--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 23:00:48 +0200
+Subject: ALSA: msnd: Fix the default sample sizes
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7c500f9ea139d0c9b80fdea5a9c911db3166ea54 ]
+
+The default sample sizes set by msnd driver are bogus; it sets ALSA
+PCM format, not the actual bit width.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/isa/msnd/msnd_pinnacle.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -82,10 +82,10 @@
+
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+ {
+- chip->play_sample_size = DEFSAMPLESIZE;
++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ chip->play_sample_rate = DEFSAMPLERATE;
+ chip->play_channels = DEFCHANNELS;
+- chip->capture_sample_size = DEFSAMPLESIZE;
++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ chip->capture_sample_rate = DEFSAMPLERATE;
+ chip->capture_channels = DEFCHANNELS;
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 23:00:54 +0200
+Subject: ALSA: pcm: Add __force to cast in snd_pcm_lib_read/write()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 95a48b7d4459948b6bacf809809cf01a7dc06d1d ]
+
+The snd_pcm_lib_read() and snd_pcm_lib_write() inline functions have
+the explicit cast from a user pointer to a kernel pointer, but they
+lacks of __force prefix.
+
+This fixes sparse warnings like:
+ ./include/sound/pcm.h:1093:47: warning: cast removes address space of expression
+
+Fixes: 68541213720d ("ALSA: pcm: Direct in-kernel read/write support")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/pcm.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -1089,14 +1089,14 @@ static inline snd_pcm_sframes_t
+ snd_pcm_lib_write(struct snd_pcm_substream *substream,
+ const void __user *buf, snd_pcm_uframes_t frames)
+ {
+- return __snd_pcm_lib_xfer(substream, (void *)buf, true, frames, false);
++ return __snd_pcm_lib_xfer(substream, (void __force *)buf, true, frames, false);
+ }
+
+ static inline snd_pcm_sframes_t
+ snd_pcm_lib_read(struct snd_pcm_substream *substream,
+ void __user *buf, snd_pcm_uframes_t frames)
+ {
+- return __snd_pcm_lib_xfer(substream, (void *)buf, true, frames, false);
++ return __snd_pcm_lib_xfer(substream, (void __force *)buf, true, frames, false);
+ }
+
+ static inline snd_pcm_sframes_t
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jeff Crukley <jcrukley@gmail.com>
+Date: Wed, 25 Jul 2018 15:05:01 -0400
+Subject: ALSA: usb-audio: Add support for Encore mDSD USB DAC
+
+From: Jeff Crukley <jcrukley@gmail.com>
+
+[ Upstream commit b080dc5bd0dfc0b33c6cfc31f909c93d5e63c186 ]
+
+This patch adds native DSD playback support for the Encore mDSD USB DAC by
+specifying the vendor and product ID's
+
+Signed-off-by: Jeff Crukley <jcrukley@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+ case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
+ case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 23:00:46 +0200
+Subject: ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit bd1cd0eb2ce9141100628d476ead4de485501b29 ]
+
+AU0828_DEVICE() macro in quirks-table.h uses USB_DEVICE_VENDOR_SPEC()
+for expanding idVendor and idProduct fields. However, the latter
+macro adds also match_flags and bInterfaceClass, which are different
+from the values AU0828_DEVICE() macro sets after that.
+
+For fixing them, just expand idVendor and idProduct fields manually in
+AU0828_DEVICE().
+
+This fixes sparse warnings like:
+ sound/usb/quirks-table.h:2892:1: warning: Initializer entry defined twice
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks-table.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ */
+
+ #define AU0828_DEVICE(vid, pid, vname, pname) { \
+- USB_DEVICE_VENDOR_SPEC(vid, pid), \
++ .idVendor = vid, \
++ .idProduct = pid, \
+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+ USB_DEVICE_ID_MATCH_INT_CLASS | \
+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Yue Wang <yuleopen@gmail.com>
+Date: Mon, 23 Jul 2018 01:56:46 -0700
+Subject: ALSA: usb-audio: Generic DSD detection for Thesycon-based implementations
+
+From: Yue Wang <yuleopen@gmail.com>
+
+[ Upstream commit 1ea0358ecb848058b35b6da13d7f4c08610a73a8 ]
+
+Thesycon provides solutions to XMOS chips, and has its own device
+vendor id.
+
+In this patch, we use generic method to detect DSD capability of
+Thesycon-based UAC2 implementations in order to support a wide range
+of current and future devices.
+
+The patch will enable the SNDRV_PCM_FMTBIT_DSD_U32_BE bit for the DAC
+hence enable native DSD playback up to DSD512 format.
+
+Signed-off-by: Yue Wang <yuleopen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1444,6 +1444,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ */
+ switch (USB_ID_VENDOR(chip->usb_id)) {
+ case 0x20b1: /* XMOS based devices */
++ case 0x152a: /* Thesycon devices */
+ case 0x25ce: /* Mytek devices */
+ if (fp->dsd_raw)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 26 Jul 2018 09:51:27 +0800
+Subject: amd-xgbe: use dma_mapping_error to check map errors
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit b24dbfe9ce03d9f83306616f22fb0e04e8960abe ]
+
+The dma_mapping_error() returns true or false, but we want
+to return -ENOMEM if there was an error.
+
+Fixes: 174fd2597b0b ("amd-xgbe: Implement split header receive support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+@@ -289,7 +289,7 @@ static int xgbe_alloc_pages(struct xgbe_
+ struct page *pages = NULL;
+ dma_addr_t pages_dma;
+ gfp_t gfp;
+- int order, ret;
++ int order;
+
+ again:
+ order = alloc_order;
+@@ -316,10 +316,9 @@ again:
+ /* Map the pages */
+ pages_dma = dma_map_page(pdata->dev, pages, 0,
+ PAGE_SIZE << order, DMA_FROM_DEVICE);
+- ret = dma_mapping_error(pdata->dev, pages_dma);
+- if (ret) {
++ if (dma_mapping_error(pdata->dev, pages_dma)) {
+ put_page(pages);
+- return ret;
++ return -ENOMEM;
+ }
+
+ pa->pages = pages;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Bhushan Shah <bshah@kde.org>
+Date: Mon, 9 Jul 2018 14:46:28 +0530
+Subject: ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci
+
+From: Bhushan Shah <bshah@kde.org>
+
+[ Upstream commit 03864e57770a9541e7ff3990bacf2d9a2fffcd5d ]
+
+The kernel would not boot on the hammerhead hardware due to the
+following error:
+
+mmc0: Timeout waiting for hardware interrupt.
+mmc0: sdhci: ============ SDHCI REGISTER DUMP ===========
+mmc0: sdhci: Sys addr: 0x00000200 | Version: 0x00003802
+mmc0: sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000200
+mmc0: sdhci: Argument: 0x00000000 | Trn mode: 0x00000023
+mmc0: sdhci: Present: 0x03e80000 | Host ctl: 0x00000034
+mmc0: sdhci: Power: 0x00000001 | Blk gap: 0x00000000
+mmc0: sdhci: Wake-up: 0x00000000 | Clock: 0x00000007
+mmc0: sdhci: Timeout: 0x0000000e | Int stat: 0x00000000
+mmc0: sdhci: Int enab: 0x02ff900b | Sig enab: 0x02ff100b
+mmc0: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000
+mmc0: sdhci: Caps: 0x642dc8b2 | Caps_1: 0x00008007
+mmc0: sdhci: Cmd: 0x00000c1b | Max curr: 0x00000000
+mmc0: sdhci: Resp[0]: 0x00000c00 | Resp[1]: 0x00000000
+mmc0: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000
+mmc0: sdhci: Host ctl2: 0x00000008
+mmc0: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x70040220
+mmc0: sdhci: ============================================
+mmc0: Card stuck in wrong state! mmcblk0 card_busy_detect status: 0xe00
+mmc0: cache flush error -110
+mmc0: Reset 0x1 never completed.
+
+This patch increases the load on l20 to 0.2 amps for the sdhci
+and allows the device to boot normally.
+
+Signed-off-by: Bhushan Shah <bshah@kde.org>
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Brian Masney <masneyb@onstation.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+@@ -189,6 +189,8 @@
+ regulator-max-microvolt = <2950000>;
+
+ regulator-boot-on;
++ regulator-system-load = <200000>;
++ regulator-allow-set-load;
+ };
+
+ l21 {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Tue, 24 Jul 2018 18:48:14 +0200
+Subject: ARM: exynos: Clear global variable on init error path
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit cd4806911cee3901bc2b5eb95603cf1958720b57 ]
+
+For most of Exynos SoCs, Power Management Unit (PMU) address space is
+mapped into global variable 'pmu_base_addr' very early when initializing
+PMU interrupt controller. A lot of other machine code depends on it so
+when doing iounmap() on this address, clear the global as well to avoid
+usage of invalid value (pointing to unmapped memory region).
+
+Properly mapped PMU address space is a requirement for all other machine
+code so this fix is purely theoretical. Boot will fail immediately in
+many other places after following this error path.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-exynos/suspend.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-exynos/suspend.c
++++ b/arch/arm/mach-exynos/suspend.c
+@@ -203,6 +203,7 @@ static int __init exynos_pmu_irq_init(st
+ NULL);
+ if (!domain) {
+ iounmap(pmu_base_addr);
++ pmu_base_addr = NULL;
+ return -ENOMEM;
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Wed, 11 Jul 2018 14:18:23 +0200
+Subject: arm64: dts: qcom: db410c: Fix Bluetooth LED trigger
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit e53db018315b7660bb7000a29e79faff2496c2c2 ]
+
+Current LED trigger, 'bt', is not known/used by any existing driver.
+Fix this by renaming it to 'bluetooth-power' trigger which is
+controlled by the Bluetooth subsystem.
+
+Fixes: 9943230c8860 ("arm64: dts: qcom: Add apq8016-sbc board LED's related device nodes")
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -338,7 +338,7 @@
+ led@6 {
+ label = "apq8016-sbc:blue:bt";
+ gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>;
+- linux,default-trigger = "bt";
++ linux,default-trigger = "bluetooth-power";
+ default-state = "off";
+ };
+ };
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 10 Jul 2018 19:01:22 +0100
+Subject: arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 14d6e289a89780377f8bb09de8926d3c62d763cd ]
+
+It's possible for userspace to control idx. Sanitize idx when using it
+as an array index, to inhibit the potential spectre-v1 write gadget.
+
+Found by smatch.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/ptrace.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -277,19 +277,22 @@ static int ptrace_hbp_set_event(unsigned
+
+ switch (note_type) {
+ case NT_ARM_HW_BREAK:
+- if (idx < ARM_MAX_BRP) {
+- tsk->thread.debug.hbp_break[idx] = bp;
+- err = 0;
+- }
++ if (idx >= ARM_MAX_BRP)
++ goto out;
++ idx = array_index_nospec(idx, ARM_MAX_BRP);
++ tsk->thread.debug.hbp_break[idx] = bp;
++ err = 0;
+ break;
+ case NT_ARM_HW_WATCH:
+- if (idx < ARM_MAX_WRP) {
+- tsk->thread.debug.hbp_watch[idx] = bp;
+- err = 0;
+- }
++ if (idx >= ARM_MAX_WRP)
++ goto out;
++ idx = array_index_nospec(idx, ARM_MAX_WRP);
++ tsk->thread.debug.hbp_watch[idx] = bp;
++ err = 0;
+ break;
+ }
+
++out:
+ return err;
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Oder Chiou <oder_chiou@realtek.com>
+Date: Tue, 24 Jul 2018 15:49:23 +0800
+Subject: ASoC: rt5514: Fix the issue of the delay volume applied
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+[ Upstream commit d96f8bd28cd0bae3e6702ae90df593628ef6906f ]
+
+The patch fixes the issue of the delay volume applied.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/rt5514.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -64,8 +64,8 @@ static const struct reg_sequence rt5514_
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_ADCFED, 0x00000800},
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
+ };
+
+ static const struct reg_default rt5514_reg[] = {
+@@ -92,10 +92,10 @@ static const struct reg_default rt5514_r
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+ {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
+ {RT5514_DOWNFILTER1_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER1_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_LDO18_16, 0x02000345},
+ {RT5514_ANA_CTRL_ADC12, 0x0000a2a8},
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Fri, 20 Jul 2018 14:57:38 -0400
+Subject: block: allow max_discard_segments to be stacked
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+[ Upstream commit 42c9cdfe1e11e083dceb0f0c4977b758cf7403b9 ]
+
+Set max_discard_segments to USHRT_MAX in blk_set_stacking_limits() so
+that blk_stack_limits() can stack up this limit for stacked devices.
+
+before:
+
+$ cat /sys/block/nvme0n1/queue/max_discard_segments
+256
+$ cat /sys/block/dm-0/queue/max_discard_segments
+1
+
+after:
+
+$ cat /sys/block/nvme0n1/queue/max_discard_segments
+256
+$ cat /sys/block/dm-0/queue/max_discard_segments
+256
+
+Fixes: 1e739730c5b9e ("block: optionally merge discontiguous discard bios into a single request")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-settings.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -128,7 +128,7 @@ void blk_set_stacking_limits(struct queu
+
+ /* Inherit limits from component devices */
+ lim->max_segments = USHRT_MAX;
+- lim->max_discard_segments = 1;
++ lim->max_discard_segments = USHRT_MAX;
+ lim->max_hw_sectors = UINT_MAX;
+ lim->max_segment_size = UINT_MAX;
+ lim->max_sectors = UINT_MAX;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Rajan Vaja <rajan.vaja@xilinx.com>
+Date: Tue, 17 Jul 2018 06:17:00 -0700
+Subject: clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure
+
+From: Rajan Vaja <rajan.vaja@xilinx.com>
+
+[ Upstream commit f6dab4233d6b64d719109040503b567f71fbfa01 ]
+
+Fixed factor clock has two initializations at of_clk_init() time
+and during platform driver probe. Before of_clk_init() call,
+node is marked as populated and so its probe never gets called.
+
+During of_clk_init() fixed factor clock registration may fail if
+any of its parent clock is not registered. In this case, it doesn't
+get chance to retry registration from probe. Clear OF_POPULATED
+flag if fixed factor clock registration fails so that clock
+registration is attempted again from probe.
+
+Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk-fixed-factor.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_
+
+ clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags,
+ mult, div);
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ /*
++ * If parent clock is not registered, registration would fail.
++ * Clear OF_POPULATED flag so that clock registration can be
++ * attempted again from probe function.
++ */
++ of_node_clear_flag(node, OF_POPULATED);
+ return clk;
++ }
+
+ ret = of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ if (ret) {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Mikko Perttunen <mperttunen@nvidia.com>
+Date: Wed, 11 Jul 2018 11:21:04 +0300
+Subject: clk: core: Potentially free connection id
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 365f7a89c881e84f1ebc925f65f899d5d7ce547e ]
+
+Patch "clk: core: Copy connection id" made it so that the connector id
+'con_id' is kstrdup_const()ed to cater to drivers that pass non-constant
+connection ids. The patch added the corresponding kfree_const to
+__clk_free_clk(), but struct clk's can be freed also via __clk_put().
+Add the kfree_const call to __clk_put() and add comments to both
+functions to remind that the logic in them should be kept in sync.
+
+Fixes: 253160a8ad06 ("clk: core: Copy connection id")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2933,6 +2933,7 @@ struct clk *__clk_create_clk(struct clk_
+ return clk;
+ }
+
++/* keep in sync with __clk_put */
+ void __clk_free_clk(struct clk *clk)
+ {
+ clk_prepare_lock();
+@@ -3312,6 +3313,7 @@ int __clk_get(struct clk *clk)
+ return 1;
+ }
+
++/* keep in sync with __clk_free_clk */
+ void __clk_put(struct clk *clk)
+ {
+ struct module *owner;
+@@ -3345,6 +3347,7 @@ void __clk_put(struct clk *clk)
+
+ module_put(owner);
+
++ kfree_const(clk->con_id);
+ kfree(clk);
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Fri, 13 Jul 2018 18:40:04 +0200
+Subject: clk: imx6sll: fix missing of_node_put()
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 7f5eac5934d747535f9ffc997792a0a6eb289374 ]
+
+of_find_compatible_node() is returning a device node with refcount
+incremented and must be explicitly decremented after the last use
+which is right after the us in of_iomap() here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 4a5f720b6542 ("clk: imx: add clock driver for imx6sll")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-imx6sll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/imx/clk-imx6sll.c
++++ b/drivers/clk/imx/clk-imx6sll.c
+@@ -92,6 +92,7 @@ static void __init imx6sll_clocks_init(s
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6sll-anatop");
+ base = of_iomap(np, 0);
++ of_node_put(np);
+ WARN_ON(!base);
+
+ /* Do not bypass PLLs initially */
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Fri, 13 Jul 2018 13:13:20 +0200
+Subject: clk: imx6ul: fix missing of_node_put()
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 11177e7a7aaef95935592072985526ebf0a3df43 ]
+
+of_find_compatible_node() is returning a device node with refcount
+incremented and must be explicitly decremented after the last use
+which is right after the us in of_iomap() here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 787b4271a6a0 ("clk: imx: add imx6ul clk tree support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-imx6ul.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/imx/clk-imx6ul.c
++++ b/drivers/clk/imx/clk-imx6ul.c
+@@ -142,6 +142,7 @@ static void __init imx6ul_clocks_init(st
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop");
+ base = of_iomap(np, 0);
++ of_node_put(np);
+ WARN_ON(!base);
+
+ clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+Date: Fri, 13 Jul 2018 12:27:26 +0200
+Subject: clk: mvebu: armada-37xx-periph: Fix wrong return value in get_parent
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+[ Upstream commit 616bf80d381da13fbb392ebff06f46f946e3ee84 ]
+
+The return value of the get_parent operation is a u8, whereas a -EINVAL
+was returned. This wrong value was return if the value was bigger that
+the number of parent but this case was already handled by the core.
+
+So we can just remove this chunk of code to fix the issue.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 9818a7a4fd10 ("clk: mvebu: armada-37xx-periph: prepare cpu clk to
+be used with DVFS")
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/mvebu/armada-37xx-periph.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -429,9 +429,6 @@ static u8 clk_pm_cpu_get_parent(struct c
+ val &= pm_cpu->mask_mux;
+ }
+
+- if (val >= num_parents)
+- return -EINVAL;
+-
+ return val;
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: "Michael Müller" <michael@fds-team.de>
+Date: Sun, 15 Jul 2018 00:27:06 +0200
+Subject: crypto: sharah - Unregister correct algorithms for SAHARA 3
+
+From: "Michael Müller" <michael@fds-team.de>
+
+[ Upstream commit 0e7d4d932ffc23f75efb31a8c2ac2396c1b81c55 ]
+
+This patch fixes two typos related to unregistering algorithms supported by
+SAHARAH 3. In sahara_register_algs the wrong algorithms are unregistered
+in case of an error. In sahara_unregister_algs the wrong array is used to
+determine the iteration count.
+
+Signed-off-by: Michael Müller <michael@fds-team.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/sahara.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1351,7 +1351,7 @@ err_sha_v4_algs:
+
+ err_sha_v3_algs:
+ for (j = 0; j < k; j++)
+- crypto_unregister_ahash(&sha_v4_algs[j]);
++ crypto_unregister_ahash(&sha_v3_algs[j]);
+
+ err_aes_algs:
+ for (j = 0; j < i; j++)
+@@ -1367,7 +1367,7 @@ static void sahara_unregister_algs(struc
+ for (i = 0; i < ARRAY_SIZE(aes_algs); i++)
+ crypto_unregister_alg(&aes_algs[i]);
+
+- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++)
++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++)
+ crypto_unregister_ahash(&sha_v3_algs[i]);
+
+ if (dev->version > SAHARA_VERSION_3)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Hanna Hawa <hannah@marvell.com>
+Date: Tue, 17 Jul 2018 13:30:00 +0300
+Subject: dmaengine: mv_xor_v2: kill the tasklets upon exit
+
+From: Hanna Hawa <hannah@marvell.com>
+
+[ Upstream commit 8bbafed8dd5cfa81071b50ead5cb60367fdef3a9 ]
+
+The mv_xor_v2 driver uses a tasklet, initialized during the probe()
+routine. However, it forgets to cleanup the tasklet using
+tasklet_kill() function during the remove() routine, which this patch
+fixes. This prevents the tasklet from potentially running after the
+module has been removed.
