;
+ SET_FIELD(p_cxt->tstorm_ag_context.flags3,
+@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ rc = qed_spq_post(p_hwfn, p_ent, NULL);
+
+ return rc;
++
++err:
++ qed_sp_destroy_request(p_hwfn, p_ent);
++ return rc;
+ }
+
+ static int
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+index 1135387bd99d..4f8a685d1a55 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
+ "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n",
+ p_params->num_queues,
+ p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 82a1bd1f8a8c..67c02ea93906 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+
+ rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params);
+ if (rc) {
+- /* Return spq entry which is taken in qed_sp_init_request()*/
+- qed_spq_return_entry(p_hwfn, p_ent);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+
+@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn,
+ DP_NOTICE(p_hwfn,
+ "%d is not supported yet\n",
+ p_filter_cmd->opcode);
++ qed_sp_destroy_request(p_hwfn, *pp_ent);
+ return -EINVAL;
+ }
+
+@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ } else {
+ rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id);
+ if (rc)
+- return rc;
++ goto err;
+
+ if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) {
+ rc = qed_fw_l2_queue(p_hwfn, p_params->qid,
+ &abs_rx_q_id);
+ if (rc)
+- return rc;
++ goto err;
+
+ p_ramrod->rx_qid_valid = 1;
+ p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id);
+@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ (u64)p_params->addr, p_params->length);
+
+ return qed_spq_post(p_hwfn, p_ent, NULL);
++
++err:
++ qed_sp_destroy_request(p_hwfn, p_ent);
++ return rc;
+ }
+
+ int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index c71391b9c757..62113438c880 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -1514,6 +1514,7 @@ qed_rdma_register_tid(void *rdma_cxt,
+ default:
+ rc = -EINVAL;
+ DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+ SET_FIELD(p_ramrod->flags1,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+index f9167d1354bb..e49fada85410 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn,
+ DP_NOTICE(p_hwfn,
+ "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n",
+ rc);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+index 04259df8a5c2..3157c0d99441 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -399,6 +399,17 @@ struct qed_sp_init_data {
+ struct qed_spq_comp_cb *p_comp_data;
+ };
+
++/**
++ * @brief Returns a SPQ entry to the pool / frees the entry if allocated.
++ * Should be called on in error flows after initializing the SPQ entry
++ * and before posting it.
++ *
++ * @param p_hwfn
++ * @param p_ent
++ */
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++ struct qed_spq_entry *p_ent);
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry **pp_ent,
+ u8 cmd,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+index e86a1ea23613..888274fa208b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+@@ -47,6 +47,19 @@
+ #include "qed_sp.h"
+ #include "qed_sriov.h"
+
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++ struct qed_spq_entry *p_ent)
++{
++ /* qed_spq_get_entry() can either get an entry from the free_pool,
++ * or, if no entries are left, allocate a new entry and add it to
++ * the unlimited_pending list.
++ */
++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
++ kfree(p_ent);
++ else
++ qed_spq_return_entry(p_hwfn, p_ent);
++}
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry **pp_ent,
+ u8 cmd, u8 protocol, struct qed_sp_init_data *p_data)
+@@ -111,14 +124,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ return 0;
+
+ err:
+- /* qed_spq_get_entry() can either get an entry from the free_pool,
+- * or, if no entries are left, allocate a new entry and add it to
+- * the unlimited_pending list.
+- */
+- if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
+- kfree(p_ent);
+- else
+- qed_spq_return_entry(p_hwfn, p_ent);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+
+ return -EINVAL;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 9b08a9d9e151..ca6290fa0f30 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
+ default:
+ DP_NOTICE(p_hwfn, "Unknown VF personality %d\n",
+ p_hwfn->hw_info.personality);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return -EINVAL;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 82ea944c6cd51f5d86710ab589953e65e938c159 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 30 Oct 2018 15:06:38 -0700
+Subject: reiserfs: propagate errors from fill_with_dentries() properly
+
+[ Upstream commit b10298d56c9623f9b173f19959732d3184b35f4f ]
+
+fill_with_dentries() failed to propagate errors up to
+reiserfs_for_each_xattr() properly. Plumb them through.
+
+Note that reiserfs_for_each_xattr() is only used by
+reiserfs_delete_xattrs() and reiserfs_chown_xattrs(). The result of
+reiserfs_delete_xattrs() is discarded anyway, the only difference there is
+whether a warning is printed to dmesg. The result of
+reiserfs_chown_xattrs() does matter because it can block chowning of the
+file to which the xattrs belong; but either way, the resulting state can
+have misaligned ownership, so my patch doesn't improve things greatly.
+
+Credit for making me look at this code goes to Al Viro, who pointed out
+that the ->actor calling convention is suboptimal and should be changed.
+
+Link: http://lkml.kernel.org/r/20180802163335.83312-1-jannh@google.com
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Jeff Mahoney <jeffm@suse.com>
+Cc: Eric Biggers <ebiggers@google.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/xattr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 48cdfc81fe10..32d8986c26fb 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -185,6 +185,7 @@ struct reiserfs_dentry_buf {
+ struct dir_context ctx;
+ struct dentry *xadir;
+ int count;
++ int err;
+ struct dentry *dentries[8];
+ };
+
+@@ -207,6 +208,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+
+ dentry = lookup_one_len(name, dbuf->xadir, namelen);
+ if (IS_ERR(dentry)) {
++ dbuf->err = PTR_ERR(dentry);
+ return PTR_ERR(dentry);
+ } else if (d_really_is_negative(dentry)) {
+ /* A directory entry exists, but no file? */
+@@ -215,6 +217,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+ "not found for file %pd.\n",
+ dentry, dbuf->xadir);
+ dput(dentry);
++ dbuf->err = -EIO;
+ return -EIO;
+ }
+
+@@ -262,6 +265,10 @@ static int reiserfs_for_each_xattr(struct inode *inode,
+ err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx);
+ if (err)
+ break;
++ if (buf.err) {
++ err = buf.err;
++ break;
++ }
+ if (!buf.count)
+ break;
+ for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) {
+--
+2.17.1
+
--- /dev/null
+From 26ddba964b8bdf7925f1db1eb6efdb0d619a241a Mon Sep 17 00:00:00 2001
+From: Inki Dae <inki.dae@samsung.com>
+Date: Fri, 5 Oct 2018 11:50:20 +0900
+Subject: Revert "drm/exynos/decon5433: implement frame counter"
+
+[ Upstream commit 6ca469e22a30992b4478d2ab88737c70667c1e00 ]
+
+This reverts commit 0586feba322e1de05075700eb4b835c8b683e62b
+
+This patch makes it to need get_vblank_counter callback in crtc
+to get frame counter from decon driver.
