--- /dev/null
+From e70bc26374fa787f531edbec4cbc53debd1b2d87 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Mon, 3 Dec 2018 10:30:25 -0800
+Subject: acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than
+ "ARS-short"
+
+[ Upstream commit b5fd2e00a60248902315fb32210550ac3cb9f44c ]
+
+A "short" ARS (address range scrub) instructs the platform firmware to
+return known errors. In contrast, a "long" ARS instructs platform
+firmware to arrange every data address on the DIMM to be read / checked
+for poisoned data.
+
+The conversion of the flags in commit d3abaf43bab8 "acpi, nfit: Fix
+Address Range Scrub completion tracking", changed the meaning of passing
+'0' to acpi_nfit_ars_rescan(). Previously '0' meant "not short", now '0'
+is ARS_REQ_SHORT. Pass ARS_REQ_LONG to restore the expected scrub-type
+behavior of user-initiated ARS sessions.
+
+Fixes: d3abaf43bab8 ("acpi, nfit: Fix Address Range Scrub completion tracking")
+Reported-by: Jacek Zloch <jacek.zloch@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index c5d15752dfb3..75b331f8a16a 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1303,7 +1303,7 @@ static ssize_t scrub_store(struct device *dev,
+ if (nd_desc) {
+ struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
+
+- rc = acpi_nfit_ars_rescan(acpi_desc, 0);
++ rc = acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
+ }
+ device_unlock(dev);
+ if (rc)
+--
+2.19.1
+
--- /dev/null
+From de6f6dacd50061045c7626f4a451214f84a8defc Mon Sep 17 00:00:00 2001
+From: Jose Abreu <joabreu@synopsys.com>
+Date: Fri, 30 Nov 2018 09:47:31 +0000
+Subject: ARC: io.h: Implement reads{x}()/writes{x}()
+
+[ Upstream commit 10d443431dc2bb733cf7add99b453e3fb9047a2e ]
+
+Some ARC CPU's do not support unaligned loads/stores. Currently, generic
+implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC.
+This can lead to misfunction of some drivers as generic functions do a
+plain dereference of a pointer that can be unaligned.
+
+Let's use {get/put}_unaligned() helpers instead of plain dereference of
+pointer in order to fix. The helpers allow to get and store data from an
+unaligned address whilst preserving the CPU internal alignment.
+According to [1], the use of these helpers are costly in terms of
+performance so we added an initial check for a buffer already aligned so
+that the usage of the helpers can be avoided, when possible.
+
+[1] Documentation/unaligned-memory-access.txt
+
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Tested-by: Vitor Soares <soares@synopsys.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/io.h | 72 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
+index c22b181e8206..2f39d9b3886e 100644
+--- a/arch/arc/include/asm/io.h
++++ b/arch/arc/include/asm/io.h
+@@ -12,6 +12,7 @@
+ #include <linux/types.h>
+ #include <asm/byteorder.h>
+ #include <asm/page.h>
++#include <asm/unaligned.h>
+
+ #ifdef CONFIG_ISA_ARCV2
+ #include <asm/barrier.h>
+@@ -94,6 +95,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
+ return w;
+ }
+
++/*
++ * {read,write}s{b,w,l}() repeatedly access the same IO address in
++ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
++ * @count times
++ */
++#define __raw_readsx(t,f) \
++static inline void __raw_reads##f(const volatile void __iomem *addr, \
++ void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ *buf++ = x; \
++ } while (--count); \
++ } else { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ put_unaligned(x, buf++); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_readsb __raw_readsb
++__raw_readsx(8, b)
++#define __raw_readsw __raw_readsw
++__raw_readsx(16, w)
++#define __raw_readsl __raw_readsl
++__raw_readsx(32, l)
++
+ #define __raw_writeb __raw_writeb
+ static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
+ {
+@@ -126,6 +163,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+
+ }
+
++#define __raw_writesx(t,f) \
++static inline void __raw_writes##f(volatile void __iomem *addr, \
++ const void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ const u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ __raw_write##f(*buf++, addr); \
++ } while (--count); \
++ } else { \
++ do { \
++ __raw_write##f(get_unaligned(buf++), addr); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_writesb __raw_writesb
++__raw_writesx(8, b)
++#define __raw_writesw __raw_writesw
++__raw_writesx(16, w)
++#define __raw_writesl __raw_writesl
++__raw_writesx(32, l)
++
+ /*
+ * MMIO can also get buffered/optimized in micro-arch, so barriers needed
+ * Based on ARM model for the typical use case
+@@ -141,10 +207,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+ #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; })
+ #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+ #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
++#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); })
++#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); })
++#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); })
+
+ #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); })
+ #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); })
+ #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); })
++#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); })
++#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); })
++#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); })
+
+ /*
+ * Relaxed API for drivers which can handle barrier ordering themselves
+--
+2.19.1
+
--- /dev/null
+From 134405b4333fd6499371375e8eed664cc8e1420c Mon Sep 17 00:00:00 2001
+From: Chris Cole <chris@sageembedded.com>
+Date: Fri, 23 Nov 2018 12:20:45 +0100
+Subject: ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address
+ handling
+
+[ Upstream commit a1208f6a822ac29933e772ef1f637c5d67838da9 ]
+
+This patch addresses possible memory corruption when
+v7_dma_inv_range(start_address, end_address) address parameters are not
+aligned to whole cache lines. This function issues "invalidate" cache
+management operations to all cache lines from start_address (inclusive)
+to end_address (exclusive). When start_address and/or end_address are
+not aligned, the start and/or end cache lines are first issued "clean &
+invalidate" operation. The assumption is this is done to ensure that any
+dirty data addresses outside the address range (but part of the first or
+last cache lines) are cleaned/flushed so that data is not lost, which
+could happen if just an invalidate is issued.
+
+The problem is that these first/last partial cache lines are issued
+"clean & invalidate" and then "invalidate". This second "invalidate" is
+not required and worse can cause "lost" writes to addresses outside the
+address range but part of the cache line. If another component writes to
+its part of the cache line between the "clean & invalidate" and
+"invalidate" operations, the write can get lost. This fix is to remove
+the extra "invalidate" operation when unaligned addressed are used.
+
+A kernel module is available that has a stress test to reproduce the
+issue and a unit test of the updated v7_dma_inv_range(). It can be
+downloaded from
+http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz.
+
+v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction)
+when the direction is DMA_FROM_DEVICE. One can (I believe) successfully
+argue that DMA from a device to main memory should use buffers aligned
+to cache line size, because the "clean & invalidate" might overwrite
+data that the device just wrote using DMA. But if a driver does use
+unaligned buffers, at least this fix will prevent memory corruption
+outside the buffer.
+
+Signed-off-by: Chris Cole <chris@sageembedded.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/cache-v7.S | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
+index 215df435bfb9..2149b47a0c5a 100644
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -360,14 +360,16 @@ v7_dma_inv_range:
+ ALT_UP(W(nop))
+ #endif
+ mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line
++ addne r0, r0, r2
+
+ tst r1, r3
+ bic r1, r1, r3
+ mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line
+-1:
+- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+--
+2.19.1
+
--- /dev/null
+From d18bf0f0fcbfbc6fc2c5959fc4a0111eda4b7a36 Mon Sep 17 00:00:00 2001
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+Date: Fri, 23 Nov 2018 12:25:21 +0100
+Subject: ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart
+
+[ Upstream commit 3d0358d0ba048c5afb1385787aaec8fa5ad78fcc ]
+
+Chris has discovered and reported that v7_dma_inv_range() may corrupt
+memory if address range is not aligned to cache line size.
+
+Since the whole cache-v7m.S was lifted form cache-v7.S the same
+observation applies to v7m_dma_inv_range(). So the fix just mirrors
+what has been done for v7 with a little specific of M-class.
+
+Cc: Chris Cole <chris@sageembedded.com>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/cache-v7m.S | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/mm/cache-v7m.S b/arch/arm/mm/cache-v7m.S
+index 788486e830d3..32aa2a2aa260 100644
+--- a/arch/arm/mm/cache-v7m.S
++++ b/arch/arm/mm/cache-v7m.S
+@@ -73,9 +73,11 @@
+ /*
+ * dcimvac: Invalidate data cache line by MVA to PoC
+ */
+-.macro dcimvac, rt, tmp
+- v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC
++.irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
++.macro dcimvac\c, rt, tmp
++ v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC, \c
+ .endm
++.endr
+
+ /*
+ * dccmvau: Clean data cache line by MVA to PoU
+@@ -369,14 +371,16 @@ v7m_dma_inv_range:
+ tst r0, r3
+ bic r0, r0, r3
+ dccimvacne r0, r3
++ addne r0, r0, r2
+ subne r3, r2, #1 @ restore r3, corrupted by v7m's dccimvac
+ tst r1, r3
+ bic r1, r1, r3
+ dccimvacne r1, r3
+-1:
+- dcimvac r0, r3
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ dcimvaclo r0, r3
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+--
+2.19.1
+
--- /dev/null
+From 3ea6d4d6dfb6c625637da704d4e36272ac6a0d0b Mon Sep 17 00:00:00 2001
+From: Nathan Jones <nathanj439@gmail.com>
+Date: Tue, 4 Dec 2018 10:05:32 +0100
+Subject: ARM: 8816/1: dma-mapping: fix potential uninitialized return
+
+[ Upstream commit c2a3831df6dc164af66d8d86cf356a90c021b86f ]
+
+While trying to use the dma_mmap_*() interface, it was noticed that this
+interface returns strange values when passed an incorrect length.
+
+If neither of the if() statements fire then the return value is
+uninitialized. In the worst case it returns 0 which means the caller
+will think the function succeeded.
+
+Fixes: 1655cf8829d8 ("ARM: dma-mapping: Remove traces of NOMMU code")
+Signed-off-by: Nathan Jones <nathanj439@gmail.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/dma-mapping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 66566472c153..1cb9c0f9b5d6 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -830,7 +830,7 @@ static int __arm_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+ void *cpu_addr, dma_addr_t dma_addr, size_t size,
+ unsigned long attrs)
+ {
+- int ret;
++ int ret = -ENXIO;
+ unsigned long nr_vma_pages = vma_pages(vma);
+ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+ unsigned long pfn = dma_to_pfn(dev, dma_addr);
+--
+2.19.1
+
--- /dev/null
+From 673fef155459d2f0276eee04b480fc413e5c7afd Mon Sep 17 00:00:00 2001
+From: Toni Peltonen <peltzi@peltzi.fi>
+Date: Tue, 27 Nov 2018 16:56:57 +0200
+Subject: bonding: fix 802.3ad state sent to partner when unbinding slave
+
+[ Upstream commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ]
+
+Previously when unbinding a slave the 802.3ad implementation only told
+partner that the port is not suitable for aggregation by setting the port
+aggregation state from aggregatable to individual. This is not enough. If the
+physical layer still stays up and we only unbinded this port from the bond there
+is nothing in the aggregation status alone to prevent the partner from sending
+traffic towards us. To ensure that the partner doesn't consider this
+port at all anymore we should also disable collecting and distributing to
+signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to
+ensure partner exits collecting + distributing state.
+
+I have tested this behaviour againts Arista EOS switches with mlx5 cards
+(physical link stays up even when interface is down) and simulated
+the same situation virtually Linux <-> Linux with two network namespaces
+running two veth device pairs. In both cases setting aggregation to
+individual doesn't alone prevent traffic from being to sent towards this
+port given that the link stays up in partners end. Partner still keeps
+it's end in collecting + distributing state and continues until timeout is
+reached. In most cases this means we are losing the traffic partner sends
+towards our port while we wait for timeout. This is most visible with slow
+periodic time (LACP rate slow).
+
+Other open source implementations like Open VSwitch and libreswitch, and
+vendor implementations like Arista EOS, seem to disable collecting +
+distributing to when doing similar port disabling/detaching/removing change.
+With this patch kernel implementation would behave the same way and ensure
+partner doesn't consider our actor viable anymore.
+
+Signed-off-by: Toni Peltonen <peltzi@peltzi.fi>
+Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Acked-by: Jonathan Toppins <jtoppins@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_3ad.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index f43fb2f958a5..93dfcef8afc4 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2086,6 +2086,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
+ aggregator->aggregator_identifier);
+
+ /* Tell the partner that this port is not suitable for aggregation */
++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
+ port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
+ __update_lacpdu_from_port(port);
+ ad_lacpdu_send(port);
+--
+2.19.1
+
--- /dev/null
+From b9b4ea0220a0ec580d0b7ff67bfea70349184b41 Mon Sep 17 00:00:00 2001
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Mon, 3 Dec 2018 22:46:04 -0800
+Subject: bpf: check pending signals while verifying programs
+
+[ Upstream commit c3494801cd1785e2c25f1a5735fa19ddcf9665da ]
+
+Malicious user space may try to force the verifier to use as much cpu
+time and memory as possible. Hence check for pending signals
+while verifying the program.
+Note that suspend of sys_bpf(PROG_LOAD) syscall will lead to EAGAIN,
+since the kernel has to release the resources used for program verification.
+
+Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 56acfbb80104..2954e4b3abd5 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4792,6 +4792,9 @@ static int do_check(struct bpf_verifier_env *env)
+ goto process_bpf_exit;
+ }
+
++ if (signal_pending(current))
++ return -EAGAIN;
++
+ if (need_resched())
+ cond_resched();
+
+--
+2.19.1
+
--- /dev/null
+From d18cf092f9d9b37e73cf0729bdfaec67c7424e47 Mon Sep 17 00:00:00 2001
+From: David Miller <davem@davemloft.net>
+Date: Wed, 28 Nov 2018 22:33:53 -0800
+Subject: bpf: Fix verifier log string check for bad alignment.
+
+[ Upstream commit c01ac66b38660f2b507ccd0b75d28e3002d56fbb ]
+
+The message got changed a lot time ago.
+
+This was responsible for 36 test case failures on sparc64.