+
+Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver")
+
+Signed-off-by: Hanna Hawa <hannah@marvell.com>
+Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/mv_xor_v2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -899,6 +899,8 @@ static int mv_xor_v2_remove(struct platf
+
+ platform_msi_domain_free_irqs(&pdev->dev);
+
++ tasklet_kill(&xor_dev->irq_tasklet);
++
+ clk_disable_unprepare(xor_dev->clk);
+
+ return 0;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: John Keeping <john@metanate.com>
+Date: Tue, 17 Jul 2018 11:48:16 +0100
+Subject: dmaengine: pl330: fix irq race with terminate_all
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit e49756544a21f5625b379b3871d27d8500764670 ]
+
+In pl330_update() when checking if a channel has been aborted, the
+channel's lock is not taken, only the overall pl330_dmac lock. But in
+pl330_terminate_all() the aborted flag (req_running==-1) is set under
+the channel lock and not the pl330_dmac lock.
+
+With threaded interrupts, this leads to a potential race:
+
+ pl330_terminate_all pl330_update
+ ------------------- ------------
+ lock channel
+ entry
+ lock pl330
+ _stop channel
+ unlock pl330
+ lock pl330
+ check req_running != -1
+ req_running = -1
+ _start channel
+
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/pl330.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2257,13 +2257,14 @@ static int pl330_terminate_all(struct dm
+
+ pm_runtime_get_sync(pl330->ddma.dev);
+ spin_lock_irqsave(&pch->lock, flags);
++
+ spin_lock(&pl330->lock);
+ _stop(pch->thread);
+- spin_unlock(&pl330->lock);
+-
+ pch->thread->req[0].desc = NULL;
+ pch->thread->req[1].desc = NULL;
+ pch->thread->req_running = -1;
++ spin_unlock(&pl330->lock);
++
+ power_down = pch->active;
+ pch->active = false;
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Pingfan Liu <kernelfans@gmail.com>
+Date: Thu, 19 Jul 2018 13:14:58 +0800
+Subject: drivers/base: stop new probing during shutdown
+
+From: Pingfan Liu <kernelfans@gmail.com>
+
+[ Upstream commit 3297c8fc65af5d40501ea7cddff1b195cae57e4e ]
+
+There is a race window in device_shutdown(), which may cause
+-1. parent device shut down before child or
+-2. no shutdown on a new probing device.
+
+For 1st, taking the following scenario:
+ device_shutdown new plugin device
+ list_del_init(parent_dev);
+ spin_unlock(list_lock);
+ device_add(child)
+ probe child
+ shutdown parent_dev
+ --> now child is on the tail of devices_kset
+
+For 2nd, taking the following scenario:
+ device_shutdown new plugin device
+ device_add(dev)
+ device_lock(dev);
+ ...
+ device_unlock(dev);
+ probe dev
+ --> now, the new occurred dev has no opportunity to shutdown
+
+To fix this race issue, just prevent the new probing request. With this
+logic, device_shutdown() is more similar to dpm_prepare().
+
+Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
+Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2809,6 +2809,9 @@ void device_shutdown(void)
+ {
+ struct device *dev, *parent;
+
++ wait_for_device_probe();
++ device_block_probing();
++
+ spin_lock(&devices_kset->list_lock);
+ /*
+ * Walk the devices list backward, shutting down each in turn.
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Rex Zhu <rex.zhu@amd.com>
+Date: Tue, 17 Jul 2018 18:31:50 +0800
+Subject: drm/amd/pp: Set Max clock level to display by default
+
+From: Rex Zhu <rex.zhu@amd.com>
+
+[ Upstream commit 97e8f102f5a9123d30258e196c6c1ea29cf52e83 ]
+
+avoid the error in dmesg:
+[drm:dm_pp_get_static_clocks]
+*ERROR* DM_PPLIB: invalid powerlevel state: 0!
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/powerplay/amd_powerplay.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+@@ -1020,7 +1020,7 @@ static int pp_get_display_power_level(vo
+ static int pp_get_current_clocks(void *handle,
+ struct amd_pp_clock_info *clocks)
+ {
+- struct amd_pp_simple_clock_info simple_clocks;
++ struct amd_pp_simple_clock_info simple_clocks = { 0 };
+ struct pp_clock_info hw_clocks;
+ struct pp_hwmgr *hwmgr = handle;
+ int ret = 0;
+@@ -1056,7 +1056,10 @@ static int pp_get_current_clocks(void *h
+ clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk;
+ clocks->min_engine_clock_in_sr = hw_clocks.min_eng_clk;
+
+- clocks->max_clocks_state = simple_clocks.level;
++ if (simple_clocks.level == 0)
++ clocks->max_clocks_state = PP_DAL_POWERLEVEL_7;
++ else
++ clocks->max_clocks_state = simple_clocks.level;
+
+ if (0 == phm_get_current_shallow_sleep_clocks(hwmgr, &hwmgr->current_ps->hardware, &hw_clocks)) {
+ clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk;
+@@ -1159,6 +1162,8 @@ static int pp_get_display_mode_validatio
+ if (!hwmgr || !hwmgr->pm_en ||!clocks)
+ return -EINVAL;
+
++ clocks->level = PP_DAL_POWERLEVEL_7;
++
+ mutex_lock(&hwmgr->smu_lock);
+
+ if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, PHM_PlatformCaps_DynamicPatchPowerState))
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon, 23 Jul 2018 10:57:30 +0900
+Subject: efi/arm: preserve early mapping of UEFI memory map longer for BGRT
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 3ea86495aef2f6de26b7cb1599ba350dd6a0c521 ]
+
+The BGRT code validates the contents of the table against the UEFI
+memory map, and so it expects it to be mapped when the code runs.
+
+On ARM, this is currently not the case, since we tear down the early
+mapping after efi_init() completes, and only create the permanent
+mapping in arm_enable_runtime_services(), which executes as an early
+initcall, but still leaves a window where the UEFI memory map is not
+mapped.
+
+So move the call to efi_memmap_unmap() from efi_init() to
+arm_enable_runtime_services().
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+[will: fold in EFI_MEMMAP attribute check from Ard]
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/efi/arm-init.c | 1 -
+ drivers/firmware/efi/arm-runtime.c | 4 +++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -259,7 +259,6 @@ void __init efi_init(void)
+
+ reserve_regions();
+ efi_esrt_init();
+- efi_memmap_unmap();
+
+ memblock_reserve(params.mmap & PAGE_MASK,
+ PAGE_ALIGN(params.mmap_size +
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -110,11 +110,13 @@ static int __init arm_enable_runtime_ser
+ {
+ u64 mapsize;
+
+- if (!efi_enabled(EFI_BOOT)) {
++ if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
+ pr_info("EFI services will not be available.\n");
+ return 0;
+ }
+
++ efi_memmap_unmap();
++
+ if (efi_runtime_disabled()) {
+ pr_info("EFI runtime services will be disabled.\n");
+ return 0;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Fredrik Noring <noring@nocrew.org>
+Date: Tue, 24 Jul 2018 19:11:24 +0200
+Subject: fbdev: Distinguish between interlaced and progressive modes
+
+From: Fredrik Noring <noring@nocrew.org>
+
+[ Upstream commit 1ba0a59cea41ea05fda92daaf2a2958a2246b9cf ]
+
+I discovered the problem when developing a frame buffer driver for the
+PlayStation 2 (not yet merged), using the following video modes for the
+PlayStation 3 in drivers/video/fbdev/ps3fb.c:
+
+ }, {
+ /* 1080if */
+ "1080if", 50, 1920, 1080, 13468, 148, 484, 36, 4, 88, 5,
+ FB_SYNC_BROADCAST, FB_VMODE_INTERLACED
+ }, {
+ /* 1080pf */
+ "1080pf", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5,
+ FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED
+ },
+
+In ps3fb_probe, the mode_option module parameter is used with fb_find_mode
+but it can only select the interlaced variant of 1920x1080 since the loop
+matching the modes does not take the difference between interlaced and
+progressive modes into account.
+
+In short, without the patch, progressive 1920x1080 cannot be chosen as a
+mode_option parameter since fb_find_mode (falsely) thinks interlace is a
+perfect match.
+
+Signed-off-by: Fredrik Noring <noring@nocrew.org>
+Cc: "Maciej W. Rozycki" <macro@linux-mips.org>
+[b.zolnierkie: updated patch description]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/modedb.c | 41 +++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_scr
+ *
+ * Valid mode specifiers for @mode_option:
+ *
+- * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or
++ * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or
+ * <name>[-<bpp>][@<refresh>]
+ *
+ * with <xres>, <yres>, <bpp> and <refresh> decimal numbers and
+@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_scr
+ * If 'M' is present after yres (and before refresh/bpp if present),
+ * the function will compute the timings using VESA(tm) Coordinated
+ * Video Timings (CVT). If 'R' is present after 'M', will compute with
+- * reduced blanking (for flatpanels). If 'i' is present, compute
+- * interlaced mode. If 'm' is present, add margins equal to 1.8%
+- * of xres rounded down to 8 pixels, and 1.8% of yres. The char
+- * 'i' and 'm' must be after 'M' and 'R'. Example:
++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute
++ * interlaced or progressive mode. If 'm' is present, add margins equal
++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars
++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example:
+ *
+ * 1024x768MR-8@60m - Reduced blank with margins at 60Hz.
+ *
+@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninf
+ unsigned int namelen = strlen(name);
+ int res_specified = 0, bpp_specified = 0, refresh_specified = 0;
+ unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0;
+- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0;
++ int yres_specified = 0, cvt = 0, rb = 0;
++ int interlace_specified = 0, interlace = 0;
+ int margins = 0;
+ u32 best, diff, tdiff;
+
+@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninf
+ if (!cvt)
+ margins = 1;
+ break;
++ case 'p':
++ if (!cvt) {
++ interlace = 0;
++ interlace_specified = 1;
++ }
++ break;
+ case 'i':
+- if (!cvt)
++ if (!cvt) {
+ interlace = 1;
++ interlace_specified = 1;
++ }
+ break;
+ default:
+ goto done;
+@@ -819,11 +828,21 @@ done:
+ if ((name_matches(db[i], name, namelen) ||
+ (res_specified && res_matches(db[i], xres, yres))) &&
+ !fb_try_mode(var, info, &db[i], bpp)) {
+- if (refresh_specified && db[i].refresh == refresh)
+- return 1;
++ const int db_interlace = (db[i].vmode &
++ FB_VMODE_INTERLACED ? 1 : 0);
++ int score = abs(db[i].refresh - refresh);
++
++ if (interlace_specified)
++ score += abs(db_interlace - interlace);
++
++ if (!interlace_specified ||
++ db_interlace == interlace)
++ if (refresh_specified &&
++ db[i].refresh == refresh)
++ return 1;
+
+- if (abs(db[i].refresh - refresh) < diff) {
+- diff = abs(db[i].refresh - refresh);
++ if (score < diff) {
++ diff = score;
+ best = i;
+ }
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 24 Jul 2018 19:11:28 +0200
+Subject: fbdev: omapfb: off by one in omapfb_register_client()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ec1ec35b2979b59d0b33381e7c9aac17e159d16 ]
+
+The omapfb_register_client[] array has OMAPFB_PLANE_NUM elements so the
+> should be >= or we are one element beyond the end of the array.
+
+Fixes: 8b08cf2b64f5 ("OMAP: add TI OMAP framebuffer driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Imre Deak <imre.deak@solidboot.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/omap/omapfb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/omap/omapfb_main.c
++++ b/drivers/video/fbdev/omap/omapfb_main.c
+@@ -958,7 +958,7 @@ int omapfb_register_client(struct omapfb
+ {
+ int r;
+
+- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM)
++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM)
+ return -EINVAL;
+
+ if (!notifier_inited) {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 24 Jul 2018 19:11:27 +0200
+Subject: fbdev/via: fix defined but not used warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b6566b47a67e07fdca44cf51abb14e2fbe17d3eb ]
+
+Fix a build warning in viafbdev.c when CONFIG_PROC_FS is not enabled
+by marking the unused function as __maybe_unused.
+
+../drivers/video/fbdev/via/viafbdev.c:1471:12: warning: 'viafb_sup_odev_proc_show' defined but not used [-Wunused-function]
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/via/viafbdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/via/viafbdev.c
++++ b/drivers/video/fbdev/via/viafbdev.c
+@@ -19,6 +19,7 @@
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
++#include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+@@ -1468,7 +1469,7 @@ static const struct file_operations viaf
+
+ #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */
+
+-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v)
+ {
+ via_odev_to_seq(m, supported_odev_map[
+ viaparinfo->shared->chip_info.gfx_chip_name]);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Bob Peterson <rpeterso@redhat.com>
+Date: Mon, 18 Jun 2018 13:24:13 -0500
+Subject: gfs2: Don't reject a supposedly full bitmap if we have blocks reserved
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit e79e0e1428188b24c3b57309ffa54a33c4ae40c4 ]
+
+Before this patch, you could get into situations like this:
+
+1. Process 1 searches for X free blocks, finds them, makes a reservation
+2. Process 2 searches for free blocks in the same rgrp, but now the
+ bitmap is full because process 1's reservation is skipped over.
+ So it marks the bitmap as GBF_FULL.
+3. Process 1 tries to allocate blocks from its own reservation, but
+ since the GBF_FULL bit is set, it skips over the rgrp and searches
+ elsewhere, thus not using its own reservation.
+
+This patch adds an additional check to allow processes to use their
+own reservations.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/gfs2/rgrp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1686,7 +1686,8 @@ static int gfs2_rbm_find(struct gfs2_rbm
+
+ while(1) {
+ bi = rbm_bi(rbm);
+- if (test_bit(GBF_FULL, &bi->bi_flags) &&
++ if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) &&
++ test_bit(GBF_FULL, &bi->bi_flags) &&
+ (state == GFS2_BLKST_FREE))
+ goto next_bitmap;
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Wed, 25 Jul 2018 18:45:08 +0100
+Subject: gfs2: Special-case rindex for gfs2_grow
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 776125785a87ff05d49938bd5b9f336f2a05bff6 ]
+
+To speed up the common case of appending to a file,
+gfs2_write_alloc_required presumes that writing beyond the end of a file
+will always require additional blocks to be allocated. This assumption
+is incorrect for preallocates files, but there are no negative
+consequences as long as *some* space is still left on the filesystem.
+
+One special file that always has some space preallocated beyond the end
+of the file is the rindex: when growing a filesystem, gfs2_grow adds one
+or more new resource groups and appends records describing those
+resource groups to the rindex; the preallocated space ensures that this
+is always possible.
+
+However, when a filesystem is completely full, gfs2_write_alloc_required
+will indicate that an additional allocation is required, and appending
+the next record to the rindex will fail even though space for that
+record has already been preallocated. To fix that, skip the incorrect
+optimization in gfs2_write_alloc_required, but for the rindex only.
+Other writes to preallocated space beyond the end of the file are still
+allowed to fail on completely full filesystems.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/gfs2/bmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -2060,7 +2060,7 @@ int gfs2_write_alloc_required(struct gfs
+ end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift;
+ lblock = offset >> shift;
+ lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift;
+- if (lblock_stop > end_of_file)
++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex))
+ return 1;
+
+ size = (lblock_stop - lblock) << shift;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Date: Mon, 2 Jul 2018 14:20:28 -0700
+Subject: i2c: aspeed: Fix initial values of master and slave state
+
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+
+[ Upstream commit 517fde0eb5a8f46c54ba6e2c36e32563b23cb14f ]
+
+This patch changes the order of enum aspeed_i2c_master_state and
+enum aspeed_i2c_slave_state defines to make their initial value to
+ASPEED_I2C_MASTER_INACTIVE and ASPEED_I2C_SLAVE_STOP respectively.
+In case of multi-master use, if a slave data comes ahead of the
+first master xfer, master_state starts from an invalid state so
+this change fixes the issue.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Reviewed-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-aspeed.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -111,22 +111,22 @@
+ #define ASPEED_I2CD_DEV_ADDR_MASK GENMASK(6, 0)
+
+ enum aspeed_i2c_master_state {
++ ASPEED_I2C_MASTER_INACTIVE,
+ ASPEED_I2C_MASTER_START,
+ ASPEED_I2C_MASTER_TX_FIRST,
+ ASPEED_I2C_MASTER_TX,
+ ASPEED_I2C_MASTER_RX_FIRST,
+ ASPEED_I2C_MASTER_RX,
+ ASPEED_I2C_MASTER_STOP,
+- ASPEED_I2C_MASTER_INACTIVE,
+ };
+
+ enum aspeed_i2c_slave_state {
++ ASPEED_I2C_SLAVE_STOP,
+ ASPEED_I2C_SLAVE_START,
+ ASPEED_I2C_SLAVE_READ_REQUESTED,
+ ASPEED_I2C_SLAVE_READ_PROCESSED,
+ ASPEED_I2C_SLAVE_WRITE_REQUESTED,
+ ASPEED_I2C_SLAVE_WRITE_RECEIVED,
+- ASPEED_I2C_SLAVE_STOP,
+ };
+
+ struct aspeed_i2c_bus {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 11 Jul 2018 13:15:42 +0000
+Subject: IB/ipoib: Fix error return code in ipoib_dev_init()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 99a7e2bf704d64c966dfacede1ba2d9b47cb676e ]
+
+Fix to return a negative error code from the ipoib_neigh_hash_init()
+error handling case instead of 0, as done elsewhere in this function.
+
+Fixes: 515ed4f3aab4 ("IB/IPoIB: Separate control and data related initializations")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1787,7 +1787,8 @@ int ipoib_dev_init(struct net_device *de
+ goto out_free_pd;
+ }
+
+- if (ipoib_neigh_hash_init(priv) < 0) {
++ ret = ipoib_neigh_hash_init(priv);
++ if (ret) {
+ pr_warn("%s failed to init neigh hash\n", dev->name);
+ goto out_dev_uninit;
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+Date: Fri, 13 Jul 2018 03:10:20 -0400
+Subject: IB/rxe: Drop QP0 silently
+
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+
+[ Upstream commit 536ca245c512aedfd84cde072d7b3ca14b6e1792 ]
+
+According to "Annex A16: RDMA over Converged Ethernet (RoCE)":
+
+A16.4.3 MANAGEMENT INTERFACES
+
+As defined in the base specification, a special Queue Pair, QP0 is defined
+solely for communication between subnet manager(s) and subnet management
+agents. Since such an IB-defined subnet management architecture is outside
+the scope of this annex, it follows that there is also no requirement that
+a port which conforms to this annex be associated with a QP0. Thus, for
+end nodes designed to conform to this annex, the concept of QP0 is
+undefined and unused for any port connected to an Ethernet network.
+
+CA16-8: A packet arriving at a RoCE port containing a BTH with the
+destination QP field set to QP0 shall be silently dropped.
+
+Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Acked-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -225,9 +225,14 @@ static int hdr_check(struct rxe_pkt_info
+ goto err1;
+ }
+
++ if (unlikely(qpn == 0)) {
++ pr_warn_once("QP 0 not supported");
++ goto err1;
++ }
++
+ if (qpn != IB_MULTICAST_QPN) {
+- index = (qpn == 0) ? port->qp_smi_index :
+- ((qpn == 1) ? port->qp_gsi_index : qpn);
++ index = (qpn == 1) ? port->qp_gsi_index : qpn;
++
+ qp = rxe_pool_get_index(&rxe->qp_pool, index);
+ if (unlikely(!qp)) {
+ pr_warn_ratelimited("no qp matches qpn 0x%x\n", qpn);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 18 Jul 2018 18:03:36 +0000
+Subject: Input: pxrc - fix freeing URB on device teardown
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 34dad2cf1104869ce2db2bddb34f8e6780c2ddaa ]
+
+URB is the only resource that is not managed, and thus is destroyed too early,
+before we unregister input device and stop URB in pxrc_close(). To fix it let's
+install custom devm handler to free the URB at the right time in devm unwind
+sequence.
