--- /dev/null
+From 8be3022a5ae87e12645266e0143be64d9f470d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 16:39:10 +0200
+Subject: ALSA: intel8x0m: Register irq handler after register initializations
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ]
+
+The interrupt handler has to be acquired after the other resource
+initialization when allocated with IRQF_SHARED. Otherwise it's
+triggered before the resource gets ready, and may lead to unpleasant
+behavior.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/intel8x0m.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 1bc98c867133d..2286dfd72ff7e 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ }
+
+ port_inited:
+- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
+- KBUILD_MODNAME, chip)) {
+- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
+- snd_intel8x0m_free(chip);
+- return -EBUSY;
+- }
+- chip->irq = pci->irq;
+- pci_set_master(pci);
+- synchronize_irq(chip->irq);
+-
+ /* initialize offsets */
+ chip->bdbars_count = 2;
+ tbl = intel_regs;
+@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ chip->int_sta_reg = ICH_REG_GLOB_STA;
+ chip->int_sta_mask = int_sta_masks;
+
++ pci_set_master(pci);
++
+ if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+ }
+
++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, chip)) {
++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
++ snd_intel8x0m_free(chip);
++ return -EBUSY;
++ }
++ chip->irq = pci->irq;
++
+ if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From c8c0e76fe4a4079b255efb0fe9632437a2ad602f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 12:21:45 +0300
+Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ]
+
+The "frames" variable is unsigned so the error handling doesn't work
+properly.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/pcm_plugin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index a84a1d3d23e56..c6888d76ca5e9 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+--
+2.20.1
+
--- /dev/null
+From 7579047c03ea4e8caeff1190a555ad161da8d885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 12:49:43 +0200
+Subject: ALSA: seq: Do error checks at creating system ports
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ]
+
+snd_seq_system_client_init() doesn't check the errors returned from
+its port creations. Let's do it properly and handle the error paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_system.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
+index 8ce1d0b40dce1..ce1f1e4727ab1 100644
+--- a/sound/core/seq/seq_system.c
++++ b/sound/core/seq/seq_system.c
+@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void)
+ {
+ struct snd_seq_port_callback pcallbacks;
+ struct snd_seq_port_info *port;
++ int err;
+
+ port = kzalloc(sizeof(*port), GFP_KERNEL);
+ if (!port)
+@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+
+ /* register announcement port */
+ strcpy(port->name, "Announce");
+@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+ announce_port = port->addr.port;
+
+ kfree(port);
+ return 0;
++
++ error_port:
++ snd_seq_system_client_done();
++ kfree(port);
++ return err;
+ }
+
+
+ /* unregister our internal client */
+-void __exit snd_seq_system_client_done(void)
++void snd_seq_system_client_done(void)
+ {
+ int oldsysclient = sysclient;
+
+--
+2.20.1
+
--- /dev/null
+From 0625741e91818d8e54778929316dfd420a77d98a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 17:33:40 -0500
+Subject: ARM: dts: am335x-evm: fix number of cpsw
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ]
+
+am335x-evm has only one CPSW external port physically wired, but DT defines
+2 ext. ports. As result, PHY connection failure reported for the second
+ext. port.
+
+Update DT to reflect am335x-evm board HW configuration, and, while here,
+switch to use phy-handle instead of phy_id.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index e82432c79f85f..3f3ad09c7cd5f 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -701,6 +701,7 @@
+ pinctrl-0 = <&cpsw_default>;
+ pinctrl-1 = <&cpsw_sleep>;
+ status = "okay";
++ slaves = <1>;
+ };
+
+ &davinci_mdio {
+@@ -708,15 +709,14 @@
+ pinctrl-0 = <&davinci_mdio_default>;
+ pinctrl-1 = <&davinci_mdio_sleep>;
+ status = "okay";
+-};
+
+-&cpsw_emac0 {
+- phy_id = <&davinci_mdio>, <0>;
+- phy-mode = "rgmii-txid";
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
+ };
+
+-&cpsw_emac1 {
+- phy_id = <&davinci_mdio>, <1>;
++&cpsw_emac0 {
++ phy-handle = <ðphy0>;
+ phy-mode = "rgmii-txid";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From e04b8945cfc11a22fef25f0b5ed6fc59be1528e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:42:01 +0200
+Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
+
+From: Jay Foster <jayfoster@ieee.org>
+
+[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ]
+
+Fix a typo. No functional change made by this patch.
+
+Signed-off-by: Jay Foster <jayfoster@ieee.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index b3501ae2a3bd1..4fba898b8f4f9 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -546,7 +546,7 @@
+ };
+ };
+
+- uart1 {
++ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP /* PB4 periph A with pullup */
+--
+2.20.1
+
--- /dev/null
+From 1aaf9a116e4339150e9dc6be14b655298216b413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:41:35 +0200
+Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ]
+
+S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has
+external pull-up resistors, so disable any pull control for it in
+in controller node. This fixes support for S5M8767 interrupts and
+enables operation of wakeup from S5M8767 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index 6098dacd09f11..1b2709af2a42b 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -170,6 +170,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s5m8767_irq>;
+
+ vinb1-supply = <&main_dc_reg>;
+ vinb2-supply = <&main_dc_reg>;
+@@ -547,6 +549,13 @@
+ cap-sd-highspeed;
+ };
+
++&pinctrl_0 {
++ s5m8767_irq: s5m8767-irq {
++ samsung,pins = "gpx3-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &rtc {
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 6559141b7636889b4959f99f6db4c07d09954e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 10:04:25 +0200
+Subject: ARM: dts: exynos: Fix regulators configuration on Peach Pi/Pit
+ Chromebooks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit f8f3b7fc21b1cb59385b780acd9b9a26d04cb7b2 ]
+
+Regulators, which are marked as 'on-in-suspend' seems to be critical for
+board operation, thus they must not be disabled anytime. This can be
+only assured by marking them as 'always-on', because otherwise some
+actions of their clients might result in turning them off. This patch
+restores suspend/resume operation on Peach-Pit Chromebook board. It
+partially reverts 'always-on' property removal done by the commit
+mentioned in the Fixes tag.