+
+Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 2bde9ee04db7..e436b67f2426 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -12765,7 +12765,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
+
+ reject_from_alignment = fd_prog < 0 &&
+ (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
+- strstr(bpf_vlog, "Unknown alignment.");
++ strstr(bpf_vlog, "misaligned");
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ if (reject_from_alignment) {
+ printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
+--
+2.19.1
+
--- /dev/null
+From ecfa86816913c7d7f22ad806a78b7cbf8c201f9d Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Sat, 3 Nov 2018 15:02:44 -0500
+Subject: cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure
+ cifs)
+
+[ Upstream commit 6e785302dad32228819d8066e5376acd15d0e6ba ]
+
+Missing a dependency. Shouldn't show cifs posix extensions
+in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1
+protocol) is disabled.
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
+index abcd78e332fe..85dadb93c992 100644
+--- a/fs/cifs/Kconfig
++++ b/fs/cifs/Kconfig
+@@ -133,7 +133,7 @@ config CIFS_XATTR
+
+ config CIFS_POSIX
+ bool "CIFS POSIX Extensions"
+- depends on CIFS_XATTR
++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
+ help
+ Enabling this option will cause the cifs client to attempt to
+ negotiate a newer dialect with servers, such as Samba 3.0.5
+--
+2.19.1
+
--- /dev/null
+From adfe6ced9637a9bc4added935f2c37c75eecec80 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:51:43 +0300
+Subject: clk: mmp: Off by one in mmp_clk_add()
+
+[ Upstream commit 2e85c57493e391b93445c1e0d530b36b95becc64 ]
+
+The > comparison should be >= or we write one element beyond the end of
+the unit->clk_table[] array.
+
+(The unit->clk_table[] array is allocated in the mmp_clk_init() function
+and it has unit->nr_clks elements).
+
+Fixes: 4661fda10f8b ("clk: mmp: add basic support functions for DT support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c
+index ad8d483a35cd..ca7d37e2c7be 100644
+--- a/drivers/clk/mmp/clk.c
++++ b/drivers/clk/mmp/clk.c
+@@ -183,7 +183,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id,
+ pr_err("CLK %d has invalid pointer %p\n", id, clk);
+ return;
+ }
+- if (id > unit->nr_clks) {
++ if (id >= unit->nr_clks) {
+ pr_err("CLK %d is invalid\n", id);
+ return;
+ }
+--
+2.19.1
+
--- /dev/null
+From 0d09f322194e4f8a6bf5680d7033ce13e6afa24c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:50:55 +0300
+Subject: clk: mvebu: Off by one bugs in cp110_of_clk_get()
+
+[ Upstream commit d9f5b7f5dd0fa74a89de5a7ac1e26366f211ccee ]
+
+These > comparisons should be >= to prevent reading beyond the end of
+of the clk_data->hws[] buffer.
+
+The clk_data->hws[] array is allocated in cp110_syscon_common_probe()
+when we do:
+ cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) +
+ sizeof(struct clk_hw *) * CP110_CLK_NUM,
+ GFP_KERNEL);
+As you can see, it has CP110_CLK_NUM elements which is equivalent to
+CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS.
+
+Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 75bf7b8f282f..0153c76d4a20 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -202,11 +202,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec,
+ unsigned int idx = clkspec->args[1];
+
+ if (type == CP110_CLK_TYPE_CORE) {
+- if (idx > CP110_MAX_CORE_CLOCKS)
++ if (idx >= CP110_MAX_CORE_CLOCKS)
+ return ERR_PTR(-EINVAL);
+ return clk_data->hws[idx];
+ } else if (type == CP110_CLK_TYPE_GATABLE) {
+- if (idx > CP110_MAX_GATABLE_CLOCKS)
++ if (idx >= CP110_MAX_GATABLE_CLOCKS)
+ return ERR_PTR(-EINVAL);
+ return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx];
+ }
+--
+2.19.1
+
--- /dev/null
+From 561590e4ce80d27681785e596991a087d61512d1 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:38:26 -0500
+Subject: drivers/sbus/char: add of_node_put()
+
+[ Upstream commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/sbus/char/envctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
+index 56e962a01493..b8481927bfe4 100644
+--- a/drivers/sbus/char/envctrl.c
++++ b/drivers/sbus/char/envctrl.c
+@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
+ for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
+ pchild->mon_type[len] = ENVCTRL_NOMON;
+ }
++ of_node_put(root_node);
+ return;
+ }
++ of_node_put(root_node);
+ }
+
+ /* Get the monitor channels. */
+--
+2.19.1
+
--- /dev/null
+From 942750732081a3c886203160de201a3dcfd1945a Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 21 Nov 2018 10:22:54 -0500
+Subject: drivers/tty: add missing of_node_put()
+
+[ Upstream commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ]
+
+of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+This place is not doing this, so fix it.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/suncore.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
+index 70a4ea4eaa6e..990376576970 100644
+--- a/drivers/tty/serial/suncore.c
++++ b/drivers/tty/serial/suncore.c
+@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
++ of_node_put(dp);
+ }
+
+ cflag = CREAD | HUPCL | CLOCAL;
+--
+2.19.1
+
--- /dev/null
+From 68ac27c82f3c3e254d4653ccfee1acfd3a1aa080 Mon Sep 17 00:00:00 2001
+From: Roman Li <Roman.Li@amd.com>
+Date: Tue, 27 Nov 2018 17:16:37 -0500
+Subject: drm/amd/display: Fix 6x4K displays light-up on Vega20 (v2)
+
+[ Upstream commit c6888879fd55b1ba903c2a770127edbf6aef6f27 ]
+
+[Why]
+More than 4x4K didn't lightup on Vega20 due to low dcfclk value.
+Powerplay expects valid min requirement for dcfclk from DC.
+
+[How]
+Update min_dcfclock_khz based on min_engine_clock value.
+
+v2: backport to 4.20 (Alex)
+
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Roman Li <Roman.Li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index b2f308766a9e..0941f3c689bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -2530,6 +2530,8 @@ static void pplib_apply_display_requirements(
+ dc,
+ context->bw.dce.sclk_khz);
+
++ pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
++
+ pp_display_cfg->min_engine_clock_deep_sleep_khz
+ = context->bw.dce.sclk_deep_sleep_khz;
+
+--
+2.19.1
+
--- /dev/null
+From b22fb932f5eb71a866f9e488a0962eadbeb5552e Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Wed, 28 Nov 2018 16:36:12 +0800
+Subject: drm/amd/powerplay: issue pre-display settings for display change
+ event
+
+[ Upstream commit 10cb3e6b63bf4266a5198813526fdd7259ffb8be ]
+
+For display config change event only, pre-display config settings are
+needed.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c | 3 +++
+ drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+index 8994aa5c8cf8..64596029b696 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+@@ -365,6 +365,9 @@ int hwmgr_handle_task(struct pp_hwmgr *hwmgr, enum amd_pp_task task_id,
+
+ switch (task_id) {
+ case AMD_PP_TASK_DISPLAY_CONFIG_CHANGE:
++ ret = phm_pre_display_configuration_changed(hwmgr);
++ if (ret)
++ return ret;
+ ret = phm_set_cpu_power_state(hwmgr);
+ if (ret)
+ return ret;
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+index 91ffb7bc4ee7..56437866d120 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+@@ -265,8 +265,6 @@ int psm_adjust_power_state_dynamic(struct pp_hwmgr *hwmgr, bool skip,
+ if (skip)
+ return 0;
+
+- phm_pre_display_configuration_changed(hwmgr);
+-
+ phm_display_configuration_changed(hwmgr);
+
+ if (hwmgr->ps)
+--
+2.19.1
+
--- /dev/null
+From 39c4b8b53aa952c946c8caa3f69f86b8e2c8ca6b Mon Sep 17 00:00:00 2001
+From: James Zhu <James.Zhu@amd.com>
+Date: Mon, 3 Dec 2018 22:04:28 -0500
+Subject: drm/amdgpu/vcn: Update vcn.cur_state during suspend
+
+[ Upstream commit 0a9b89b2e2e7b6d90f81ddc47e489be1043e01b1 ]
+
+Replace vcn_v1_0_stop with vcn_v1_0_set_powergating_state during suspend,
+to keep adev->vcn.cur_state update. It will fix VCN S3 hung issue.
+
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 072371ef5975..4f8f3bb21832 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -43,6 +43,7 @@ static void vcn_v1_0_set_enc_ring_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_set_jpeg_ring_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_set_irq_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_jpeg_ring_set_patch_ring(struct amdgpu_ring *ring, uint32_t ptr);
++static int vcn_v1_0_set_powergating_state(void *handle, enum amd_powergating_state state);
+
+ /**
+ * vcn_v1_0_early_init - set function pointers
+@@ -216,7 +217,7 @@ static int vcn_v1_0_hw_fini(void *handle)
+ struct amdgpu_ring *ring = &adev->vcn.ring_dec;
+
+ if (RREG32_SOC15(VCN, 0, mmUVD_STATUS))
+- vcn_v1_0_stop(adev);
++ vcn_v1_0_set_powergating_state(adev, AMD_PG_STATE_GATE);
+
+ ring->ready = false;
+
+--
+2.19.1
+
--- /dev/null
+From ed7b5a5908c5ba8a162623c39341b2efeb711069 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Fri, 26 Oct 2018 15:59:05 +0200
+Subject: drm/amdgpu: wait for IB test on first device open
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 3bfa8897e4d08f822d1d58cf6cbbffbccef82e08 ]
+
+Instead of delaying that to the first query. Otherwise we could try to use the
+SDMA for VM updates before the IB tests are done.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
+Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index bd98cc5fb97b..fd825d30edf1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -292,9 +292,6 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ if (!info->return_size || !info->return_pointer)
+ return -EINVAL;
+
+- /* Ensure IB tests are run on ring */
+- flush_delayed_work(&adev->late_init_work);
+-
+ switch (info->query) {
+ case AMDGPU_INFO_ACCEL_WORKING:
+ ui32 = adev->accel_working;
+@@ -861,6 +858,9 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ struct amdgpu_fpriv *fpriv;
+ int r, pasid;
+
++ /* Ensure IB tests are run on ring */
++ flush_delayed_work(&adev->late_init_work);
++
+ file_priv->driver_priv = NULL;
+
+ r = pm_runtime_get_sync(dev->dev);
+--
+2.19.1
+
--- /dev/null
+From fe2601f2462871fe9b68f06b5f5b6e3bc199b17b Mon Sep 17 00:00:00 2001
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+Date: Mon, 3 Dec 2018 11:53:21 +1100
+Subject: drm/ast: Fix connector leak during driver unload
+
+[ Upstream commit e594a5e349ddbfdaca1951bb3f8d72f3f1660d73 ]
+
+When unloading the ast driver, a warning message is printed by
+drm_mode_config_cleanup() because a reference is still held to one of
+the drm_connector structs.
+
+Correct this by calling drm_crtc_force_disable_all() in
+ast_fbdev_destroy().
+
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1e613f3c630c7bbc72e04a44b178259b9164d2f6.1543798395.git.sbobroff@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
+index 0cd827e11fa2..de26df0c6044 100644
+--- a/drivers/gpu/drm/ast/ast_fb.c
++++ b/drivers/gpu/drm/ast/ast_fb.c
+@@ -263,6 +263,7 @@ static void ast_fbdev_destroy(struct drm_device *dev,
+ {
+ struct ast_framebuffer *afb = &afbdev->afb;
+
++ drm_crtc_force_disable_all(dev);
+ drm_fb_helper_unregister_fbi(&afbdev->helper);
+
+ if (afb->obj) {
+--
+2.19.1
+
--- /dev/null
+From fd9d9d898ba2fb40f3ac41d4ea999e87cba889cf Mon Sep 17 00:00:00 2001
+From: Sean Paul <seanpaul@chromium.org>
+Date: Tue, 16 Oct 2018 11:52:45 -0400
+Subject: drm/msm: dpu: Don't set legacy plane->crtc pointer
+
+[ Upstream commit 081679c51ef2fd7b23cf9ddb7d775b17f75de18c ]
+
+It causes a WARN in drm_atomic_get_plane_state(), and is not used by
+atomic (or dpu).
+
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index cd02eae884cc..4752f08f0884 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -2122,7 +2122,6 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane)
+ NULL);
+
+ drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
+- plane->crtc = crtc;
+
+ /* save user friendly CRTC name for later */
+ snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
+--
+2.19.1
+
--- /dev/null
+From 337b3186f1d73f51bb160364fbea6378db427a2f Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 16 Nov 2018 19:25:26 +0800
+Subject: drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data"
+
+[ Upstream commit ce25aa3ee6939d83979cccf7adc5737cba9a0cb7 ]
+
+'dpu_enc' is a member of 'drm_enc'
+And 'drm_enc' got allocated with devm_kzalloc in dpu_encoder_init.
+
+This gives this error message:
+./drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:459:1-6:
+ WARNING: invalid free of devm_ allocated data
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 1b4de3486ef9..ec3fd67378c1 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -503,8 +503,6 @@ static void dpu_encoder_destroy(struct drm_encoder *drm_enc)
+
+ drm_encoder_cleanup(drm_enc);
+ mutex_destroy(&dpu_enc->enc_lock);
+-
+- kfree(dpu_enc);
+ }
+
+ void dpu_encoder_helper_split_config(
+--
+2.19.1
+
--- /dev/null
+From 52381a548d97be2ca799b9fb0b0b9b6020c8d66f Mon Sep 17 00:00:00 2001
+From: Abhinav Kumar <abhinavk@codeaurora.org>
+Date: Thu, 14 Jun 2018 21:01:10 -0700
+Subject: drm/msm/dsi: configure VCO rate for 10nm PLL driver
+
+[ Upstream commit 8531f0587f5c9e1a74cd9543a97617349f5e0706 ]
+
+Currenty the VCO rate in the 10nm PLL driver relies
+on the parent rate which is not configured.
+
+Configure the VCO rate to 19.2 Mhz as required by
+the 10nm PLL driver.
+
+Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 4c03f0b7343e..41bec570c518 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -39,6 +39,8 @@
+ #define DSI_PIXEL_PLL_CLK 1
+ #define NUM_PROVIDED_CLKS 2
+
++#define VCO_REF_CLK_RATE 19200000
++
+ struct dsi_pll_regs {
+ u32 pll_prop_gain_rate;
+ u32 pll_lockdet_rate;
+@@ -316,7 +318,7 @@ static int dsi_pll_10nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
+ parent_rate);
+
+ pll_10nm->vco_current_rate = rate;
+- pll_10nm->vco_ref_clk_rate = parent_rate;
++ pll_10nm->vco_ref_clk_rate = VCO_REF_CLK_RATE;
+
+ dsi_pll_setup_config(pll_10nm);
+
+--
+2.19.1
+
--- /dev/null
+From 245f83599ecaa2637c1e8eeeffc353d7b1992041 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 29 Nov 2018 14:01:50 +0800
+Subject: drm/msm: Fix error return checking
+
+[ Upstream commit 098336deb946f37a70afc0979af388b615c378bf ]
+
+The error checks on ret for a negative error return always fails because
+the return value of iommu_map_sg() is unsigned and can never be negative.