+
+Reviewed-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Tested-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/pxrc.c | 68 +++++++++++++++++++-----------------------
+ 1 file changed, 31 insertions(+), 37 deletions(-)
+
+--- a/drivers/input/joystick/pxrc.c
++++ b/drivers/input/joystick/pxrc.c
+@@ -120,48 +120,51 @@ static void pxrc_close(struct input_dev
+ mutex_unlock(&pxrc->pm_mutex);
+ }
+
++static void pxrc_free_urb(void *_pxrc)
++{
++ struct pxrc *pxrc = _pxrc;
++
++ usb_free_urb(pxrc->urb);
++}
++
+ static int pxrc_usb_init(struct pxrc *pxrc)
+ {
+ struct usb_endpoint_descriptor *epirq;
+ unsigned int pipe;
+- int retval;
++ int error;
+
+ /* Set up the endpoint information */
+ /* This device only has an interrupt endpoint */
+- retval = usb_find_common_endpoints(pxrc->intf->cur_altsetting,
+- NULL, NULL, &epirq, NULL);
+- if (retval) {
+- dev_err(&pxrc->intf->dev,
+- "Could not find endpoint\n");
+- goto error;
++ error = usb_find_common_endpoints(pxrc->intf->cur_altsetting,
++ NULL, NULL, &epirq, NULL);
++ if (error) {
++ dev_err(&pxrc->intf->dev, "Could not find endpoint\n");
++ return error;
+ }
+
+ pxrc->bsize = usb_endpoint_maxp(epirq);
+ pxrc->epaddr = epirq->bEndpointAddress;
+ pxrc->data = devm_kmalloc(&pxrc->intf->dev, pxrc->bsize, GFP_KERNEL);
+- if (!pxrc->data) {
+- retval = -ENOMEM;
+- goto error;
+- }
++ if (!pxrc->data)
++ return -ENOMEM;
+
+ usb_set_intfdata(pxrc->intf, pxrc);
+ usb_make_path(pxrc->udev, pxrc->phys, sizeof(pxrc->phys));
+ strlcat(pxrc->phys, "/input0", sizeof(pxrc->phys));
+
+ pxrc->urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (!pxrc->urb) {
+- retval = -ENOMEM;
+- goto error;
+- }
++ if (!pxrc->urb)
++ return -ENOMEM;
++
++ error = devm_add_action_or_reset(&pxrc->intf->dev, pxrc_free_urb, pxrc);
++ if (error)
++ return error;
+
+ pipe = usb_rcvintpipe(pxrc->udev, pxrc->epaddr),
+ usb_fill_int_urb(pxrc->urb, pxrc->udev, pipe, pxrc->data, pxrc->bsize,
+ pxrc_usb_irq, pxrc, 1);
+
+-error:
+- return retval;
+-
+-
++ return 0;
+ }
+
+ static int pxrc_input_init(struct pxrc *pxrc)
+@@ -197,7 +200,7 @@ static int pxrc_probe(struct usb_interfa
+ const struct usb_device_id *id)
+ {
+ struct pxrc *pxrc;
+- int retval;
++ int error;
+
+ pxrc = devm_kzalloc(&intf->dev, sizeof(*pxrc), GFP_KERNEL);
+ if (!pxrc)
+@@ -207,29 +210,20 @@ static int pxrc_probe(struct usb_interfa
+ pxrc->udev = usb_get_dev(interface_to_usbdev(intf));
+ pxrc->intf = intf;
+
+- retval = pxrc_usb_init(pxrc);
+- if (retval)
+- goto error;
+-
+- retval = pxrc_input_init(pxrc);
+- if (retval)
+- goto err_free_urb;
++ error = pxrc_usb_init(pxrc);
++ if (error)
++ return error;
++
++ error = pxrc_input_init(pxrc);
++ if (error)
++ return error;
+
+ return 0;
+-
+-err_free_urb:
+- usb_free_urb(pxrc->urb);
+-
+-error:
+- return retval;
+ }
+
+ static void pxrc_disconnect(struct usb_interface *intf)
+ {
+- struct pxrc *pxrc = usb_get_intfdata(intf);
+-
+- usb_free_urb(pxrc->urb);
+- usb_set_intfdata(intf, NULL);
++ /* All driver resources are devm-managed. */
+ }
+
+ static int pxrc_suspend(struct usb_interface *intf, pm_message_t message)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Miao Zhong <zhongmiao@hisilicon.com>
+Date: Mon, 23 Jul 2018 20:56:58 +0800
+Subject: iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register
+
+From: Miao Zhong <zhongmiao@hisilicon.com>
+
+[ Upstream commit 0d535967ac658966c6ade8f82b5799092f7d5441 ]
+
+When PRI queue occurs overflow, driver should update the OVACKFLG to
+the PRIQ consumer register, otherwise subsequent PRI requests will not
+be processed.
+
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Miao Zhong <zhongmiao@hisilicon.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/arm-smmu-v3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1302,6 +1302,7 @@ static irqreturn_t arm_smmu_priq_thread(
+
+ /* Sync our overflow flag, as we believe we're up to speed */
+ q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons);
++ writel(q->cons, q->cons_reg);
+ return IRQ_HANDLED;
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Mon, 18 Jun 2018 12:27:54 +0100
+Subject: iommu/io-pgtable-arm: Fix pgtable allocation in selftest
+
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+
+[ Upstream commit fac83d29d95471ad6a104f8c0d21669a3d59097b ]
+
+Commit 4b123757eeaa ("iommu/io-pgtable-arm: Make allocations
+NUMA-aware") added a NUMA hint to page table allocation, but the pgtable
+selftest doesn't provide an SMMU device parameter. Since dev_to_node
+doesn't accept a NULL argument, add a special case for selftest.
+
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/io-pgtable-arm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -237,7 +237,8 @@ static void *__arm_lpae_alloc_pages(size
+ void *pages;
+
+ VM_BUG_ON((gfp & __GFP_HIGHMEM));
+- p = alloc_pages_node(dev_to_node(dev), gfp | __GFP_ZERO, order);
++ p = alloc_pages_node(dev ? dev_to_node(dev) : NUMA_NO_NODE,
++ gfp | __GFP_ZERO, order);
+ if (!p)
+ return NULL;
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Tue, 19 Jun 2018 13:52:24 +0100
+Subject: iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE
+
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+
+[ Upstream commit 29859aeb8a6ea17ba207933a81b6b77b4d4df81a ]
+
+When run on a 64-bit system in selftest, the v7s driver may obtain page
+table with physical addresses larger than 32-bit. Level-2 tables are 1KB
+and are are allocated with slab, which doesn't accept the GFP_DMA32
+flag. Currently map() truncates the address written in the PTE, causing
+iova_to_phys() or unmap() to access invalid memory. Kasan reports it as
+a use-after-free. To avoid any nasty surprise, test if the physical
+address fits in a PTE before returning a new table. 32-bit systems,
+which are the main users of this page table format, shouldn't see any
+difference.
+
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/io-pgtable-arm-v7s.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -192,6 +192,7 @@ static void *__arm_v7s_alloc_table(int l
+ {
+ struct io_pgtable_cfg *cfg = &data->iop.cfg;
+ struct device *dev = cfg->iommu_dev;
++ phys_addr_t phys;
+ dma_addr_t dma;
+ size_t size = ARM_V7S_TABLE_SIZE(lvl);
+ void *table = NULL;
+@@ -200,6 +201,10 @@ static void *__arm_v7s_alloc_table(int l
+ table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size));
+ else if (lvl == 2)
+ table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA);
++ phys = virt_to_phys(table);
++ if (phys != (arm_v7s_iopte)phys)
++ /* Doesn't fit in PTE */
++ goto out_free;
+ if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) {
+ dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, dma))
+@@ -209,7 +214,7 @@ static void *__arm_v7s_alloc_table(int l
+ * address directly, so if the DMA layer suggests otherwise by
+ * translating or truncating them, that bodes very badly...
+ */
+- if (dma != virt_to_phys(table))
++ if (dma != phys)
+ goto out_unmap;
+ }
+ kmemleak_ignore(table);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Mon, 9 Jul 2018 11:53:31 +0900
+Subject: iommu/ipmmu-vmsa: IMUCTRn.TTSEL needs a special usage on R-Car Gen3
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 2ae86955703e9e6a119af4bbe27f6b6dd7a43131 ]
+
+The TTSEL bit of IMUCTRn register of R-Car Gen3 needs to be set
+unused MMU context number even if uTLBs are disabled
+(The MMUEN bit of IMUCTRn register = 0).
+Since initial values of IMUCTRn.TTSEL on all IPMMU-domains are 0,
+this patch adds a new feature "reserved_context" to reserve IPMMU
+context number 0 as the unused MMU context.
+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/ipmmu-vmsa.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -47,6 +47,7 @@ struct ipmmu_features {
+ unsigned int number_of_contexts;
+ bool setup_imbuscr;
+ bool twobit_imttbcr_sl0;
++ bool reserved_context;
+ };
+
+ struct ipmmu_vmsa_device {
+@@ -916,6 +917,7 @@ static const struct ipmmu_features ipmmu
+ .number_of_contexts = 1, /* software only tested with one context */
+ .setup_imbuscr = true,
+ .twobit_imttbcr_sl0 = false,
++ .reserved_context = false,
+ };
+
+ static const struct ipmmu_features ipmmu_features_r8a7795 = {
+@@ -924,6 +926,7 @@ static const struct ipmmu_features ipmmu
+ .number_of_contexts = 8,
+ .setup_imbuscr = false,
+ .twobit_imttbcr_sl0 = true,
++ .reserved_context = true,
+ };
+
+ static const struct of_device_id ipmmu_of_ids[] = {
+@@ -1017,6 +1020,11 @@ static int ipmmu_probe(struct platform_d
+ }
+
+ ipmmu_device_reset(mmu);
++
++ if (mmu->features->reserved_context) {
++ dev_info(&pdev->dev, "IPMMU context 0 is reserved\n");
++ set_bit(0, mmu->ctx);
++ }
+ }
+
+ /*
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Golan Ben Ami <golan.ben.ami@intel.com>
+Date: Sun, 4 Feb 2018 10:50:05 +0200
+Subject: iwlwifi: cancel the injective function between hw pointers to tfd entry index
+
+From: Golan Ben Ami <golan.ben.ami@intel.com>
+
+[ Upstream commit f5955a6cc3862a02d46f50b723c3172d24d749a5 ]
+
+Nowadays, the tfd queue max size is 2^8, and the reserved size in the
+command header sequence field for the tfd entry index is 8 bits,
+allowing an injective function from the hw pointers to the tfd entry index
+in the sequence field.
+
+In 22560 devices the tfd queue max size is 2^16, meaning that
+the hw pointers are 16 bit long (allowing to point to each entry
+in the tfd queue). However, the reserved space in the sequence field for
+the tfd entry doesn't change, and we are limited to 8 bit.
+This requires cancelling the injective function from hw pointer to
+tfd entry in the sequence number.
+
+Use iwl_pcie_get_cmd_index to wrap the hw pointer's to the n_window
+size, which is maximum 256 in tx queues, and so, keep the injective
+function between the window wrapped hw pointers to tfd entry index in
+the sequence.
+
+Signed-off-by: Golan Ben Ami <golan.ben.ami@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 12 ++++++++----
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 11 ++++++++---
+ 2 files changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -660,7 +660,7 @@ static inline void iwl_enable_fw_load_in
+ }
+ }
+
+-static inline u8 iwl_pcie_get_cmd_index(struct iwl_txq *q, u32 index)
++static inline u8 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index)
+ {
+ return index & (q->n_window - 1);
+ }
+@@ -730,9 +730,13 @@ static inline void iwl_stop_queue(struct
+
+ static inline bool iwl_queue_used(const struct iwl_txq *q, int i)
+ {
+- return q->write_ptr >= q->read_ptr ?
+- (i >= q->read_ptr && i < q->write_ptr) :
+- !(i < q->read_ptr && i >= q->write_ptr);
++ int index = iwl_pcie_get_cmd_index(q, i);
++ int r = iwl_pcie_get_cmd_index(q, q->read_ptr);
++ int w = iwl_pcie_get_cmd_index(q, q->write_ptr);
++
++ return w >= r ?
++ (index >= r && index < w) :
++ !(index < r && index >= w);
+ }
+
+ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1225,9 +1225,13 @@ static void iwl_pcie_cmdq_reclaim(struct
+ struct iwl_txq *txq = trans_pcie->txq[txq_id];
+ unsigned long flags;
+ int nfreed = 0;
++ u16 r;
+
+ lockdep_assert_held(&txq->lock);
+
++ idx = iwl_pcie_get_cmd_index(txq, idx);
++ r = iwl_pcie_get_cmd_index(txq, txq->read_ptr);
++
+ if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(txq, idx))) {
+ IWL_ERR(trans,
+ "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+@@ -1236,12 +1240,13 @@ static void iwl_pcie_cmdq_reclaim(struct
+ return;
+ }
+
+- for (idx = iwl_queue_inc_wrap(idx); txq->read_ptr != idx;
+- txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr)) {
++ for (idx = iwl_queue_inc_wrap(idx); r != idx;
++ r = iwl_queue_inc_wrap(r)) {
++ txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr);
+
+ if (nfreed++ > 0) {
+ IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
+- idx, txq->write_ptr, txq->read_ptr);
++ idx, txq->write_ptr, r);
+ iwl_force_nmi(trans);
+ }
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Fri, 20 Jul 2018 16:46:33 +0900
+Subject: kbuild: add .DELETE_ON_ERROR special target
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 9c2af1c7377a8a6ef86e5cabf80978f3dbbb25c0 ]
+
+If Make gets a fatal signal while a shell is executing, it may delete
+the target file that the recipe was supposed to update. This is needed
+to make sure that it is remade from scratch when Make is next run; if
+Make is interrupted after the recipe has begun to write the target file,
+it results in an incomplete file whose time stamp is newer than that
+of the prerequisites files. Make automatically deletes the incomplete
+file on interrupt unless the target is marked .PRECIOUS.
+
+The situation is just the same as when the shell fails for some reasons.
+Usually when a recipe line fails, if it has changed the target file at
+all, the file is corrupted, or at least it is not completely updated.
+Yet the file’s time stamp says that it is now up to date, so the next
+time Make runs, it will not try to update that file.
+
+However, Make does not cater to delete the incomplete target file in
+this case. We need to add .DELETE_ON_ERROR somewhere in the Makefile
+to request it.
+
+scripts/Kbuild.include seems a suitable place to add it because it is
+included from almost all sub-makes.
+
+Please note .DELETE_ON_ERROR is not effective for phony targets.
+
+The external module building should never ever touch the kernel tree.
+The following recipe fails if include/generated/autoconf.h is missing.
+However, include/config/auto.conf is not deleted since it is a phony
+target.
+
+ PHONY += include/config/auto.conf
+
+ include/config/auto.conf:
+ $(Q)test -e include/generated/autoconf.h -a -e $@ || ( \
+ echo >&2; \
+ echo >&2 " ERROR: Kernel configuration is invalid."; \
+ echo >&2 " include/generated/autoconf.h or $@ are missing.";\
+ echo >&2 " Run 'make oldconfig && make prepare' on kernel src to fix it."; \
+ echo >&2 ; \
+ /bin/false)
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/Kbuild.include | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -400,3 +400,6 @@ endif
+ endef
+ #
+ ###############################################################################
++
++# delete partially updated (i.e. corrupted) files on error
++.DELETE_ON_ERROR:
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Fri, 20 Jul 2018 16:46:34 +0900
+Subject: kbuild: do not update config when running install targets
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit d79424137a7312d381d131d707a462440c0e8df9 ]
+
+"make syncconfig" is automatically invoked when any of the following
+happens:
+
+ - .config is updated
+ - any of Kconfig files is updated
+ - any of environment variables referenced in Kconfig is changed
+
+Then, it updates configuration files such as include/config/auto.conf
+include/generated/autoconf.h, etc.
+
+Even install targets (install, modules_install, etc.) are no exception.
+However, they should never ever modify the source tree. Install
+targets are often run with root privileges. Once those configuration
+files are owned by root, "make mrproper" would end up with permission
+error.
+
+Install targets should just copy things blindly. They should not care
+whether the configuration is up-to-date or not. This makes more sense
+because we are interested in the configuration that was used in the
+previous kernel building.
+
+This issue has existed since before, but rarely happened. I expect
+more chance where people are hit by this; with the new Kconfig syntax
+extension, the .config now contains the compiler information. If you
+cross-compile the kernel with CROSS_COMPILE, but forget to pass it
+for "make install", you meet "any of environment variables referenced
+in Kconfig is changed" because $(CC) is referenced in Kconfig.
+Another scenario is the compiler upgrade before the installation.
+
+Install targets need the configuration. "make modules_install" refer
+to CONFIG_MODULES etc. "make dtbs_install" also needs CONFIG_ARCH_*
+to decide which dtb files to install. However, the auto-update of
+the configuration files should be avoided. We already do this for
+external modules.
+
+Now, Make targets are categorized into 3 groups:
+
+[1] Do not need the kernel configuration at all
+
+ help, coccicheck, headers_install etc.
+
+[2] Need the latest kernel configuration
+
+ If new config options are added, Kconfig will show prompt to
+ ask user's selection.
+
+ Build targets such as vmlinux, in-kernel modules are the cases.
+
+[3] Need the kernel configuration, but do not want to update it
+
+ Install targets except headers_install, and external modules
+ are the cases.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -225,10 +225,12 @@ no-dot-config-targets := $(clean-targets
+ cscope gtags TAGS tags help% %docs check% coccicheck \
+ $(version_h) headers_% archheaders archscripts \
+ kernelversion %src-pkg
++no-sync-config-targets := $(no-dot-config-targets) install %install
+
+-config-targets := 0
+-mixed-targets := 0
+-dot-config := 1
++config-targets := 0
++mixed-targets := 0
++dot-config := 1
++may-sync-config := 1
+
+ ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),)
+ ifeq ($(filter-out $(no-dot-config-targets), $(MAKECMDGOALS)),)
+@@ -236,6 +238,16 @@ ifneq ($(filter $(no-dot-config-targets)
+ endif
+ endif
+
++ifneq ($(filter $(no-sync-config-targets), $(MAKECMDGOALS)),)
++ ifeq ($(filter-out $(no-sync-config-targets), $(MAKECMDGOALS)),)
++ may-sync-config := 0
++ endif
++endif
++
++ifneq ($(KBUILD_EXTMOD),)
++ may-sync-config := 0
++endif
++
+ ifeq ($(KBUILD_EXTMOD),)
+ ifneq ($(filter config %config,$(MAKECMDGOALS)),)
+ config-targets := 1
+@@ -610,7 +622,7 @@ ARCH_CFLAGS :=
+ include arch/$(SRCARCH)/Makefile
+
+ ifeq ($(dot-config),1)
+-ifeq ($(KBUILD_EXTMOD),)
++ifeq ($(may-sync-config),1)
+ # Read in dependencies to all Kconfig* files, make sure to run syncconfig if
+ # changes are detected. This should be included after arch/$(SRCARCH)/Makefile
+ # because some architectures define CROSS_COMPILE there.
+@@ -625,8 +637,9 @@ $(KCONFIG_CONFIG) include/config/auto.co
+ include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd
+ $(Q)$(MAKE) -f $(srctree)/Makefile syncconfig
+ else
+-# external modules needs include/generated/autoconf.h and include/config/auto.conf
+-# but do not care if they are up-to-date. Use auto.conf to trigger the test
++# External modules and some install targets need include/generated/autoconf.h
++# and include/config/auto.conf but do not care if they are up-to-date.
++# Use auto.conf to trigger the test
+ PHONY += include/config/auto.conf
+
+ include/config/auto.conf:
+@@ -638,7 +651,7 @@ include/config/auto.conf:
+ echo >&2 ; \
+ /bin/false)
+
+-endif # KBUILD_EXTMOD
++endif # may-sync-config
+
+ else
+ # Dummy target needed, because used as prerequisite
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Christoffer Dall <christoffer.dall@arm.com>
+Date: Tue, 3 Jul 2018 22:54:14 +0200
+Subject: KVM: arm/arm64: Fix vgic init race
+
+From: Christoffer Dall <christoffer.dall@arm.com>
+
+[ Upstream commit 1d47191de7e15900f8fbfe7cccd7c6e1c2d7c31a ]
+
+The vgic_init function can race with kvm_arch_vcpu_create() which does
+not hold kvm_lock() and we therefore have no synchronization primitives
+to ensure we're doing the right thing.
+
+As the user is trying to initialize or run the VM while at the same time
+creating more VCPUs, we just have to refuse to initialize the VGIC in
+this case rather than silently failing with a broken VCPU.
+
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/arm/vgic/vgic-init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -271,6 +271,10 @@ int vgic_init(struct kvm *kvm)
+ if (vgic_initialized(kvm))
+ return 0;
+
++ /* Are we also in the middle of creating a VCPU? */
++ if (kvm->created_vcpus != atomic_read(&kvm->online_vcpus))
++ return -EBUSY;
++
+ /* freeze the number of spis */
+ if (!dist->nr_spis)
+ dist->nr_spis = VGIC_NR_IRQS_LEGACY - VGIC_NR_PRIVATE_IRQS;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 10 Jul 2018 19:01:23 +0100
+Subject: KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr()
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 6b8b9a48545e08345b8ff77c9fd51b1aebdbefb3 ]
+
+It's possible for userspace to control n. Sanitize n when using it as an
+array index, to inhibit the potential spectre-v1 write gadget.