+
+However, drm_dev->max_vblank_count is a member unique to
+vendor's DRM driver but in case of ARM DRM, some CRTC devices
+don't provide the frame counter value. As a result, this patch
+made extension and clone mode not working.
+
+Instead of this patch, we may need separated max_vblank_count
+which belongs to each CRTC device, or need to implement frame
+counter emulation for them who don't support HW frame counter.
+
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 9 ---------
+ drivers/gpu/drm/exynos/exynos_drm_crtc.c | 11 -----------
+ drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 -
+ 3 files changed, 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 94529aa82339..aef487dd8731 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+ return frm;
+ }
+
+-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc)
+-{
+- struct decon_context *ctx = crtc->ctx;
+-
+- return decon_get_frame_count(ctx, false);
+-}
+-
+ static void decon_setup_trigger(struct decon_context *ctx)
+ {
+ if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG))
+@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = {
+ .disable = decon_disable,
+ .enable_vblank = decon_enable_vblank,
+ .disable_vblank = decon_disable_vblank,
+- .get_vblank_counter = decon_get_vblank_counter,
+ .atomic_begin = decon_atomic_begin,
+ .update_plane = decon_update_plane,
+ .disable_plane = decon_disable_plane,
+@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data)
+ int ret;
+
+ ctx->drm_dev = drm_dev;
+- drm_dev->max_vblank_count = 0xffffffff;
+
+ for (win = ctx->first_win; win < WINDOWS_NR; win++) {
+ ctx->configs[win].pixel_formats = decon_formats;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+index eea90251808f..2696289ecc78 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc)
+ exynos_crtc->ops->disable_vblank(exynos_crtc);
+ }
+
+-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc)
+-{
+- struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
+-
+- if (exynos_crtc->ops->get_vblank_counter)
+- return exynos_crtc->ops->get_vblank_counter(exynos_crtc);
+-
+- return 0;
+-}
+-
+ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ .set_config = drm_atomic_helper_set_config,
+ .page_flip = drm_atomic_helper_page_flip,
+@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+ .enable_vblank = exynos_drm_crtc_enable_vblank,
+ .disable_vblank = exynos_drm_crtc_disable_vblank,
+- .get_vblank_counter = exynos_drm_crtc_get_vblank_counter,
+ };
+
+ struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev,
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+index c737c4bd2c19..630f1edc5de2 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+@@ -133,7 +133,6 @@ struct exynos_drm_crtc_ops {
+ void (*disable)(struct exynos_drm_crtc *crtc);
+ int (*enable_vblank)(struct exynos_drm_crtc *crtc);
+ void (*disable_vblank)(struct exynos_drm_crtc *crtc);
+- u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc);
+ enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc,
+ const struct drm_display_mode *mode);
+ bool (*mode_fixup)(struct exynos_drm_crtc *crtc,
+--
+2.17.1
+
--- /dev/null
+From 9148770e7be077af9cc3a3ed21060e730ad2f1ba Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Wed, 17 Oct 2018 09:01:53 +0200
+Subject: Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
+
+[ Upstream commit 6298944d8f57f40ee2a3e6dcea1253e78d7a9969 ]
+
+This reverts commit 67ddbb3e6568fb1820b2cc45b00c50702b114801.
+
+67ddbb3e656 ("HID: add NOGET quirk for Eaton Ellipse MAX UPS") was reported
+by Laurent Bigonville. It turns out that a later model Laurent got
+doesn't need the quirk after all.
+
+My take is that Eaton upgraded their firmwares, so we don't need it
+anymore.
+
+The old model was from 2012, so better make sure the new line works
+properly by removing the quirk. This allows upower to actually fetch
+the current data.
+
+Reported-by: Laurent Bigonville <bigon@bigon.be>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 249d49b6b16c..caafbea94882 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -106,7 +106,6 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.17.1
+
--- /dev/null
+From bb23b22e6a600e77a4891644d97dd05d94d57474 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 26 Oct 2018 11:14:28 +0200
+Subject: Revert "netfilter: nft_numgen: add map lookups for numgen random
+ operations"
+
+[ Upstream commit 4269fea768a11a447d8de620ce420f2214d4685c ]
+
+Laura found a better way to do this from userspace without requiring
+kernel infrastructure, revert this.
+
+Fixes: 978d8f9055c3 ("netfilter: nft_numgen: add map lookups for numgen random operations")
+Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter/nf_tables.h | 4 +-
+ net/netfilter/nft_numgen.c | 127 -----------------------
+ 2 files changed, 2 insertions(+), 129 deletions(-)
+
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index e23290ffdc77..325ec6ef0a76 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -1581,8 +1581,8 @@ enum nft_ng_attributes {
+ NFTA_NG_MODULUS,
+ NFTA_NG_TYPE,
+ NFTA_NG_OFFSET,
+- NFTA_NG_SET_NAME,
+- NFTA_NG_SET_ID,
++ NFTA_NG_SET_NAME, /* deprecated */
++ NFTA_NG_SET_ID, /* deprecated */
+ __NFTA_NG_MAX
+ };
+ #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
+diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
+index 649d1700ec5b..3cc1b3dc3c3c 100644
+--- a/net/netfilter/nft_numgen.c
++++ b/net/netfilter/nft_numgen.c
+@@ -24,7 +24,6 @@ struct nft_ng_inc {
+ u32 modulus;
+ atomic_t counter;
+ u32 offset;
+- struct nft_set *map;
+ };
+
+ static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
+@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
+ regs->data[priv->dreg] = nft_ng_inc_gen(priv);
+ }
+
+-static void nft_ng_inc_map_eval(const struct nft_expr *expr,
+- struct nft_regs *regs,
+- const struct nft_pktinfo *pkt)
+-{
+- struct nft_ng_inc *priv = nft_expr_priv(expr);
+- const struct nft_set *map = priv->map;
+- const struct nft_set_ext *ext;
+- u32 result;
+- bool found;
+-
+- result = nft_ng_inc_gen(priv);
+- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+-
+- if (!found)
+- return;
+-
+- nft_data_copy(®s->data[priv->dreg],
+- nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
+ [NFTA_NG_DREG] = { .type = NLA_U32 },
+ [NFTA_NG_MODULUS] = { .type = NLA_U32 },
+ [NFTA_NG_TYPE] = { .type = NLA_U32 },
+ [NFTA_NG_OFFSET] = { .type = NLA_U32 },
+- [NFTA_NG_SET_NAME] = { .type = NLA_STRING,