+
+Detected with Coccinelle:
+drivers/gpu/drm/msm/msm_iommu.c:69:9-12: WARNING: Unsigned expression
+compared with zero: ret < 0
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+CC: Rob Clark <robdclark@gmail.com>
+CC: David Airlie <airlied@linux.ie>
+CC: Julia Lawall <julia.lawall@lip6.fr>
+CC: linux-arm-msm@vger.kernel.org
+CC: dri-devel@lists.freedesktop.org
+CC: freedreno@lists.freedesktop.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
+index b23d33622f37..2a90aa4caec0 100644
+--- a/drivers/gpu/drm/msm/msm_iommu.c
++++ b/drivers/gpu/drm/msm/msm_iommu.c
+@@ -66,7 +66,7 @@ static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova,
+ // pm_runtime_get_sync(mmu->dev);
+ ret = iommu_map_sg(iommu->domain, iova, sgt->sgl, sgt->nents, prot);
+ // pm_runtime_put_sync(mmu->dev);
+- WARN_ON(ret < 0);
++ WARN_ON(!ret);
+
+ return (ret == len) ? 0 : -EINVAL;
+ }
+--
+2.19.1
+
--- /dev/null
+From 2e4428495c26ea2c80261efe5c07eedf78764a6e Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@gmail.com>
+Date: Mon, 15 Oct 2018 11:22:57 -0400
+Subject: drm/msm: fix handling of cmdstream offset
+
+[ Upstream commit 47e7f506ee6590ceb2efa1f08aca7f9f2ee5c1d3 ]
+
+Userspace hasn't used submit cmds with submit_offset != 0 for a while,
+but this starts cropping up again with cmdstream sub-buffer-allocation
+in libdrm_freedreno.
+
+Doesn't do much good to increment the buf ptr before assigning it.
+
+Fixes: 78b8e5b847b4 drm/msm: dump a rd GPUADDR header for all buffers in the command
+Reviewed-by: Kristian H. Kristensen <hoegsberg@google.com>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_rd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index 3aa8a8576abe..f7a0edea4705 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -316,10 +316,11 @@ static void snapshot_buf(struct msm_rd_state *rd,
+ uint64_t iova, uint32_t size)
+ {
+ struct msm_gem_object *obj = submit->bos[idx].obj;
++ unsigned offset = 0;
+ const char *buf;
+
+ if (iova) {
+- buf += iova - submit->bos[idx].iova;
++ offset = iova - submit->bos[idx].iova;
+ } else {
+ iova = submit->bos[idx].iova;
+ size = obj->base.size;
+@@ -340,6 +341,8 @@ static void snapshot_buf(struct msm_rd_state *rd,
+ if (IS_ERR(buf))
+ return;
+
++ buf += offset;
++
+ rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size);
+
+ msm_gem_put_vaddr(&obj->base);
+--
+2.19.1
+
--- /dev/null
+From b6aedf7c97181940a83d9122b225a0368a564c9d Mon Sep 17 00:00:00 2001
+From: Sharat Masetty <smasetty@codeaurora.org>
+Date: Fri, 12 Oct 2018 14:26:56 +0530
+Subject: drm/msm: Fix task dump in gpu recovery
+
+[ Upstream commit 482f96324a4e08818db7d75bb12beaaea6c9561d ]
+
+The current recovery code gets a pointer to the task struct and does a
+few things all within the rcu_read_lock. This puts constraints on the
+types of gfp flags that can be used within the rcu lock. This patch
+instead gets a reference to the task within the rcu lock and releases
+the lock immediately, this way the task stays afloat until we need it and
+we also get to use the desired gfp flags.
+
+Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gpu.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 46e6b82f7b66..52a2146dc1f2 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -425,10 +425,9 @@ static void recover_worker(struct work_struct *work)
+ if (submit) {
+ struct task_struct *task;
+
+- rcu_read_lock();
+- task = pid_task(submit->pid, PIDTYPE_PID);
++ task = get_pid_task(submit->pid, PIDTYPE_PID);
+ if (task) {
+- comm = kstrdup(task->comm, GFP_ATOMIC);
++ comm = kstrdup(task->comm, GFP_KERNEL);
+
+ /*
+ * So slightly annoying, in other paths like
+@@ -441,10 +440,10 @@ static void recover_worker(struct work_struct *work)
+ * about the submit going away.
+ */
+ mutex_unlock(&dev->struct_mutex);
+- cmd = kstrdup_quotable_cmdline(task, GFP_ATOMIC);
++ cmd = kstrdup_quotable_cmdline(task, GFP_KERNEL);
++ put_task_struct(task);
+ mutex_lock(&dev->struct_mutex);
+ }
+- rcu_read_unlock();
+
+ if (comm && cmd) {
+ dev_err(dev->dev, "%s: offending task: %s (%s)\n",
+--
+2.19.1
+
--- /dev/null
+From 21d18c13a72d8631d7f9535c2e7f51f010742778 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 13 Oct 2018 13:28:06 +0300
+Subject: drm/msm/gpu: Fix a couple memory leaks in debugfs
+
+[ Upstream commit 51270de91412b819f654b849db3bf92dac0a0855 ]
+
+The msm_gpu_open() function should free "show_priv" on error or it
+causes static checker warnings.
+
+Fixes: 4f776f4511c7 ("drm/msm/gpu: Convert the GPU show function to use the GPU state")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_debugfs.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
+index f0da0d3c8a80..d756436c1fcd 100644
+--- a/drivers/gpu/drm/msm/msm_debugfs.c
++++ b/drivers/gpu/drm/msm/msm_debugfs.c
+@@ -84,7 +84,7 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
+
+ ret = mutex_lock_interruptible(&dev->struct_mutex);
+ if (ret)
+- return ret;
++ goto free_priv;
+
+ pm_runtime_get_sync(&gpu->pdev->dev);
+ show_priv->state = gpu->funcs->gpu_state_get(gpu);
+@@ -94,13 +94,20 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
+
+ if (IS_ERR(show_priv->state)) {
+ ret = PTR_ERR(show_priv->state);
+- kfree(show_priv);
+- return ret;
++ goto free_priv;
+ }
+
+ show_priv->dev = dev;
+
+- return single_open(file, msm_gpu_show, show_priv);
++ ret = single_open(file, msm_gpu_show, show_priv);
++ if (ret)
++ goto free_priv;
++
++ return 0;
++
++free_priv:
++ kfree(show_priv);
++ return ret;
+ }
+
+ static const struct file_operations msm_gpu_fops = {
+--
+2.19.1
+
--- /dev/null
+From 5009d6624b7f3ded50ce312e852d60c75d7b168f Mon Sep 17 00:00:00 2001
+From: Sean Paul <seanpaul@chromium.org>
+Date: Wed, 3 Oct 2018 16:22:31 -0400
+Subject: drm/msm: Grab a vblank reference when waiting for commit_done
+
+[ Upstream commit 3b712e43e3876b42b38321ecf790a1f5fe59c834 ]
+
+Similar to the atomic helpers, we should enable vblank while we're
+waiting for the commit to finish. DPU needs this, MDP5 seems to work
+fine without it.
+
+Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_atomic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
+index c1f1779c980f..2b7bb6e166d3 100644
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -32,7 +32,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev,
+ if (!new_crtc_state->active)
+ continue;
+
++ if (drm_crtc_vblank_get(crtc))
++ continue;
++
+ kms->funcs->wait_for_crtc_commit_done(kms, crtc);
++
++ drm_crtc_vblank_put(crtc);
+ }
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 4beddfa450f4fc9afedb69d84008df7d6ddbdd0b Mon Sep 17 00:00:00 2001
+From: Todor Tomov <todor.tomov@linaro.org>
+Date: Fri, 19 Oct 2018 17:07:22 +0300
+Subject: drm/msm/hdmi: Enable HPD after HDMI IRQ is set up
+
+[ Upstream commit ee4456359640defe3f51cc6b728bfce4bc444c9e ]
+
+SoCs that contain MDP5 have a top level wrapper called MDSS that
+manages locks, power and irq for the sub-blocks within it.
+
+Irq for HDMI is also routed through the MDSS.
+
+Shortly after the Hot Plug Detection (HPD) is enabled in HDMI,
+HDMI interrupts are recieved by the MDSS interrupt handler.
+However at this moment the HDMI irq is still not mapped to
+the MDSS irq domain so the HDMI irq handler cannot be called
+to process the interrupts.
+
+This leads to a flood of HDMI interrupts on CPU 0.
+
+If we are lucky to have the HDMI initialization running on a
+different CPU, it will eventually map the HDMI irq to MDSS irq
+domain, the next HDMI interrupt will be handled by the HDMI irq
+handler, the interrupt flood will stop and we will recover.
+
+If the HDMI initialization is running on CPU 0, then it cannot
+complete and there is nothing to stop the interrupt flood on
+CPU 0. The system is stuck.
+
+Fix this by moving the HPD enablement after the HDMI irq is
+mapped to the MDSS irq domain.
+
+Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi.c | 6 ++++++
+ drivers/gpu/drm/msm/hdmi/hdmi.h | 1 +
+ drivers/gpu/drm/msm/hdmi/hdmi_connector.c | 10 ++--------
+ 3 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index c79659ca5706..33e083f71a17 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -332,6 +332,12 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
+ goto fail;
+ }
+
++ ret = msm_hdmi_hpd_enable(hdmi->connector);
++ if (ret < 0) {
++ DRM_DEV_ERROR(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
++ goto fail;
++ }
++
+ encoder->bridge = hdmi->bridge;
+
+ priv->bridges[priv->num_bridges++] = hdmi->bridge;
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
+index accc9a61611d..5c5df6ab2a57 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
+@@ -245,6 +245,7 @@ void msm_hdmi_bridge_destroy(struct drm_bridge *bridge);
+
+ void msm_hdmi_connector_irq(struct drm_connector *connector);
+ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi);
++int msm_hdmi_hpd_enable(struct drm_connector *connector);
+
+ /*
+ * i2c adapter for ddc:
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+index e9c9a0af508e..30e908dfded7 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+@@ -167,8 +167,9 @@ static void enable_hpd_clocks(struct hdmi *hdmi, bool enable)
+ }
+ }
+
+-static int hpd_enable(struct hdmi_connector *hdmi_connector)
++int msm_hdmi_hpd_enable(struct drm_connector *connector)
+ {
++ struct hdmi_connector *hdmi_connector = to_hdmi_connector(connector);
+ struct hdmi *hdmi = hdmi_connector->hdmi;
+ const struct hdmi_platform_config *config = hdmi->config;
+ struct device *dev = &hdmi->pdev->dev;
+@@ -450,7 +451,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
+ {
+ struct drm_connector *connector = NULL;
+ struct hdmi_connector *hdmi_connector;
+- int ret;
+
+ hdmi_connector = kzalloc(sizeof(*hdmi_connector), GFP_KERNEL);
+ if (!hdmi_connector)
+@@ -471,12 +471,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
+ connector->interlace_allowed = 0;
+ connector->doublescan_allowed = 0;
+
+- ret = hpd_enable(hdmi_connector);
+- if (ret) {
+- dev_err(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
+- return ERR_PTR(ret);
+- }
+-
+ drm_connector_attach_encoder(connector, hdmi->encoder);
+
+ return connector;
+--
+2.19.1
+
--- /dev/null
+From 30ad75d31edbc01c8266b113c99b832741c673d2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 29 Nov 2018 16:25:10 +0100
+Subject: drm/ttm: fix LRU handling in ttm_buffer_object_transfer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit d6e820fcd4cf08b11d291a1dd7bbd0636914647c ]
+
+We need to set the NO_EVICT flag on the ghost object or otherwise we are
+adding it to the LRU.
+
+When it is added to the LRU we can run into a race between destroying
+and evicting it again.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo_util.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
+index 046a6dda690a..40904e84f883 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -492,8 +492,10 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
+ if (!fbo)
+ return -ENOMEM;
+
+- ttm_bo_get(bo);
+ fbo->base = *bo;
++ fbo->base.mem.placement |= TTM_PL_FLAG_NO_EVICT;
++
++ ttm_bo_get(bo);
+ fbo->bo = bo;
+
+ /**
+--
+2.19.1
+
--- /dev/null
+From 2ae903a5f872b568c1ef9b2e00b5b328c96106cd Mon Sep 17 00:00:00 2001
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Date: Mon, 3 Dec 2018 13:21:01 +0100
+Subject: ethernet: fman: fix wrong of_node_put() in probe function
+
+[ Upstream commit ecb239d96d369c23c33d41708646df646de669f4 ]
+
+After getting a reference to the platform device's of_node the probe
+function ends up calling of_find_matching_node() using the node as an
+argument. The function takes care of decreasing the refcount on it. We
+are then incorrectly decreasing the refcount on that node again.
+
+This patch removes the unwarranted call to of_node_put().
+
+Fixes: 414fd46e7762 ("fsl/fman: Add FMan support")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index c415ac67cb7b..e80fedb27cee 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -2786,7 +2786,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ if (!muram_node) {
+ dev_err(&of_dev->dev, "%s: could not find MURAM node\n",
+ __func__);
+- goto fman_node_put;
++ goto fman_free;
+ }
+
+ err = of_address_to_resource(muram_node, 0,
+@@ -2795,11 +2795,10 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ of_node_put(muram_node);
+ dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n",
+ __func__, err);
+- goto fman_node_put;
++ goto fman_free;
+ }
+
+ of_node_put(muram_node);
+- of_node_put(fm_node);
+
+ err = devm_request_irq(&of_dev->dev, irq, fman_irq, IRQF_SHARED,
+ "fman", fman);
+--
+2.19.1
+
--- /dev/null
+From 46265c2106ccf68ba07a928b86812c1c4d843631 Mon Sep 17 00:00:00 2001
+From: "Adamski, Krzysztof (Nokia - PL/Wroclaw)" <krzysztof.adamski@nokia.com>
+Date: Fri, 16 Nov 2018 13:24:41 +0000
+Subject: i2c: axxia: properly handle master timeout
+
+[ Upstream commit 6c7f25cae54b840302e4f1b371dbf318fbf09ab2 ]
+
+According to Intel (R) Axxia TM Lionfish Communication Processor
+Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module
+have a programmable Master Wait Timer, which among others, checks the
+time between commands send in manual mode. When a timeout (25ms) passes,
+TSS bit is set in Master Interrupt Status register and a Stop command is
+issued by the hardware.