+
+Note that while it appears that n must be bound to the interval [0,3]
+due to the way it is extracted from addr, we cannot guarantee that
+compiler transformations (and/or future refactoring) will ensure this is
+the case, and given this is a slow path it's better to always perform
+the masking.
+
+Found by smatch.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Christoffer Dall <christoffer.dall@arm.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: kvmarm@lists.cs.columbia.edu
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/arm/vgic/vgic-mmio-v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
+@@ -352,6 +352,9 @@ static void vgic_mmio_write_apr(struct k
+
+ if (n > vgic_v3_max_apr_idx(vcpu))
+ return;
++
++ n = array_index_nospec(n, 4);
++
+ /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */
+ vgicv3->vgic_ap1r[n] = val;
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Tue, 10 Jul 2018 16:48:27 +0530
+Subject: mac80211: restrict delayed tailroom needed decrement
+
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+
+[ Upstream commit 133bf90dbb8b873286f8ec2e81ba26e863114b8c ]
+
+As explained in ieee80211_delayed_tailroom_dec(), during roam,
+keys of the old AP will be destroyed and new keys will be
+installed. Deletion of the old key causes
+crypto_tx_tailroom_needed_cnt to go from 1 to 0 and the new key
+installation causes a transition from 0 to 1.
+
+Whenever crypto_tx_tailroom_needed_cnt transitions from 0 to 1,
+we invoke synchronize_net(); the reason for doing this is to avoid
+a race in the TX path as explained in increment_tailroom_need_count().
+This synchronize_net() operation can be slow and can affect the station
+roam time. To avoid this, decrementing the crypto_tx_tailroom_needed_cnt
+is delayed for a while so that upon installation of new key the
+transition would be from 1 to 2 instead of 0 to 1 and thereby
+improving the roam time.
+
+This is all correct for a STA iftype, but deferring the tailroom_needed
+decrement for other iftypes may be unnecessary.
+
+For example, let's consider the case of a 4-addr client connecting to
+an AP for which AP_VLAN interface is also created, let the initial
+value for tailroom_needed on the AP be 1.
+
+* 4-addr client connects to the AP (AP: tailroom_needed = 1)
+* AP will clear old keys, delay decrement of tailroom_needed count
+* AP_VLAN is created, it takes the tailroom count from master
+ (AP_VLAN: tailroom_needed = 1, AP: tailroom_needed = 1)
+* Install new key for the station, assume key is plumbed in the HW,
+ there won't be any change in tailroom_needed count on AP iface
+* Delayed decrement of tailroom_needed count on AP
+ (AP: tailroom_needed = 0, AP_VLAN: tailroom_needed = 1)
+
+Because of the delayed decrement on AP iface, tailroom_needed count goes
+out of sync between AP(master iface) and AP_VLAN(slave iface) and
+there would be unnecessary tailroom created for the packets going
+through AP_VLAN iface.
+
+Also, WARN_ONs were observed while trying to bring down the AP_VLAN
+interface:
+(warn_slowpath_common) (warn_slowpath_null+0x18/0x20)
+(warn_slowpath_null) (ieee80211_free_keys+0x114/0x1e4)
+(ieee80211_free_keys) (ieee80211_del_virtual_monitor+0x51c/0x850)
+(ieee80211_del_virtual_monitor) (ieee80211_stop+0x30/0x3c)
+(ieee80211_stop) (__dev_close_many+0x94/0xb8)
+(__dev_close_many) (dev_close_many+0x5c/0xc8)
+
+Restricting delayed decrement to station interface alone fixes the problem
+and it makes sense to do so because delayed decrement is done to improve
+roam time which is applicable only for client devices.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/cfg.c | 2 +-
+ net/mac80211/key.c | 24 +++++++++++++++---------
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -495,7 +495,7 @@ static int ieee80211_del_key(struct wiph
+ goto out_unlock;
+ }
+
+- ieee80211_key_free(key, true);
++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION);
+
+ ret = 0;
+ out_unlock:
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -656,11 +656,15 @@ int ieee80211_key_link(struct ieee80211_
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_key *old_key;
+- int idx, ret;
+- bool pairwise;
+-
+- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+- idx = key->conf.keyidx;
++ int idx = key->conf.keyidx;
++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
++ /*
++ * We want to delay tailroom updates only for station - in that
++ * case it helps roaming speed, but in other cases it hurts and
++ * can cause warnings to appear.
++ */
++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION;
++ int ret;
+
+ mutex_lock(&sdata->local->key_mtx);
+
+@@ -688,14 +692,14 @@ int ieee80211_key_link(struct ieee80211_
+ increment_tailroom_need_count(sdata);
+
+ ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+- ieee80211_key_destroy(old_key, true);
++ ieee80211_key_destroy(old_key, delay_tailroom);
+
+ ieee80211_debugfs_key_add(key);
+
+ if (!local->wowlan) {
+ ret = ieee80211_key_enable_hw_accel(key);
+ if (ret)
+- ieee80211_key_free(key, true);
++ ieee80211_key_free(key, delay_tailroom);
+ } else {
+ ret = 0;
+ }
+@@ -930,7 +934,8 @@ void ieee80211_free_sta_keys(struct ieee
+ ieee80211_key_replace(key->sdata, key->sta,
+ key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ key, NULL);
+- __ieee80211_key_destroy(key, true);
++ __ieee80211_key_destroy(key, key->sdata->vif.type ==
++ NL80211_IFTYPE_STATION);
+ }
+
+ for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+@@ -940,7 +945,8 @@ void ieee80211_free_sta_keys(struct ieee
+ ieee80211_key_replace(key->sdata, key->sta,
+ key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ key, NULL);
+- __ieee80211_key_destroy(key, true);
++ __ieee80211_key_destroy(key, key->sdata->vif.type ==
++ NL80211_IFTYPE_STATION);
+ }
+
+ mutex_unlock(&local->key_mtx);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Todor Tomov <todor.tomov@linaro.org>
+Date: Mon, 18 Jun 2018 04:06:58 -0400
+Subject: media: ov5645: Supported external clock is 24MHz
+
+From: Todor Tomov <todor.tomov@linaro.org>
+
+[ Upstream commit 4adb0a0432f489c5eb802b33dae7737f69e6fd7a ]
+
+The external clock frequency was set to 23.88MHz by mistake
+because of a platform which cannot get closer to 24MHz.
+The supported by the driver external clock is 24MHz so
+set it correctly and also fix the values of the pixel
+clock and link clock.
+However allow 1% tolerance to the external clock as this
+difference is small enough to be insignificant.
+
+Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov5645.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/ov5645.c
++++ b/drivers/media/i2c/ov5645.c
+@@ -510,8 +510,8 @@ static const struct reg_value ov5645_set
+ };
+
+ static const s64 link_freq[] = {
+- 222880000,
+- 334320000
++ 224000000,
++ 336000000
+ };
+
+ static const struct ov5645_mode_info ov5645_mode_info_data[] = {
+@@ -520,7 +520,7 @@ static const struct ov5645_mode_info ov5
+ .height = 960,
+ .data = ov5645_setting_sxga,
+ .data_size = ARRAY_SIZE(ov5645_setting_sxga),
+- .pixel_clock = 111440000,
++ .pixel_clock = 112000000,
+ .link_freq = 0 /* an index in link_freq[] */
+ },
+ {
+@@ -528,7 +528,7 @@ static const struct ov5645_mode_info ov5
+ .height = 1080,
+ .data = ov5645_setting_1080p,
+ .data_size = ARRAY_SIZE(ov5645_setting_1080p),
+- .pixel_clock = 167160000,
++ .pixel_clock = 168000000,
+ .link_freq = 1 /* an index in link_freq[] */
+ },
+ {
+@@ -536,7 +536,7 @@ static const struct ov5645_mode_info ov5
+ .height = 1944,
+ .data = ov5645_setting_full,
+ .data_size = ARRAY_SIZE(ov5645_setting_full),
+- .pixel_clock = 167160000,
++ .pixel_clock = 168000000,
+ .link_freq = 1 /* an index in link_freq[] */
+ },
+ };
+@@ -1145,7 +1145,8 @@ static int ov5645_probe(struct i2c_clien
+ return ret;
+ }
+
+- if (xclk_freq != 23880000) {
++ /* external clock must be 24MHz, allow 1% tolerance */
++ if (xclk_freq < 23760000 || xclk_freq > 24240000) {
+ dev_err(dev, "external clock frequency %u is not supported\n",
+ xclk_freq);
+ return -EINVAL;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Krzysztof Ha?asa <khalasa@piap.pl>
+Date: Thu, 28 Jun 2018 17:45:07 -0400
+Subject: media: tw686x: Fix oops on buffer alloc failure
+
+From: Krzysztof Ha?asa <khalasa@piap.pl>
+
+[ Upstream commit 5a1a2f63d840dc2631505b607e11ff65ac1b7d3c ]
+
+The error path currently calls tw686x_video_free() which requires
+vc->dev to be initialized, causing a NULL dereference on uninitizalized
+channels.
+
+Fix this by setting the vc->dev fields for all the channels first.
+
+Fixes: f8afaa8dbc0d ("[media] tw686x: Introduce an interface to support multiple DMA modes")
+
+Signed-off-by: Krzysztof Ha?asa <khalasa@piap.pl>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/tw686x/tw686x-video.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/pci/tw686x/tw686x-video.c
++++ b/drivers/media/pci/tw686x/tw686x-video.c
+@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev
+ return err;
+ }
+
++ /* Initialize vc->dev and vc->ch for the error path */
++ for (ch = 0; ch < max_channels(dev); ch++) {
++ struct tw686x_video_channel *vc = &dev->video_channels[ch];
++
++ vc->dev = dev;
++ vc->ch = ch;
++ }
++
+ for (ch = 0; ch < max_channels(dev); ch++) {
+ struct tw686x_video_channel *vc = &dev->video_channels[ch];
+ struct video_device *vdev;
+@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev
+ spin_lock_init(&vc->qlock);
+ INIT_LIST_HEAD(&vc->vidq_queued);
+
+- vc->dev = dev;
+- vc->ch = ch;
+-
+ /* default settings */
+ err = tw686x_set_standard(vc, V4L2_STD_NTSC);
+ if (err)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Thu, 5 Jul 2018 04:25:19 -0400
+Subject: media: videobuf2-core: check for q->error in vb2_core_qbuf()
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit b509d733d337417bcb7fa4a35be3b9a49332b724 ]
+
+The vb2_core_qbuf() function didn't check if q->error was set. It is
+checked in __buf_prepare(), but that function isn't called if the buffer
+was already prepared before with VIDIOC_PREPARE_BUF.
+
+So check it at the start of vb2_core_qbuf() as well.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/common/videobuf2/videobuf2-core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1377,6 +1377,11 @@ int vb2_core_qbuf(struct vb2_queue *q, u
+ struct vb2_buffer *vb;
+ int ret;
+
++ if (q->error) {
++ dprintk(1, "fatal error occurred on queue\n");
++ return -EIO;
++ }
++
+ vb = q->bufs[index];
+
+ switch (vb->state) {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 20 Jul 2018 13:58:22 +0200
+Subject: MIPS: ath79: fix system restart
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit f8a7bfe1cb2c1ebfa07775c9c8ac0ad3ba8e5ff5 ]
+
+This patch disables irq on reboot to fix hang issues that were observed
+due to pending interrupts.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/19913/
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/ath79/setup.c | 1 +
+ arch/mips/include/asm/mach-ath79/ath79.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYP
+
+ static void ath79_restart(char *command)
+ {
++ local_irq_disable();
+ ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
+ for (;;)
+ if (cpu_wait)
+--- a/arch/mips/include/asm/mach-ath79/ath79.h
++++ b/arch/mips/include/asm/mach-ath79/ath79.h
+@@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned
+ static inline void ath79_reset_wr(unsigned reg, u32 val)
+ {
+ __raw_writel(val, ath79_reset_base + reg);
++ (void) __raw_readl(ath79_reset_base + reg); /* flush */
+ }
+
+ static inline u32 ath79_reset_rr(unsigned reg)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 8 Jul 2018 17:07:12 +0200
+Subject: MIPS: jz4740: Bump zload address
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit c6ea7e9747318e5a6774995f4f8e3e0f7c0fa8ba ]
+
+Having the zload address at 0x8060.0000 means the size of the
+uncompressed kernel cannot be bigger than around 6 MiB, as it is
+deflated at address 0x8001.0000.
+
+This limit is too small; a kernel with some built-in drivers and things
+like debugfs enabled will already be over 6 MiB in size, and so will
+fail to extract properly.
+
+To fix this, we bump the zload address from 0x8060.0000 to 0x8100.0000.
+
+This is fine, as all the boards featuring Ingenic JZ SoCs have at least
+32 MiB of RAM, and use u-boot or compatible bootloaders which won't
+hardcode the load address but read it from the uImage's header.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/19787/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/jz4740/Platform | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/jz4740/Platform
++++ b/arch/mips/jz4740/Platform
+@@ -1,4 +1,4 @@
+ platform-$(CONFIG_MACH_INGENIC) += jz4740/
+ cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740
+ load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000
+-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000
++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 24 Jul 2018 11:29:01 -0700
+Subject: mtd/maps: fix solutionengine.c printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 1d25e3eeed1d987404e2d2e451eebac8c15cecc1 ]
+
+Fix 2 printk format warnings (this driver is currently only used by
+arch/sh/) by using "%pap" instead of "%lx".
+
+Fixes these build warnings:
+
+../drivers/mtd/maps/solutionengine.c: In function 'init_soleng_maps':
+../include/linux/kern_levels.h:5:18: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'resource_size_t' {aka 'unsigned int'} [-Wformat=]
+../drivers/mtd/maps/solutionengine.c:62:54: note: format string is defined here
+ printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
+ ~~~~^
+ %08x
+../include/linux/kern_levels.h:5:18: warning: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'resource_size_t' {aka 'unsigned int'} [-Wformat=]
+../drivers/mtd/maps/solutionengine.c:62:72: note: format string is defined here
+ printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
+ ~~~~^
+ %08x
+
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Brian Norris <computersforpeace@gmail.com>
+Cc: Boris Brezillon <boris.brezillon@bootlin.com>
+Cc: Marek Vasut <marek.vasut@gmail.com>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: linux-mtd@lists.infradead.org
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Rich Felker <dalias@libc.org>
+Cc: linux-sh@vger.kernel.org
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/maps/solutionengine.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/maps/solutionengine.c
++++ b/drivers/mtd/maps/solutionengine.c
+@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void)
+ return -ENXIO;
+ }
+ }
+- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
+- soleng_flash_map.phys & 0x1fffffff,
+- soleng_eprom_map.phys & 0x1fffffff);
++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n",
++ &soleng_flash_map.phys,
++ &soleng_eprom_map.phys);
+ flash_mtd->owner = THIS_MODULE;
+
+ eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Fri, 20 Jul 2018 21:14:39 -0700
+Subject: nfp: avoid buffer leak when FW communication fails
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 07300f774fec9519663a597987a4083225588be4 ]
+
+After device is stopped we reset the rings by moving all free buffers
+to positions [0, cnt - 2], and clear the position cnt - 1 in the ring.
+We then proceed to clear the read/write pointers. This means that if
+we try to reset the ring again the code will assume that the next to
+fill buffer is at position 0 and swap it with cnt - 1. Since we
+previously cleared position cnt - 1 it will lead to leaking the first
+buffer and leaving ring in a bad state.
+
+This scenario can only happen if FW communication fails, in which case
+the ring will never be used again, so the fact it's in a bad state will
+not be noticed. Buffer leak is the only problem. Don't try to move
+buffers in the ring if the read/write pointers indicate the ring was
+never used or have already been reset.
+
+nfp_net_clear_config_and_disable() is now fully idempotent.
+
+Found by code inspection, FW communication failures are very rare,
+and reconfiguring a live device is not common either, so it's unlikely
+anyone has ever noticed the leak.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -1093,7 +1093,7 @@ static bool nfp_net_xdp_complete(struct
+ * @dp: NFP Net data path struct
+ * @tx_ring: TX ring structure
+ *
+- * Assumes that the device is stopped
++ * Assumes that the device is stopped, must be idempotent.
+ */
+ static void
+ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
+@@ -1295,13 +1295,18 @@ static void nfp_net_rx_give_one(const st
+ * nfp_net_rx_ring_reset() - Reflect in SW state of freelist after disable
+ * @rx_ring: RX ring structure
+ *
+- * Warning: Do *not* call if ring buffers were never put on the FW freelist
+- * (i.e. device was not enabled)!
++ * Assumes that the device is stopped, must be idempotent.
+ */
+ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
+ {
+ unsigned int wr_idx, last_idx;
+
++ /* wr_p == rd_p means ring was never fed FL bufs. RX rings are always
++ * kept at cnt - 1 FL bufs.
++ */
++ if (rx_ring->wr_p == 0 && rx_ring->rd_p == 0)
++ return;
++
+ /* Move the empty entry to the end of the list */
+ wr_idx = D_IDX(rx_ring, rx_ring->wr_p);
+ last_idx = rx_ring->cnt - 1;
+@@ -2524,6 +2529,8 @@ static void nfp_net_vec_clear_ring_data(
+ /**
+ * nfp_net_clear_config_and_disable() - Clear control BAR and disable NFP
+ * @nn: NFP Net device to reconfigure
++ *
++ * Warning: must be fully idempotent.
+ */
+ static void nfp_net_clear_config_and_disable(struct nfp_net *nn)
+ {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Wed, 25 Jul 2018 19:40:34 -0700
+Subject: nfp: don't fail probe on pci_sriov_set_totalvfs() errors
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 5b0ced17edc5710d4e946392d0f2934a9e07b37f ]
+
+On machines with buggy ACPI tables or when SR-IOV is already enabled
+we may not be able to set the SR-IOV VF limit in sysfs, it's not fatal
+because the limit is imposed by the driver anyway. Only the sysfs
+'sriov_totalvfs' attribute will be too high. Print an error to inform
+user about the failure but allow probe to continue.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_main.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
+@@ -236,16 +236,20 @@ static int nfp_pcie_sriov_read_nfd_limit
+ int err;
+
+ pf->limit_vfs = nfp_rtsym_read_le(pf->rtbl, "nfd_vf_cfg_max_vfs", &err);
+- if (!err)
+- return pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs);
++ if (err) {
++ /* For backwards compatibility if symbol not found allow all */
++ pf->limit_vfs = ~0;
++ if (err == -ENOENT)
++ return 0;
+
+- pf->limit_vfs = ~0;
+- /* Allow any setting for backwards compatibility if symbol not found */
+- if (err == -ENOENT)
+- return 0;
++ nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err);
++ return err;
++ }
+
+- nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err);
+- return err;
++ err = pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs);
++ if (err)
++ nfp_warn(pf->cpp, "Failed to set VF count in sysfs: %d\n", err);
++ return 0;
+ }
+
+ static int nfp_pcie_sriov_enable(struct pci_dev *pdev, int num_vfs)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Mon, 9 Jul 2018 12:49:05 +0300
+Subject: nvme-rdma: unquiesce queues when deleting the controller
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 90140624e8face94207003ac9a9d2a329b309d68 ]
+
+If the controller is going away, we need to unquiesce the IO queues so
+that all pending request can fail gracefully before moving forward with
+controller deletion. Do that before we destroy the IO queues so
+blk_cleanup_queue won't block in freeze.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1741,6 +1741,8 @@ static void nvme_rdma_shutdown_ctrl(stru
+ nvme_rdma_stop_io_queues(ctrl);
+ blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ nvme_cancel_request, &ctrl->ctrl);
++ if (shutdown)
++ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, shutdown);
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Wed, 11 Jul 2018 12:43:16 +0300
+Subject: nvmet: fix file discard return status
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 1b72b71faccee986e2128a271125177dfe91f7b7 ]
+
+If nvmet_copy_from_sgl failed, we falsly return successful
+completion status.