+
+Fixes: 665c441eea3d ("ARM: dts: exynos: Remove unneded always-on for regulators on Peach boards")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-peach-pit.dts | 3 +++
+ arch/arm/boot/dts/exynos5800-peach-pi.dts | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 8b754ae8c8f7d..c9d379b1a1669 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -302,6 +302,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -323,6 +324,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +335,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index 1f90df2d7ecd8..ae58b8d6f6144 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -302,6 +302,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -323,6 +324,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +335,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+--
+2.20.1
+
--- /dev/null
+From 1339a70db967a1dfdd187bba6999915ef0f425cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 12:55:32 +0200
+Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ]
+
+This patch adds missing properties to the CODEC and sound nodes, so the
+audio will work also on Snow rev5 Chromebook. This patch is an extension
+to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and
+DAI properties to the max98095 node in Snow Chromebook")
+and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow
+Chromebook"). It has been reported that such changes work fine on the
+rev5 board too.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+[krzk: Fixed typo in phandle to &max98090]
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+index 90560c316f644..cb986175b69b4 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts
++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+@@ -23,6 +23,14 @@
+
+ samsung,model = "Snow-I2S-MAX98090";
+ samsung,audio-codec = <&max98090>;
++
++ cpu {
++ sound-dai = <&i2s0 0>;
++ };
++
++ codec {
++ sound-dai = <&max98090 0>, <&hdmi>;
++ };
+ };
+ };
+
+@@ -34,6 +42,9 @@
+ interrupt-parent = <&gpx0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max98090_irq>;
++ clocks = <&pmu_system_controller 0>;
++ clock-names = "mclk";
++ #sound-dai-cells = <1>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 888d337ec6eb376b61a61888561ca2a57d068490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:33 -0500
+Subject: ARM: dts: lpc32xx: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 11236ef582b8d66290bb3b3710e03ca1d85d8ad8 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Vladimir Zapolskiy <vz@mleia.com>
+Cc: Sylvain Lemieux <slemieux.tyco@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 0d20aadc78bb1..5fa3111731cb0 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -179,7 +179,7 @@
+ * ssp0 and spi1 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp0: ssp@20084000 {
++ ssp0: spi@20084000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x20084000 0x1000>;
+ interrupts = <20 IRQ_TYPE_LEVEL_HIGH>;
+@@ -199,7 +199,7 @@
+ * ssp1 and spi2 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp1: ssp@2008c000 {
++ ssp1: spi@2008c000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x2008c000 0x1000>;
+ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 57039f8d09b77f9dd9c79667ee9b5180d15c3513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:31 -0500
+Subject: ARM: dts: marvell: Fix SPI and I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit cf680cc5251487b9a39919c3cda31a108af19cf8 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/dove-cubox.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-dove-db.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@14600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/orion5x-kuroboxpro.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lschl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lsgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lswtgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Cc: Gregory Clement <gregory.clement@bootlin.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dove-cubox.dts | 2 +-
+ arch/arm/boot/dts/dove.dtsi | 6 +++---
+ arch/arm/boot/dts/orion5x-linkstation.dtsi | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dove-cubox.dts b/arch/arm/boot/dts/dove-cubox.dts
+index af3cb633135fc..ee32315e3d3af 100644
+--- a/arch/arm/boot/dts/dove-cubox.dts
++++ b/arch/arm/boot/dts/dove-cubox.dts
+@@ -86,7 +86,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- si5351: clock-generator {
++ si5351: clock-generator@60 {
+ compatible = "silabs,si5351a-msop";
+ reg = <0x60>;
+ #address-cells = <1>;
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index 698d58cea20d2..11342aeccb73a 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -152,7 +152,7 @@
+ 0xffffe000 MBUS_ID(0x03, 0x01) 0 0x0000800 /* CESA SRAM 2k */
+ 0xfffff000 MBUS_ID(0x0d, 0x00) 0 0x0000800>; /* PMU SRAM 2k */
+
+- spi0: spi-ctrl@10600 {
++ spi0: spi@10600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -165,7 +165,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c-ctrl@11000 {
++ i2c: i2c@11000 {
+ compatible = "marvell,mv64xxx-i2c";
+ reg = <0x11000 0x20>;
+ #address-cells = <1>;
+@@ -215,7 +215,7 @@
+ status = "disabled";
+ };
+
+- spi1: spi-ctrl@14600 {
++ spi1: spi@14600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/orion5x-linkstation.dtsi b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+index ed456ab35fd84..c1bc8376d4eb0 100644
+--- a/arch/arm/boot/dts/orion5x-linkstation.dtsi
++++ b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+@@ -156,7 +156,7 @@
+ &i2c {
+ status = "okay";
+
+- rtc {
++ rtc@32 {
+ compatible = "ricoh,rs5c372a";
+ reg = <0x32>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 23d05dc563344f2723543baf5bad63638ef97713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:10 +0200
+Subject: ARM: dts: omap3-gta04: fix touchscreen tsc2007
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 7384a24248eda140a234d356b6c840701ee9f055 ]
+
+we fix penirq polarity, add penirq pinmux and touchscreen
+properties.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index e86f42086a29b..6e809b0ff5c9f 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -274,6 +274,13 @@
+ OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */
+ >;
+ };
++
++ penirq_pins: pinmux_penirq_pins {
++ pinctrl-single,pins = <
++ /* here we could enable to wakeup the cpu from suspend by a pen touch */
++ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
+@@ -411,10 +418,19 @@
+ tsc2007@48 {
+ compatible = "ti,tsc2007";
+ reg = <0x48>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&penirq_pins>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <0 IRQ_TYPE_EDGE_FALLING>; /* GPIO_160 */
+- gpios = <&gpio6 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* GPIO_160 */
+ ti,x-plate-ohms = <600>;
++ touchscreen-size-x = <480>;