+
+The axxia_i2c_xfer(), does not properly handle this situation, however.
+For each message a separate axxia_i2c_xfer_msg() is called and this
+function incorrectly assumes that any interrupt might happen only when
+waiting for completion. This is mostly correct but there is one
+exception - a master timeout can trigger if enough time has passed
+between individual transfers. It will, by definition, happen between
+transfers when the interrupts are disabled by the code. If that happens,
+the hardware issues Stop command.
+
+The interrupt indicating timeout will not be triggered as soon as we
+enable them since the Master Interrupt Status is cleared when master
+mode is entered again (which happens before enabling irqs) meaning this
+error is lost and the transfer is continued even though the Stop was
+issued on the bus. The subsequent operations completes without error but
+a bogus value (0xFF in case of read) is read as the client device is
+confused because aborted transfer. No error is returned from
+master_xfer() making caller believe that a valid value was read.
+
+To fix the problem, the TSS bit (indicating timeout) in Master Interrupt
+Status register is checked before each transfer. If it is set, there was
+a timeout before this transfer and (as described above) the hardware
+already issued Stop command so the transaction should be aborted thus
+-ETIMEOUT is returned from the master_xfer() callback. In order to be
+sure no timeout was issued we can't just read the status just before
+starting new transaction as there will always be a small window of time
+(few CPU cycles at best) where this might still happen. For this reason
+we have to temporally disable the timer before checking for TSS bit.
+Disabling it will, however, clear the TSS bit so in order to preserve
+that information, we have to read it in ISR so we have to ensure that
+the TSS interrupt is not masked between transfers of one transaction.
+There is no need to call bus recovery or controller reinitialization if
+that happens so it's skipped.
+
+Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-axxia.c | 40 ++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
+index 8e60048a33f8..51d34959709b 100644
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -74,8 +74,7 @@
+ MST_STATUS_ND)
+ #define MST_STATUS_ERR (MST_STATUS_NAK | \
+ MST_STATUS_AL | \
+- MST_STATUS_IP | \
+- MST_STATUS_TSS)
++ MST_STATUS_IP)
+ #define MST_TX_BYTES_XFRD 0x50
+ #define MST_RX_BYTES_XFRD 0x54
+ #define SCL_HIGH_PERIOD 0x80
+@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev)
+ */
+ if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) {
+ idev->msg_err = -EPROTO;
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ break;
+ }
+@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+
+ if (status & MST_STATUS_SCC) {
+ /* Stop completed */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ } else if (status & MST_STATUS_SNS) {
+ /* Transfer done */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+ axxia_i2c_empty_rx_fifo(idev);
+ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_TSS) {
++ /* Transfer timeout */
++ idev->msg_err = -ETIMEDOUT;
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
+ } else if (unlikely(status & MST_STATUS_ERR)) {
+ /* Transfer error */
+ i2c_int_disable(idev, ~0);
+@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ u32 rx_xfer, tx_xfer;
+ u32 addr_1, addr_2;
+ unsigned long time_left;
++ unsigned int wt_value;
+
+ idev->msg = msg;
+ idev->msg_xfrd = 0;
+- idev->msg_err = 0;
+ reinit_completion(&idev->msg_complete);
+
+ if (i2c_m_ten(msg)) {
+@@ -383,9 +387,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ else if (axxia_i2c_fill_tx_fifo(idev) != 0)
+ int_mask |= MST_STATUS_TFL;
+
++ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL));
++ /* Disable wait timer temporarly */
++ writel(wt_value, idev->base + WAIT_TIMER_CONTROL);
++ /* Check if timeout error happened */
++ if (idev->msg_err)
++ goto out;
++
+ /* Start manual mode */
+ writel(CMD_MANUAL, idev->base + MST_COMMAND);
+
++ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL);
++
+ i2c_int_enable(idev, int_mask);
+
+ time_left = wait_for_completion_timeout(&idev->msg_complete,
+@@ -396,13 +409,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ if (readl(idev->base + MST_COMMAND) & CMD_BUSY)
+ dev_warn(idev->dev, "busy after xfer\n");
+
+- if (time_left == 0)
++ if (time_left == 0) {
+ idev->msg_err = -ETIMEDOUT;
+-
+- if (idev->msg_err == -ETIMEDOUT)
+ i2c_recover_bus(&idev->adapter);
++ axxia_i2c_init(idev);
++ }
+
+- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO)
++out:
++ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO &&
++ idev->msg_err != -ETIMEDOUT)
+ axxia_i2c_init(idev);
+
+ return idev->msg_err;
+@@ -410,7 +425,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+
+ static int axxia_i2c_stop(struct axxia_i2c_dev *idev)
+ {
+- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC;
++ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS;
+ unsigned long time_left;
+
+ reinit_completion(&idev->msg_complete);
+@@ -437,6 +452,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ int i;
+ int ret = 0;
+
++ idev->msg_err = 0;
++ i2c_int_enable(idev, MST_STATUS_TSS);
++
+ for (i = 0; ret == 0 && i < num; ++i)
+ ret = axxia_i2c_xfer_msg(idev, &msgs[i]);
+
+--
+2.19.1
+
--- /dev/null
+From d2d43ba8bc24f03a614c0752c7b151ab12317d1d Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 13 Nov 2018 12:15:42 +0100
+Subject: i2c: rcar: check bus state before reinitializing
+
+[ Upstream commit 0b57436f15bf40e432487086c4f2d01fd3529393 ]
+
+We should check the bus state before reinitializing the IP core.
+Otherwise, the internal bus busy state which also tracks multi-master
+activity is lost.
+
+Credits go to the Renesas BSP team for suggesting this change.
+
+Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Fixes: ae481cc13965 ("i2c: rcar: fix resume by always initializing registers before transfer")
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 4aa7dde876f3..254e6219e538 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -779,6 +779,11 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+
+ pm_runtime_get_sync(dev);
+
++ /* Check bus state before init otherwise bus busy info will be lost */
++ ret = rcar_i2c_bus_barrier(priv);
++ if (ret < 0)
++ goto out;
++
+ /* Gen3 needs a reset before allowing RXDMA once */
+ if (priv->devtype == I2C_RCAR_GEN3) {
+ priv->flags |= ID_P_NO_RXDMA;
+@@ -791,10 +796,6 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+
+ rcar_i2c_init(priv);
+
+- ret = rcar_i2c_bus_barrier(priv);
+- if (ret < 0)
+- goto out;
+-
+ for (i = 0; i < num; i++)
+ rcar_i2c_request_dma(priv, msgs + i);
+
+--
+2.19.1
+
--- /dev/null
+From 39213b26d0114749a20e5c44a7bc9224d971b6d6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 21 Nov 2018 10:19:55 +0100
+Subject: i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI
+ device node
+
+[ Upstream commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 ]
+
+Some AMD based HP laptops have a SMB0001 ACPI device node which does not
+define any methods.
+
+This leads to the following error in dmesg:
+
+[ 5.222731] cmi: probe of SMB0001:00 failed with error -5
+
+This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case
+silencing the error. In case of a failure of the i2c_add_adapter() call
+this commit now propagates the error from that call instead of -EIO.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-scmi.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
+index 7e9a2bbf5ddc..ff3f4553648f 100644
+--- a/drivers/i2c/busses/i2c-scmi.c
++++ b/drivers/i2c/busses/i2c-scmi.c
+@@ -367,6 +367,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ {
+ struct acpi_smbus_cmi *smbus_cmi;
+ const struct acpi_device_id *id;
++ int ret;
+
+ smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
+ if (!smbus_cmi)
+@@ -388,8 +389,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
+ acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
+
+- if (smbus_cmi->cap_info == 0)
++ if (smbus_cmi->cap_info == 0) {
++ ret = -ENODEV;
+ goto err;
++ }
+
+ snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
+ "SMBus CMI adapter %s",
+@@ -400,7 +403,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ smbus_cmi->adapter.dev.parent = &device->dev;
+
+- if (i2c_add_adapter(&smbus_cmi->adapter)) {
++ ret = i2c_add_adapter(&smbus_cmi->adapter);
++ if (ret) {
+ dev_err(&device->dev, "Couldn't register adapter!\n");
+ goto err;
+ }
+@@ -410,7 +414,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ err:
+ kfree(smbus_cmi);
+ device->driver_data = NULL;
+- return -EIO;
++ return ret;
+ }
+
+ static int acpi_smbus_cmi_remove(struct acpi_device *device)
+--
+2.19.1
+
--- /dev/null
+From 796c67751de917e43ec83c5391f2ade6cc50ee8d Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Thu, 6 Dec 2018 12:55:28 +0900
+Subject: i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode
+
+[ Upstream commit ece27a337d42a3197935711997f2880f0957ed7e ]
+
+Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode,
+tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us.
+
+tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode:
+ Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us
+ Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier-f.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index a403e8579b65..bc26ec822e26 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -470,9 +470,26 @@ static void uniphier_fi2c_hw_init(struct uniphier_fi2c_priv *priv)
+
+ uniphier_fi2c_reset(priv);
+
++ /*
++ * Standard-mode: tLOW + tHIGH = 10 us
++ * Fast-mode: tLOW + tHIGH = 2.5 us
++ */
+ writel(cyc, priv->membase + UNIPHIER_FI2C_CYC);
+- writel(cyc / 2, priv->membase + UNIPHIER_FI2C_LCTL);
++ /*
++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us, tBUF = 4.7 us
++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us, tBUF = 1.3 us
++ * "tLow/tHIGH = 5/4" meets both.
++ */
++ writel(cyc * 5 / 9, priv->membase + UNIPHIER_FI2C_LCTL);
++ /*
++ * Standard-mode: tHD;STA = 4.0 us, tSU;STA = 4.7 us, tSU;STO = 4.0 us
++ * Fast-mode: tHD;STA = 0.6 us, tSU;STA = 0.6 us, tSU;STO = 0.6 us
++ */
+ writel(cyc / 2, priv->membase + UNIPHIER_FI2C_SSUT);
++ /*
++ * Standard-mode: tSU;DAT = 250 ns
++ * Fast-mode: tSU;DAT = 100 ns
++ */
+ writel(cyc / 16, priv->membase + UNIPHIER_FI2C_DSUT);
+
+ uniphier_fi2c_prepare_operation(priv);
+--
+2.19.1
+
--- /dev/null
+From ec679b158eb8f098000539de0938c1b2591e8682 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Thu, 6 Dec 2018 12:55:27 +0900
+Subject: i2c: uniphier: fix violation of tLOW requirement for Fast-mode
+
+[ Upstream commit 8469636ab5d8c77645b953746c10fda6983a8830 ]
+
+Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode,
+tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us.
+
+tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode:
+ Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us
+ Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
+index 454f914ae66d..c488e558aef7 100644
+--- a/drivers/i2c/busses/i2c-uniphier.c
++++ b/drivers/i2c/busses/i2c-uniphier.c
+@@ -320,7 +320,13 @@ static void uniphier_i2c_hw_init(struct uniphier_i2c_priv *priv)
+
+ uniphier_i2c_reset(priv, true);
+
+- writel((cyc / 2 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
++ /*
++ * Bit30-16: clock cycles of tLOW.
++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us
++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us
++ * "tLow/tHIGH = 5/4" meets both.
++ */
++ writel((cyc * 5 / 9 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
+
+ uniphier_i2c_reset(priv, false);
+ }
+--
+2.19.1
+
--- /dev/null
+From ef59cdfbdd822e91ee25dd5504ab5b3e8e1bbce7 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:02:49 -0500
+Subject: ide: pmac: add of_node_put()
+
+[ Upstream commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/pmac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
+index c5b902b86b44..203ed4adc04a 100644
+--- a/drivers/ide/pmac.c
++++ b/drivers/ide/pmac.c
+@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
+ struct device_node *root = of_find_node_by_path("/");
+ const char *model = of_get_property(root, "model", NULL);
+
++ of_node_put(root);
+ /* Get cable type from device-tree. */
+ if (cable && !strncmp(cable, "80-", 3)) {
+ /* Some drives fail to detect 80c cable in PowerBook */
+--
+2.19.1
+
--- /dev/null
+From 929e2f05b06e3c8b1c21622cb7931473feb0d3ce Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Thu, 15 Nov 2018 11:05:10 -0800
+Subject: Input: hyper-v - fix wakeup from suspend-to-idle
+
+[ Upstream commit 10f91c73cc41ceead210a905dbd196398e99c7d2 ]
+
+It makes little sense but still possible to put Hyper-V guests into
+suspend-to-idle state. To wake them up two wakeup sources were registered
+in the past: hyperv-keyboard and hid-hyperv. However, since
+commit eed4d47efe95 ("ACPI / sleep: Ignore spurious SCI wakeups from
+suspend-to-idle") pm_wakeup_event() from these devices is ignored. Switch
+to pm_wakeup_hard_event() API as these devices are actually the only
+possible way to wakeup Hyper-V guests.
+
+Fixes: eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle)
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: K. Y. Srinivasan <kys@microsoft.com>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-hyperv.c | 2 +-
+ drivers/input/serio/hyperv-keyboard.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
+index b372854cf38d..704049e62d58 100644
+--- a/drivers/hid/hid-hyperv.c
++++ b/drivers/hid/hid-hyperv.c
+@@ -309,7 +309,7 @@ static void mousevsc_on_receive(struct hv_device *device,
+ hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
+ input_dev->input_buf, len, 1);
+
+- pm_wakeup_event(&input_dev->device->device, 0);
++ pm_wakeup_hard_event(&input_dev->device->device);
+
+ break;
+ default:
+diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
+index 47a0e81a2989..a8b9be3e28db 100644
+--- a/drivers/input/serio/hyperv-keyboard.c
++++ b/drivers/input/serio/hyperv-keyboard.c
+@@ -177,7 +177,7 @@ static void hv_kbd_on_receive(struct hv_device *hv_dev,
+ * state because the Enter-UP can trigger a wakeup at once.