+
+Fixes: d5eff33ee6f8 ("nvmet: add simple file backed ns support")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/io-cmd-file.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -209,22 +209,24 @@ static void nvmet_file_execute_discard(s
+ {
+ int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
+ struct nvme_dsm_range range;
+- loff_t offset;
+- loff_t len;
+- int i, ret;
++ loff_t offset, len;
++ u16 ret;
++ int i;
+
+ for (i = 0; i <= le32_to_cpu(req->cmd->dsm.nr); i++) {
+- if (nvmet_copy_from_sgl(req, i * sizeof(range), &range,
+- sizeof(range)))
++ ret = nvmet_copy_from_sgl(req, i * sizeof(range), &range,
++ sizeof(range));
++ if (ret)
+ break;
+ offset = le64_to_cpu(range.slba) << req->ns->blksize_shift;
+ len = le32_to_cpu(range.nlb) << req->ns->blksize_shift;
+- ret = vfs_fallocate(req->ns->file, mode, offset, len);
+- if (ret)
++ if (vfs_fallocate(req->ns->file, mode, offset, len)) {
++ ret = NVME_SC_INTERNAL | NVME_SC_DNR;
+ break;
++ }
+ }
+
+- nvmet_req_complete(req, ret < 0 ? NVME_SC_INTERNAL | NVME_SC_DNR : 0);
++ nvmet_req_complete(req, ret);
+ }
+
+ static void nvmet_file_dsm_work(struct work_struct *w)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 24 Jul 2018 19:11:27 +0200
+Subject: omapfb: rename omap2 module to omap2fb.ko
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4bcd8c90ac0f27d3d76fcfc50582ff3685059de9 ]
+
+In a kernel configuration with both CONFIG_FB_OMAP=m and CONFIG_FB_OMAP2=m,
+Kbuild fails to point out that we have two modules with the same name (omapfb.ko),
+but instead fails with a cryptic error message like:
+
+ERROR: "omapfb_register_panel" [drivers/video/fbdev/omap/lcd_osk.ko] undefined!
+
+This can now happen when building a randconfig kernel with CONFIG_ARCH_OMAP1,
+as the omap1 fbdev driver depends on that, whiel the omap2 fbdev driver can
+now be built anywhere with CONFIG_COMPILE_TEST.
+
+The solution is to rename one of the two modules, so for consistency with
+the directory naming I decided to rename the omap2 version to omap2fb.ko.
+
+Fixes: 7378f1149884 ("media: omap2: omapfb: allow building it with COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/omap2/omapfb/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/omap2/omapfb/Makefile
++++ b/drivers/video/fbdev/omap2/omapfb/Makefile
+@@ -2,5 +2,5 @@
+ obj-$(CONFIG_OMAP2_VRFB) += vrfb.o
+ obj-y += dss/
+ obj-y += displays/
+-obj-$(CONFIG_FB_OMAP2) += omapfb.o
+-omapfb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o
++obj-$(CONFIG_FB_OMAP2) += omap2fb.o
++omap2fb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Tue, 3 Jul 2018 18:27:43 -0500
+Subject: PCI/AER: Honor "pcie_ports=native" even if HEST sets FIRMWARE_FIRST
+
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+
+[ Upstream commit 7af02fcd84c16801958936f88b848944c726ca07 ]
+
+According to the documentation, "pcie_ports=native", linux should use
+native AER and DPC services. While that is true for the _OSC method
+parsing, this is not the only place that is checked. Should the HEST
+list PCIe ports as firmware-first, linux will not use native services.
+
+This happens because aer_acpi_firmware_first() doesn't take 'pcie_ports'
+into account. This is wrong. DPC uses the same logic when it decides
+whether to load or not, so fixing this also fixes DPC not loading.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+[bhelgaas: return "false" from bool function (from kbuild robot)]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pcie/aer.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -303,6 +303,9 @@ int pcie_aer_get_firmware_first(struct p
+ if (!pci_is_pcie(dev))
+ return 0;
+
++ if (pcie_ports_native)
++ return 0;
++
+ if (!dev->__aer_firmware_first_valid)
+ aer_set_firmware_first(dev);
+ return dev->__aer_firmware_first;
+@@ -323,6 +326,9 @@ bool aer_acpi_firmware_first(void)
+ .firmware_first = 0,
+ };
+
++ if (pcie_ports_native)
++ return false;
++
+ if (!parsed) {
+ apei_hest_parse(aer_hest_parse, &info);
+ aer_firmware_first = info.firmware_first;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 10 Jul 2018 19:28:14 +0530
+Subject: perf powerpc: Fix callchain ip filtering when return address is in a register
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 9068533e4f470daf2b0f29c71d865990acd8826e ]
+
+For powerpc64, perf will filter out the second entry in the callchain,
+i.e. the LR value, if the return address of the function corresponding
+to the probed location has already been saved on its caller's stack.
+
+The state of the return address is determined using debug information.
+At any point within a function, if the return address is already saved
+somewhere, a DWARF expression can tell us about its location. If the
+return address in still in LR only, no DWARF expression would exist.
+
+Typically, the instructions in a function's prologue first copy the LR
+value to R0 and then pushes R0 on to the stack. If LR has already been
+copied to R0 but R0 is yet to be pushed to the stack, we can still get a
+DWARF expression that says that the return address is in R0. This is
+indicating that getting a DWARF expression for the return address does
+not guarantee the fact that it has already been saved on the stack.
+
+This can be observed on a powerpc64le system running Fedora 27 as shown
+below.
+
+ # objdump -d /usr/lib64/libc-2.26.so | less
+ ...
+ 000000000015af20 <inet_pton>:
+ 15af20: 0b 00 4c 3c addis r2,r12,11
+ 15af24: e0 c1 42 38 addi r2,r2,-15904
+ 15af28: a6 02 08 7c mflr r0
+ 15af2c: f0 ff c1 fb std r30,-16(r1)
+ 15af30: f8 ff e1 fb std r31,-8(r1)
+ 15af34: 78 1b 7f 7c mr r31,r3
+ 15af38: 78 23 83 7c mr r3,r4
+ 15af3c: 78 2b be 7c mr r30,r5
+ 15af40: 10 00 01 f8 std r0,16(r1)
+ 15af44: c1 ff 21 f8 stdu r1,-64(r1)
+ 15af48: 28 00 81 f8 std r4,40(r1)
+ ...
+
+ # readelf --debug-dump=frames-interp /usr/lib64/libc-2.26.so | less
+ ...
+ 00027024 0000000000000024 00027028 FDE cie=00000000 pc=000000000015af20..000000000015af88
+ LOC CFA r30 r31 ra
+ 000000000015af20 r1+0 u u u
+ 000000000015af34 r1+0 c-16 c-8 r0
+ 000000000015af48 r1+64 c-16 c-8 c+16
+ 000000000015af5c r1+0 c-16 c-8 c+16
+ 000000000015af78 r1+0 u u
+ ...
+
+ # perf probe -x /usr/lib64/libc-2.26.so -a inet_pton+0x18
+ # perf record -e probe_libc:inet_pton -g ping -6 -c 1 ::1
+ # perf script
+
+Before:
+
+ ping 2829 [005] 512917.460174: probe_libc:inet_pton: (7fff7e2baf38)
+ 7fff7e2baf38 __GI___inet_pton+0x18 (/usr/lib64/libc-2.26.so)
+ 7fff7e2705b4 getaddrinfo+0x164 (/usr/lib64/libc-2.26.so)
+ 12f152d70 _init+0xbfc (/usr/bin/ping)
+ 7fff7e1836a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fff7e183898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+After:
+
+ ping 2829 [005] 512917.460174: probe_libc:inet_pton: (7fff7e2baf38)
+ 7fff7e2baf38 __GI___inet_pton+0x18 (/usr/lib64/libc-2.26.so)
+ 7fff7e26fa54 gaih_inet.constprop.7+0xf44 (/usr/lib64/libc-2.26.so)
+ 7fff7e2705b4 getaddrinfo+0x164 (/usr/lib64/libc-2.26.so)
+ 12f152d70 _init+0xbfc (/usr/bin/ping)
+ 7fff7e1836a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fff7e183898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+Reported-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Maynard Johnson <maynard@us.ibm.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/66e848a7bdf2d43b39210a705ff6d828a0865661.1530724939.git.sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/powerpc/util/skip-callchain-idx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno
+ }
+
+ /*
+- * Check if return address is on the stack.
++ * Check if return address is on the stack. If return address
++ * is in a register (typically R0), it is yet to be saved on
++ * the stack.
+ */
+- if (nops != 0 || ops != NULL)
++ if ((nops != 0 || ops != NULL) &&
++ !(nops == 1 && ops[0].atom == DW_OP_regx &&
++ ops[0].number2 == 0 && ops[0].offset == 0))
+ return 0;
+
+ /*
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 10 Jul 2018 19:28:13 +0530
+Subject: perf powerpc: Fix callchain ip filtering
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit c715fcfda5a08edabaa15508742be926b7ee51db ]
+
+For powerpc64, redundant entries in the callchain are filtered out by
+determining the state of the return address and the stack frame using
+DWARF debug information.
+
+For making these filtering decisions we must analyze the debug
+information for the location corresponding to the program counter value,
+i.e. the first entry in the callchain, and not the LR value; otherwise,
+perf may filter out either the second or the third entry in the
+callchain incorrectly.
+
+This can be observed on a powerpc64le system running Fedora 27 as shown
+below.
+
+Case 1 - Attaching a probe at inet_pton+0x8 (binary offset 0x15af28).
+ Return address is still in LR and a new stack frame is not yet
+ allocated. The LR value, i.e. the second entry, should not be
+ filtered out.
+
+ # objdump -d /usr/lib64/libc-2.26.so | less
+ ...
+ 000000000010eb10 <gaih_inet.constprop.7>:
+ ...
+ 10fa48: 78 bb e4 7e mr r4,r23
+ 10fa4c: 0a 00 60 38 li r3,10
+ 10fa50: d9 b4 04 48 bl 15af28 <inet_pton+0x8>
+ 10fa54: 00 00 00 60 nop
+ 10fa58: ac f4 ff 4b b 10ef04 <gaih_inet.constprop.7+0x3f4>
+ ...
+ 0000000000110450 <getaddrinfo>:
+ ...
+ 1105a8: 54 00 ff 38 addi r7,r31,84
+ 1105ac: 58 00 df 38 addi r6,r31,88
+ 1105b0: 69 e5 ff 4b bl 10eb18 <gaih_inet.constprop.7+0x8>
+ 1105b4: 78 1b 71 7c mr r17,r3
+ 1105b8: 50 01 7f e8 ld r3,336(r31)
+ ...
+ 000000000015af20 <inet_pton>:
+ 15af20: 0b 00 4c 3c addis r2,r12,11
+ 15af24: e0 c1 42 38 addi r2,r2,-15904
+ 15af28: a6 02 08 7c mflr r0
+ 15af2c: f0 ff c1 fb std r30,-16(r1)
+ 15af30: f8 ff e1 fb std r31,-8(r1)
+ ...
+
+ # perf probe -x /usr/lib64/libc-2.26.so -a inet_pton+0x8
+ # perf record -e probe_libc:inet_pton -g ping -6 -c 1 ::1
+ # perf script
+
+Before:
+
+ ping 4507 [002] 514985.546540: probe_libc:inet_pton: (7fffa7dbaf28)
+ 7fffa7dbaf28 __GI___inet_pton+0x8 (/usr/lib64/libc-2.26.so)
+ 7fffa7d705b4 getaddrinfo+0x164 (/usr/lib64/libc-2.26.so)
+ 13fb52d70 _init+0xbfc (/usr/bin/ping)
+ 7fffa7c836a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fffa7c83898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+After:
+
+ ping 4507 [002] 514985.546540: probe_libc:inet_pton: (7fffa7dbaf28)
+ 7fffa7dbaf28 __GI___inet_pton+0x8 (/usr/lib64/libc-2.26.so)
+ 7fffa7d6fa54 gaih_inet.constprop.7+0xf44 (/usr/lib64/libc-2.26.so)
+ 7fffa7d705b4 getaddrinfo+0x164 (/usr/lib64/libc-2.26.so)
+ 13fb52d70 _init+0xbfc (/usr/bin/ping)
+ 7fffa7c836a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fffa7c83898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+Case 2 - Attaching a probe at _int_malloc+0x180 (binary offset 0x9cf10).
+ Return address in still in LR and a new stack frame has already
+ been allocated but not used. The caller's caller, i.e. the third
+ entry, is invalid and should be filtered out and not the second
+ one.
+
+ # objdump -d /usr/lib64/libc-2.26.so | less
+ ...
+ 000000000009cd90 <_int_malloc>:
+ 9cd90: 17 00 4c 3c addis r2,r12,23
+ 9cd94: 70 a3 42 38 addi r2,r2,-23696
+ 9cd98: 26 00 80 7d mfcr r12
+ 9cd9c: f8 ff e1 fb std r31,-8(r1)
+ 9cda0: 17 00 e4 3b addi r31,r4,23
+ 9cda4: d8 ff 61 fb std r27,-40(r1)
+ 9cda8: 78 23 9b 7c mr r27,r4
+ 9cdac: 1f 00 bf 2b cmpldi cr7,r31,31
+ 9cdb0: f0 ff c1 fb std r30,-16(r1)
+ 9cdb4: b0 ff c1 fa std r22,-80(r1)
+ 9cdb8: 78 1b 7e 7c mr r30,r3
+ 9cdbc: 08 00 81 91 stw r12,8(r1)
+ 9cdc0: 11 ff 21 f8 stdu r1,-240(r1)
+ 9cdc4: 4c 01 9d 41 bgt cr7,9cf10 <_int_malloc+0x180>
+ 9cdc8: 20 00 a4 2b cmpldi cr7,r4,32
+ ...
+ 9cf08: 00 00 00 60 nop
+ 9cf0c: 00 00 42 60 ori r2,r2,0
+ 9cf10: e4 06 ff 7b rldicr r31,r31,0,59
+ 9cf14: 40 f8 a4 7f cmpld cr7,r4,r31
+ 9cf18: 68 05 9d 41 bgt cr7,9d480 <_int_malloc+0x6f0>
+ ...
+ 000000000009e3c0 <tcache_init.part.4>:
+ ...
+ 9e420: 40 02 80 38 li r4,576
+ 9e424: 78 fb e3 7f mr r3,r31
+ 9e428: 71 e9 ff 4b bl 9cd98 <_int_malloc+0x8>
+ 9e42c: 00 00 a3 2f cmpdi cr7,r3,0
+ 9e430: 78 1b 7e 7c mr r30,r3
+ ...
+ 000000000009f7a0 <__libc_malloc>:
+ ...
+ 9f8f8: 00 00 89 2f cmpwi cr7,r9,0
+ 9f8fc: 1c ff 9e 40 bne cr7,9f818 <__libc_malloc+0x78>
+ 9f900: c9 ea ff 4b bl 9e3c8 <tcache_init.part.4+0x8>
+ 9f904: 00 00 00 60 nop
+ 9f908: e8 90 22 e9 ld r9,-28440(r2)
+ ...
+
+ # perf probe -x /usr/lib64/libc-2.26.so -a _int_malloc+0x180
+ # perf record -e probe_libc:_int_malloc -g ./test-malloc
+ # perf script
+
+Before:
+
+ test-malloc 6554 [009] 515975.797403: probe_libc:_int_malloc: (7fffa6e6cf10)
+ 7fffa6e6cf10 _int_malloc+0x180 (/usr/lib64/libc-2.26.so)
+ 7fffa6dd0000 [unknown] (/usr/lib64/libc-2.26.so)
+ 7fffa6e6f904 malloc+0x164 (/usr/lib64/libc-2.26.so)
+ 7fffa6e6f9fc malloc+0x25c (/usr/lib64/libc-2.26.so)
+ 100006b4 main+0x38 (/home/testuser/test-malloc)
+ 7fffa6df36a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fffa6df3898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+After:
+
+ test-malloc 6554 [009] 515975.797403: probe_libc:_int_malloc: (7fffa6e6cf10)
+ 7fffa6e6cf10 _int_malloc+0x180 (/usr/lib64/libc-2.26.so)
+ 7fffa6e6e42c tcache_init.part.4+0x6c (/usr/lib64/libc-2.26.so)
+ 7fffa6e6f904 malloc+0x164 (/usr/lib64/libc-2.26.so)
+ 7fffa6e6f9fc malloc+0x25c (/usr/lib64/libc-2.26.so)
+ 100006b4 main+0x38 (/home/sandipan/test-malloc)
+ 7fffa6df36a0 generic_start_main.isra.0+0x140 (/usr/lib64/libc-2.26.so)
+ 7fffa6df3898 __libc_start_main+0xb8 (/usr/lib64/libc-2.26.so)
+ 0 [unknown] ([unknown])
+
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Maynard Johnson <maynard@us.ibm.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Fixes: a60335ba3298 ("perf tools powerpc: Adjust callchain based on DWARF debug info")
+Link: http://lkml.kernel.org/r/24bb726d91ed173aebc972ec3f41a2ef2249434e.1530724939.git.sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -250,7 +250,7 @@ int arch_skip_callchain_idx(struct threa
+ if (!chain || chain->nr < 3)
+ return skip_slot;
+
+- ip = chain->ips[2];
++ ip = chain->ips[1];
+
+ thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al);
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 3 Jul 2018 17:35:55 +0530
+Subject: perf script: Show correct offsets for DWARF-based unwinding
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 2a9d5050dc84fa2060f08a52f632976923e0fa7e ]
+
+When perf/data is recorded with the dwarf call-graph option, the
+callchain shown by 'perf script' still shows the binary offsets of the
+userspace symbols instead of their virtual addresses. Since the symbol
+offset calculation is based on using virtual address as the ip, we see
+incorrect offsets as well.
+
+The use of virtual addresses affects the ability to find out the
+line number in the corresponding source file to which an address
+maps to as described in commit 67540759151a ("perf unwind: Use
+addr_location::addr instead of ip for entries").
+
+This has also been addressed by temporarily converting the virtual
+address to the correponding binary offset so that it can be mapped
+to the source line number correctly.
+
+This is a follow-up for commit 19610184693c ("perf script: Show
+virtual addresses instead of offsets").
+
+This can be verified on a powerpc64le system running Fedora 27 as
+shown below:
+
+ # perf probe -x /usr/lib64/libc-2.26.so -a inet_pton
+ # perf record -e probe_libc:inet_pton --call-graph=dwarf ping -6 -c 1 ::1
+
+Before:
+
+ # perf report --stdio --no-children -s sym,srcline -g address
+
+ # Samples: 1 of event 'probe_libc:inet_pton'
+ # Event count (approx.): 1
+ #
+ # Overhead Symbol Source:Line
+ # ........ .................... ...........
+ #
+ 100.00% [.] __GI___inet_pton inet_pton.c
+ |
+ ---gaih_inet getaddrinfo.c:537 (inlined)
+ __GI_getaddrinfo getaddrinfo.c:2304 (inlined)
+ main ping.c:519
+ generic_start_main libc-start.c:308 (inlined)
+ __libc_start_main libc-start.c:102
+ ...
+
+ # perf script -F comm,ip,sym,symoff,srcline,dso
+
+ ping
+ 15af28 __GI___inet_pton+0xffff000099160008 (/usr/lib64/libc-2.26.so)
+ libc-2.26.so[ffff80004ca0af28]
+ 10fa53 gaih_inet+0xffff000099160f43
+ libc-2.26.so[ffff80004c9bfa53] (inlined)
+ 1105b3 __GI_getaddrinfo+0xffff000099160163
+ libc-2.26.so[ffff80004c9c05b3] (inlined)
+ 2d6f main+0xfffffffd9f1003df (/usr/bin/ping)
+ ping[fffffffecf882d6f]
+ 2369f generic_start_main+0xffff00009916013f
+ libc-2.26.so[ffff80004c8d369f] (inlined)
+ 23897 __libc_start_main+0xffff0000991600b7 (/usr/lib64/libc-2.26.so)
+ libc-2.26.so[ffff80004c8d3897]
+
+After:
+
+ # perf report --stdio --no-children -s sym,srcline -g address
+
+ # Samples: 1 of event 'probe_libc:inet_pton'
+ # Event count (approx.): 1
+ #
+ # Overhead Symbol Source:Line
+ # ........ .................... ...........
+ #
+ 100.00% [.] __GI___inet_pton inet_pton.c
+ |
+ ---gaih_inet.constprop.7 getaddrinfo.c:537
+ getaddrinfo getaddrinfo.c:2304
+ main ping.c:519
+ generic_start_main.isra.0 libc-start.c:308
+ __libc_start_main libc-start.c:102
+ ...