++ touchscreen-size-y = <640>;
++ touchscreen-max-pressure = <1000>;
++ touchscreen-fuzz-x = <3>;
++ touchscreen-fuzz-y = <8>;
++ touchscreen-fuzz-pressure = <10>;
++ touchscreen-inverted-y;
+ };
+
+ /* RFID EEPROM */
+--
+2.20.1
+
--- /dev/null
+From 07a194ca3e042f812fe03feee363053a324cbb8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:07 +0200
+Subject: ARM: dts: omap3-gta04: fixes for tvout / venc
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit f6591391373dbff2c0200e1055d4ff86191578d2 ]
+
+* fix connector compatibility (composite)
+* add comment for gpio1 23
+* add proper #address-cells
+* we use only one venc_out channel for composite
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 95c6ac44e307f..67b50dbe28189 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -122,7 +122,7 @@
+ };
+
+ tv0: connector {
+- compatible = "svideo-connector";
++ compatible = "composite-video-connector";
+ label = "tv";
+
+ port {
+@@ -134,7 +134,7 @@
+
+ tv_amp: opa362 {
+ compatible = "ti,opa362";
+- enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
++ enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; /* GPIO_23 to enable video out amplifier */
+
+ ports {
+ #address-cells = <1>;
+@@ -539,10 +539,14 @@
+
+ vdda-supply = <&vdac>;
+
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port {
++ reg = <0>;
+ venc_out: endpoint {
+ remote-endpoint = <&opa_in>;
+- ti,channels = <2>;
++ ti,channels = <1>;
+ ti,invert-polarity;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From f5ff50a65092315d2671c4d2c9a34313d6d51148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:06 +0200
+Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can
+ overwrite in other DTS files
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ]
+
+needed for device variants based on GTA04 board but with
+different display panel (driver).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index b3a8b1f24499a..95c6ac44e307f 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -70,7 +70,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- spi_lcd {
++ spi_lcd: spi_lcd {
+ compatible = "spi-gpio";
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 48b795e7224a16bbb2f0bf5516d0b6ad2140350f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:14 +0200
+Subject: ARM: dts: omap3-gta04: keep vpll2 always on
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ]
+
+This is needed to make the display and venc work properly.
+Compare to omap3-beagle.dts.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 6b8e013e49bb9..7191506934494 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -536,6 +536,12 @@
+ regulator-max-microvolt = <3150000>;
+ };
+
++/* Needed to power the DPI pins */
++
++&vpll2 {
++ regulator-always-on;
++};
++
+ &dss {
+ pinctrl-names = "default";
+ pinctrl-0 = < &dss_dpi_pins >;
+--
+2.20.1
+
--- /dev/null
+From 50254e80b7850564ac5c7d2ae443af31a9ae0ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:12 +0200
+Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent
+ U-Boot
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ]
+
+Vendor defined U-Boot has changed the partition scheme a while ago:
+
+* kernel partition 6MB
+* file system partition uses the remainder up to end of the NAND
+* increased size of the environment partition (to get an OneNAND compatible base address)
+* shrink the U-Boot partition
+
+Let's be compatible (e.g. Debian kernel built from upstream).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 6e809b0ff5c9f..6b8e013e49bb9 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -607,22 +607,22 @@
+
+ bootloaders@80000 {
+ label = "U-Boot";
+- reg = <0x80000 0x1e0000>;
++ reg = <0x80000 0x1c0000>;
+ };
+
+- bootloaders_env@260000 {
++ bootloaders_env@240000 {
+ label = "U-Boot Env";
+- reg = <0x260000 0x20000>;
++ reg = <0x240000 0x40000>;
+ };
+
+ kernel@280000 {
+ label = "Kernel";
+- reg = <0x280000 0x400000>;
++ reg = <0x280000 0x600000>;
+ };
+
+- filesystem@680000 {
++ filesystem@880000 {
+ label = "File System";
+- reg = <0x680000 0xf980000>;
++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 4c810614b7e2c3cd8b2c1c10374fcdedb8020864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:09 +0200
+Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ]
+
+The omap dss susbystem takes the display aliases to find
+out which displays exist. To enable tv-out we must define
+an alias.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 67b50dbe28189..e86f42086a29b 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -28,6 +28,7 @@
+
+ aliases {
+ display0 = &lcd;
++ display1 = &tv0;
+ };
+
+ gpio-keys {
+--
+2.20.1
+
--- /dev/null
+From 3afd5837462b81c737ad327e8de8ee359896638d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 10:45:40 +0200
+Subject: ARM: dts: paz00: fix wakeup gpio keycode
+
+From: Marc Dietrich <marvin24@gmx.de>
+
+[ Upstream commit ebea2a43fdafdbce918bd7e200b709d6c33b9f3b ]
+
+The power key is controlled solely by the EC, which only tiggeres this
+gpio after wakeup.
+Fixes immediately return to suspend after wake from LP1.
+
+Signed-off-by: Marc Dietrich <marvin24@gmx.de>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-paz00.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
+index b4bfa5586c233..23d4c837b87a6 100644
+--- a/arch/arm/boot/dts/tegra20-paz00.dts
++++ b/arch/arm/boot/dts/tegra20-paz00.dts
+@@ -521,10 +521,10 @@
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- power {
+- label = "Power";
++ wakeup {
++ label = "Wakeup";
+ gpios = <&gpio TEGRA_GPIO(J, 7) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_POWER>;
++ linux,code = <KEY_WAKEUP>;
+ wakeup-source;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 49f3a87162fe27e79be0375d587c42b0f7203754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:03:09 +0200
+Subject: ARM: dts: pxa: fix power i2c base address
+
+From: Marcel Ziswiler <marcel@ziswiler.com>
+
+[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ]
+
+There is one too many zeroes in the Power I2C base address. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 9e73dc6b3ed3e..0e1320afa1562 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -70,7 +70,7 @@
+ clocks = <&clks CLK_PWM1>;
+ };
+
+- pwri2c: i2c@40f000180 {
++ pwri2c: i2c@40f00180 {
+ compatible = "mrvl,pxa-i2c";
+ reg = <0x40f00180 0x24>;
+ interrupts = <6>;
+--
+2.20.1
+
--- /dev/null
+From ae08fe4594dec0319c7e5b29082f73d2af9102b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jul 2018 10:37:47 +0200
+Subject: ARM: dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit bd73a3dd257fb838bd456a18eeee0ef0224b7a40 ]
+
+while compiling an ipq4019 target, dtc will complain:
+regulator@b089000 unit address format error, expected "2089000"
+
+The saw0 regulator reg value seems to be
+copied and pasted from qcom-ipq8064.dtsi.