+ */
+ if (!(info & IS_BREAK))
+- pm_wakeup_event(&hv_dev->device, 0);
++ pm_wakeup_hard_event(&hv_dev->device);
+
+ break;
+
+--
+2.19.1
+
--- /dev/null
+From 827958b0100188b3b69bf551c947fd30d0f3f08c Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Dec 2018 11:24:30 -0800
+Subject: Input: omap-keypad - fix keyboard debounce configuration
+
+[ Upstream commit 6c3516fed7b61a3527459ccfa67fab130d910610 ]
+
+I noticed that the Android v3.0.8 kernel on droid4 is using different
+keypad values from the mainline kernel and does not have issues with
+keys occasionally being stuck until pressed again. Turns out there was
+an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
+Correct debounce time", but it was never reposted to fix use macros
+for timing calculations.
+
+This updated version is using macros, and also fixes the use of the
+input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
+use the known good Android kernel values of 3 and 6 instead of 2 and 6
+in the earlier patch.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 46406345742b..a7dc286f406c 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -60,8 +60,18 @@
+
+ /* OMAP4 values */
+ #define OMAP4_VAL_IRQDISABLE 0x0
+-#define OMAP4_VAL_DEBOUNCINGTIME 0x7
+-#define OMAP4_VAL_PVT 0x7
++
++/*
++ * Errata i689: If a key is released for a time shorter than debounce time,
++ * the keyboard will idle and never detect the key release. The workaround
++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
++ * "26.4.6.2 Keyboard Controller Timer" for more information.
++ */
++#define OMAP4_KEYPAD_PTV_DIV_128 0x6
++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \
++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \
++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
+
+ enum {
+ KBD_REVISION_OMAP4 = 0,
+@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
+
+ kbd_writel(keypad_data, OMAP4_KBD_CTRL,
+ OMAP4_DEF_CTRL_NOSOFTMODE |
+- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
+ kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
+- OMAP4_VAL_DEBOUNCINGTIME);
++ OMAP4_VAL_DEBOUNCINGTIME_16MS);
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+--
+2.19.1
+
--- /dev/null
+From cd9f0bcd0aaf570cbe15725e8644ea51e39dba81 Mon Sep 17 00:00:00 2001
+From: Teika Kazura <teika@gmx.com>
+Date: Mon, 3 Dec 2018 11:26:03 -0800
+Subject: Input: synaptics - enable SMBus for HP 15-ay000
+
+[ Upstream commit 5a6dab15f7a79817cab4af612ddd99eda793fce6 ]
+
+SMBus works fine for the touchpad with id SYN3221, used in the HP 15-ay000
+series,
+
+This device has been reported in these messages in the "linux-input"
+mailing list:
+* https://marc.info/?l=linux-input&m=152016683003369&w=2
+* https://www.spinics.net/lists/linux-input/msg52525.html
+
+Reported-by: Nitesh Debnath <niteshkd1999@gmail.com>
+Reported-by: Teika Kazura <teika@gmx.com>
+Signed-off-by: Teika Kazura <teika@gmx.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index c42813d50591..2bd5bb11c8ba 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -178,6 +178,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 8b46655a4fd0d099eecb5698033a86d135bccec0 Mon Sep 17 00:00:00 2001
+From: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Date: Sun, 2 Dec 2018 12:47:08 +0200
+Subject: libata: whitelist all SAMSUNG MZ7KM* solid-state disks
+
+[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ]
+
+These devices support read zero after trim (RZAT), as they advertise to
+the OS. However, the OS doesn't believe the SSDs unless they are
+explicitly whitelisted.
+
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index a7f5202a4815..b8c3f9e6af89 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4602,6 +4602,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From 372ab42f7187ecf1e995aca3a3fa0e48ce8bcf2d Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Thu, 29 Nov 2018 07:54:22 +0800
+Subject: liquidio: read sc->iq_no before release sc
+
+[ Upstream commit c0f53771ba45745e5870daf880127925c93f232f ]
+
+The function lio_vf_rep_packet_sent_callback releases the occupation of
+sc via octeon_free_soft_command. sc should not be used after that.
+Unfortunately, sc->iq_no is read. To fix this, the patch stores sc->iq_no
+into a local variable before releasing sc and then uses the local variable
+instead of sc->iq_no.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+index ddd7431579f4..c99b59fe4c8f 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+@@ -367,13 +367,15 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct,
+ struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
+ struct sk_buff *skb = sc->ctxptr;
+ struct net_device *ndev = skb->dev;
++ u32 iq_no;
+
+ dma_unmap_single(&oct->pci_dev->dev, sc->dmadptr,
+ sc->datasize, DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
++ iq_no = sc->iq_no;
+ octeon_free_soft_command(oct, sc);
+
+- if (octnet_iq_is_full(oct, sc->iq_no))
++ if (octnet_iq_is_full(oct, iq_no))
+ return;
+
+ if (netif_queue_stopped(ndev))
+--
+2.19.1
+
--- /dev/null
+From a6fd6f8f421b3bf581ab34ec6c9d64235c0d4bf2 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Fri, 5 Oct 2018 23:22:06 +0300
+Subject: mac80211_hwsim: fix module init error paths for netlink
+
+[ Upstream commit 05cc09de4c017663a217630682041066f2f9a5cd ]
+
+There is no unregister netlink notifier and family on error paths
+in init_mac80211_hwsim(). Also there is an error path where
+hwsim_class is not destroyed.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 62ab42e94c9d..4ca6592f5b3a 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3712,16 +3712,16 @@ static int __init init_mac80211_hwsim(void)
+ if (err)
+ goto out_unregister_pernet;
+
++ err = hwsim_init_netlink();
++ if (err)
++ goto out_unregister_driver;
++
+ hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+ if (IS_ERR(hwsim_class)) {
+ err = PTR_ERR(hwsim_class);
+- goto out_unregister_driver;
++ goto out_exit_netlink;
+ }
+
+- err = hwsim_init_netlink();
+- if (err < 0)
+- goto out_unregister_driver;
+-
+ for (i = 0; i < radios; i++) {
+ struct hwsim_new_radio_params param = { 0 };
+
+@@ -3827,6 +3827,8 @@ out_free_mon:
+ free_netdev(hwsim_mon);
+ out_free_radios:
+ mac80211_hwsim_free();
++out_exit_netlink:
++ hwsim_exit_netlink();
+ out_unregister_driver:
+ platform_driver_unregister(&mac80211_hwsim_driver);
+ out_unregister_pernet:
+--
+2.19.1
+
--- /dev/null
+From d37f2a953ede40558f82dd8983db3fc4b3827ea2 Mon Sep 17 00:00:00 2001
+From: Matteo Croce <mcroce@redhat.com>
+Date: Sat, 1 Dec 2018 00:26:27 +0100
+Subject: macvlan: return correct error value
+
+[ Upstream commit 59f997b088d26a774958cb7b17b0763cd82de7ec ]
+
+A MAC address must be unique among all the macvlan devices with the same
+lower device. The only exception is the passthru [sic] mode,
+which shares the lower device address.
+
+When duplicate addresses are detected, EBUSY is returned when bringing
+the interface up:
+
+ # ip link add macvlan0 link eth0 type macvlan
+ # read addr </sys/class/net/eth0/address
+ # ip link set macvlan0 address $addr
+ # ip link set macvlan0 up
+ RTNETLINK answers: Device or resource busy
+
+Use correct error code which is EADDRINUSE, and do the check also
+earlier, on address change:
+
+ # ip link set macvlan0 address $addr
+ RTNETLINK answers: Address already in use
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macvlan.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index cfda146f3b3b..6372cdc4a510 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -608,7 +608,7 @@ static int macvlan_open(struct net_device *dev)
+ goto hash_add;
+ }
+
+- err = -EBUSY;
++ err = -EADDRINUSE;
+ if (macvlan_addr_busy(vlan->port, dev->dev_addr))
+ goto out;
+
+@@ -706,7 +706,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
+ } else {
+ /* Rehash and update the device filters */
+ if (macvlan_addr_busy(vlan->port, addr))
+- return -EBUSY;
++ return -EADDRINUSE;
+
+ if (!macvlan_passthru(port)) {
+ err = dev_uc_add(lowerdev, addr);
+@@ -747,6 +747,9 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p)
+ return dev_set_mac_address(vlan->lowerdev, addr);
+ }
+
++ if (macvlan_addr_busy(vlan->port, addr->sa_data))
++ return -EADDRINUSE;
++
+ return macvlan_sync_address(dev, addr->sa_data);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 68c6b9906b3decae5746a5f56e5b36227a382127 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Thu, 6 Dec 2018 17:44:53 +0000
+Subject: mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl
+
+[ Upstream commit 993107fea5eefdfdfde1ca38d3f01f0bebf76e77 ]
+
+When deleting a VLAN device using an ioctl the netdev is unregistered
+before the VLAN filter is updated via ndo_vlan_rx_kill_vid(). It can
+lead to a use-after-free in mlxsw in case the VLAN device is deleted
+while being enslaved to a bridge.
+
+The reason for the above is that when mlxsw receives the CHANGEUPPER
+event, it wrongly assumes that the VLAN device is no longer its upper
+and thus destroys the internal representation of the bridge port despite
+the reference count being non-zero.
+
+Fix this by checking if the VLAN device is our upper using its real
+device. In net-next I'm going to remove this trick and instead make
+mlxsw completely agnostic to the order of the events.
+
+Fixes: c57529e1d5d8 ("mlxsw: spectrum: Replace vPorts with Port-VLAN")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 7715f1ed2bcb..4eb64cb0d9a1 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -286,7 +286,13 @@ static bool
+ mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port *
+ bridge_port)
+ {
+- struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(bridge_port->dev);
++ struct net_device *dev = bridge_port->dev;
++ struct mlxsw_sp *mlxsw_sp;
++
++ if (is_vlan_dev(dev))
++ mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev));
++ else
++ mlxsw_sp = mlxsw_sp_lower_get(dev);
+
+ /* In case ports were pulled from out of a bridged LAG, then
+ * it's possible the reference count isn't zero, yet the bridge
+@@ -2020,7 +2026,7 @@ mlxsw_sp_bridge_8021d_port_leave(struct mlxsw_sp_bridge_device *bridge_device,
+
+ vid = is_vlan_dev(dev) ? vlan_dev_vlan_id(dev) : 1;
+ mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
+- if (WARN_ON(!mlxsw_sp_port_vlan))
++ if (!mlxsw_sp_port_vlan)
+ return;
+
+ mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan);
+--
+2.19.1
+
--- /dev/null
+From 1e92d6658a2b4137e8c5570546fd71c0a019eea5 Mon Sep 17 00:00:00 2001
+From: Anderson Luiz Alves <alacn1@gmail.com>
+Date: Fri, 30 Nov 2018 21:58:36 -0200
+Subject: mv88e6060: disable hardware level MAC learning
+
+[ Upstream commit a74515604a7b171f2702bdcbd1e231225fb456d0 ]
+
+Disable hardware level MAC learning because it breaks station roaming.
+When enabled it drops all frames that arrive from a MAC address
+that is on a different port at learning table.
+
+Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6060.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 65f10fec25b3..0b3e51f248c2 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+--
+2.19.1
+
--- /dev/null
+From f763822016d16697336ebbbad7508a89f23b7da5 Mon Sep 17 00:00:00 2001
+From: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Date: Tue, 27 Nov 2018 14:51:17 +0000
+Subject: net: aquantia: fix rx checksum offload bits
+
+[ Upstream commit 37c4b91f955fdd5f4ad771956b97d35f1321098e ]
+
+The last set of csum offload fixes had a leak:
+
+Checksum enabled status bits from rx descriptor were incorrectly
+interpreted. Consequently all the other valid logic worked on zero bits.
+That caused rx checksum offloads never to trigger.
+
+Tested by dumping rx descriptors and validating resulting csum_level.
+
+Reported-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Fixes: ad703c2b9127f ("net: aquantia: invalid checksumm offload implementation")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 88705dee5b95..56363ff5c891 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -667,7 +667,7 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+
+ rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
+
+- is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
++ is_rx_check_sum_enabled = (rxd_wb->type >> 19) & 0x3U;
+
+ pkt_type = 0xFFU & (rxd_wb->type >> 4);
+
+--
+2.19.1
+
--- /dev/null
+From 467c58f9729f7e325b50439194b8ac7d64eed0a8 Mon Sep 17 00:00:00 2001
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Date: Thu, 29 Nov 2018 17:08:37 +0900
+Subject: net: ethernet: ave: Replace NET_IP_ALIGN with AVE_FRAME_HEADROOM
+
+[ Upstream commit 88113957ddb7b7d5451e28cd708c82ea7e63b097 ]
+
+In commit 26a4676faa1a ("arm64: mm: define NET_IP_ALIGN to 0"),
+AVE controller affects this modification because the controller forces
+to ignore lower 2bits of buffer start address, and make 2-byte headroom,
+that is, data reception starts from (buffer + 2).
+
+This patch defines AVE_FRAME_HEADROOM macro as hardware-specific value,
+and replaces NET_IP_ALIGN with it.
+
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/sni_ave.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index f7ecceeb1e28..f27d67a4d304 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -194,6 +194,7 @@
+
+ /* Parameter for ethernet frame */
+ #define AVE_MAX_ETHFRAME 1518
++#define AVE_FRAME_HEADROOM 2
+
+ /* Parameter for interrupt */
+ #define AVE_INTM_COUNT 20
+@@ -585,12 +586,13 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
+
+ skb = priv->rx.desc[entry].skbs;
+ if (!skb) {
+- skb = netdev_alloc_skb_ip_align(ndev,
+- AVE_MAX_ETHFRAME);
++ skb = netdev_alloc_skb(ndev, AVE_MAX_ETHFRAME);
+ if (!skb) {
+ netdev_err(ndev, "can't allocate skb for Rx\n");
+ return -ENOMEM;
+ }
++ skb->data += AVE_FRAME_HEADROOM;
++ skb->tail += AVE_FRAME_HEADROOM;
+ }
+
+ /* set disable to cmdsts */
+@@ -603,12 +605,12 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
+ * - Rx buffer begins with 2 byte headroom, and data will be put from
+ * (buffer + 2).