+- .len = NFT_SET_MAXNAMELEN - 1 },
+- [NFTA_NG_SET_ID] = { .type = NLA_U32 },
+ };
+
+ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+ NFT_DATA_VALUE, sizeof(u32));
+ }
+
+-static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nlattr * const tb[])
+-{
+- struct nft_ng_inc *priv = nft_expr_priv(expr);
+- u8 genmask = nft_genmask_next(ctx->net);
+-
+- nft_ng_inc_init(ctx, expr, tb);
+-
+- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+- tb[NFTA_NG_SET_NAME],
+- tb[NFTA_NG_SET_ID], genmask);
+-
+- return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
+ u32 modulus, enum nft_ng_types type, u32 offset)
+ {
+@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ priv->offset);
+ }
+
+-static int nft_ng_inc_map_dump(struct sk_buff *skb,
+- const struct nft_expr *expr)
+-{
+- const struct nft_ng_inc *priv = nft_expr_priv(expr);
+-
+- if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+- NFT_NG_INCREMENTAL, priv->offset) ||
+- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+- goto nla_put_failure;
+-
+- return 0;
+-
+-nla_put_failure:
+- return -1;
+-}
+-
+ struct nft_ng_random {
+ enum nft_registers dreg:8;
+ u32 modulus;
+ u32 offset;
+- struct nft_set *map;
+ };
+
+ static u32 nft_ng_random_gen(struct nft_ng_random *priv)
+@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr,
+ regs->data[priv->dreg] = nft_ng_random_gen(priv);
+ }
+
+-static void nft_ng_random_map_eval(const struct nft_expr *expr,
+- struct nft_regs *regs,
+- const struct nft_pktinfo *pkt)
+-{
+- struct nft_ng_random *priv = nft_expr_priv(expr);
+- const struct nft_set *map = priv->map;
+- const struct nft_set_ext *ext;
+- u32 result;
+- bool found;
+-
+- result = nft_ng_random_gen(priv);
+- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+- if (!found)
+- return;
+-
+- nft_data_copy(®s->data[priv->dreg],
+- nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ NFT_DATA_VALUE, sizeof(u32));
+ }
+
+-static int nft_ng_random_map_init(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nlattr * const tb[])
+-{
+- struct nft_ng_random *priv = nft_expr_priv(expr);
+- u8 genmask = nft_genmask_next(ctx->net);
+-
+- nft_ng_random_init(ctx, expr, tb);
+- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+- tb[NFTA_NG_SET_NAME],
+- tb[NFTA_NG_SET_ID], genmask);
+-
+- return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ {
+ const struct nft_ng_random *priv = nft_expr_priv(expr);
+@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ priv->offset);
+ }
+
+-static int nft_ng_random_map_dump(struct sk_buff *skb,
+- const struct nft_expr *expr)
+-{
+- const struct nft_ng_random *priv = nft_expr_priv(expr);
+-
+- if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+- NFT_NG_RANDOM, priv->offset) ||
+- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+- goto nla_put_failure;
+-
+- return 0;
+-
+-nla_put_failure:
+- return -1;
+-}
+-
+ static struct nft_expr_type nft_ng_type;
+ static const struct nft_expr_ops nft_ng_inc_ops = {
+ .type = &nft_ng_type,
+@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
+ .dump = nft_ng_inc_dump,
+ };
+
+-static const struct nft_expr_ops nft_ng_inc_map_ops = {
+- .type = &nft_ng_type,
+- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
+- .eval = nft_ng_inc_map_eval,
+- .init = nft_ng_inc_map_init,
+- .dump = nft_ng_inc_map_dump,
+-};
+-
+ static const struct nft_expr_ops nft_ng_random_ops = {
+ .type = &nft_ng_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = {
+ .dump = nft_ng_random_dump,
+ };
+
+-static const struct nft_expr_ops nft_ng_random_map_ops = {
+- .type = &nft_ng_type,
+- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+- .eval = nft_ng_random_map_eval,
+- .init = nft_ng_random_map_init,
+- .dump = nft_ng_random_map_dump,
+-};
+-
+ static const struct nft_expr_ops *
+ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+ {
+@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+
+ switch (type) {
+ case NFT_NG_INCREMENTAL:
+- if (tb[NFTA_NG_SET_NAME])
+- return &nft_ng_inc_map_ops;
+ return &nft_ng_inc_ops;
+ case NFT_NG_RANDOM:
+- if (tb[NFTA_NG_SET_NAME])
+- return &nft_ng_random_map_ops;
+ return &nft_ng_random_ops;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 770f6a6ae966096d20738439cb4e99ff6014dbc6 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 6 Nov 2018 10:10:38 -0800
+Subject: Revert "scripts/setlocalversion: git: Make -dirty check more robust"
+
+[ Upstream commit 8ef14c2c41d962756d314f1d7dc972b0ea7a180f ]
+
+This reverts commit 6147b1cf19651c7de297e69108b141fb30aa2349.
+
+The reverted patch results in attempted write access to the source
+repository, even if that repository is mounted read-only.
+
+Output from "strace git status -uno --porcelain":
+
+getcwd("/tmp/linux-test", 129) = 16
+open("/tmp/linux-test/.git/index.lock", O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0666) =
+ -1 EROFS (Read-only file system)
+
+While git appears to be able to handle this situation, a monitored
+build environment (such as the one used for Chrome OS kernel builds)
+may detect it and bail out with an access violation error. On top of
+that, the attempted write access suggests that git _will_ write to the
+file even if a build output directory is specified. Users may have the
+reasonable expectation that the source repository remains untouched in
+that situation.
+
+Fixes: 6147b1cf19651 ("scripts/setlocalversion: git: Make -dirty check more robust"
+Cc: Genki Sky <sky@genki.is>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/setlocalversion | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 79f7dd57d571..71f39410691b 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -74,7 +74,7 @@ scm_version()
+ fi
+
+ # Check for uncommitted changes
+- if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
++ if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
+ printf '%s' -dirty
+ fi
+
+--
+2.17.1
+
--- /dev/null
+From 94dc28d0eb0869420bd5dd4ab98aa172465535bf Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Fri, 19 Oct 2018 13:37:46 +0200
+Subject: s390/decompressor: add missing FORCE to build targets
+
+[ Upstream commit ef5febae1543f35a45f01614123e829d77326d0f ]
+
+According to Documentation/kbuild/makefiles.txt all build targets
+using if_changed should use FORCE as well. Add missing FORCE to make
+sure vmlinux decompressor targets are rebuild properly when not just
+immediate prerequisites have changed but also when build command differs.