+
+This patch fixes the reg value to match that of the
+unit address which in turn silences the warning.
+(There is no driver for qcom,saw2 right now.
+So this went unnoticed)
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 4b7d97275c621..5ee84e3cb3e97 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -211,7 +211,7 @@
+
+ saw0: regulator@b089000 {
+ compatible = "qcom,saw2";
+- reg = <0x02089000 0x1000>, <0x0b009000 0x1000>;
++ reg = <0x0b089000 0x1000>, <0x0b009000 0x1000>;
+ regulator;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 83cf9b28fb00675da3df23d7a13f8117447e36f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:26 -0500
+Subject: ARM: dts: realview: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 016add12977bcc30f77d7e48fc9a3a024cb46645 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-eb.dtsi | 2 +-
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pb11mp.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pbx.dtsi | 2 +-
+ arch/arm/boot/dts/versatile-ab.dts | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
+index e2e9599596e25..05379b6c1c13b 100644
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -334,7 +334,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index c789564f28033..c1fd5615ddfe3 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -343,7 +343,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- pb1176_ssp: ssp@1010b000 {
++ pb1176_ssp: spi@1010b000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1010b000 0x1000>;
+ interrupt-parent = <&intc_dc1176>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 3944765ac4b06..e306f1cceb4ec 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -480,7 +480,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp@1000d000 {
++ spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ interrupt-parent = <&intc_pb11mp>;
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index aeb49c4bd773f..2bf3958b2e6b9 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -318,7 +318,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
+index 409e069b3a845..00d7d28e86f0b 100644
+--- a/arch/arm/boot/dts/versatile-ab.dts
++++ b/arch/arm/boot/dts/versatile-ab.dts
+@@ -303,7 +303,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- ssp@101f4000 {
++ spi@101f4000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x101f4000 0x1000>;
+ interrupts = <11>;
+--
+2.20.1
+
--- /dev/null
+From 46329b28a80bc3074a66343f87f8240138ade710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:36 -0500
+Subject: ARM: dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 131c3eb428ccd5f0c784b9edb4f72ec296a045d2 ]
+
+dtc has new checks for SPI buses. The rk3036 dts file has a node named
+spi' which causes false positive warnings. As the node is a pinctrl child
+node, change the node name to be 'spi-pins' to fix the warnings.
+
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: linux-rockchip@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index a935523a1eb85..147c73f68f1d9 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -744,7 +744,7 @@
+ /* no rts / cts for uart2 */
+ };
+
+- spi {
++ spi-pins {
+ spi_txd:spi-txd {
+ rockchip,pins = <1 29 RK_FUNC_3 &pcfg_pull_default>;
+ };
+--
+2.20.1
+
--- /dev/null
+From f9aab5c0aaaae6a807abb8455dcfb991985587b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 23:52:49 -0500
+Subject: ARM: dts: socfpga: Fix I2C bus unit-address error
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53"
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+index afea3645ada43..89d55894d9162 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+@@ -88,7 +88,7 @@
+ status = "okay";
+ speed-mode = <0>;
+
+- adxl345: adxl345@0 {
++ adxl345: adxl345@53 {
+ compatible = "adi,adxl345";
+ reg = <0x53>;
+
+--
+2.20.1
+
--- /dev/null
+From e7c4e0dd3911a2ceefba6be52b78ae705df0c2c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:34 -0500
+Subject: ARM: dts: ste: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++--
+ arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +-
+ arch/arm/boot/dts/ste-snowball.dts | 2 +-
+ arch/arm/boot/dts/ste-u300.dts | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 45869c3234358..5f1769209526a 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -864,7 +864,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80002000 0x1000>;
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+@@ -878,7 +878,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80003000 {
++ spi@80003000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80003000 0x1000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+index ece222d51717c..cf8d03bc42c15 100644
+--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+@@ -57,7 +57,7 @@
+ };
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ /*
+ * On the first generation boards, this SSP/SPI port was connected
+ * to the AB8500.