+ * To satisfy this, specify the address to put back the buffer
+- * pointer advanced by NET_IP_ALIGN by netdev_alloc_skb_ip_align(),
+- * and expand the map size by NET_IP_ALIGN.
++ * pointer advanced by AVE_FRAME_HEADROOM, and expand the map size
++ * by AVE_FRAME_HEADROOM.
+ */
+ ret = ave_dma_map(ndev, &priv->rx.desc[entry],
+- skb->data - NET_IP_ALIGN,
+- AVE_MAX_ETHFRAME + NET_IP_ALIGN,
++ skb->data - AVE_FRAME_HEADROOM,
++ AVE_MAX_ETHFRAME + AVE_FRAME_HEADROOM,
+ DMA_FROM_DEVICE, &paddr);
+ if (ret) {
+ netdev_err(ndev, "can't map skb for Rx\n");
+--
+2.19.1
+
--- /dev/null
+From fd3667552042ccafab441fb41dcd059f0ee877b7 Mon Sep 17 00:00:00 2001
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Sun, 2 Dec 2018 14:34:37 +0200
+Subject: net/mlx4_en: Fix build break when CONFIG_INET is off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 1b603f9e4313348608f256b564ed6e3d9e67f377 ]
+
+MLX4_EN depends on NETDEVICES, ETHERNET and INET Kconfigs.
+Make sure they are listed in MLX4_EN Kconfig dependencies.
+
+This fixes the following build break:
+
+drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: ‘struct iphdr’ declared inside parameter list [enabled by default]
+struct iphdr *iph)
+^
+drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default]
+drivers/net/ethernet/mellanox/mlx4/en_rx.c: In function ‘get_fixed_ipv4_csum’:
+drivers/net/ethernet/mellanox/mlx4/en_rx.c:586:20: error: dereferencing pointer to incomplete type
+_u8 ipproto = iph->protocol;
+
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/Kconfig b/drivers/net/ethernet/mellanox/mlx4/Kconfig
+index 36054e6fb9d3..f200b8c420d5 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/Kconfig
++++ b/drivers/net/ethernet/mellanox/mlx4/Kconfig
+@@ -5,7 +5,7 @@
+ config MLX4_EN
+ tristate "Mellanox Technologies 1/10/40Gbit Ethernet support"
+ depends on MAY_USE_DEVLINK
+- depends on PCI
++ depends on PCI && NETDEVICES && ETHERNET && INET
+ select MLX4_CORE
+ imply PTP_1588_CLOCK
+ ---help---
+--
+2.19.1
+
--- /dev/null
+From 2fd9df4a9154655aed4920fcad5d9aec1b098ddb Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Tue, 4 Dec 2018 16:03:52 +0200
+Subject: net: mvpp2: fix detection of 10G SFP modules
+
+[ Upstream commit 01b3fd5ac97caffb8e5d5bd85086da33db3b361f ]
+
+The mvpp2_phylink_validate() relies on the interface field of
+phylink_link_state to determine valid link modes. However, when called
+from phylink_sfp_module_insert() this field in not initialized. The
+default switch case then excludes 10G link modes. This allows 10G SFP
+modules that are detected correctly to be configured at max rate of
+2.5G.
+
+Catch the uninitialized PHY mode case, and allow 10G rates.
+
+Fixes: d97c9f4ab000b ("net: mvpp2: 1000baseX support")
+Cc: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Cc: Antoine Tenart <antoine.tenart@bootlin.com>
+Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index a74002b43b51..1b3b64fea038 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4271,6 +4271,7 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+
+ switch (state->interface) {
+ case PHY_INTERFACE_MODE_10GKR:
++ case PHY_INTERFACE_MODE_NA:
+ phylink_set(mask, 10000baseCR_Full);
+ phylink_set(mask, 10000baseSR_Full);
+ phylink_set(mask, 10000baseLR_Full);
+--
+2.19.1
+
--- /dev/null
+From e98826b1e23e33c55e3b9103ccffe4baa2c37b82 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Tue, 4 Dec 2018 16:03:53 +0200
+Subject: net: mvpp2: fix phylink handling of invalid PHY modes
+
+[ Upstream commit 0fb628f0f250c74b1023edd0ca4a57c8b35b9b2c ]
+
+The .validate phylink callback should empty the supported bitmap when
+the interface mode is invalid.
+
+Cc: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Cc: Antoine Tenart <antoine.tenart@bootlin.com>
+Reported-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 33 ++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 1b3b64fea038..6320e080b831 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4262,8 +4262,27 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ unsigned long *supported,
+ struct phylink_link_state *state)
+ {
++ struct mvpp2_port *port = netdev_priv(dev);
+ __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
++ /* Invalid combinations */
++ switch (state->interface) {
++ case PHY_INTERFACE_MODE_10GKR:
++ case PHY_INTERFACE_MODE_XAUI:
++ if (port->gop_id != 0)
++ goto empty_set;
++ break;
++ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
++ if (port->gop_id == 0)
++ goto empty_set;
++ break;
++ default:
++ break;
++ }
++
+ phylink_set(mask, Autoneg);
+ phylink_set_port_modes(mask);
+ phylink_set(mask, Pause);
+@@ -4271,6 +4290,7 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+
+ switch (state->interface) {
+ case PHY_INTERFACE_MODE_10GKR:
++ case PHY_INTERFACE_MODE_XAUI:
+ case PHY_INTERFACE_MODE_NA:
+ phylink_set(mask, 10000baseCR_Full);
+ phylink_set(mask, 10000baseSR_Full);
+@@ -4279,7 +4299,11 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ phylink_set(mask, 10000baseER_Full);
+ phylink_set(mask, 10000baseKR_Full);
+ /* Fall-through */
+- default:
++ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
++ case PHY_INTERFACE_MODE_SGMII:
+ phylink_set(mask, 10baseT_Half);
+ phylink_set(mask, 10baseT_Full);
+ phylink_set(mask, 100baseT_Half);
+@@ -4291,11 +4315,18 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ phylink_set(mask, 1000baseT_Full);
+ phylink_set(mask, 1000baseX_Full);
+ phylink_set(mask, 2500baseX_Full);
++ break;
++ default:
++ goto empty_set;
+ }
+
+ bitmap_and(supported, supported, mask, __ETHTOOL_LINK_MODE_MASK_NBITS);
+ bitmap_and(state->advertising, state->advertising, mask,
+ __ETHTOOL_LINK_MODE_MASK_NBITS);
++ return;
++
++empty_set:
++ bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+ }
+
+ static void mvpp22_xlg_link_state(struct mvpp2_port *port,
+--
+2.19.1
+
--- /dev/null
+From 781db879903afa873f6e010a59692659f1cbfa58 Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Tue, 27 Nov 2018 14:21:43 +0100
+Subject: net: stmmac: Move debugfs init/exit to ->probe()/->remove()
+
+[ Upstream commit 5f2b8b62786853341a20d4cd4948f9cbca3db002 ]
+
+Setting up and tearing down debugfs is current unbalanced, as seen by
+this error during resume from suspend:
+
+ [ 752.134067] dwc-eth-dwmac 2490000.ethernet eth0: ERROR failed to create debugfs directory
+ [ 752.134347] dwc-eth-dwmac 2490000.ethernet eth0: stmmac_hw_setup: failed debugFS registration
+
+The imbalance happens because the driver creates the debugfs hierarchy
+when the device is opened and tears it down when the device is closed.
+There's little gain in that, and it could be argued that it is even
+surprising because it's not usually done for other devices. Fix the
+imbalance by moving the debugfs creation and teardown to the driver's
+->probe() and ->remove() implementations instead.
+
+Note that the ring descriptors cannot be read while the interface is
+down, so make sure to return an empty file when the descriptors_status
+debugfs file is read.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 23 +++++++++++--------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 75896d6ba6e2..99ea5c4ce29c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2547,12 +2547,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
+ netdev_warn(priv->dev, "PTP init failed\n");
+ }
+
+-#ifdef CONFIG_DEBUG_FS
+- ret = stmmac_init_fs(dev);
+- if (ret < 0)
+- netdev_warn(priv->dev, "%s: failed debugFS registration\n",
+- __func__);
+-#endif
+ priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
+
+ if (priv->use_riwt) {
+@@ -2753,10 +2747,6 @@ static int stmmac_release(struct net_device *dev)
+
+ netif_carrier_off(dev);
+
+-#ifdef CONFIG_DEBUG_FS
+- stmmac_exit_fs(dev);
+-#endif
+-
+ stmmac_release_ptp(priv);
+
+ return 0;
+@@ -3896,6 +3886,9 @@ static int stmmac_sysfs_ring_read(struct seq_file *seq, void *v)
+ u32 tx_count = priv->plat->tx_queues_to_use;
+ u32 queue;
+
++ if ((dev->flags & IFF_UP) == 0)
++ return 0;
++
+ for (queue = 0; queue < rx_count; queue++) {
+ struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+
+@@ -4394,6 +4387,13 @@ int stmmac_dvr_probe(struct device *device,
+ goto error_netdev_register;
+ }
+
++#ifdef CONFIG_DEBUG_FS
++ ret = stmmac_init_fs(ndev);
++ if (ret < 0)
++ netdev_warn(priv->dev, "%s: failed debugFS registration\n",
++ __func__);
++#endif
++
+ return ret;
+
+ error_netdev_register:
+@@ -4429,6 +4429,9 @@ int stmmac_dvr_remove(struct device *dev)
+
+ netdev_info(priv->dev, "%s: removing driver", __func__);
+
++#ifdef CONFIG_DEBUG_FS
++ stmmac_exit_fs(ndev);
++#endif
+ stmmac_stop_all_dma(priv);
+
+ stmmac_mac_set(priv, priv->ioaddr, false);
+--
+2.19.1
+
--- /dev/null
+From e36ee4e04f03cb81949f083ab7e25c6f3e7bf212 Mon Sep 17 00:00:00 2001
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+Date: Tue, 27 Nov 2018 19:31:30 +0000
+Subject: nfs: don't dirty kernel pages read by direct-io
+
+[ Upstream commit ad3cba223ac02dc769c3bbe88efe277bbb457566 ]
+
+When we use direct_IO with an NFS backing store, we can trigger a
+WARNING in __set_page_dirty(), as below, since we're dirtying the page
+unnecessarily in nfs_direct_read_completion().
+
+To fix, replicate the logic in commit 53cbf3b157a0 ("fs: direct-io:
+don't dirtying pages for ITER_BVEC/ITER_KVEC direct read").
+
+Other filesystems that implement direct_IO handle this; most use
+blockdev_direct_IO(). ceph and cifs have similar logic.
+
+mount 127.0.0.1:/export /nfs
+dd if=/dev/zero of=/nfs/image bs=1M count=200
+losetup --direct-io=on -f /nfs/image
+mkfs.btrfs /dev/loop0
+mount -t btrfs /dev/loop0 /mnt/
+
+kernel: WARNING: CPU: 0 PID: 8067 at fs/buffer.c:580 __set_page_dirty+0xaf/0xd0
+kernel: Modules linked in: loop(E) nfsv3(E) rpcsec_gss_krb5(E) nfsv4(E) dns_resolver(E) nfs(E) fscache(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) fuse(E) tun(E) ip6t_rpfilter(E) ipt_REJECT(E) nf_
+kernel: snd_seq(E) snd_seq_device(E) snd_pcm(E) video(E) snd_timer(E) snd(E) soundcore(E) ip_tables(E) xfs(E) libcrc32c(E) sd_mod(E) sr_mod(E) cdrom(E) ata_generic(E) pata_acpi(E) crc32c_intel(E) ahci(E) li
+kernel: CPU: 0 PID: 8067 Comm: kworker/0:2 Tainted: G E 4.20.0-rc1.master.20181111.ol7.x86_64 #1
+kernel: Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+kernel: Workqueue: nfsiod rpc_async_release [sunrpc]
+kernel: RIP: 0010:__set_page_dirty+0xaf/0xd0
+kernel: Code: c3 48 8b 02 f6 c4 04 74 d4 48 89 df e8 ba 05 f7 ff 48 89 c6 eb cb 48 8b 43 08 a8 01 75 1f 48 89 d8 48 8b 00 a8 04 74 02 eb 87 <0f> 0b eb 83 48 83 e8 01 eb 9f 48 83 ea 01 0f 1f 00 eb 8b 48 83 e8
+kernel: RSP: 0000:ffffc1c8825b7d78 EFLAGS: 00013046
+kernel: RAX: 000fffffc0020089 RBX: fffff2b603308b80 RCX: 0000000000000001
+kernel: RDX: 0000000000000001 RSI: ffff9d11478115c8 RDI: ffff9d11478115d0
+kernel: RBP: ffffc1c8825b7da0 R08: 0000646f6973666e R09: 8080808080808080
+kernel: R10: 0000000000000001 R11: 0000000000000000 R12: ffff9d11478115d0
+kernel: R13: ffff9d11478115c8 R14: 0000000000003246 R15: 0000000000000001
+kernel: FS: 0000000000000000(0000) GS:ffff9d115ba00000(0000) knlGS:0000000000000000
+kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kernel: CR2: 00007f408686f640 CR3: 0000000104d8e004 CR4: 00000000000606f0
+kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+kernel: Call Trace:
+kernel: __set_page_dirty_buffers+0xb6/0x110
+kernel: set_page_dirty+0x52/0xb0
+kernel: nfs_direct_read_completion+0xc4/0x120 [nfs]
+kernel: nfs_pgio_release+0x10/0x20 [nfs]
+kernel: rpc_free_task+0x30/0x70 [sunrpc]
+kernel: rpc_async_release+0x12/0x20 [sunrpc]
+kernel: process_one_work+0x174/0x390
+kernel: worker_thread+0x4f/0x3e0
+kernel: kthread+0x102/0x140
+kernel: ? drain_workqueue+0x130/0x130
+kernel: ? kthread_stop+0x110/0x110
+kernel: ret_from_fork+0x35/0x40
+kernel: ---[ end trace 01341980905412c9 ]---
+
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+
+[forward-ported to v4.20]
+Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
+Reviewed-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/direct.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index aa12c3063bae..33824a0a57bf 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -98,8 +98,11 @@ struct nfs_direct_req {
+ struct pnfs_ds_commit_info ds_cinfo; /* Storage for cinfo */
+ struct work_struct work;
+ int flags;
++ /* for write */
+ #define NFS_ODIRECT_DO_COMMIT (1) /* an unstable reply was received */
+ #define NFS_ODIRECT_RESCHED_WRITES (2) /* write verification failed */
++ /* for read */
++#define NFS_ODIRECT_SHOULD_DIRTY (3) /* dirty user-space page after read */
+ struct nfs_writeverf verf; /* unstable write verifier */
+ };
+
+@@ -412,7 +415,8 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+ struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ struct page *page = req->wb_page;
+
+- if (!PageCompound(page) && bytes < hdr->good_bytes)
++ if (!PageCompound(page) && bytes < hdr->good_bytes &&
++ (dreq->flags == NFS_ODIRECT_SHOULD_DIRTY))
+ set_page_dirty(page);
+ bytes += req->wb_bytes;
+ nfs_list_remove_request(req);
+@@ -587,6 +591,9 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
+ if (!is_sync_kiocb(iocb))
+ dreq->iocb = iocb;
+
++ if (iter_is_iovec(iter))
++ dreq->flags = NFS_ODIRECT_SHOULD_DIRTY;
++
+ nfs_start_io_direct(inode);
+
+ NFS_I(inode)->read_io += count;
+--
+2.19.1
+
--- /dev/null
+From 3a49ef6e71c48348d2f93c39b9757e2a0bae4874 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Tue, 27 Nov 2018 17:04:44 -0800
+Subject: nvme: validate controller state before rescheduling keep alive
+
+[ Upstream commit 86880d646122240596d6719b642fee3213239994 ]
+
+Delete operations are seeing NULL pointer references in call_timer_fn.