+
+Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/compressed/Makefile | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
+index 04609478d18b..b375c6c5ae7b 100644
+--- a/arch/s390/boot/compressed/Makefile
++++ b/arch/s390/boot/compressed/Makefile
+@@ -20,7 +20,7 @@ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR)
+ OBJECTS := $(addprefix $(obj)/,$(obj-y))
+
+ LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T
+-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS)
++$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE
+ $(call if_changed,ld)
+
+ # extract required uncompressed vmlinux symbols and adjust them to reflect offsets inside vmlinux.bin
+@@ -51,17 +51,17 @@ suffix-$(CONFIG_KERNEL_LZMA) := .lzma
+ suffix-$(CONFIG_KERNEL_LZO) := .lzo
+ suffix-$(CONFIG_KERNEL_XZ) := .xz
+
+-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,gzip)
+-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,bzip2)
+-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lz4)
+-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lzma)
+-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lzo)
+-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,xzkern)
+
+ LDFLAGS_piggy.o := -r --format binary --oformat $(LD_BFD) -T
+--
+2.17.1
+
--- /dev/null
+From 6513279a6385d1f98a2cb84d39b133e0322e0ba8 Mon Sep 17 00:00:00 2001
+From: "Justin M. Forbes" <jforbes@fedoraproject.org>
+Date: Wed, 31 Oct 2018 13:02:03 -0500
+Subject: s390/mm: Fix ERROR: "__node_distance" undefined!
+
+[ Upstream commit a541f0ebcc08ed8bc0cc492eec9a86cb280a9f24 ]
+
+Fixes:
+ERROR: "__node_distance" [drivers/nvme/host/nvme-core.ko] undefined!
+make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1
+make: *** [Makefile:1275: modules] Error 2
++ exit 1
+
+Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/numa/numa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
+index 5bd374491f94..6c151b42e65d 100644
+--- a/arch/s390/numa/numa.c
++++ b/arch/s390/numa/numa.c
+@@ -54,6 +54,7 @@ int __node_distance(int a, int b)
+ {
+ return mode->distance ? mode->distance(a, b) : 0;
+ }
++EXPORT_SYMBOL(__node_distance);
+
+ int numa_debug_enabled;
+
+--
+2.17.1
+
--- /dev/null
+From 0985ca9dca4be938ad9fc283b1dcf6d3c405d1a2 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Mon, 15 Oct 2018 11:09:16 +0200
+Subject: s390/mm: fix mis-accounting of pgtable_bytes
+
+[ Upstream commit e12e4044aede97974f2222eb7f0ed726a5179a32 ]
+
+In case a fork or a clone system fails in copy_process and the error
+handling does the mmput() at the bad_fork_cleanup_mm label, the
+following warning messages will appear on the console:
+
+ BUG: non-zero pgtables_bytes on freeing mm: 16384
+
+The reason for that is the tricks we play with mm_inc_nr_puds() and
+mm_inc_nr_pmds() in init_new_context().
+
+A normal 64-bit process has 3 levels of page table, the p4d level and
+the pud level are folded. On process termination the free_pud_range()
+function in mm/memory.c will subtract 16KB from pgtable_bytes with a
+mm_dec_nr_puds() call, but there actually is not really a pud table.
+
+One issue with this is the fact that pgtable_bytes is usually off
+by a few kilobytes, but the more severe problem is that for a failed
+fork or clone the free_pgtables() function is not called. In this case
+there is no mm_dec_nr_puds() or mm_dec_nr_pmds() that go together with
+the mm_inc_nr_puds() and mm_inc_nr_pmds in init_new_context().
+The pgtable_bytes will be off by 16384 or 32768 bytes and we get the
+BUG message. The message itself is purely cosmetic, but annoying.
+
+To fix this override the mm_pmd_folded, mm_pud_folded and mm_p4d_folded
+function to check for the true size of the address space.
+
+Reported-by: Li Wang <liwang@redhat.com>
+Tested-by: Li Wang <liwang@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/mmu_context.h | 5 -----
+ arch/s390/include/asm/pgalloc.h | 6 +++---
+ arch/s390/include/asm/pgtable.h | 18 ++++++++++++++++++
+ arch/s390/include/asm/tlb.h | 6 +++---
+ arch/s390/mm/pgalloc.c | 1 +
+ 5 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index 0717ee76885d..f1ab9420ccfb 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -45,8 +45,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ mm->context.asce_limit = STACK_TOP_MAX;
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_REGION3;
+- /* pgd_alloc() did not account this pud */
+- mm_inc_nr_puds(mm);
+ break;
+ case -PAGE_SIZE:
+ /* forked 5-level task, set new asce with new_mm->pgd */
+@@ -62,9 +60,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ /* forked 2-level compat task, set new asce with new mm->pgd */
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
+- /* pgd_alloc() did not account this pmd */
+- mm_inc_nr_pmds(mm);
+- mm_inc_nr_puds(mm);
+ }
+ crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
+ return 0;
+diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
+index f0f9bcf94c03..5ee733720a57 100644
+--- a/arch/s390/include/asm/pgalloc.h
++++ b/arch/s390/include/asm/pgalloc.h
+@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry)
+
+ static inline unsigned long pgd_entry_type(struct mm_struct *mm)
+ {
+- if (mm->context.asce_limit <= _REGION3_SIZE)
++ if (mm_pmd_folded(mm))
+ return _SEGMENT_ENTRY_EMPTY;
+- if (mm->context.asce_limit <= _REGION2_SIZE)
++ if (mm_pud_folded(mm))
+ return _REGION3_ENTRY_EMPTY;
+- if (mm->context.asce_limit <= _REGION1_SIZE)
++ if (mm_p4d_folded(mm))
+ return _REGION2_ENTRY_EMPTY;
+ return _REGION1_ENTRY_EMPTY;
+ }
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 0e7cb0dc9c33..de05466ce50c 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -485,6 +485,24 @@ static inline int is_module_addr(void *addr)
+ _REGION_ENTRY_PROTECT | \
+ _REGION_ENTRY_NOEXEC)
+
++static inline bool mm_p4d_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION1_SIZE;
++}
++#define mm_p4d_folded(mm) mm_p4d_folded(mm)
++
++static inline bool mm_pud_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION2_SIZE;
++}
++#define mm_pud_folded(mm) mm_pud_folded(mm)
++
++static inline bool mm_pmd_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION3_SIZE;
++}
++#define mm_pmd_folded(mm) mm_pmd_folded(mm)
++
+ static inline int mm_has_pgste(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_PGSTE
+diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
+index 457b7ba0fbb6..b31c779cf581 100644
+--- a/arch/s390/include/asm/tlb.h
++++ b/arch/s390/include/asm/tlb.h
+@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION3_SIZE)
++ if (mm_pmd_folded(tlb->mm))
+ return;
+ pgtable_pmd_page_dtor(virt_to_page(pmd));
+ tlb_remove_table(tlb, pmd);
+@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION1_SIZE)
++ if (mm_p4d_folded(tlb->mm))
+ return;
+ tlb_remove_table(tlb, p4d);
+ }
+@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION2_SIZE)
++ if (mm_pud_folded(tlb->mm))
+ return;
+ tlb_remove_table(tlb, pud);
+ }
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index 76d89ee8b428..814f26520aa2 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
+ mm->context.asce_limit = _REGION1_SIZE;
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_REGION2;
++ mm_inc_nr_puds(mm);
+ } else {
+ crst_table_init(table, _REGION1_ENTRY_EMPTY);
+ pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd);
+--
+2.17.1
+
--- /dev/null
+From 03f958ca0f48f7e9fbbf31dc0d47ab9c14b21871 Mon Sep 17 00:00:00 2001
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Mon, 29 Oct 2018 08:11:33 +0000
+Subject: s390/perf: Change CPUM_CF return code in event init function
+
+[ Upstream commit 0bb2ae1b26e1fb7543ec7474cdd374ac4b88c4da ]
+
+The function perf_init_event() creates a new event and
+assignes it to a PMU. This a done in a loop over all existing
+PMUs. For each listed PMU the event init function is called
+and if this function does return any other error than -ENOENT,
+the loop is terminated the creation of the event fails.