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index 386eee6de2320..272d36c3d223b 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -386,7 +386,7 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ssp0_snowball_mode>;
+ };
+diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts
+index 2f5107ffeef04..ea6768b96a9df 100644
+--- a/arch/arm/boot/dts/ste-u300.dts
++++ b/arch/arm/boot/dts/ste-u300.dts
+@@ -441,7 +441,7 @@
+ dma-names = "rx";
+ };
+
+- spi: ssp@c0006000 {
++ spi: spi@c0006000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0xc0006000 0x1000>;
+ interrupt-parent = <&vica>;
+--
+2.20.1
+
--- /dev/null
+From 577b5466c771a045d93a5172d12edb5a18bf70e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:42:33 +0200
+Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ]
+
+There was a dot instead of a comma. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
+index 5030065cbdfe3..ad30d2a51af15 100644
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -823,7 +823,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <1>;
+ nvidia,xcvr-lsrslew = <1>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -860,7 +860,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -896,7 +896,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+--
+2.20.1
+
--- /dev/null
+From 18ccf467df3e4ab9a722bdd2bd1fa901960fb5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jun 2018 09:50:09 +0200
+Subject: ARM: dts: ux500: Correct SCU unit address
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ]
+
+The unit address of the Cortex-A9 SCU device node contains one zero too
+many. Remove it.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index d309314f3a364..45869c3234358 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -188,7 +188,7 @@
+ <0xa0410100 0x100>;
+ };
+
+- scu@a04100000 {
++ scu@a0410000 {
+ compatible = "arm,cortex-a9-scu";
+ reg = <0xa0410000 0x100>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 3d191d51991862a69f73d563bb37dd35c1430e2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jul 2018 10:30:03 +0200
+Subject: ARM: dts: ux500: Fix LCDA clock line muxing
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ]
+
+The "lcdaclk_b_1" group is muxed with the function "lcd"
+but needs a separate entry to be muxed in with "lcda"
+rather than "lcd".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+index 5c5cea232743d..1ec193b0c5065 100644
+--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+@@ -607,16 +607,20 @@
+
+ mcde {
+ lcd_default_mode: lcd_default {
+- default_mux {
++ default_mux1 {
+ /* Mux in VSI0 and all the data lines */
+ function = "lcd";
+ groups =
+ "lcdvsi0_a_1", /* VSI0 for LCD */
+ "lcd_d0_d7_a_1", /* Data lines */
+ "lcd_d8_d11_a_1", /* TV-out */
+- "lcdaclk_b_1", /* Clock line for TV-out */
+ "lcdvsi1_a_1"; /* VSI1 for HDMI */
+ };
++ default_mux2 {
++ function = "lcda";
++ groups =
++ "lcdaclk_b_1"; /* Clock line for TV-out */
++ };
+ default_cfg1 {
+ pins =
+ "GPIO68_E1", /* VSI0 */
+--
+2.20.1
+
--- /dev/null
+From 7c696d5453382dc0db1482db55b16e98972a2475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 12:34:21 +0200
+Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff"
+ is set
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ]
+
+One of the Freescale recommended sequences for power off with external
+PMIC is the following:
+...
+3. SoC is programming PMIC for power off when standby is asserted.
+4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies.
+
+See:
+http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf
+page 5083
+
+This patch implements step 4. of this sequence.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 1515e498d348c..dd9eb3f14f45c 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -602,6 +602,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+ IMX6Q_GPR1_GINT);
+ }
+
++static void imx6_pm_stby_poweroff(void)
++{
++ imx6_set_lpm(STOP_POWER_OFF);
++ imx6q_suspend_finish(0);
++
++ mdelay(1000);
++
++ pr_emerg("Unable to poweroff system\n");
++}
++
++static int imx6_pm_stby_poweroff_probe(void)
++{
++ if (pm_power_off) {
++ pr_warn("%s: pm_power_off already claimed %p %pf!\n",
++ __func__, pm_power_off, pm_power_off);
++ return -EBUSY;
++ }
++
++ pm_power_off = imx6_pm_stby_poweroff;
++ return 0;
++}
++
+ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ {
+ struct device_node *np;
+@@ -618,6 +640,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ val = readl_relaxed(ccm_base + CLPCR);
+ val &= ~BM_CLPCR_LPM;
+ writel_relaxed(val, ccm_base + CLPCR);
++
++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff"))
++ imx6_pm_stby_poweroff_probe();
+ }
+
+ void __init imx6q_pm_init(void)
+--
+2.20.1
+
--- /dev/null
+From df01d438be33f06540a8667840b682d645d48201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 18:37:43 +0200
+Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ]
+
+Fix MMC1 cmd pin pull-up causing issues on carrier boards without
+external pull-up.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index 192b95177aac3..826bdd0b8a257 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -147,14 +147,14 @@
+
+ /* Apalis MMC1 */
+ sdmmc3_clk_pa6 {
+- nvidia,pins = "sdmmc3_clk_pa6",
+- "sdmmc3_cmd_pa7";
++ nvidia,pins = "sdmmc3_clk_pa6";
+ nvidia,function = "sdmmc3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+ sdmmc3_dat0_pb7 {
+- nvidia,pins = "sdmmc3_dat0_pb7",
++ nvidia,pins = "sdmmc3_cmd_pa7",
++ "sdmmc3_dat0_pb7",
+ "sdmmc3_dat1_pb6",
+ "sdmmc3_dat2_pb5",
+ "sdmmc3_dat3_pb4",
+--
+2.20.1
+
--- /dev/null
+From b5cee8062323eab16591cd746c92c8a0388ba8ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:40 -0500
+Subject: arm64: dts: amd: Fix SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ]
+
+dtc has new checks for SPI buses. Fix the warnings in node names.
+
+arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+
+Cc: Brijesh Singh <brijeshkumar.singh@amd.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+index bd3adeac374f4..2973a14523eaf 100644
+--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+@@ -106,7 +106,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- spi0: ssp@e1020000 {
++ spi0: spi@e1020000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1020000 0 0x1000>;
+@@ -116,7 +116,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- spi1: ssp@e1030000 {
++ spi1: spi@e1030000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1030000 0 0x1000>;
+--
+2.20.1
+
--- /dev/null
+From c6c8942ff9a11933c65ab6a8d6b26be387789382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:44 -0500
+Subject: arm64: dts: lg: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 09bae3b64cb580c95329bd8d16f08f0a5cb81ec9 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/lg/lg1312.dtsi | 4 ++--
+ arch/arm64/boot/dts/lg/lg1313.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi
+index fbafa24cd5335..5e0c5dc973e33 100644
+--- a/arch/arm64/boot/dts/lg/lg1312.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi
+@@ -167,14 +167,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi
+index e703e1149c757..f3b1ba6f74220 100644
+--- a/arch/arm64/boot/dts/lg/lg1313.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi
+@@ -167,14 +167,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 57bbbb30d483df9446998679fea3c0a048e650ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 21:08:35 +0300
+Subject: arm64: dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply
+
+From: Aapo Vienamo <avienamo@nvidia.com>
+
+[ Upstream commit 6ff7705da8806de45ca1490194f0b4eb07725804 ]
+
+On p2180 sdmmc4 is powered from a fixed 1.8 V regulator.