+
+ # perf script -F comm,ip,sym,symoff,srcline,dso
+
+ ping
+ 7fffb38aaf28 __GI___inet_pton+0x8 (/usr/lib64/libc-2.26.so)
+ inet_pton.c:68
+ 7fffb385fa53 gaih_inet.constprop.7+0xf43 (/usr/lib64/libc-2.26.so)
+ getaddrinfo.c:537
+ 7fffb38605b3 getaddrinfo+0x163 (/usr/lib64/libc-2.26.so)
+ getaddrinfo.c:2304
+ 130782d6f main+0x3df (/usr/bin/ping)
+ ping.c:519
+ 7fffb377369f generic_start_main.isra.0+0x13f (/usr/lib64/libc-2.26.so)
+ libc-start.c:308
+ 7fffb3773897 __libc_start_main+0xb7 (/usr/lib64/libc-2.26.so)
+ libc-start.c:102
+
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Milian Wolff <milian.wolff@kdab.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Fixes: 67540759151a ("perf unwind: Use addr_location::addr instead of ip for entries")
+Link: http://lkml.kernel.org/r/20180703120555.32971-1-sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/machine.c | 9 ++++++++-
+ tools/perf/util/unwind-libdw.c | 2 +-
+ tools/perf/util/unwind-libunwind-local.c | 2 +-
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2272,6 +2272,7 @@ static int unwind_entry(struct unwind_en
+ {
+ struct callchain_cursor *cursor = arg;
+ const char *srcline = NULL;
++ u64 addr;
+
+ if (symbol_conf.hide_unresolved && entry->sym == NULL)
+ return 0;
+@@ -2279,7 +2280,13 @@ static int unwind_entry(struct unwind_en
+ if (append_inlines(cursor, entry->map, entry->sym, entry->ip) == 0)
+ return 0;
+
+- srcline = callchain_srcline(entry->map, entry->sym, entry->ip);
++ /*
++ * Convert entry->ip from a virtual address to an offset in
++ * its corresponding binary.
++ */
++ addr = map__map_ip(entry->map, entry->ip);
++
++ srcline = callchain_srcline(entry->map, entry->sym, addr);
+ return callchain_cursor_append(cursor, entry->ip,
+ entry->map, entry->sym,
+ false, NULL, 0, 0, 0, srcline);
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -77,7 +77,7 @@ static int entry(u64 ip, struct unwind_i
+ if (__report_module(&al, ip, ui))
+ return -1;
+
+- e->ip = al.addr;
++ e->ip = ip;
+ e->map = al.map;
+ e->sym = al.sym;
+
+--- a/tools/perf/util/unwind-libunwind-local.c
++++ b/tools/perf/util/unwind-libunwind-local.c
+@@ -575,7 +575,7 @@ static int entry(u64 ip, struct thread *
+ struct addr_location al;
+
+ e.sym = thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al);
+- e.ip = al.addr;
++ e.ip = ip;
+ e.map = al.map;
+
+ pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 24 Jul 2018 15:48:58 +0200
+Subject: perf test: Fix subtest number when showing results
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 9ef0112442bdddef5fb55adf20b3a5464b33de75 ]
+
+Perf test 40 for example has several subtests numbered 1-4 when
+displaying the start of the subtest. When the subtest results
+are displayed the subtests are numbered 0-3.
+
+Use this command to generate trace output:
+
+ [root@s35lp76 perf]# ./perf test -Fv 40 2>/tmp/bpf1
+
+Fix this by adjusting the subtest number when show the
+subtest result.
+
+Output before:
+
+ [root@s35lp76 perf]# egrep '(^40\.[0-4]| subtest [0-4]:)' /tmp/bpf1
+ 40.1: Basic BPF filtering :
+ BPF filter subtest 0: Ok
+ 40.2: BPF pinning :
+ BPF filter subtest 1: Ok
+ 40.3: BPF prologue generation :
+ BPF filter subtest 2: Ok
+ 40.4: BPF relocation checker :
+ BPF filter subtest 3: Ok
+ [root@s35lp76 perf]#
+
+Output after:
+
+ root@s35lp76 ~]# egrep '(^40\.[0-4]| subtest [0-4]:)' /tmp/bpf1
+ 40.1: Basic BPF filtering :
+ BPF filter subtest 1: Ok
+ 40.2: BPF pinning :
+ BPF filter subtest 2: Ok
+ 40.3: BPF prologue generation :
+ BPF filter subtest 3: Ok
+ 40.4: BPF relocation checker :
+ BPF filter subtest 4: Ok
+ [root@s35lp76 ~]#
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Link: http://lkml.kernel.org/r/20180724134858.100644-1-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/builtin-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/tests/builtin-test.c
++++ b/tools/perf/tests/builtin-test.c
+@@ -599,7 +599,7 @@ static int __cmd_test(int argc, const ch
+ for (subi = 0; subi < subn; subi++) {
+ pr_info("%2d.%1d: %-*s:", i, subi + 1, subw,
+ t->subtest.get_desc(subi));
+- err = test_and_print(t, skip, subi);
++ err = test_and_print(t, skip, subi + 1);
+ if (err != TEST_OK && t->subtest.skip_if_fail)
+ skip = true;
+ }
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 10 Jul 2018 19:28:15 +0530
+Subject: perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 3eae52f842329a95f8549124079518231c0daba8 ]
+
+For powerpc64, this test currently fails due to a mismatch in the
+expected output.
+
+This can be observed on a powerpc64le system running Fedora 27 as shown
+below.
+
+ # perf test -v "probe libc's inet_pton & backtrace it with ping"
+
+Before:
+
+ 62: probe libc's inet_pton & backtrace it with ping :
+ --- start ---
+ test child forked, pid 23948
+ ping 23965 [003] 71136.075084: probe_libc:inet_pton: (7fff996aaf28)
+ 7fff996aaf28 __GI___inet_pton+0x8 (/usr/lib64/libc-2.26.so)
+ 7fff9965fa54 gaih_inet.constprop.7+0xf44 (/usr/lib64/libc-2.26.so)
+ FAIL: expected backtrace entry 2 "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\(/usr/lib64/libc-2.26.so\)$" got "7fff9965fa54 gaih_inet.constprop.7+0xf44 (/usr/lib64/libc-2.26.so)"
+ test child finished with -1
+ ---- end ----
+ probe libc's inet_pton & backtrace it with ping: FAILED!
+
+After:
+
+ 62: probe libc's inet_pton & backtrace it with ping :
+ --- start ---
+ test child forked, pid 24638
+ ping 24655 [001] 71208.525396: probe_libc:inet_pton: (7fffa245af28)
+ 7fffa245af28 __GI___inet_pton+0x8 (/usr/lib64/libc-2.26.so)
+ 7fffa240fa54 gaih_inet.constprop.7+0xf44 (/usr/lib64/libc-2.26.so)
+ 7fffa24105b4 getaddrinfo+0x164 (/usr/lib64/libc-2.26.so)
+ 138d52d70 main+0x3e0 (/usr/bin/ping)
+ test child finished with 0
+ ---- end ----
+ probe libc's inet_pton & backtrace it with ping: Ok
+
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@arm.com>
+Cc: Maynard Johnson <maynard@us.ibm.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Fixes: e07d585e2454 ("perf tests: Switch trace+probe_libc_inet_pton to use record")
+Link: http://lkml.kernel.org/r/49621ec5f37109f0655e5a8c32287ad68d85a1e5.1530724939.git.sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -26,6 +26,12 @@ trace_libc_inet_pton_backtrace() {
+ echo "(__GI_)?getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
+ echo "main\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
++ ppc64|ppc64le)
++ eventattr='max-stack=4'
++ echo "gaih_inet.*\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
++ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
++ echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ ;;
+ *)
+ eventattr='max-stack=3'
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 10 Jul 2018 19:28:16 +0530
+Subject: perf tests: Fix record+probe_libc_inet_pton.sh to ensure cleanups
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 83e3b6d73e66a10088f362b08b99c36fec3a14e7 ]
+
+If there is a mismatch in the perf script output, this test fails and
+exits before the event and temporary files created during its execution
+are cleaned up.
+
+This can be observed on a powerpc64 system running Fedora 27 as shown
+below.
+
+ # perf test -v "probe libc's inet_pton & backtrace it with ping"
+
+ 62: probe libc's inet_pton & backtrace it with ping :
+ --- start ---
+ test child forked, pid 18655
+ ping 18674 [013] 24511.496995: probe_libc:inet_pton: (7fffa6b423b0)
+ 7fffa6b423b0 __GI___inet_pton+0x0 (/usr/lib64/power8/libc-2.26.so)
+ 7fffa6af90dc gaih_inet.constprop.7+0xf4c (/usr/lib64/power8/libc-2.26.so)
+ FAIL: expected backtrace entry "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\(/usr/lib64/power8/libc-2.26.so\)$" got "7fffa6af90dc gaih_inet.constprop.7+0xf4c (/usr/lib64/power8/libc-2.26.so)"
+ test child finished with -1
+ ---- end ----
+ probe libc's inet_pton & backtrace it with ping: FAILED!
+
+ # ls /tmp/expected.* /tmp/perf.data.* /tmp/perf.script.*
+
+ /tmp/expected.u31 /tmp/perf.data.Pki /tmp/perf.script.Bhs
+
+ # perf probe --list
+
+ probe_libc:inet_pton (on __inet_pton@resolv/inet_pton.c in /usr/lib64/power8/libc-2.26.so)
+
+Cleanup of the event and the temporary files are now ensured by allowing
+the cleanup code to be executed even if the lines from the backtrace do
+not match their expected patterns instead of simply exiting from the
+point of failure.
+
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@arm.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/ce9fb091dd3028fba8749a1a267cfbcb264bbfb1.1530724939.git.sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -65,7 +65,7 @@ trace_libc_inet_pton_backtrace() {
+ echo "$line" | egrep -q "$pattern"
+ if [ $? -ne 0 ] ; then
+ printf "FAIL: expected backtrace entry \"%s\" got \"%s\"\n" "$pattern" "$line"
+- exit 1
++ return 1
+ fi
+ done
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Tue, 10 Jul 2018 19:28:17 +0530
+Subject: perf tests: Fix record+probe_libc_inet_pton.sh when event exists
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 60089e42d38438772e2f83334e3e5b7497009366 ]
+
+If the event 'probe_libc:inet_pton' already exists, this test fails and
+deletes the existing event before exiting. This will then pass for any
+subsequent executions.
+
+Instead of skipping to deleting the existing event because of failing to
+add a new event, a duplicate event is now created and the script
+continues with the usual checks. Only the new duplicate event that is
+created at the beginning of the test is deleted as a part of the
+cleanups in the end. All existing events remain as it is.
+
+This can be observed on a powerpc64 system running Fedora 27 as shown
+below.
+
+ # perf probe -x /usr/lib64/power8/libc-2.26.so -a inet_pton
+
+ Added new event:
+ probe_libc:inet_pton (on inet_pton in /usr/lib64/power8/libc-2.26.so)
+
+Before:
+
+ # perf test -v "probe libc's inet_pton & backtrace it with ping"
+
+ 62: probe libc's inet_pton & backtrace it with ping :
+ --- start ---
+ test child forked, pid 21302
+ test child finished with -1
+ ---- end ----
+ probe libc's inet_pton & backtrace it with ping: FAILED!
+
+ # perf probe --list
+
+After:
+
+ # perf test -v "probe libc's inet_pton & backtrace it with ping"
+
+ 62: probe libc's inet_pton & backtrace it with ping :
+ --- start ---
+ test child forked, pid 21490
+ ping 21513 [035] 39357.565561: probe_libc:inet_pton_1: (7fffa4c623b0)
+ 7fffa4c623b0 __GI___inet_pton+0x0 (/usr/lib64/power8/libc-2.26.so)
+ 7fffa4c190dc gaih_inet.constprop.7+0xf4c (/usr/lib64/power8/libc-2.26.so)
+ 7fffa4c19c4c getaddrinfo+0x15c (/usr/lib64/power8/libc-2.26.so)
+ 111d93c20 main+0x3e0 (/usr/bin/ping)
+ test child finished with 0
+ ---- end ----
+ probe libc's inet_pton & backtrace it with ping: Ok
+
+ # perf probe --list
+
+ probe_libc:inet_pton (on __inet_pton@resolv/inet_pton.c in /usr/lib64/power8/libc-2.26.so)
+
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@arm.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/e11fecff96e6cf4c65cdbd9012463513d7b8356c.1530724939.git.sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 28 +++++++++++++++---
+ 1 file changed, 24 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -13,11 +13,24 @@
+ libc=$(grep -w libc /proc/self/maps | head -1 | sed -r 's/.*[[:space:]](\/.*)/\1/g')
+ nm -Dg $libc 2>/dev/null | fgrep -q inet_pton || exit 254
+
++event_pattern='probe_libc:inet_pton(\_[[:digit:]]+)?'
++
++add_libc_inet_pton_event() {
++
++ event_name=$(perf probe -f -x $libc -a inet_pton 2>&1 | tail -n +2 | head -n -5 | \
++ grep -P -o "$event_pattern(?=[[:space:]]\(on inet_pton in $libc\))")
++
++ if [ $? -ne 0 -o -z "$event_name" ] ; then
++ printf "FAIL: could not add event\n"
++ return 1
++ fi
++}
++
+ trace_libc_inet_pton_backtrace() {
+
+ expected=`mktemp -u /tmp/expected.XXX`
+
+- echo "ping[][0-9 \.:]+probe_libc:inet_pton: \([[:xdigit:]]+\)" > $expected
++ echo "ping[][0-9 \.:]+$event_name: \([[:xdigit:]]+\)" > $expected
+ echo ".*inet_pton\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
+ case "$(uname -m)" in
+ s390x)
+@@ -41,7 +54,7 @@ trace_libc_inet_pton_backtrace() {
+
+ perf_data=`mktemp -u /tmp/perf.data.XXX`
+ perf_script=`mktemp -u /tmp/perf.script.XXX`
+- perf record -e probe_libc:inet_pton/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
++ perf record -e $event_name/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
+ perf script -i $perf_data > $perf_script
+
+ exec 3<$perf_script
+@@ -62,13 +75,20 @@ trace_libc_inet_pton_backtrace() {
+ # even if the perf script output does not match.
+ }
+
++delete_libc_inet_pton_event() {
++
++ if [ -n "$event_name" ] ; then
++ perf probe -q -d $event_name
++ fi
++}
++
+ # Check for IPv6 interface existence
+ ip a sh lo | fgrep -q inet6 || exit 2
+
+ skip_if_no_perf_probe && \
+-perf probe -q $libc inet_pton && \
++add_libc_inet_pton_event && \
+ trace_libc_inet_pton_backtrace
+ err=$?
+ rm -f ${perf_data} ${perf_script} ${expected}
+-perf probe -q -d probe_libc:inet_pton
++delete_libc_inet_pton_event
+ exit $err
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Fri, 20 Jul 2018 12:17:40 +0200
+Subject: perf tools: Fix struct comm_str removal crash
+
+From: Jiri Olsa <jolsa@redhat.com>
+
+[ Upstream commit 46b3722cc7765582354488da633aafffcb138458 ]
+
+We occasionaly hit following assert failure in 'perf top', when processing the
+/proc info in multiple threads.
+
+ perf: ...include/linux/refcount.h:109: refcount_inc:
+ Assertion `!(!refcount_inc_not_zero(r))' failed.
+
+The gdb backtrace looks like this:
+
+ [Switching to Thread 0x7ffff11ba700 (LWP 13749)]
+ 0x00007ffff50839fb in raise () from /lib64/libc.so.6
+ (gdb)
+ #0 0x00007ffff50839fb in raise () from /lib64/libc.so.6
+ #1 0x00007ffff5085800 in abort () from /lib64/libc.so.6
+ #2 0x00007ffff507c0da in __assert_fail_base () from /lib64/libc.so.6
+ #3 0x00007ffff507c152 in __assert_fail () from /lib64/libc.so.6
+ #4 0x0000000000535373 in refcount_inc (r=0x7fffdc009be0)
+ at ...include/linux/refcount.h:109
+ #5 0x00000000005354f1 in comm_str__get (cs=0x7fffdc009bc0)
+ at util/comm.c:24
+ #6 0x00000000005356bd in __comm_str__findnew (str=0x7fffd000b260 ":2",
+ root=0xbed5c0 <comm_str_root>) at util/comm.c:72
+ #7 0x000000000053579e in comm_str__findnew (str=0x7fffd000b260 ":2",
+ root=0xbed5c0 <comm_str_root>) at util/comm.c:95
+ #8 0x000000000053582e in comm__new (str=0x7fffd000b260 ":2",
+ timestamp=0, exec=false) at util/comm.c:111
+ #9 0x00000000005363bc in thread__new (pid=2, tid=2) at util/thread.c:57
+ #10 0x0000000000523da0 in ____machine__findnew_thread (machine=0xbfde38,
+ threads=0xbfdf28, pid=2, tid=2, create=true) at util/machine.c:457
+ #11 0x0000000000523eb4 in __machine__findnew_thread (machine=0xbfde38,
+ ...
+
+The failing assertion is this one:
+
+ REFCOUNT_WARN(!refcount_inc_not_zero(r), ...
+
+The problem is that we keep global comm_str_root list, which
+is accessed by multiple threads during the 'perf top' startup
+and following 2 paths can race:
+
+ thread 1:
+ ...
+ thread__new
+ comm__new
+ comm_str__findnew
+ down_write(&comm_str_lock);
+ __comm_str__findnew
+ comm_str__get
+
+ thread 2:
+ ...
+ comm__override or comm__free
+ comm_str__put
+ refcount_dec_and_test
+ down_write(&comm_str_lock);
+ rb_erase(&cs->rb_node, &comm_str_root);
+
+Because thread 2 first decrements the refcnt and only after then it removes the
+struct comm_str from the list, the thread 1 can find this object on the list
+with refcnt equls to 0 and hit the assert.
+
+This patch fixes the thread 1 __comm_str__findnew path, by ignoring objects
+that already dropped the refcnt to 0. For the rest of the objects we take the
+refcnt before comparing its name and release it afterwards with comm_str__put,
+which can also release the object completely.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: kernel-team@lge.com
+Link: http://lkml.kernel.org/r/20180720101740.GA27176@krava
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/comm.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/tools/perf/util/comm.c
++++ b/tools/perf/util/comm.c
+@@ -20,9 +20,10 @@ static struct rw_semaphore comm_str_lock
+
+ static struct comm_str *comm_str__get(struct comm_str *cs)
+ {
+- if (cs)
+- refcount_inc(&cs->refcnt);
+- return cs;
++ if (cs && refcount_inc_not_zero(&cs->refcnt))
++ return cs;
++
++ return NULL;
+ }
+
+ static void comm_str__put(struct comm_str *cs)
+@@ -67,9 +68,14 @@ struct comm_str *__comm_str__findnew(con
+ parent = *p;
+ iter = rb_entry(parent, struct comm_str, rb_node);
+
++ /*
++ * If we race with comm_str__put, iter->refcnt is 0
++ * and it will be removed within comm_str__put call
++ * shortly, ignore it in this search.
++ */
+ cmp = strcmp(str, iter->str);
+- if (!cmp)
+- return comm_str__get(iter);
++ if (!cmp && comm_str__get(iter))
++ return iter;
+
+ if (cmp < 0)
+ p = &(*p)->rb_left;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Thu, 12 Jul 2018 15:52:02 +0200
+Subject: perf tools: Synthesize GROUP_DESC feature in pipe mode
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit e8fedff1cc729fd227924305152ccc6f580e8c83 ]
+
+Stephan reported, that pipe mode does not carry the group information
+and thus the piped report won't display the grouped output for following
+command:
+
+ # perf record -e '{cycles,instructions,branches}' -a sleep 4 | perf report
+
+It has no idea about the group setup, so it will display events
+separately:
+
+ # Overhead Command Shared Object ...
+ # ........ ............... .......................
+ #
+ 6.71% swapper [kernel.kallsyms]
+ 2.28% offlineimap libpython2.7.so.1.0
+ 0.78% perf [kernel.kallsyms]
+ ...
+
+Fix GROUP_DESC feature record to be synthesized in pipe mode, so the
+report output is grouped if there are groups defined in record:
+
+ # Overhead Command Shared ...
+ # ........................ ............... .......
+ #
+ 7.57% 0.16% 0.30% swapper [kernel
+ 1.87% 3.15% 2.46% offlineimap libpyth
+ 1.33% 0.00% 0.00% perf [kernel
+ ...
+
+Reported-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Stephane Eranian <eranian@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: David Carrillo-Cisneros <davidcc@google.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180712135202.14774-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/header.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2587,7 +2587,7 @@ static const struct feature_ops feat_ops
+ FEAT_OPR(NUMA_TOPOLOGY, numa_topology, true),
+ FEAT_OPN(BRANCH_STACK, branch_stack, false),
+ FEAT_OPR(PMU_MAPPINGS, pmu_mappings, false),
+- FEAT_OPN(GROUP_DESC, group_desc, false),
++ FEAT_OPR(GROUP_DESC, group_desc, false),
+ FEAT_OPN(AUXTRACE, auxtrace, false),
+ FEAT_OPN(STAT, stat, false),
+ FEAT_OPN(CACHE, cache, true),
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 6 Jul 2018 20:53:09 -0700
+Subject: platform/x86: toshiba_acpi: Fix defined but not used build warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c2e2a618eb7104e18fdcf739d4d911563812a81c ]
+
+Fix a build warning in toshiba_acpi.c when CONFIG_PROC_FS is not enabled
+by marking the unused function as __maybe_unused.