+
+If the event is invalid, return -ENOENT to try other PMUs.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_cf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
+index cc085e2d2ce9..74091fd3101e 100644
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -373,7 +373,7 @@ static int __hw_perf_event_init(struct perf_event *event)
+ return -ENOENT;
+
+ if (ev > PERF_CPUM_CF_MAX_CTR)
+- return -EINVAL;
++ return -ENOENT;
+
+ /* Obtain the counter set to which the specified counter belongs */
+ set = get_counter_set(ev);
+--
+2.17.1
+
--- /dev/null
+From 187bf1ff5933d24e510a63cda94082d61cec6fc2 Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Fri, 2 Nov 2018 19:04:09 +0100
+Subject: s390/qeth: fix HiperSockets sniffer
+
+[ Upstream commit bd74a7f9cc033cf4d405788f80292268987dc0c5 ]
+
+Sniffing mode for L3 HiperSockets requires that no IP addresses are
+registered with the HW. The preferred way to achieve this is for
+userspace to delete all the IPs on the interface. But qeth is expected
+to also tolerate a configuration where that is not the case, by skipping
+the IP registration when in sniffer mode.
+Since commit 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback")
+reworked the IP registration logic in the L3 subdriver, this no longer
+works. When the qeth device is set online, qeth_l3_recover_ip() now
+unconditionally registers all unicast addresses from our internal
+IP table.
+
+While we could fix this particular problem by skipping
+qeth_l3_recover_ip() on a sniffer device, the more future-proof change
+is to skip the IP address registration at the lowest level. This way we
+a) catch any future code path that attempts to register an IP address
+ without considering the sniffer scenario, and
+b) continue to build up our internal IP table, so that if sniffer mode
+ is switched off later we can operate just like normal.
+
+Fixes: 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_main.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index ada258c01a08..17e2fd584fbf 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -279,9 +279,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)
+
+ QETH_CARD_TEXT(card, 4, "clearip");
+
+- if (recover && card->options.sniffer)
+- return;
+-
+ spin_lock_bh(&card->ip_lock);
+
+ hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
+@@ -664,6 +661,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card,
+ int rc = 0;
+ int cnt = 3;
+
++ if (card->options.sniffer)
++ return 0;
+
+ if (addr->proto == QETH_PROT_IPV4) {
+ QETH_CARD_TEXT(card, 2, "setaddr4");
+@@ -698,6 +697,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card,
+ {
+ int rc = 0;
+
++ if (card->options.sniffer)
++ return 0;
++
+ if (addr->proto == QETH_PROT_IPV4) {
+ QETH_CARD_TEXT(card, 2, "deladdr4");
+ QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int));
+--
+2.17.1
+
--- /dev/null
+From 4ebfa97b196cfdc06834cf2e6433d952c03a409c Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Fri, 2 Nov 2018 19:04:10 +0100
+Subject: s390/qeth: unregister netdevice only when registered
+
+[ Upstream commit 30356d08159d7899438e94503ae322a8b881e205 ]
+
+qeth only registers its netdevice when the qeth device is first set
+online. Thus a device that has never been set online will trigger
+a WARN ("network todo 'hsi%d' but state 0") in unregister_netdev() when
+removed.
+
+Fix this by protecting the unregister step, just like we already protect
+against repeated registering of the netdevice.
+
+Fixes: d3d1b205e89f ("s390/qeth: allocate netdevice early")
+Reported-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core.h | 5 +++++
+ drivers/s390/net/qeth_l2_main.c | 5 +++--
+ drivers/s390/net/qeth_l3_main.c | 5 +++--
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 34e0d476c5c6..970654fcc48d 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -826,6 +826,11 @@ struct qeth_trap_id {
+ /*some helper functions*/
+ #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
+
++static inline bool qeth_netdev_is_registered(struct net_device *dev)
++{
++ return dev->netdev_ops != NULL;
++}
++
+ static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf,
+ unsigned int elements)
+ {
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index b5e38531733f..76b2fba5fba2 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -854,7 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
+
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l2_set_offline(cgdev);
+- unregister_netdev(card->dev);
++ if (qeth_netdev_is_registered(card->dev))
++ unregister_netdev(card->dev);
+ }
+
+ static const struct ethtool_ops qeth_l2_ethtool_ops = {
+@@ -894,7 +895,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
+ {
+ int rc;
+
+- if (card->dev->netdev_ops)
++ if (qeth_netdev_is_registered(card->dev))
+ return 0;
+
+ card->dev->priv_flags |= IFF_UNICAST_FLT;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 17e2fd584fbf..b7f6a8384543 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2514,7 +2514,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
+ {
+ int rc;
+
+- if (card->dev->netdev_ops)
++ if (qeth_netdev_is_registered(card->dev))
+ return 0;
+
+ if (card->info.type == QETH_CARD_TYPE_OSD ||
+@@ -2611,7 +2611,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l3_set_offline(cgdev);
+
+- unregister_netdev(card->dev);
++ if (qeth_netdev_is_registered(card->dev))
++ unregister_netdev(card->dev);
+ qeth_l3_clear_ip_htable(card, 0);
+ qeth_l3_clear_ipato_list(card);
+ }
+--
+2.17.1
+
--- /dev/null
+From cbc8681cbc19ee498b3fbf418a9873f41da02945 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Fri, 19 Oct 2018 15:37:01 +0200
+Subject: s390/vdso: add missing FORCE to build targets
+
+[ Upstream commit b44b136a3773d8a9c7853f8df716bd1483613cbb ]
+
+According to Documentation/kbuild/makefiles.txt all build targets using
+if_changed should use FORCE as well. Add missing FORCE to make sure
+vdso targets are rebuild properly when not just immediate prerequisites
+have changed but also when build command differs.