+Tracking these back, the timer appears to be the keep alive timer.
+
+nvme_keep_alive_work() which is tied to the timer that is cancelled
+by nvme_stop_keep_alive(), simply starts the keep alive io but doesn't
+wait for it's completion. So nvme_stop_keep_alive() only stops a timer
+when it's pending. When a keep alive is in flight, there is no timer
+running and the nvme_stop_keep_alive() will have no affect on the keep
+alive io. Thus, if the io completes successfully, the keep alive timer
+will be rescheduled. In the failure case, delete is called, the
+controller state is changed, the nvme_stop_keep_alive() is called while
+the io is outstanding, and the delete path continues on. The keep
+alive happens to successfully complete before the delete paths mark it
+as aborted as part of the queue termination, so the timer is restarted.
+The delete paths then tear down the controller, and later on the timer
+code fires and the timer entry is now corrupt.
+
+Fix by validating the controller state before rescheduling the keep
+alive. Testing with the fix has confirmed the condition above was hit.
+
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b7b2659e02fa..e5bddae16ed4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -831,6 +831,8 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
+ {
+ struct nvme_ctrl *ctrl = rq->end_io_data;
++ unsigned long flags;
++ bool startka = false;
+
+ blk_mq_free_request(rq);
+
+@@ -841,7 +843,13 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
+ return;
+ }
+
+- schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
++ spin_lock_irqsave(&ctrl->lock, flags);
++ if (ctrl->state == NVME_CTRL_LIVE ||
++ ctrl->state == NVME_CTRL_CONNECTING)
++ startka = true;
++ spin_unlock_irqrestore(&ctrl->lock, flags);
++ if (startka)
++ schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
+ }
+
+ static int nvme_keep_alive(struct nvme_ctrl *ctrl)
+--
+2.19.1
+
--- /dev/null
+From e4ae5277504e1aab8b418f91b257d917aea3e574 Mon Sep 17 00:00:00 2001
+From: Israel Rukshin <israelr@mellanox.com>
+Date: Wed, 5 Dec 2018 16:54:57 +0000
+Subject: nvmet-rdma: fix response use after free
+
+[ Upstream commit d7dcdf9d4e15189ecfda24cc87339a3425448d5c ]
+
+nvmet_rdma_release_rsp() may free the response before using it at error
+flow.
+
+Fixes: 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/rdma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index bfc4da660bb4..e57f3902beb3 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -529,6 +529,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
+ {
+ struct nvmet_rdma_rsp *rsp =
+ container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
++ struct nvmet_rdma_queue *queue = cq->cq_context;
+
+ nvmet_rdma_release_rsp(rsp);
+
+@@ -536,7 +537,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
+ wc->status != IB_WC_WR_FLUSH_ERR)) {
+ pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
+ wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
+- nvmet_rdma_error_comp(rsp->queue);
++ nvmet_rdma_error_comp(queue);
+ }
+ }
+
+--
+2.19.1
+
--- /dev/null
+From b4d36e78a8d954fb181b3dc44b34a50518f16232 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:30:40 -0500
+Subject: sbus: char: add of_node_put()
+
+[ Upstream commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/sbus/char/display7seg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
+index 5c8ed7350a04..a36e4cf1841d 100644
+--- a/drivers/sbus/char/display7seg.c
++++ b/drivers/sbus/char/display7seg.c
+@@ -220,6 +220,7 @@ static int d7s_probe(struct platform_device *op)
+ dev_set_drvdata(&op->dev, p);
+ d7s_device = p;
+ err = 0;
++ of_node_put(opts);
+
+ out:
+ return err;
+--
+2.19.1
+
--- /dev/null
+From 9c09d21bb154075b53c4792d1f97fef256e8b02c Mon Sep 17 00:00:00 2001
+From: Fred Herard <fred.herard@oracle.com>
+Date: Tue, 20 Nov 2018 20:22:45 -0500
+Subject: scsi: libiscsi: Fix NULL pointer dereference in
+ iscsi_eh_session_reset
+
+[ Upstream commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ]
+
+This commit addresses NULL pointer dereference in iscsi_eh_session_reset.
+Reference should not be made to session->leadconn when session->state is
+set to ISCSI_STATE_TERMINATE.
+
+Signed-off-by: Fred Herard <fred.herard@oracle.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 93c66ebad907..f78d2e5c1471 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
+ failed:
+ ISCSI_DBG_EH(session,
+ "failing session reset: Could not log back into "
+- "%s, %s [age %d]\n", session->targetname,
+- conn->persistent_address, session->age);
++ "%s [age %d]\n", session->targetname,
++ session->age);
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ return FAILED;
+--
+2.19.1
+
--- /dev/null
+From 10a1d96a1c16a68e43bee5636cadc0ebaf4ab9c8 Mon Sep 17 00:00:00 2001
+From: Cathy Avery <cavery@redhat.com>
+Date: Tue, 27 Nov 2018 14:28:53 -0500
+Subject: scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq
+ during unload
+
+[ Upstream commit 02f425f811cefcc4d325d7a72272651e622dc97e ]
+
+Currently pvscsi_remove calls free_irq more than once as
+pvscsi_release_resources and __pvscsi_shutdown both call
+pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ'
+warning and stack trace. To solve the problem pvscsi_shutdown_intr has been
+moved out of pvscsi_release_resources.
+
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/vmw_pvscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 0cd947f78b5b..890b8aaf95e1 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -1202,8 +1202,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
+
+ static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
+ {
+- pvscsi_shutdown_intr(adapter);
+-
+ if (adapter->workqueue)
+ destroy_workqueue(adapter->workqueue);
+
+@@ -1535,6 +1533,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ out_reset_adapter:
+ ll_adapter_reset(adapter);
+ out_release_resources:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ scsi_host_put(host);
+ out_disable_device:
+@@ -1543,6 +1542,7 @@ out_disable_device:
+ return error;
+
+ out_release_resources_and_disable:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ goto out_disable_device;
+ }
+--
+2.19.1
+
locking-qspinlock-re-order-code.patch
locking-qspinlock-x86-provide-liveness-guarantee.patch
ib-hfi1-remove-race-conditions-in-user_sdma-send-pat.patch
+mac80211_hwsim-fix-module-init-error-paths-for-netli.patch
+input-hyper-v-fix-wakeup-from-suspend-to-idle.patch
+i2c-rcar-check-bus-state-before-reinitializing.patch
+scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch
+scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch
+tools-bpf-fix-two-test_btf-unit-test-cases.patch
+tools-bpf-add-addition-type-tests-to-test_btf.patch
+net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch
+drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch
+x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch
+drm-msm-fix-task-dump-in-gpu-recovery.patch
+drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch
+drm-msm-fix-handling-of-cmdstream-offset.patch
+drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch
+drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch
+drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch
+drm-amdgpu-wait-for-ib-test-on-first-device-open.patch
+arc-io.h-implement-reads-x-writes-x.patch
+net-stmmac-move-debugfs-init-exit-to-probe-remove.patch
+net-aquantia-fix-rx-checksum-offload-bits.patch
+bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch
+bpf-fix-verifier-log-string-check-for-bad-alignment.patch
+liquidio-read-sc-iq_no-before-release-sc.patch
+nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch
+sunrpc-fix-a-potential-race-in-xprt_connect.patch
+sbus-char-add-of_node_put.patch
+drivers-sbus-char-add-of_node_put.patch
+drivers-tty-add-missing-of_node_put.patch
+ide-pmac-add-of_node_put.patch
+drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch
+drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch
+drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch
+drm-msm-fix-error-return-checking.patch
+drm-amd-powerplay-issue-pre-display-settings-for-dis.patch
+clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch
+clk-mmp-off-by-one-in-mmp_clk_add.patch
+input-synaptics-enable-smbus-for-hp-15-ay000.patch
+input-omap-keypad-fix-keyboard-debounce-configuratio.patch
+libata-whitelist-all-samsung-mz7km-solid-state-disks.patch
+macvlan-return-correct-error-value.patch
+mv88e6060-disable-hardware-level-mac-learning.patch
+net-mlx4_en-fix-build-break-when-config_inet-is-off.patch
+bpf-check-pending-signals-while-verifying-programs.patch
+arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch
+arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch
+arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch
+ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch
+thermal-armada-fix-legacy-validity-test-sense.patch
+net-mvpp2-fix-detection-of-10g-sfp-modules.patch
+net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch
+x86-build-fix-compiler-support-check-for-config_retp.patch
+drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch
+tools-testing-nvdimm-align-test-resources-to-128m.patch
+acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch
+drm-ast-fix-connector-leak-during-driver-unload.patch
+cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch
+vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
+mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch
+i2c-axxia-properly-handle-master-timeout.patch
+i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch
+i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch
+i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch
+nvme-validate-controller-state-before-rescheduling-k.patch
+nvmet-rdma-fix-response-use-after-free.patch
--- /dev/null
+From ce09b4d73ba8d1f06d9670f1b542ce6499d6402e Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 1 Dec 2018 23:18:00 -0500
+Subject: SUNRPC: Fix a potential race in xprt_connect()
+
+[ Upstream commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 ]
+
+If an asynchronous connection attempt completes while another task is
+in xprt_connect(), then the call to rpc_sleep_on() could end up
+racing with the call to xprt_wake_pending_tasks().
+So add a second test of the connection state after we've put the
+task to sleep and set the XPRT_CONNECTING flag, when we know that there
+can be no asynchronous connection attempts still in progress.
+
+Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprt.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index a8db2e3f8904..d066aae3cb6d 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -781,8 +781,15 @@ void xprt_connect(struct rpc_task *task)
+ return;
+ if (xprt_test_and_set_connecting(xprt))
+ return;
+- xprt->stat.connect_start = jiffies;
+- xprt->ops->connect(xprt, task);
++ /* Race breaker */
++ if (!xprt_connected(xprt)) {
++ xprt->stat.connect_start = jiffies;
++ xprt->ops->connect(xprt, task);
++ } else {
++ xprt_clear_connecting(xprt);
++ task->tk_status = 0;
++ rpc_wake_up_queued_task(&xprt->pending, task);
++ }
+ }
+ xprt_release_write(xprt, task);
+ }
+--
+2.19.1
+
--- /dev/null
+From 2cdfb852666b0bd362261a19de15556c69aa8fee Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 9 Nov 2018 16:44:14 +0000
+Subject: thermal: armada: fix legacy validity test sense
+
+[ Upstream commit 70bb27b79adf63ea39e37371d09c823c7a8f93ce ]
+
+Commit 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid()
+pointer") removed the unnecessary indirection through a function
+pointer, but in doing so, also removed the negation operator too:
+
+- if (priv->data->is_valid && !priv->data->is_valid(priv)) {
++ if (armada_is_valid(priv)) {
+
+which results in:
+
+armada_thermal f06f808c.thermal: Temperature sensor reading not valid
+armada_thermal f2400078.thermal: Temperature sensor reading not valid
+armada_thermal f4400078.thermal: Temperature sensor reading not valid
+
+at boot, or whenever the "temp" sysfs file is read. Replace the
+negation operator.
+
+Fixes: 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid() pointer")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/armada_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
+index 2c2f6d93034e..e16b3cb1808c 100644
+--- a/drivers/thermal/armada_thermal.c
++++ b/drivers/thermal/armada_thermal.c
+@@ -357,7 +357,7 @@ static int armada_get_temp_legacy(struct thermal_zone_device *thermal,
+ int ret;
+
+ /* Valid check */
+- if (armada_is_valid(priv)) {
++ if (!armada_is_valid(priv)) {
+ dev_err(priv->dev,
+ "Temperature sensor reading not valid\n");
+ return -EIO;
+--
+2.19.1
+
--- /dev/null
+From eb1f5e159fa7975e59f57750453b3335603b1a33 Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yhs@fb.com>
+Date: Tue, 27 Nov 2018 13:23:30 -0800
+Subject: tools/bpf: add addition type tests to test_btf
+
+[ Upstream commit d08489125e04a9f73d9323caea43270fd22d395f ]
+
+The following additional unit testcases are added to test_btf:
+...