+
+../drivers/platform/x86/toshiba_acpi.c:1685:12: warning: 'version_proc_show' defined but not used [-Wunused-function]
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Azael Avalos <coproscefalo@gmail.com>
+Cc: platform-driver-x86@vger.kernel.org
+Cc: Andy Shevchenko <andy@infradead.org>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/toshiba_acpi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -34,6 +34,7 @@
+ #define TOSHIBA_ACPI_VERSION "0.24"
+ #define PROC_INTERFACE_VERSION 1
+
++#include <linux/compiler.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+@@ -1682,7 +1683,7 @@ static const struct file_operations keys
+ .write = keys_proc_write,
+ };
+
+-static int version_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused version_proc_show(struct seq_file *m, void *v)
+ {
+ seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION);
+ seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 1 May 2018 00:55:44 +1000
+Subject: powerpc/powernv: opal_put_chars partial write fix
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit bd90284cc6c1c9e8e48c8eadd0c79574fcce0b81 ]
+
+The intention here is to consume and discard the remaining buffer
+upon error. This works if there has not been a previous partial write.
+If there has been, then total_len is no longer total number of bytes
+to copy. total_len is always "bytes left to copy", so it should be
+added to written bytes.
+
+This code may not be exercised any more if partial writes will not be
+hit, but this is a small bugfix before a larger change.
+
+Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/powernv/opal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powernv/opal.c
++++ b/arch/powerpc/platforms/powernv/opal.c
+@@ -388,7 +388,7 @@ int opal_put_chars(uint32_t vtermno, con
+ /* Closed or other error drop */
+ if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
+ rc != OPAL_BUSY_EVENT) {
+- written = total_len;
++ written += total_len;
+ break;
+ }
+ if (rc == OPAL_SUCCESS) {
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Niklas Cassel <niklas.cassel@linaro.org>
+Date: Mon, 16 Jul 2018 15:32:51 +0200
+Subject: regulator: qcom_spmi: Fix warning Bad of_node_put()
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit fffe7f52eb5db41eedadba9a8038e982dcfaee0c ]
+
+For of_find_node_by_name(), you typically pass what the previous call
+returned. Therefore, of_find_node_by_name() increases the refcount of
+the returned node, and decreases the refcount of the node passed as the
+first argument.
+
+of_find_node_by_name() is incorrectly used, and produces a warning.
+Fix the warning by using the more suitable function
+of_get_child_by_name().
+
+Also add a missing of_node_put() for the returned value, since this was
+previously being leaked.
+
+OF: ERROR: Bad of_node_put() on /soc/qcom,spmi@400f000/pmic@3/regulators
+CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.18.0-rc4-00223-gefd7b360b70e #12
+Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
+Call trace:
+ dump_backtrace+0x0/0x1a8
+ show_stack+0x14/0x20
+ dump_stack+0x90/0xb4
+ of_node_release+0x74/0x78
+ kobject_put+0x90/0x1f0
+ of_node_put+0x14/0x20
+ of_find_node_by_name+0x80/0xd8
+ qcom_spmi_regulator_probe+0x30c/0x508
+
+Fixes: 0caecaa87202 ("regulator: qcom_spmi: Add support for SAW")
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/qcom_spmi-regulator.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1752,7 +1752,8 @@ static int qcom_spmi_regulator_probe(str
+ const char *name;
+ struct device *dev = &pdev->dev;
+ struct device_node *node = pdev->dev.of_node;
+- struct device_node *syscon;
++ struct device_node *syscon, *reg_node;
++ struct property *reg_prop;
+ int ret, lenp;
+ struct list_head *vreg_list;
+
+@@ -1780,10 +1781,13 @@ static int qcom_spmi_regulator_probe(str
+
+ for (reg = match->data; reg->name; reg++) {
+
+- if (saw_regmap && \
+- of_find_property(of_find_node_by_name(node, reg->name), \
+- "qcom,saw-slave", &lenp)) {
+- continue;
++ if (saw_regmap) {
++ reg_node = of_get_child_by_name(node, reg->name);
++ reg_prop = of_find_property(reg_node, "qcom,saw-slave",
++ &lenp);
++ of_node_put(reg_node);
++ if (reg_prop)
++ continue;
+ }
+
+ vreg = devm_kzalloc(dev, sizeof(*vreg), GFP_KERNEL);
+@@ -1816,13 +1820,17 @@ static int qcom_spmi_regulator_probe(str
+ if (ret)
+ continue;
+
+- if (saw_regmap && \
+- of_find_property(of_find_node_by_name(node, reg->name), \
+- "qcom,saw-leader", &lenp)) {
+- spmi_saw_ops = *(vreg->desc.ops);
+- spmi_saw_ops.set_voltage_sel = \
+- spmi_regulator_saw_set_voltage;
+- vreg->desc.ops = &spmi_saw_ops;
++ if (saw_regmap) {
++ reg_node = of_get_child_by_name(node, reg->name);
++ reg_prop = of_find_property(reg_node, "qcom,saw-leader",
++ &lenp);
++ of_node_put(reg_node);
++ if (reg_prop) {
++ spmi_saw_ops = *(vreg->desc.ops);
++ spmi_saw_ops.set_voltage_sel =
++ spmi_regulator_saw_set_voltage;
++ vreg->desc.ops = &spmi_saw_ops;
++ }
+ }
+
+ config.dev = dev;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Niklas Cassel <niklas.cassel@linaro.org>
+Date: Mon, 16 Jul 2018 15:32:52 +0200
+Subject: regulator: qcom_spmi: Use correct regmap when checking for error
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit 85046a15529606466bc778e1205f4cab8e3724d1 ]
+
+Since we have just assigned saw_regmap, and since the error message
+refers to saw_regmap, it feels safe to assume that it is saw_regmap,
+and not regmap, that should be checked for errors.
+
+Fixes: 0caecaa87202 ("regulator: qcom_spmi: Add support for SAW")
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/qcom_spmi-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1774,7 +1774,7 @@ static int qcom_spmi_regulator_probe(str
+ syscon = of_parse_phandle(node, "qcom,saw-reg", 0);
+ saw_regmap = syscon_node_to_regmap(syscon);
+ of_node_put(syscon);
+- if (IS_ERR(regmap))
++ if (IS_ERR(saw_regmap))
+ dev_err(dev, "ERROR reading SAW regmap\n");
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Fri, 20 Jul 2018 15:47:43 +0300
+Subject: reset: imx7: Fix always writing bits as 0
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 26fce0557fa639fb7bbc33e31a57cff7df25c3a0 ]
+
+Right now the only user of reset-imx7 is pci-imx6 and the
+reset_control_assert and deassert calls on pciephy_reset don't toggle
+the PCIEPHY_BTN and PCIEPHY_G_RST bits as expected. Fix this by writing
+1 or 0 respectively.
+
+The reference manual is not very clear regarding SRC_PCIEPHY_RCR but for
+other registers like MIPIPHY and HSICPHY the bits are explicitly
+documented as "1 means assert, 0 means deassert".
+
+The values are still reversed for IMX7_RESET_PCIE_CTRL_APPS_EN.
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-imx7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/reset/reset-imx7.c
++++ b/drivers/reset/reset-imx7.c
+@@ -80,7 +80,7 @@ static int imx7_reset_set(struct reset_c
+ {
+ struct imx7_src *imx7src = to_imx7_src(rcdev);
+ const struct imx7_src_signal *signal = &imx7_src_signals[id];
+- unsigned int value = 0;
++ unsigned int value = assert ? signal->bit : 0;
+
+ switch (id) {
+ case IMX7_RESET_PCIEPHY:
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Thu, 19 Jul 2018 12:43:48 +0200
+Subject: s390/qeth: fix race in used-buffer accounting
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit a702349a4099cd5a7bab0904689d8e0bf8dcd622 ]
+
+By updating q->used_buffers only _after_ do_QDIO() has completed, there
+is a potential race against the buffer's TX completion. In the unlikely
+case that the TX completion path wins, qeth_qdio_output_handler() would
+decrement the counter before qeth_flush_buffers() even incremented it.
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/net/qeth_core_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -3530,13 +3530,14 @@ static void qeth_flush_buffers(struct qe
+ qdio_flags = QDIO_FLAG_SYNC_OUTPUT;
+ if (atomic_read(&queue->set_pci_flags_count))
+ qdio_flags |= QDIO_FLAG_PCI_OUT;
++ atomic_add(count, &queue->used_buffers);
++
+ rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags,
+ queue->queue_no, index, count);
+ if (queue->card->options.performance_stats)
+ queue->card->perf_stats.outbound_do_qdio_time +=
+ qeth_get_micros() -
+ queue->card->perf_stats.outbound_do_qdio_start_time;
+- atomic_add(count, &queue->used_buffers);
+ if (rc) {
+ queue->card->stats.tx_errors += count;
+ /* ignore temporary SIGA errors without busy condition */
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Thu, 19 Jul 2018 12:43:49 +0200
+Subject: s390/qeth: reset layer2 attribute on layer switch
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 70551dc46ffa3555a0b5f3545b0cd87ab67fd002 ]
+
+After the subdriver's remove() routine has completed, the card's layer
+mode is undetermined again. Reflect this in the layer2 field.
+
+If qeth_dev_layer2_store() hits an error after remove() was called, the
+card _always_ requires a setup(), even if the previous layer mode is
+requested again.
+But qeth_dev_layer2_store() bails out early if the requested layer mode
+still matches the current one. So unless we reset the layer2 field,
+re-probing the card back to its previous mode is currently not possible.
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/net/qeth_core_sys.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/s390/net/qeth_core_sys.c
++++ b/drivers/s390/net/qeth_core_sys.c
+@@ -426,6 +426,7 @@ static ssize_t qeth_dev_layer2_store(str
+ if (card->discipline) {
+ card->discipline->remove(card->gdev);
+ qeth_core_free_discipline(card);
++ card->options.layer2 = -1;
+ }
+
+ rc = qeth_core_load_discipline(card, newdis);
net-mlx5-fix-not-releasing-read-lock-when-adding-flow-rules.patch
net-mlx5-fix-possible-deadlock-from-lockdep-when-adding-fte-to-fg.patch
net-mlx5-use-u16-for-work-queue-buffer-fragment-size.patch
+usb-dwc3-change-stream-event-enable-bit-back-to-13.patch
+iommu-arm-smmu-v3-sync-the-ovackflg-to-priq-consumer-register.patch
+iommu-io-pgtable-arm-v7s-abort-allocation-when-table-address-overflows-the-pte.patch
+iommu-io-pgtable-arm-fix-pgtable-allocation-in-selftest.patch
+alsa-pcm-add-__force-to-cast-in-snd_pcm_lib_read-write.patch
+alsa-msnd-fix-the-default-sample-sizes.patch
+alsa-usb-audio-add-support-for-encore-mdsd-usb-dac.patch
+alsa-usb-audio-fix-multiple-definitions-in-au0828_device-macro.patch
+xfrm-fix-passing-zero-to-err_ptr-warning.patch
+amd-xgbe-use-dma_mapping_error-to-check-map-errors.patch
+nfp-don-t-fail-probe-on-pci_sriov_set_totalvfs-errors.patch
+iwlwifi-cancel-the-injective-function-between-hw-pointers-to-tfd-entry-index.patch
+gfs2-special-case-rindex-for-gfs2_grow.patch
+clk-imx6ul-fix-missing-of_node_put.patch
+clk-imx6sll-fix-missing-of_node_put.patch
+clk-mvebu-armada-37xx-periph-fix-wrong-return-value-in-get_parent.patch
+input-pxrc-fix-freeing-urb-on-device-teardown.patch
+clk-core-potentially-free-connection-id.patch
+clk-clk-fixed-factor-clear-of_populated-flag-in-case-of-failure.patch
+kbuild-add-.delete_on_error-special-target.patch
+kbuild-do-not-update-config-when-running-install-targets.patch
+media-tw686x-fix-oops-on-buffer-alloc-failure.patch
+dmaengine-pl330-fix-irq-race-with-terminate_all.patch
+mips-ath79-fix-system-restart.patch
+media-videobuf2-core-check-for-q-error-in-vb2_core_qbuf.patch
+ib-rxe-drop-qp0-silently.patch
+block-allow-max_discard_segments-to-be-stacked.patch
+ib-ipoib-fix-error-return-code-in-ipoib_dev_init.patch
+mtd-maps-fix-solutionengine.c-printk-format-warnings.patch
+media-ov5645-supported-external-clock-is-24mhz.patch
+perf-test-fix-subtest-number-when-showing-results.patch
+gfs2-don-t-reject-a-supposedly-full-bitmap-if-we-have-blocks-reserved.patch
+perf-tools-synthesize-group_desc-feature-in-pipe-mode.patch
+perf-tests-fix-record-probe_libc_inet_pton.sh-for-powerpc64.patch
+perf-tests-fix-record-probe_libc_inet_pton.sh-when-event-exists.patch
+perf-tests-fix-record-probe_libc_inet_pton.sh-to-ensure-cleanups.patch
+fbdev-omapfb-off-by-one-in-omapfb_register_client.patch
+perf-tools-fix-struct-comm_str-removal-crash.patch
+video-goldfishfb-fix-memory-leak-on-driver-remove.patch
+fbdev-via-fix-defined-but-not-used-warning.patch
+perf-powerpc-fix-callchain-ip-filtering-when-return-address-is-in-a-register.patch
+video-fbdev-pxafb-clear-allocated-memory-for-video-modes.patch
+fbdev-distinguish-between-interlaced-and-progressive-modes.patch
+omapfb-rename-omap2-module-to-omap2fb.ko.patch
+arm-exynos-clear-global-variable-on-init-error-path.patch
+perf-powerpc-fix-callchain-ip-filtering.patch
+nvmet-fix-file-discard-return-status.patch
+nvme-rdma-unquiesce-queues-when-deleting-the-controller.patch
+kvm-arm-arm64-vgic-fix-possible-spectre-v1-write-in-vgic_mmio_write_apr.patch
+powerpc-powernv-opal_put_chars-partial-write-fix.patch
+perf-script-show-correct-offsets-for-dwarf-based-unwinding.patch
+staging-bcm2835-camera-fix-timeout-handling-in-wait_for_completion_timeout.patch
+staging-bcm2835-camera-handle-wait_for_completion_timeout-return-properly.patch
+asoc-rt5514-fix-the-issue-of-the-delay-volume-applied.patch
+mips-jz4740-bump-zload-address.patch
+mac80211-restrict-delayed-tailroom-needed-decrement.patch
+smack-fix-handling-of-ipv4-traffic-received-by-pf_inet6-sockets.patch
+wan-fsl_ucc_hdlc-use-is_err_value-to-check-return-value-of-qe_muram_alloc.patch
+arm64-fix-possible-spectre-v1-write-in-ptrace_hbp_set_event.patch
+reset-imx7-fix-always-writing-bits-as-0.patch
+efi-arm-preserve-early-mapping-of-uefi-memory-map-longer-for-bgrt.patch
+alsa-usb-audio-generic-dsd-detection-for-thesycon-based-implementations.patch
+nfp-avoid-buffer-leak-when-fw-communication-fails.patch
+xen-netfront-fix-queue-name-setting.patch
+arm64-dts-qcom-db410c-fix-bluetooth-led-trigger.patch
+arm-dts-qcom-msm8974-hammerhead-increase-load-on-l20-for-sdhci.patch
+soc-qcom-smem-correct-check-for-global-partition.patch
+s390-qeth-fix-race-in-used-buffer-accounting.patch
+s390-qeth-reset-layer2-attribute-on-layer-switch.patch
+platform-x86-toshiba_acpi-fix-defined-but-not-used-build-warnings.patch
+kvm-arm-arm64-fix-vgic-init-race.patch
+drivers-base-stop-new-probing-during-shutdown.patch
+i2c-aspeed-fix-initial-values-of-master-and-slave-state.patch
+drm-amd-pp-set-max-clock-level-to-display-by-default.patch
+regulator-qcom_spmi-use-correct-regmap-when-checking-for-error.patch
+regulator-qcom_spmi-fix-warning-bad-of_node_put.patch
+iommu-ipmmu-vmsa-imuctrn.ttsel-needs-a-special-usage-on-r-car-gen3.patch
+dmaengine-mv_xor_v2-kill-the-tasklets-upon-exit.patch
+crypto-sharah-unregister-correct-algorithms-for-sahara-3.patch
+x86-pti-check-the-return-value-of-pti_user_pagetable_walk_p4d.patch
+x86-pti-check-the-return-value-of-pti_user_pagetable_walk_pmd.patch
+x86-mm-pti-add-an-overflow-check-to-pti_clone_pmds.patch
+pci-aer-honor-pcie_ports-native-even-if-hest-sets-firmware_first.patch
+xen-netfront-fix-warn-message-as-irq-device-name-has.patch
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Piotr Sawicki <p.sawicki2@partner.samsung.com>
+Date: Thu, 19 Jul 2018 11:42:58 +0200
+Subject: Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets
+
+From: Piotr Sawicki <p.sawicki2@partner.samsung.com>
+
+[ Upstream commit 129a99890936766f4b69b9da7ed88366313a9210 ]
+
+A socket which has sk_family set to PF_INET6 is able to receive not
+only IPv6 but also IPv4 traffic (IPv4-mapped IPv6 addresses).
+
+Prior to this patch, the smk_skb_to_addr_ipv6() could have been
+called for socket buffers containing IPv4 packets, in result such
+traffic was allowed.
+
+Signed-off-by: Piotr Sawicki <p.sawicki2@partner.samsung.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/smack/smack_lsm.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3924,15 +3924,19 @@ static int smack_socket_sock_rcv_skb(str
+ struct smack_known *skp = NULL;
+ int rc = 0;
+ struct smk_audit_info ad;
++ u16 family = sk->sk_family;
+ #ifdef CONFIG_AUDIT
+ struct lsm_network_audit net;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ struct sockaddr_in6 sadd;
+ int proto;
++
++ if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
++ family = PF_INET;
+ #endif /* CONFIG_IPV6 */
+
+- switch (sk->sk_family) {
++ switch (family) {
+ case PF_INET:
+ #ifdef CONFIG_SECURITY_SMACK_NETFILTER
+ /*
+@@ -3950,7 +3954,7 @@ static int smack_socket_sock_rcv_skb(str
+ */
+ netlbl_secattr_init(&secattr);
+
+- rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
++ rc = netlbl_skbuff_getattr(skb, family, &secattr);
+ if (rc == 0)
+ skp = smack_from_secattr(&secattr, ssp);
+ else
+@@ -3963,7 +3967,7 @@ access_check:
+ #endif
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+- ad.a.u.net->family = sk->sk_family;
++ ad.a.u.net->family = family;
+ ad.a.u.net->netif = skb->skb_iif;
+ ipv4_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif
+@@ -3977,7 +3981,7 @@ access_check:
+ rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
+ MAY_WRITE, rc);
+ if (rc != 0)
+- netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
++ netlbl_skbuff_err(skb, family, rc, 0);
+ break;
+ #if IS_ENABLED(CONFIG_IPV6)
+ case PF_INET6:
+@@ -3993,7 +3997,7 @@ access_check:
+ skp = smack_net_ambient;
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+- ad.a.u.net->family = sk->sk_family;
++ ad.a.u.net->family = family;
+ ad.a.u.net->netif = skb->skb_iif;
+ ipv6_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif /* CONFIG_AUDIT */
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Mon, 25 Jun 2018 13:06:13 -0700
+Subject: soc: qcom: smem: Correct check for global partition
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 0b65c59e3a5475895c93ea5f130597db16b8abf6 ]
+
+The moved check for the global partition ended up in the wrong place and I
+failed to spot this in my review. This moves it to the correct place.