+
+Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vdso32/Makefile | 6 +++---
+ arch/s390/kernel/vdso64/Makefile | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index c5c856f320bc..04dd3e2c3bd9 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
+
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32)
++$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
+ $(call if_changed,vdso32ld)
+
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+ # assembly rules for the .S files
+-$(obj-vdso32): %.o: %.S
++$(obj-vdso32): %.o: %.S FORCE
+ $(call if_changed_dep,vdso32as)
+
+ # actual build commands
+ quiet_cmd_vdso32ld = VDSO32L $@
+- cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++ cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso32as = VDSO32A $@
+ cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
+
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 15b1ceafc4c1..ddebc26cd949 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
+
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64)
++$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE
+ $(call if_changed,vdso64ld)
+
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+ # assembly rules for the .S files
+-$(obj-vdso64): %.o: %.S
++$(obj-vdso64): %.o: %.S FORCE
+ $(call if_changed_dep,vdso64as)
+
+ # actual build commands
+ quiet_cmd_vdso64ld = VDSO64L $@
+- cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++ cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso64as = VDSO64A $@
+ cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
+
+--
+2.17.1
+
--- /dev/null
+From e191124695dc19780026800e54c2c5d21db070f7 Mon Sep 17 00:00:00 2001
+From: Valentin Schneider <valentin.schneider@arm.com>
+Date: Tue, 23 Oct 2018 14:37:31 +0100
+Subject: sched/core: Take the hotplug lock in sched_init_smp()
+
+[ Upstream commit 40fa3780bac2b654edf23f6b13f4e2dd550aea10 ]
+
+When running on linux-next (8c60c36d0b8c ("Add linux-next specific files
+for 20181019")) + CONFIG_PROVE_LOCKING=y on a big.LITTLE system (e.g.
+Juno or HiKey960), we get the following report:
+
+ [ 0.748225] Call trace:
+ [ 0.750685] lockdep_assert_cpus_held+0x30/0x40
+ [ 0.755236] static_key_enable_cpuslocked+0x20/0xc8
+ [ 0.760137] build_sched_domains+0x1034/0x1108
+ [ 0.764601] sched_init_domains+0x68/0x90
+ [ 0.768628] sched_init_smp+0x30/0x80
+ [ 0.772309] kernel_init_freeable+0x278/0x51c
+ [ 0.776685] kernel_init+0x10/0x108
+ [ 0.780190] ret_from_fork+0x10/0x18
+
+The static_key in question is 'sched_asym_cpucapacity' introduced by
+commit:
+
+ df054e8445a4 ("sched/topology: Add static_key for asymmetric CPU capacity optimizations")
+
+In this particular case, we enable it because smp_prepare_cpus() will
+end up fetching the capacity-dmips-mhz entry from the devicetree,
+so we already have some asymmetry detected when entering sched_init_smp().
+
+This didn't get detected in tip/sched/core because we were missing:
+
+ commit cb538267ea1e ("jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations")
+
+Calls to build_sched_domains() post sched_init_smp() will hold the
+hotplug lock, it just so happens that this very first call is a
+special case. As stated by a comment in sched_init_smp(), "There's no
+userspace yet to cause hotplug operations" so this is a harmless
+warning.
+
+However, to both respect the semantics of underlying
+callees and make lockdep happy, take the hotplug lock in
+sched_init_smp(). This also satisfies the comment atop
+sched_init_domains() that says "Callers must hold the hotplug lock".
+
+Reported-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Dietmar.Eggemann@arm.com
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: morten.rasmussen@arm.com
+Cc: quentin.perret@arm.com
+Link: http://lkml.kernel.org/r/1540301851-3048-1-git-send-email-valentin.schneider@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ad97f3ba5ec5..35551110d277 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5854,11 +5854,14 @@ void __init sched_init_smp(void)
+ /*
+ * There's no userspace yet to cause hotplug operations; hence all the
+ * CPU masks are stable and all blatant races in the below code cannot
+- * happen.
++ * happen. The hotplug lock is nevertheless taken to satisfy lockdep,
++ * but there won't be any contention on it.
+ */
++ cpus_read_lock();
+ mutex_lock(&sched_domains_mutex);
+ sched_init_domains(cpu_active_mask);
+ mutex_unlock(&sched_domains_mutex);
++ cpus_read_unlock();
+
+ /* Move init over to a non-isolated CPU */
+ if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0)
+--
+2.17.1
+
--- /dev/null
+From d925b9a93b3ba0c8e181057b6c9efe2ce0656df4 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 9 Oct 2018 19:41:58 +0200
+Subject: serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA
+
+[ Upstream commit 202dc3cc10b4d37e5251431acf8d5040a8876c7d ]
+
+On SCIFA and SCIFB serial ports with DMA support (i.e. some ports on
+R-Car Gen2 and RZ/G1 SoCs), receive DMA operations are submitted before
+the DMA channel pointer is initialized. Hence this fails, and the
+driver tries to fall back to PIO. However, at this early phase in the
+initialization sequence, fallback to PIO does not work, leading to a
+serial port that cannot receive any data.
+
+Fix this by calling sci_submit_rx() after initialization of the DMA
+channel pointer.