+BTF raw test[42] (typedef (invalid name, name_off = 0)): OK
+BTF raw test[43] (typedef (invalid name, invalid identifier)): OK
+BTF raw test[44] (ptr type (invalid name, name_off <> 0)): OK
+BTF raw test[45] (volatile type (invalid name, name_off <> 0)): OK
+BTF raw test[46] (const type (invalid name, name_off <> 0)): OK
+BTF raw test[47] (restrict type (invalid name, name_off <> 0)): OK
+BTF raw test[48] (fwd type (invalid name, name_off = 0)): OK
+BTF raw test[49] (fwd type (invalid name, invalid identifier)): OK
+BTF raw test[50] (array type (invalid name, name_off <> 0)): OK
+BTF raw test[51] (struct type (name_off = 0)): OK
+BTF raw test[52] (struct type (invalid name, invalid identifier)): OK
+BTF raw test[53] (struct member (name_off = 0)): OK
+BTF raw test[54] (struct member (invalid name, invalid identifier)): OK
+BTF raw test[55] (enum type (name_off = 0)): OK
+BTF raw test[56] (enum type (invalid name, invalid identifier)): OK
+BTF raw test[57] (enum member (invalid name, name_off = 0)): OK
+BTF raw test[58] (enum member (invalid name, invalid identifier)): OK
+...
+
+Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests")
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_btf.c | 361 +++++++++++++++++++++++++
+ 1 file changed, 361 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
+index 4909aab4d6ab..29116366a9fc 100644
+--- a/tools/testing/selftests/bpf/test_btf.c
++++ b/tools/testing/selftests/bpf/test_btf.c
+@@ -1291,6 +1291,367 @@ static struct btf_raw_test raw_tests[] = {
+ .err_str = "type != 0",
+ },
+
++{
++ .descr = "typedef (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPEDEF_ENC(0, 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "typedef_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "typedef (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPEDEF_ENC(NAME_TBD, 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__!int",
++ .str_sec_size = sizeof("\0__!int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "typedef_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "ptr type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "ptr_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "volatile type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "volatile_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "const type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "const_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "restrict type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_RESTRICT, 0, 0), 2), /* [3] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "restrict_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "fwd type (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__skb",
++ .str_sec_size = sizeof("\0__skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "fwd_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "fwd type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__!skb",
++ .str_sec_size = sizeof("\0__!skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "fwd_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "array type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_ARRAY, 0, 0), 0), /* [2] */
++ BTF_ARRAY_ENC(1, 1, 4),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__skb",
++ .str_sec_size = sizeof("\0__skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "array_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "struct type (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A",
++ .str_sec_size = sizeof("\0A"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "struct type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!\0B",
++ .str_sec_size = sizeof("\0A!\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "struct member (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A",
++ .str_sec_size = sizeof("\0A"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "struct member (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A\0B*",
++ .str_sec_size = sizeof("\0A\0B*"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum type (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A\0B",
++ .str_sec_size = sizeof("\0A\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "enum type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!\0B",
++ .str_sec_size = sizeof("\0A!\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum member (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(0, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "",
++ .str_sec_size = sizeof(""),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum member (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!",
++ .str_sec_size = sizeof("\0A!"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
+ {
+ .descr = "arraymap invalid btf key (a bit field)",
+ .raw_types = {
+--
+2.19.1
+
--- /dev/null
+From d49958e0936c7ff238646bf8b6c1c822c34505d0 Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Tue, 27 Nov 2018 13:23:29 -0800
+Subject: tools/bpf: fix two test_btf unit test cases
+
+[ Upstream commit 8800cd031af085807028656c6ba7eb7908d78262 ]
+
+There are two unit test cases, which should encode
+TYPEDEF type, but instead encode PTR type.
+The error is flagged out after enforcing name
+checking in the previous patch.
+
+Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests")
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_btf.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
+index 6b5cfeb7a9cc..4909aab4d6ab 100644
+--- a/tools/testing/selftests/bpf/test_btf.c
++++ b/tools/testing/selftests/bpf/test_btf.c
+@@ -431,11 +431,11 @@ static struct btf_raw_test raw_tests[] = {
+ /* const void* */ /* [3] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
+ /* typedef const void * const_void_ptr */
+- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
+- /* struct A { */ /* [4] */
++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */
++ /* struct A { */ /* [5] */
+ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), sizeof(void *)),
+ /* const_void_ptr m; */
+- BTF_MEMBER_ENC(NAME_TBD, 3, 0),
++ BTF_MEMBER_ENC(NAME_TBD, 4, 0),
+ /* } */
+ BTF_END_RAW,
+ },
+@@ -493,10 +493,10 @@ static struct btf_raw_test raw_tests[] = {
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 0),
+ /* const void* */ /* [3] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
+- /* typedef const void * const_void_ptr */ /* [4] */
+- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
+- /* const_void_ptr[4] */ /* [5] */
+- BTF_TYPE_ARRAY_ENC(3, 1, 4),
++ /* typedef const void * const_void_ptr */
++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */
++ /* const_void_ptr[4] */
++ BTF_TYPE_ARRAY_ENC(4, 1, 4), /* [5] */
+ BTF_END_RAW,
+ },
+ .str_sec = "\0const_void_ptr",
+--
+2.19.1
+
--- /dev/null
+From c52c213f861b1294ff4ef999dd66d0fd20650ccc Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Wed, 5 Dec 2018 14:11:48 -0800
+Subject: tools/testing/nvdimm: Align test resources to 128M
+
+[ Upstream commit e3f5df762d4a6ef6326c3c09bc9f89ea8a2eab2c ]
+
+In preparation for libnvdimm growing new restrictions to detect section
+conflicts between persistent memory regions, enable nfit_test to
+allocate aligned resources. Use a gen_pool to allocate nfit_test's fake
+resources in a separate address space from the virtual translation of
+the same.
+
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Tested-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/nvdimm/test/nfit.c | 35 ++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index ec50d2a95076..fa763dbfdad7 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -15,6 +15,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/workqueue.h>
+ #include <linux/libnvdimm.h>
++#include <linux/genalloc.h>
+ #include <linux/vmalloc.h>
+ #include <linux/device.h>
+ #include <linux/module.h>
+@@ -213,6 +214,8 @@ struct nfit_test {
+
+ static struct workqueue_struct *nfit_wq;
+
++static struct gen_pool *nfit_pool;
++
+ static struct nfit_test *to_nfit_test(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+@@ -1130,6 +1133,9 @@ static void release_nfit_res(void *data)
+ list_del(&nfit_res->list);
+ spin_unlock(&nfit_test_lock);
+
++ if (resource_size(&nfit_res->res) >= DIMM_SIZE)
++ gen_pool_free(nfit_pool, nfit_res->res.start,
++ resource_size(&nfit_res->res));
+ vfree(nfit_res->buf);
+ kfree(nfit_res);
+ }
+@@ -1142,7 +1148,7 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+ GFP_KERNEL);
+ int rc;
+
+- if (!buf || !nfit_res)
++ if (!buf || !nfit_res || !*dma)
+ goto err;
+ rc = devm_add_action(dev, release_nfit_res, nfit_res);
+ if (rc)
+@@ -1162,6 +1168,8 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+
+ return nfit_res->buf;
+ err:
++ if (*dma && size >= DIMM_SIZE)
++ gen_pool_free(nfit_pool, *dma, size);
+ if (buf)
+ vfree(buf);
+ kfree(nfit_res);
+@@ -1170,9 +1178,16 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+
+ static void *test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma)
+ {
++ struct genpool_data_align data = {
++ .align = SZ_128M,
++ };
+ void *buf = vmalloc(size);
+
+- *dma = (unsigned long) buf;
++ if (size >= DIMM_SIZE)
++ *dma = gen_pool_alloc_algo(nfit_pool, size,
++ gen_pool_first_fit_align, &data);
++ else
++ *dma = (unsigned long) buf;
+ return __test_alloc(t, size, dma, buf);
+ }
+
+@@ -2837,6 +2852,17 @@ static __init int nfit_test_init(void)
+ goto err_register;
+ }
+
++ nfit_pool = gen_pool_create(ilog2(SZ_4M), NUMA_NO_NODE);
++ if (!nfit_pool) {
++ rc = -ENOMEM;
++ goto err_register;
++ }
++
++ if (gen_pool_add(nfit_pool, SZ_4G, SZ_4G, NUMA_NO_NODE)) {
++ rc = -ENOMEM;
++ goto err_register;
++ }
++
+ for (i = 0; i < NUM_NFITS; i++) {
+ struct nfit_test *nfit_test;
+ struct platform_device *pdev;
+@@ -2892,6 +2918,9 @@ static __init int nfit_test_init(void)
+ return 0;
+
+ err_register:
++ if (nfit_pool)
++ gen_pool_destroy(nfit_pool);
++
+ destroy_workqueue(nfit_wq);
+ for (i = 0; i < NUM_NFITS; i++)
+ if (instances[i])
+@@ -2915,6 +2944,8 @@ static __exit void nfit_test_exit(void)
+ platform_driver_unregister(&nfit_test_driver);
+ nfit_test_teardown();
+
++ gen_pool_destroy(nfit_pool);
++
+ for (i = 0; i < NUM_NFITS; i++)
+ put_device(&instances[i]->pdev.dev);
+ class_destroy(nfit_test_dimm);
+--
+2.19.1
+
--- /dev/null
+From 7a2e24876a525f8b7ee78ba36d7ca8d0ab30816f Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Thu, 6 Dec 2018 19:14:34 +0000
+Subject: vhost/vsock: fix reset orphans race with close timeout
+
+[ Upstream commit c38f57da428b033f2721b611d84b1f40bde674a8 ]
+
+If a local process has closed a connected socket and hasn't received a
+RST packet yet, then the socket remains in the table until a timeout
+expires.
+
+When a vhost_vsock instance is released with the timeout still pending,
+the socket is never freed because vhost_vsock has already set the
+SOCK_DONE flag.
+
+Check if the close timer is pending and let it close the socket. This
+prevents the race which can leak sockets.
+
+Reported-by: Maximilian Riemensberger <riemensberger@cadami.net>
+Cc: Graham Whaley <graham.whaley@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vsock.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 51879ed18652..98ed5be132c6 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
+ * executing.
+ */
+
+- if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
+- sock_set_flag(sk, SOCK_DONE);
+- vsk->peer_shutdown = SHUTDOWN_MASK;
+- sk->sk_state = SS_UNCONNECTED;
+- sk->sk_err = ECONNRESET;
+- sk->sk_error_report(sk);
+- }
++ /* If the peer is still valid, no need to reset connection */
++ if (vhost_vsock_get(vsk->remote_addr.svm_cid))
++ return;
++
++ /* If the close timeout is pending, let it expire. This avoids races
++ * with the timeout callback.
++ */
++ if (vsk->close_work_scheduled)
++ return;
++
++ sock_set_flag(sk, SOCK_DONE);
++ vsk->peer_shutdown = SHUTDOWN_MASK;
++ sk->sk_state = SS_UNCONNECTED;
++ sk->sk_err = ECONNRESET;
++ sk->sk_error_report(sk);
+ }
+
+ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+--
+2.19.1
+
--- /dev/null
+From fe7443c2e9788ea18a4174995385c603a7835671 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 5 Dec 2018 15:27:19 +0900
+Subject: x86/build: Fix compiler support check for CONFIG_RETPOLINE
+
+[ Upstream commit 25896d073d8a0403b07e6dec56f58e6c33678207 ]
+
+It is troublesome to add a diagnostic like this to the Makefile
+parse stage because the top-level Makefile could be parsed with
+a stale include/config/auto.conf.
+
+Once you are hit by the error about non-retpoline compiler, the
+compilation still breaks even after disabling CONFIG_RETPOLINE.
+
+The easiest fix is to move this check to the "archprepare" like
+this commit did:
+
+ 829fe4aa9ac1 ("x86: Allow generating user-space headers without a compiler")
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support")
+Link: http://lkml.kernel.org/r/1543991239-18476-1-git-send-email-yamada.masahiro@socionext.com
+Link: https://lkml.org/lkml/2018/12/4/206
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Makefile | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 9298f0f3817a..b84f61bc5e7a 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -223,9 +223,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+-ifeq ($(RETPOLINE_CFLAGS),)
+- $(error You are building kernel with non-retpoline compiler, please update your compiler.)
+-endif
+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
+ endif
+
+@@ -303,6 +300,13 @@ ifndef CC_HAVE_ASM_GOTO
+ @echo Compiler lacks asm-goto support.
+ @exit 1
+ endif
++ifdef CONFIG_RETPOLINE
++ifeq ($(RETPOLINE_CFLAGS),)
++ @echo "You are building kernel with non-retpoline compiler." >&2
++ @echo "Please update your compiler." >&2
++ @false
++endif
++endif
+
+ archclean:
+ $(Q)rm -rf $(objtree)/arch/i386
+--
+2.19.1
+
--- /dev/null
+From ae7fc3f71641d7a5d503f0d6cde379512d9b7587 Mon Sep 17 00:00:00 2001
+From: YiFei Zhu <zhuyifei1999@gmail.com>
+Date: Thu, 29 Nov 2018 18:12:30 +0100
+Subject: x86/earlyprintk/efi: Fix infinite loop on some screen widths
+
+[ Upstream commit 79c2206d369b87b19ac29cb47601059b6bf5c291 ]
+
+An affected screen resolution is 1366 x 768, which width is not
+divisible by 8, the default font width. On such screens, when longer
+lines are earlyprintk'ed, overflow-to-next-line can never trigger,
+due to the left-most x-coordinate of the next character always less
+than the screen width. Earlyprintk will infinite loop in trying to
+print the rest of the string but unable to, due to the line being
+full.
+
+This patch makes the trigger consider the right-most x-coordinate,
+instead of left-most, as the value to compare against the screen
+width threshold.
+
+Signed-off-by: YiFei Zhu <zhuyifei1999@gmail.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Eric Snowberg <eric.snowberg@oracle.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Julien Thierry <julien.thierry@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
+Cc: Sedat Dilek <sedat.dilek@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/early_printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
+index 5fdacb322ceb..c3e6be110b7d 100644
+--- a/arch/x86/platform/efi/early_printk.c
++++ b/arch/x86/platform/efi/early_printk.c
+@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
+ num--;
+ }
+
+- if (efi_x >= si->lfb_width) {
++ if (efi_x + font->width > si->lfb_width) {
+ efi_x = 0;
+ efi_y += font->height;
+ }
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