+
+Signed-off-by: Aapo Vienamo <avienamo@nvidia.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 6a51d282ec636..d1e687b4911f5 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -281,6 +281,7 @@
+ status = "okay";
+ bus-width = <8>;
+ non-removable;
++ vqmmc-supply = <&vdd_1v8>;
+ };
+
+ clocks {
+--
+2.20.1
+
--- /dev/null
+From a83c75b2733a25728f33def48089c890c8bcdafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 14:26:47 +0100
+Subject: ASoC: dpcm: Properly initialise hw->rate_max
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ]
+
+If the CPU DAI does not initialise rate_max, say if using
+using KNOT or CONTINUOUS, then the rate_max field will be
+initialised to 0. A value of zero in the rate_max field of
+the hardware runtime will cause the sound card to support no
+sample rates at all. Obviously this is not desired, just a
+different mechanism is being used to apply the constraints. As
+such update the setting of rate_max in dpcm_init_runtime_hw
+to be consistent with the non-DPCM cases and set rate_max to
+UINT_MAX if nothing is defined on the CPU DAI.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 1d00f6e894ef4..d69559e458725 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1592,7 +1592,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
+ u64 formats)
+ {
+ runtime->hw.rate_min = stream->rate_min;
+- runtime->hw.rate_max = stream->rate_max;
++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX);
+ runtime->hw.channels_min = stream->channels_min;
+ runtime->hw.channels_max = stream->channels_max;
+ if (runtime->hw.formats)
+--
+2.20.1
+
--- /dev/null
+From 1c6063031197df61d60a7c00e259fd71d31cafba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 12:19:16 -0500
+Subject: ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation
+
+From: Yong Zhi <yong.zhi@intel.com>
+
+[ Upstream commit 3b857472f34faa7d11001afa5e158833812c98d7 ]
+
+Playback of 44.1Khz contents with HDMI plugged returns
+"Invalid pipe config" because HDMI paths in the FW
+topology are configured to operate at 48Khz.
+
+This patch filters out sampling rates not supported
+at hdac_hdmi_create_dais() to let user space SRC
+to do the converting.
+
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hdmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index c602c4960924c..88355d1719a30 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1267,6 +1267,12 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdac,
+ if (ret)
+ return ret;
+
++ /* Filter out 44.1, 88.2 and 176.4Khz */
++ rates &= ~(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_88200 |
++ SNDRV_PCM_RATE_176400);
++ if (!rates)
++ return -EINVAL;
++
+ sprintf(dai_name, "intel-hdmi-hifi%d", i+1);
+ hdmi_dais[i].name = devm_kstrdup(&hdac->dev,
+ dai_name, GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 8a2e6fd95336d466d9304ba0674c7f2121236c37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 11:41:52 +0100
+Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ]
+
+In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag
+is set to zero and later vol_quot is computed by dividing by
+lo_vag causing a division by zero error. Fix this by avoiding
+a zero division and set vol_quot to zero in this specific case
+so that the lowest setting for i is correctly set.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 7406ea5c9a4f7..39810b713d5f2 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1217,7 +1217,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ * Searching for a suitable index solving this formula:
+ * idx = 40 * log10(vag_val / lo_cagcntrl) + 15
+ */
+- vol_quot = (vag * 100) / lo_vag;
++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0;
+ lo_vol = 0;
+ for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) {
+ if (vol_quot >= vol_quot_table[i])
+--
+2.20.1
+
--- /dev/null
+From 3720a43d0d314c1b5d3fb23d3805ec72f7f016e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 12:39:01 +0300
+Subject: ath10k: fix kernel panic by moving pci flush after napi_disable
+
+From: Tamizh chelvam <tamizhr@codeaurora.org>
+
+[ Upstream commit bd1d395070cca4f42a93e520b0597274789274a4 ]
+
+When continuously running wifi up/down sequence, the napi poll
+can be scheduled after the CE buffers being freed by ath10k_pci_flush
+
+Steps:
+ In a certain condition, during wifi down below scenario might occur.
+
+ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize).
+
+In the above scenario, CE buffer entries will be freed up and become NULL in
+ath10k_pci_flush. And the napi_poll has been invoked after the flush process
+and it will try to get the skb from the CE buffer entry and perform some action on that.
+Since the CE buffer already cleaned by pci flush this action will create NULL
+pointer dereference and trigger below kernel panic.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000005c
+PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci]
+ath10k_pci_htt_rx_cb [ath10k_pci]
+ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci]
+ath10k_ce_per_engine_service [ath10k_pci]
+ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci]
+ath10k_ce_per_engine_service_any [ath10k_pci]
+ath10k_pci_napi_poll+0x48/0xec [ath10k_pci]
+ath10k_pci_napi_poll [ath10k_pci]
+net_rx_action+0xac/0x160
+net_rx_action
+__do_softirq+0xdc/0x208
+__do_softirq
+irq_exit+0x84/0xe0
+irq_exit
+__handle_domain_irq+0x80/0xa0
+__handle_domain_irq
+gic_handle_irq+0x38/0x5c
+gic_handle_irq
+__irq_usr+0x44/0x60
+
+Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010
+
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/ahb.c | 4 ++--
+ drivers/net/wireless/ath/ath10k/pci.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
+index da770af830369..125b5c31b2b0a 100644
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -658,10 +658,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar)
+ ath10k_ahb_irq_disable(ar);
+ synchronize_irq(ar_ahb->irq);
+
+- ath10k_pci_flush(ar);
+-
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++
++ ath10k_pci_flush(ar);
+ }
+
+ static int ath10k_ahb_hif_power_up(struct ath10k *ar)
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 25b8d501d437e..b7bac14d1487b 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1781,9 +1781,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_pci_irq_disable(ar);
+ ath10k_pci_irq_sync(ar);
+- ath10k_pci_flush(ar);
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+ WARN_ON(ar_pci->ps_wake_refcount > 0);
+--
+2.20.1
+
--- /dev/null
+From 941f77ed2569a56ea6c126e9c99475c8067c65ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 15:07:07 +0300
+Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx
+
+From: Erik Stromdahl <erik.stromdahl@gmail.com>
+
+[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ]
+
+This is done in order not to trig the below warning in
+ieee80211_rx_napi:
+
+WARN_ON_ONCE(softirq_count() == 0);
+
+ieee80211_rx_napi requires that softirq's are disabled during
+execution.