+
+Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Fixes: 2c4ee23530ffc022 ("serial: sh-sci: Postpone DMA release when falling back to PIO")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 3649b83ef863..effba6ce0caa 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port)
+ hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ s->rx_timer.function = rx_timer_fn;
+
++ s->chan_rx_saved = s->chan_rx = chan;
++
+ if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
+ sci_submit_rx(s);
+-
+- s->chan_rx_saved = s->chan_rx = chan;
+ }
+ }
+
+--
+2.17.1
+
drm-i915-replace-some-page_size-with-i915_gtt_page_size.patch
+cifs-don-t-dereference-smb_file_target-before-null-c.patch
+cifs-fix-return-value-for-cifs_listxattr.patch
+arm64-kprobe-make-page-to-ro-mode-when-allocate-it.patch
+nvme-pci-fix-conflicting-p2p-resource-adds.patch
+block-brd-associate-with-queue-until-adding-disk.patch
+net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclgevf.patch
+net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclge_r.patch
+net-hns3-bugfix-for-handling-mailbox-while-the-comma.patch
+net-hns3-bugfix-for-the-initialization-of-command-qu.patch
+ixgbe-fix-mac-anti-spoofing-filter-after-vflr.patch
+reiserfs-propagate-errors-from-fill_with_dentries-pr.patch
+hfs-prevent-btree-data-loss-on-root-split.patch
+hfsplus-prevent-btree-data-loss-on-root-split.patch
+perf-unwind-take-pgoff-into-account-when-reporting-e.patch
+um-give-start_idle_thread-a-return-code.patch
+drm-edid-add-6-bpc-quirk-for-boe-panel.patch
+afs-handle-eio-from-delivery-function.patch
+platform-x86-intel_telemetry-report-debugfs-failure.patch
+clk-fixed-rate-fix-of_node_get-put-imbalance.patch
+perf-symbols-set-plt-entry-header-sizes-properly-on-.patch
+fs-exofs-fix-potential-memory-leak-in-mount-option-p.patch
+clk-samsung-exynos5420-enable-peris-clocks-for-suspe.patch
+apparmor-fix-uninitialized-value-in-aa_split_fqname.patch
+x86-earlyprintk-add-a-force-option-for-pciserial-dev.patch
+platform-x86-acerhdf-add-bios-entry-for-gateway-lt31.patch
+clk-meson-axg-pcie-drop-the-mpll3-clock-parent.patch
+arm64-percpu-initialize-ret-in-the-default-case.patch
+clk-meson-clk-pll-drop-clk_get_rate_nocache-where-un.patch
+clk-renesas-r9a06g032-fix-uart34567-clock-rate.patch
+clk-ti-fix-of-child-node-lookup.patch
+serial-sh-sci-fix-receive-on-scifa-scifb-variants-wi.patch
+netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch
+netfilter-bridge-define-int_min-int_max-in-userspace.patch
+s390-decompressor-add-missing-force-to-build-targets.patch
+s390-vdso-add-missing-force-to-build-targets.patch
+hid-i2c-hid-add-a-small-delay-after-sleep-command-fo.patch
+revert-hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch
+hid-alps-allow-incoming-reports-when-only-the-tracks.patch
+revert-netfilter-nft_numgen-add-map-lookups-for-numg.patch
+netfilter-ipset-list-set-decrease-refcount-synchrono.patch
+netfilter-ipset-actually-allow-allowable-cidr-0-in-h.patch
+netfilter-ipset-fix-ip_set_list-allocation-failure.patch
+s390-mm-fix-mis-accounting-of-pgtable_bytes.patch
+s390-mm-fix-error-__node_distance-undefined.patch
+bpf-fix-bpf_prog_get_info_by_fd-to-return-0-func_len.patch
+netfilter-ipset-correct-rcu_dereference-call-in-ip_s.patch
+netfilter-xt_idletimer-add-sysfs-filename-checking-r.patch
+netfilter-ipset-fix-calling-ip_set-macro-at-dumping.patch
+netfilter-nft_compat-ebtables-nat-table-is-normal-ch.patch
+s390-qeth-fix-hipersockets-sniffer.patch
+s390-qeth-unregister-netdevice-only-when-registered.patch
+net-hns3-fix-for-out-of-bounds-access-when-setting-p.patch
+hwmon-ibmpowernv-remove-bogus-__init-annotations.patch
+arm-dts-imx6sll-fix-typo-for-fsl-imx6sll-i2c-node.patch
+arm-dts-fsl-fix-improperly-quoted-stdout-path-values.patch
+revert-drm-exynos-decon5433-implement-frame-counter.patch
+arm64-dts-renesas-r8a7795-add-missing-dma-names-on-h.patch
+arm64-dts-renesas-condor-switch-from-etheravb-to-get.patch
+xen-grant-table-fix-incorrect-gnttab_dma_free_pages-.patch
+clk-fixed-factor-fix-of_node_get-put-imbalance.patch
+mtd-nand-fix-nanddev_pos_next_page-kernel-doc-header.patch
+lib-raid6-fix-arm64-test-build.patch
+drm-amd-display-stop-leaking-planes.patch
+block-clear-kernel-memory-before-copying-to-user.patch
+drm-amd-display-drop-reusing-drm-connector-for-mst.patch
+drm-amd-amdgpu-dm-fix-dm_dp_create_fake_mst_encoder.patch
+s390-perf-change-cpum_cf-return-code-in-event-init-f.patch
+ceph-quota-fix-null-pointer-dereference-in-quota-che.patch
+of-device-really-only-set-bus-dma-mask-when-appropri.patch
+nvme-make-sure-ns-head-inherits-underlying-device-li.patch
+i2c-omap-enable-for-arch_k3.patch
+i2c-qcom-geni-fix-runtime-pm-mismatch-with-child-dev.patch
+sched-core-take-the-hotplug-lock-in-sched_init_smp.patch
+perf-tools-fix-undefined-symbol-scnprintf-in-libperf.patch
+perf-tools-do-not-zero-sample_id_all-for-group-membe.patch
+ice-fix-dead-device-link-issue-with-flow-control.patch
+ice-fix-the-bytecount-sent-to-netdev_tx_sent_queue.patch
+ice-change-req_speeds-to-be-u16.patch
+i40e-restore-netif_f_gso_ipxip-46-to-netdev-features.patch
+qed-fix-memory-entry-leak-in-qed_init_sp_request.patch
+qed-fix-blocking-unlimited-spq-entries-leak.patch
+qed-fix-spq-entries-not-returned-to-pool-in-error-fl.patch
+qed-fix-potential-memory-corruption.patch
+net-stmmac-fix-rx-packet-size-8191.patch
+net-aquantia-fix-potential-iommu-fault-after-driver-.patch
+net-aquantia-fixed-enable-unicast-on-32-macvlan.patch
+net-aquantia-invalid-checksumm-offload-implementatio.patch
+kbuild-deb-pkg-fix-too-low-build-version-number.patch
+revert-scripts-setlocalversion-git-make-dirty-check-.patch
--- /dev/null
+From 95495cb17d0ae94ef8a750beaf97512c0093b4f4 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 15 Jun 2018 16:42:56 +0200
+Subject: um: Give start_idle_thread() a return code
+
+[ Upstream commit 7ff1e34bbdc15acab823b1ee4240e94623d50ee8 ]
+
+Fixes:
+arch/um/os-Linux/skas/process.c:613:1: warning: control reaches end of
+non-void function [-Wreturn-type]
+
+longjmp() never returns but gcc still warns that the end of the function
+can be reached.