+
+Fixes: 11d2e7edac6a ("soc: qcom: smem: check sooner in qcom_smem_set_global_partition()")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/smem.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -364,11 +364,6 @@ static int qcom_smem_alloc_private(struc
+ end = phdr_to_last_uncached_entry(phdr);
+ cached = phdr_to_last_cached_entry(phdr);
+
+- if (smem->global_partition) {
+- dev_err(smem->dev, "Already found the global partition\n");
+- return -EINVAL;
+- }
+-
+ while (hdr < end) {
+ if (hdr->canary != SMEM_PRIVATE_CANARY)
+ goto bad_canary;
+@@ -736,6 +731,11 @@ static int qcom_smem_set_global_partitio
+ bool found = false;
+ int i;
+
++ if (smem->global_partition) {
++ dev_err(smem->dev, "Already found the global partition\n");
++ return -EINVAL;
++ }
++
+ ptable = qcom_smem_get_ptable(smem);
+ if (IS_ERR(ptable))
+ return PTR_ERR(ptable);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 21 Jul 2018 15:20:28 +0200
+Subject: staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit b7afce51d95726a619743aaad8870db66dfa1479 ]
+
+wait_for_completion_timeout returns unsigned long not int so a variable of
+proper type is introduced. Further the check for <= 0 is ambiguous and should
+be == 0 here indicating timeout which is the only error case so no additional
+check needed here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+@@ -630,6 +630,7 @@ static int send_synchronous_mmal_msg(str
+ {
+ struct mmal_msg_context *msg_context;
+ int ret;
++ unsigned long timeout;
+
+ /* payload size must not cause message to exceed max size */
+ if (payload_len >
+@@ -668,11 +669,11 @@ static int send_synchronous_mmal_msg(str
+ return ret;
+ }
+
+- ret = wait_for_completion_timeout(&msg_context->u.sync.cmplt, 3 * HZ);
+- if (ret <= 0) {
+- pr_err("error %d waiting for sync completion\n", ret);
+- if (ret == 0)
+- ret = -ETIME;
++ timeout = wait_for_completion_timeout(&msg_context->u.sync.cmplt,
++ 3 * HZ);
++ if (timeout == 0) {
++ pr_err("timed out waiting for sync completion\n");
++ ret = -ETIME;
+ /* todo: what happens if the message arrives after aborting */
+ release_msg_context(msg_context);
+ return ret;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 21 Jul 2018 13:31:24 +0200
+Subject: staging: bcm2835-camera: handle wait_for_completion_timeout return properly
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 5b70084f6cbcd53f615433f9d216e01bd71de0bb ]
+
+wait_for_completion_timeout returns unsigned long not int so a variable of
+proper type is introduced. Further the check for <= 0 is ambiguous and
+should be == 0 here indicating timeout.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -580,6 +580,7 @@ static int start_streaming(struct vb2_qu
+ static void stop_streaming(struct vb2_queue *vq)
+ {
+ int ret;
++ unsigned long timeout;
+ struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vq);
+
+ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p\n",
+@@ -605,10 +606,10 @@ static void stop_streaming(struct vb2_qu
+ sizeof(dev->capture.frame_count));
+
+ /* wait for last frame to complete */
+- ret = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
+- if (ret <= 0)
++ timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
++ if (timeout == 0)
+ v4l2_err(&dev->v4l2_dev,
+- "error %d waiting for frame completion\n", ret);
++ "timed out waiting for frame completion\n");
+
+ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+ "disabling connection\n");
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: "Erich E. Hoover" <ehoover@sweptlaser.com>
+Date: Thu, 19 Jul 2018 17:26:24 -0600
+Subject: usb: dwc3: change stream event enable bit back to 13
+
+From: "Erich E. Hoover" <ehoover@sweptlaser.com>
+
+[ Upstream commit 9a7faac3650216112e034b157289bf1a48a99e2d ]
+
+Commit ff3f0789b3dc ("usb: dwc3: use BIT() macro where possible")
+changed DWC3_DEPCFG_STREAM_EVENT_EN from bit 13 to bit 12.
+
+Spotted this cleanup typo while looking at diffs between 4.9.35 and
+4.14.16 for a separate issue.
+
+Fixes: ff3f0789b3dc ("usb: dwc3: use BIT() macro where possible")
+Signed-off-by: Erich E. Hoover <ehoover@sweptlaser.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.h
++++ b/drivers/usb/dwc3/gadget.h
+@@ -25,7 +25,7 @@ struct dwc3;
+ #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN BIT(9)
+ #define DWC3_DEPCFG_XFER_NOT_READY_EN BIT(10)
+ #define DWC3_DEPCFG_FIFO_ERROR_EN BIT(11)
+-#define DWC3_DEPCFG_STREAM_EVENT_EN BIT(12)
++#define DWC3_DEPCFG_STREAM_EVENT_EN BIT(13)
+ #define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16)
+ #define DWC3_DEPCFG_STREAM_CAPABLE BIT(24)
+ #define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25)
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Daniel Mack <daniel@zonque.org>
+Date: Tue, 24 Jul 2018 19:11:25 +0200
+Subject: video: fbdev: pxafb: clear allocated memory for video modes
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit b951d80aaf224b1f774e10def672f5e37488e4ee ]
+
+When parsing the video modes from DT properties, make sure to zero out
+memory before using it. This is important because not all fields in the mode
+struct are explicitly initialized, even though they are used later on.
+
+Fixes: 420a488278e86 ("video: fbdev: pxafb: initial devicetree conversion")
+Reviewed-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/pxafb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2128,8 +2128,8 @@ static int of_get_pxafb_display(struct d
+ return -EINVAL;
+
+ ret = -ENOMEM;
+- info->modes = kmalloc_array(timings->num_timings,
+- sizeof(info->modes[0]), GFP_KERNEL);
++ info->modes = kcalloc(timings->num_timings, sizeof(info->modes[0]),
++ GFP_KERNEL);
+ if (!info->modes)
+ goto out;
+ info->num_modes = timings->num_timings;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Anton Vasilyev <vasilyev@ispras.ru>
+Date: Tue, 24 Jul 2018 19:11:27 +0200
+Subject: video: goldfishfb: fix memory leak on driver remove
+
+From: Anton Vasilyev <vasilyev@ispras.ru>
+
+[ Upstream commit 5958fde72d04e7b8c6de3669d1f794a90997e3eb ]
+
+goldfish_fb_probe() allocates memory for fb, but goldfish_fb_remove() does
+not have deallocation of fb, which leads to memory leak on probe/remove.
+
+The patch adds deallocation into goldfish_fb_remove().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Cc: Aleksandar Markovic <aleksandar.markovic@mips.com>
+Cc: Miodrag Dinic <miodrag.dinic@mips.com>
+Cc: Goran Ferenc <goran.ferenc@mips.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/goldfishfb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/goldfishfb.c
++++ b/drivers/video/fbdev/goldfishfb.c
+@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct pla
+ dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
+ fb->fb.fix.smem_start);
+ iounmap(fb->reg_base);
++ kfree(fb);
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Mon, 23 Jul 2018 22:12:33 +0800
+Subject: wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit fd800f646402c0f85547166b59ca065175928b7b ]
+
+qe_muram_alloc return a unsigned long integer,which should not
+compared with zero. check it using IS_ERR_VALUE() to fix this.
+
+Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -192,7 +192,7 @@ static int uhdlc_init(struct ucc_hdlc_pr
+ priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param),
+ ALIGNMENT_OF_UCC_HDLC_PRAM);
+
+- if (priv->ucc_pram_offset < 0) {
++ if (IS_ERR_VALUE(priv->ucc_pram_offset)) {
+ dev_err(priv->dev, "Can not allocate MURAM for hdlc parameter.\n");
+ ret = -ENOMEM;
+ goto free_tx_bd;
+@@ -230,14 +230,14 @@ static int uhdlc_init(struct ucc_hdlc_pr
+
+ /* Alloc riptr, tiptr */
+ riptr = qe_muram_alloc(32, 32);
+- if (riptr < 0) {
++ if (IS_ERR_VALUE(riptr)) {
+ dev_err(priv->dev, "Cannot allocate MURAM mem for Receive internal temp data pointer\n");
+ ret = -ENOMEM;
+ goto free_tx_skbuff;
+ }
+
+ tiptr = qe_muram_alloc(32, 32);
+- if (tiptr < 0) {
++ if (IS_ERR_VALUE(tiptr)) {
+ dev_err(priv->dev, "Cannot allocate MURAM mem for Transmit internal temp data pointer\n");
+ ret = -ENOMEM;
+ goto free_riptr;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Joerg Roedel <jroedel@suse.de>
+Date: Wed, 18 Jul 2018 11:41:01 +0200
+Subject: x86/mm/pti: Add an overflow check to pti_clone_pmds()
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 935232ce28dfabff1171e5a7113b2d865fa9ee63 ]
+
+The addr counter will overflow if the last PMD of the address space is
+cloned, resulting in an endless loop.
+
+Check for that and bail out of the loop when it happens.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Pavel Machek <pavel@ucw.cz>
+Cc: "H . Peter Anvin" <hpa@zytor.com>
+Cc: linux-mm@kvack.org
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Laight <David.Laight@aculab.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: Eduardo Valentin <eduval@amazon.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: aliguori@amazon.com
+Cc: daniel.gruss@iaik.tugraz.at
+Cc: hughd@google.com
+Cc: keescook@google.com
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Waiman Long <llong@redhat.com>
+Cc: "David H . Gutteridge" <dhgutteridge@sympatico.ca>
+Cc: joro@8bytes.org
+Link: https://lkml.kernel.org/r/1531906876-13451-25-git-send-email-joro@8bytes.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pti.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -306,6 +306,10 @@ pti_clone_pmds(unsigned long start, unsi
+ p4d_t *p4d;
+ pud_t *pud;
+
++ /* Overflow check */
++ if (addr < start)
++ break;
++
+ pgd = pgd_offset_k(addr);
+ if (WARN_ON(pgd_none(*pgd)))
+ return;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jiang Biao <jiang.biao2@zte.com.cn>
+Date: Fri, 20 Jul 2018 08:06:31 +0800
+Subject: x86/pti: Check the return value of pti_user_pagetable_walk_p4d()
+
+From: Jiang Biao <jiang.biao2@zte.com.cn>
+
+[ Upstream commit b2b7d986a89b6c94b1331a909de1217214fb08c1 ]
+
+pti_user_pagetable_walk_p4d() can return NULL, so the return value should
+be checked to prevent a NULL pointer dereference.
+
+Add the check and a warning when the P4D allocation fails.
+
+Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: hpa@zytor.com
+Cc: albcamus@gmail.com
+Cc: zhong.weidong@zte.com.cn
+Link: https://lkml.kernel.org/r/1532045192-49622-1-git-send-email-jiang.biao2@zte.com.cn
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pti.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -177,7 +177,7 @@ static p4d_t *pti_user_pagetable_walk_p4
+
+ if (pgd_none(*pgd)) {
+ unsigned long new_p4d_page = __get_free_page(gfp);
+- if (!new_p4d_page)
++ if (WARN_ON_ONCE(!new_p4d_page))
+ return NULL;
+
+ set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
+@@ -196,9 +196,13 @@ static p4d_t *pti_user_pagetable_walk_p4
+ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+ {
+ gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+- p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
++ p4d_t *p4d;
+ pud_t *pud;
+
++ p4d = pti_user_pagetable_walk_p4d(address);
++ if (!p4d)
++ return NULL;
++
+ BUILD_BUG_ON(p4d_large(*p4d) != 0);
+ if (p4d_none(*p4d)) {
+ unsigned long new_pud_page = __get_free_page(gfp);
+@@ -355,6 +359,9 @@ static void __init pti_clone_p4d(unsigne
+ pgd_t *kernel_pgd;
+
+ user_p4d = pti_user_pagetable_walk_p4d(addr);
++ if (!user_p4d)
++ return;
++
+ kernel_pgd = pgd_offset_k(addr);
+ kernel_p4d = p4d_offset(kernel_pgd, addr);
+ *user_p4d = *kernel_p4d;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Jiang Biao <jiang.biao2@zte.com.cn>
+Date: Fri, 20 Jul 2018 08:06:32 +0800
+Subject: x86/pti: Check the return value of pti_user_pagetable_walk_pmd()
+
+From: Jiang Biao <jiang.biao2@zte.com.cn>
+
+[ Upstream commit 8c934e01a7ce685d98e970880f5941d79272c654 ]
+
+pti_user_pagetable_walk_pmd() can return NULL, so the return value should
+be checked to prevent a NULL pointer dereference.
+
+Add the check and a warning when the PMD allocation fails.
+
+Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: hpa@zytor.com
+Cc: albcamus@gmail.com
+Cc: zhong.weidong@zte.com.cn
+Link: https://lkml.kernel.org/r/1532045192-49622-2-git-send-email-jiang.biao2@zte.com.cn
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pti.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -206,7 +206,7 @@ static pmd_t *pti_user_pagetable_walk_pm
+ BUILD_BUG_ON(p4d_large(*p4d) != 0);
+ if (p4d_none(*p4d)) {
+ unsigned long new_pud_page = __get_free_page(gfp);
+- if (!new_pud_page)
++ if (WARN_ON_ONCE(!new_pud_page))
+ return NULL;
+
+ set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
+@@ -220,7 +220,7 @@ static pmd_t *pti_user_pagetable_walk_pm
+ }
+ if (pud_none(*pud)) {
+ unsigned long new_pmd_page = __get_free_page(gfp);
+- if (!new_pmd_page)
++ if (WARN_ON_ONCE(!new_pmd_page))
+ return NULL;
+
+ set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
+@@ -242,9 +242,13 @@ static pmd_t *pti_user_pagetable_walk_pm
+ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+ {
+ gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+- pmd_t *pmd = pti_user_pagetable_walk_pmd(address);
++ pmd_t *pmd;
+ pte_t *pte;
+
++ pmd = pti_user_pagetable_walk_pmd(address);
++ if (!pmd)
++ return NULL;
++
+ /* We can't do anything sensible if we hit a large mapping. */
+ if (pmd_large(*pmd)) {
+ WARN_ON(1);
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Fri, 20 Jul 2018 18:33:59 +0200
+Subject: xen-netfront: fix queue name setting
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit 2d408c0d4574b01b9ed45e02516888bf925e11a9 ]
+
+Commit f599c64fdf7d ("xen-netfront: Fix race between device setup and
+open") changed the initialization order: xennet_create_queues() now
+happens before we do register_netdev() so using netdev->name in
+xennet_init_queue() is incorrect, we end up with the following in
+/proc/interrupts:
+
+ 60: 139 0 xen-dyn -event eth%d-q0-tx
+ 61: 265 0 xen-dyn -event eth%d-q0-rx
+ 62: 234 0 xen-dyn -event eth%d-q1-tx
+ 63: 1 0 xen-dyn -event eth%d-q1-rx
+
+and this looks ugly. Actually, using early netdev name (even when it's
+already set) is also not ideal: nowadays we tend to rename eth devices
+and queue name may end up not corresponding to the netdev name.
+
+Use nodename from xenbus device for queue naming: this can't change in VM's
+lifetime. Now /proc/interrupts looks like
+
+ 62: 202 0 xen-dyn -event device/vif/0-q0-tx
+ 63: 317 0 xen-dyn -event device/vif/0-q0-rx
+ 64: 262 0 xen-dyn -event device/vif/0-q1-tx
+ 65: 17 0 xen-dyn -event device/vif/0-q1-rx
+
+Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open")
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netfront.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1610,7 +1610,7 @@ static int xennet_init_queue(struct netf
+ timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
+
+ snprintf(queue->name, sizeof(queue->name), "%s-q%u",
+- queue->info->netdev->name, queue->id);
++ queue->info->xbdev->nodename, queue->id);
+
+ /* Initialise tx_skbs as a free chain containing every entry. */
+ queue->tx_skb_freelist = 0;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: Xiao Liang <xiliang@redhat.com>
+Date: Tue, 14 Aug 2018 23:21:28 +0800
+Subject: xen-netfront: fix warn message as irq device name has '/'
+
+From: Xiao Liang <xiliang@redhat.com>
+
+[ Upstream commit 21f2706b20100bb3db378461ab9b8e2035309b5b ]
+
+There is a call trace generated after commit 2d408c0d4574b01b9ed45e02516888bf925e11a9(
+xen-netfront: fix queue name setting). There is no 'device/vif/xx-q0-tx' file found
+under /proc/irq/xx/.
+
+This patch only picks up device type and id as its name.
+
+With the patch, now /proc/interrupts looks like below and the warning message gone:
+ 70: 21 0 0 0 xen-dyn -event vif0-q0-tx
+ 71: 15 0 0 0 xen-dyn -event vif0-q0-rx
+ 72: 14 0 0 0 xen-dyn -event vif0-q1-tx
+ 73: 33 0 0 0 xen-dyn -event vif0-q1-rx
+ 74: 12 0 0 0 xen-dyn -event vif0-q2-tx
+ 75: 24 0 0 0 xen-dyn -event vif0-q2-rx
+ 76: 19 0 0 0 xen-dyn -event vif0-q3-tx
+ 77: 21 0 0 0 xen-dyn -event vif0-q3-rx
+
+Below is call trace information without this patch:
+
+name 'device/vif/0-q0-tx'
+WARNING: CPU: 2 PID: 37 at fs/proc/generic.c:174 __xlate_proc_name+0x85/0xa0
+RIP: 0010:__xlate_proc_name+0x85/0xa0
+RSP: 0018:ffffb85c40473c18 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000006
+RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff984c7f516930
+RBP: ffffb85c40473cb8 R08: 000000000000002c R09: 0000000000000229
+R10: 0000000000000000 R11: 0000000000000001 R12: ffffb85c40473c98
+R13: ffffb85c40473cb8 R14: ffffb85c40473c50 R15: 0000000000000000
+FS: 0000000000000000(0000) GS:ffff984c7f500000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f69b6899038 CR3: 000000001c20a006 CR4: 00000000001606e0
+Call Trace:
+__proc_create+0x45/0x230
+? snprintf+0x49/0x60
+proc_mkdir_data+0x35/0x90
+register_handler_proc+0xef/0x110
+? proc_register+0xfc/0x110
+? proc_create_data+0x70/0xb0
+__setup_irq+0x39b/0x660
+? request_threaded_irq+0xad/0x160
+request_threaded_irq+0xf5/0x160
+? xennet_tx_buf_gc+0x1d0/0x1d0 [xen_netfront]
+bind_evtchn_to_irqhandler+0x3d/0x70
+? xenbus_alloc_evtchn+0x41/0xa0
+netback_changed+0xa46/0xcda [xen_netfront]
+? find_watch+0x40/0x40
+xenwatch_thread+0xc5/0x160
+? finish_wait+0x80/0x80
+kthread+0x112/0x130
+? kthread_create_worker_on_cpu+0x70/0x70
+ret_from_fork+0x35/0x40
+Code: 81 5c 00 48 85 c0 75 cc 5b 49 89 2e 31 c0 5d 4d 89 3c 24 41 5c 41 5d 41 5e 41 5f c3 4c 89 ee 48 c7 c7 40 4f 0e b4 e8 65 ea d8 ff <0f> 0b b8 fe ff ff ff 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 0f 1f
+---[ end trace 650e5561b0caab3a ]---
+
+Signed-off-by: Xiao Liang <xiliang@redhat.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netfront.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1603,14 +1603,16 @@ static int xennet_init_queue(struct netf
+ {
+ unsigned short i;
+ int err = 0;
++ char *devid;
+
+ spin_lock_init(&queue->tx_lock);
+ spin_lock_init(&queue->rx_lock);
+
+ timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
+
+- snprintf(queue->name, sizeof(queue->name), "%s-q%u",
+- queue->info->xbdev->nodename, queue->id);
++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1;
++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u",
++ devid, queue->id);
+
+ /* Initialise tx_skbs as a free chain containing every entry. */
+ queue->tx_skb_freelist = 0;
--- /dev/null
+From foo@baz Fri Sep 21 10:21:24 CEST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 25 Jul 2018 16:54:33 +0800
+Subject: xfrm: fix 'passing zero to ERR_PTR()' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 934ffce1343f22ed5e2d0bd6da4440f4848074de ]
+
+Fix a static code checker warning:
+
+ net/xfrm/xfrm_policy.c:1836 xfrm_resolve_and_create_bundle() warn: passing zero to 'ERR_PTR'
+
+xfrm_tmpl_resolve return 0 just means no xdst found, return NULL
+instead of passing zero to ERR_PTR.
+
+Fixes: d809ec895505 ("xfrm: do not assume that template resolving always returns xfrms")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_policy.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1831,7 +1831,10 @@ xfrm_resolve_and_create_bundle(struct xf
+ /* Try to instantiate a bundle */
+ err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
+ if (err <= 0) {
+- if (err != 0 && err != -EAGAIN)
++ if (err == 0)
++ return NULL;
++
++ if (err != -EAGAIN)
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
+ return ERR_PTR(err);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