+
+The High latency bus drivers (SDIO and USB) sometimes call the wmi
+ep_rx_complete callback from non softirq context, resulting in a trigger
+of the above warning.
+
+Calling ieee80211_rx_ni with softirq's already disabled (e.g., from
+softirq context) should be safe as the local_bh_disable and
+local_bh_enable functions (called from ieee80211_rx_ni) are fully
+reentrant.
+
+Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index bbfe7be214e12..c208fed048554 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2384,7 +2384,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+ status->freq, status->band, status->signal,
+ status->rate_idx);
+
+- ieee80211_rx(ar->hw, skb);
++ ieee80211_rx_ni(ar->hw, skb);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 679b0d8322e6ca8395f05c0bf0c04c001e9f05d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 18:49:05 +0200
+Subject: ath9k: add back support for using active monitor interfaces for tx99
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 6df0580be8bc30803c4d8b2ed9c2230a2740c795 ]
+
+Various documented examples on how to set up tx99 with ath9k rely
+on setting up a regular monitor interface for setting the channel.
+My previous patch "ath9k: fix tx99 with monitor mode interface" made
+it possible to set it up this way again. However, it was removing support
+for using an active monitor interface, which is required for controlling
+the bitrate as well, since the bitrate is not passed down with a regular
+monitor interface.
+
+This patch partially reverts the previous one, but keeps support for using
+a regular monitor interface to keep documented steps working in cases
+where the bitrate does not matter
+
+Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 10 ++++++++--
+ drivers/net/wireless/ath/ath9k/tx99.c | 7 +++++++
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 51e878a9d5211..7bda18c61eb6e 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1033,6 +1033,7 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
++ struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index fbc34beee1580..f6151a00041d6 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1249,8 +1249,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99))
+- return -EOPNOTSUPP;
++ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
++ if (sc->cur_chan->nvifs >= 1) {
++ mutex_unlock(&sc->mutex);
++ return -EOPNOTSUPP;
++ }
++ sc->tx99_vif = vif;
++ }
+
+ mutex_lock(&sc->mutex);
+
+@@ -1335,6 +1340,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
++ sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index 0cb5b2a873be8..096902e0fdf5c 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
++ struct ath_vif *avp;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
++ if (sc->tx99_vif) {
++ avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++ hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++ }
++
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
++ tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 2c35819f65426..0ef27d99bef33 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2970,7 +2970,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(NULL, NULL, bf);
++ ath_set_rates(sc->tx99_vif, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From b2cf42593b46e5c77ee78d84f739ac7267f7b7d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 23:08:43 +0300
+Subject: ath9k: Fix a locking bug in ath9k_add_interface()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 461cf036057477805a8a391e5fd0f5264a5e56a8 ]
+
+We tried to revert commit d9c52fd17cb4 ("ath9k: fix tx99 with monitor
+mode interface") but accidentally missed part of the locking change.
+
+The lock has to be held earlier so that we're holding it when we do
+"sc->tx99_vif = vif;" and also there in the current code there is a
+stray unlock before we have taken the lock.
+
+Fixes: 6df0580be8bc ("ath9k: add back support for using active monitor interfaces for tx99")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index f6151a00041d6..abc997427bae5 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1249,6 +1249,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
++ mutex_lock(&sc->mutex);
+ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+ if (sc->cur_chan->nvifs >= 1) {
+ mutex_unlock(&sc->mutex);
+@@ -1257,8 +1258,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ sc->tx99_vif = vif;
+ }
+
+- mutex_lock(&sc->mutex);
+-
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+
+--
+2.20.1
+
--- /dev/null
+From 2b502d1d22c3940bc686180c57af8420c34dd2f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:37:51 +0200
+Subject: ath9k: fix tx99 with monitor mode interface
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit d9c52fd17cb483bd8a470398afcb79f86c1b77c8 ]
+
+Tx99 is typically configured via a monitor mode interface, which does
+not get added to the driver as a vif. Since the code currently expects
+a configured virtual interface for tx99, enabling tx99 via debugfs fails.