+Add a return code and debug aid to detect this impossible case.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/skas/process.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index c94c3bd70ccd..df4a985716eb 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -610,6 +610,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf)
+ fatal_sigsegv();
+ }
+ longjmp(*switch_buf, 1);
++
++ /* unreachable */
++ printk(UM_KERN_ERR "impossible long jump!");
++ fatal_sigsegv();
++ return 0;
+ }
+
+ void initial_thread_cb_skas(void (*proc)(void *), void *arg)
+--
+2.17.1
+
--- /dev/null
+From 254c904607a6c4bce6996accff51c8065e8612c6 Mon Sep 17 00:00:00 2001
+From: Feng Tang <feng.tang@intel.com>
+Date: Wed, 3 Oct 2018 00:49:21 +0800
+Subject: x86/earlyprintk: Add a force option for pciserial device
+
+[ Upstream commit d2266bbfa9e3e32e3b642965088ca461bd24a94f ]
+
+The "pciserial" earlyprintk variant helps much on many modern x86
+platforms, but unfortunately there are still some platforms with PCI
+UART devices which have the wrong PCI class code. In that case, the
+current class code check does not allow for them to be used for logging.
+
+Add a sub-option "force" which overrides the class code check and thus
+the use of such device can be enforced.
+
+ [ bp: massage formulations. ]
+
+Suggested-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: "Stuart R . Anderson" <stuart.r.anderson@intel.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Feng Tang <feng.tang@intel.com>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: H Peter Anvin <hpa@linux.intel.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: Kate Stewart <kstewart@linuxfoundation.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Thymo van Beers <thymovanbeers@gmail.com>
+Cc: alan@linux.intel.com
+Cc: linux-doc@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181002164921.25833-1-feng.tang@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt | 6 +++-
+ arch/x86/kernel/early_printk.c | 29 ++++++++++++-------
+ 2 files changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 92eb1f42240d..34e6800dea0e 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1063,7 +1063,7 @@
+ earlyprintk=serial[,0x...[,baudrate]]
+ earlyprintk=ttySn[,baudrate]
+ earlyprintk=dbgp[debugController#]
+- earlyprintk=pciserial,bus:device.function[,baudrate]
++ earlyprintk=pciserial[,force],bus:device.function[,baudrate]
+ earlyprintk=xdbc[xhciController#]
+
+ earlyprintk is useful when the kernel crashes before
+@@ -1095,6 +1095,10 @@
+
+ The sclp output can only be used on s390.
+
++ The optional "force" to "pciserial" enables use of a
++ PCI device even when its classcode is not of the
++ UART class.
++
+ edac_report= [HW,EDAC] Control how to report EDAC event
+ Format: {"on" | "off" | "force"}
+ on: enable EDAC to report H/W event. May be overridden
+diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
+index 5e801c8c8ce7..374a52fa5296 100644
+--- a/arch/x86/kernel/early_printk.c
++++ b/arch/x86/kernel/early_printk.c
+@@ -213,8 +213,9 @@ static unsigned int mem32_serial_in(unsigned long addr, int offset)
+ * early_pci_serial_init()
+ *
+ * This function is invoked when the early_printk param starts with "pciserial"
+- * The rest of the param should be ",B:D.F,baud" where B, D & F describe the
+- * location of a PCI device that must be a UART device.
++ * The rest of the param should be "[force],B:D.F,baud", where B, D & F describe
++ * the location of a PCI device that must be a UART device. "force" is optional
++ * and overrides the use of an UART device with a wrong PCI class code.
+ */
+ static __init void early_pci_serial_init(char *s)
+ {
+@@ -224,17 +225,23 @@ static __init void early_pci_serial_init(char *s)
+ u32 classcode, bar0;
+ u16 cmdreg;
+ char *e;
++ int force = 0;
+
+-
+- /*
+- * First, part the param to get the BDF values
+- */
+ if (*s == ',')
+ ++s;
+
+ if (*s == 0)
+ return;
+
++ /* Force the use of an UART device with wrong class code */
++ if (!strncmp(s, "force,", 6)) {
++ force = 1;
++ s += 6;
++ }
++
++ /*
++ * Part the param to get the BDF values
++ */
+ bus = (u8)simple_strtoul(s, &e, 16);
+ s = e;
+ if (*s != ':')
+@@ -253,7 +260,7 @@ static __init void early_pci_serial_init(char *s)
+ s++;
+
+ /*
+- * Second, find the device from the BDF
++ * Find the device from the BDF
+ */
+ cmdreg = read_pci_config(bus, slot, func, PCI_COMMAND);
+ classcode = read_pci_config(bus, slot, func, PCI_CLASS_REVISION);
+@@ -264,8 +271,10 @@ static __init void early_pci_serial_init(char *s)
+ */
+ if (((classcode >> 16 != PCI_CLASS_COMMUNICATION_MODEM) &&
+ (classcode >> 16 != PCI_CLASS_COMMUNICATION_SERIAL)) ||
+- (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */
+- return;
++ (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ {
++ if (!force)
++ return;
++ }
+
+ /*
+ * Determine if it is IO or memory mapped
+@@ -289,7 +298,7 @@ static __init void early_pci_serial_init(char *s)
+ }
+
+ /*
+- * Lastly, initialize the hardware
++ * Initialize the hardware
+ */
+ if (*s) {
+ if (strcmp(s, "nocfg") == 0)
+--
+2.17.1
+
--- /dev/null
+From 25f5c9093c4d9837a258de80f149fa1f538eec88 Mon Sep 17 00:00:00 2001
+From: Liam Merwick <Liam.Merwick@oracle.com>
+Date: Fri, 2 Nov 2018 14:04:23 +0000
+Subject: xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug
+ message
+
+[ Upstream commit d9cccfa7c4d1d9ef967ec9308df7304a18609b30 ]
+
+If a call to xenmem_reservation_increase() in gnttab_dma_free_pages()
+fails it triggers a message "Failed to decrease reservation..." which
+should be "Failed to increase reservation..."
+
+Fixes: 9bdc7304f536 ('xen/grant-table: Allow allocating buffers suitable for DMA')
+Reported-by: Ross Philipson <ross.philipson@oracle.com>
+Signed-off-by: Liam Merwick <liam.merwick@oracle.com>
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/grant-table.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 84575baceebc..97341fa75458 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args)
+
+ ret = xenmem_reservation_increase(args->nr_pages, args->frames);
+ if (ret != args->nr_pages) {
+- pr_debug("Failed to decrease reservation for DMA buffer\n");
++ pr_debug("Failed to increase reservation for DMA buffer\n");
+ ret = -EFAULT;
+ } else {
+ ret = 0;
+--
+2.17.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