+Since the vif is not needed anyway, remove all checks for it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+[kvalo@codeaurora.org: s/CPTCFG/CONFIG/]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 -
+ drivers/net/wireless/ath/ath9k/main.c | 12 +++---------
+ drivers/net/wireless/ath/ath9k/tx99.c | 9 ---------
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 4 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 7bda18c61eb6e..51e878a9d5211 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1033,7 +1033,6 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
+- struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index b868f02ced893..fbc34beee1580 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1249,15 +1249,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- mutex_lock(&sc->mutex);
++ if (IS_ENABLED(CONFIG_ATH9K_TX99))
++ return -EOPNOTSUPP;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+- if (sc->cur_chan->nvifs >= 1) {
+- mutex_unlock(&sc->mutex);
+- return -EOPNOTSUPP;
+- }
+- sc->tx99_vif = vif;
+- }
++ mutex_lock(&sc->mutex);
+
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+@@ -1340,7 +1335,6 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
+- sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index 8e9480cc33e15..0cb5b2a873be8 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,12 +54,6 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
+- struct ath_vif *avp;
+-
+- if (!sc->tx99_vif)
+- return NULL;
+-
+- avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -77,14 +71,11 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+- hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
+-
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
+- tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 0ef27d99bef33..2c35819f65426 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2970,7 +2970,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(sc->tx99_vif, NULL, bf);
++ ath_set_rates(NULL, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From ac6a65bf87fc0e8b78ce852a2c6863f700c5c327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 13:39:22 +0300
+Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ]
+
+If the remote is not able to fully utilize the MPS choosen recalculate
+the credits based on the actual amount it is sending that way it can
+still send packets of MTU size without credits dropping to 0.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 48d23abfe7992..1306962a792af 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6811,6 +6811,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ chan->sdu_len = sdu_len;
+ chan->sdu_last_frag = skb;
+
++ /* Detect if remote is not able to use the selected MPS */
++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
++
++ /* Adjust the number of credits */
++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
++ chan->mps = mps_len;
++ l2cap_chan_le_send_credits(chan);
++ }
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f629320f003f468187410588ca2afc6b52e1a22a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:22:51 -0700
+Subject: bnx2x: Ignore bandwidth attention in single function mode
+
+From: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+
+[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ]
+
+This is a workaround for FW bug -
+MFW generates bandwidth attention in single function mode, which
+is only expected to be generated in multi function mode.
+This undesired attention in SF mode results in incorrect HW
+configuration and resulting into Tx timeout.
+
+Signed-off-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index a9681b191304a..ce8a777b1e975 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3540,6 +3540,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp)
+ */
+ static void bnx2x_config_mf_bw(struct bnx2x *bp)
+ {
++ /* Workaround for MFW bug.
++ * MFW is not supposed to generate BW attention in
++ * single function mode.
++ */
++ if (!IS_MF(bp)) {
++ DP(BNX2X_MSG_MCP,
++ "Ignoring MF BW config in single function mode\n");
++ return;
++ }
++
+ if (bp->link_vars.link_up) {
+ bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+ bnx2x_link_sync_notify(bp);
+--
+2.20.1
+
--- /dev/null
+From ac5f05b7480bf14067322499d4b8efeb1d83f0ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jul 2018 18:46:13 +0530
+Subject: cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set
+
+From: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+
+[ Upstream commit 7417844b63d4b0dc8ab23f88259bf95de7d09b57 ]
+
+When REGULATORY_COUNTRY_IE_IGNORE is set, __reg_process_hint_country_ie()
+ignores the country code change request from __cfg80211_connect_result()
+via regulatory_hint_country_ie().
+
+After Disconnect, similar to above, country code should not be reset to
+world when country IE ignore is set. But this is violated and restore of
+regulatory settings is invoked by cfg80211_disconnect_work via
+regulatory_hint_disconnect().
+
+To address this, avoid regulatory restore from regulatory_hint_disconnect()
+when COUNTRY_IE_IGNORE is set.
+
+Note: Currently, restore_regulatory_settings() takes care of clearing
+beacon hints. But in the proposed change, regulatory restore is avoided.
+Therefore, explicitly clear beacon hints when DISABLE_BEACON_HINTS
+is not set.
+
+Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 44befe9f9ff08..dde741f298de7 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2616,8 +2616,54 @@ static void restore_regulatory_settings(bool reset_user)
+ schedule_work(®_work);
+ }
+
++static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
++{
++ struct cfg80211_registered_device *rdev;
++ struct wireless_dev *wdev;
++
++ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ wdev_lock(wdev);
++ if (!(wdev->wiphy->regulatory_flags & flag)) {
++ wdev_unlock(wdev);
++ return false;
++ }
++ wdev_unlock(wdev);
++ }
++ }
++
++ return true;
++}
++
+ void regulatory_hint_disconnect(void)
+ {
++ /* Restore of regulatory settings is not required when wiphy(s)
++ * ignore IE from connected access point but clearance of beacon hints
++ * is required when wiphy(s) supports beacon hints.
++ */
++ if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
++ struct reg_beacon *reg_beacon, *btmp;
++
++ if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
++ return;
++
++ spin_lock_bh(®_pending_beacons_lock);
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_pending_beacons, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++ spin_unlock_bh(®_pending_beacons_lock);
++
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_beacon_list, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++
++ return;
++ }
++
+ pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+ restore_regulatory_settings(false);
+ }
+--
+2.20.1
+
--- /dev/null
+From fa520477520422d97190491b946032cd1661dde1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 21:15:39 -0700
+Subject: component: fix loop condition to call unbind() if bind() fails
+
+From: Banajit Goswami <bgoswami@codeaurora.org>
+
+[ Upstream commit bdae566d5d9733b6e32b378668b84eadf28a94d4 ]
+
+During component_bind_all(), if bind() fails for any
+particular component associated with a master, unbind()
+should be called for all previous components in that
+master's match array, whose bind() might have completed
+successfully. As per the current logic, if bind() fails
+for the component at position 'n' in the master's match
+array, it would start calling unbind() from component in
+'n'th position itself and work backwards, and will always
+skip calling unbind() for component in 0th position in the
+master's match array.
+Fix this by updating the loop condition, and the logic to
+refer to the components in master's match array, so that
+unbind() is called for all components starting from 'n-1'st
+position in the array, until (and including) component in
+0th position.
+
+Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/component.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 89b032f2ffd22..08da6160e94dd 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -461,9 +461,9 @@ int component_bind_all(struct device *master_dev, void *data)
+ }
+
+ if (ret != 0) {
+- for (; i--; )
+- if (!master->match->compare[i].duplicate) {
+- c = master->match->compare[i].component;
++ for (; i > 0; i--)
++ if (!master->match->compare[i - 1].duplicate) {
++ c = master->match->compare[i - 1].component;
+ component_unbind(c, master, data);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 62ced2335527de07d900c4adf01e346c443ed372 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:00 -0600
+Subject: coresight: etm4x: Configure EL2 exception level when kernel is
+ running in HYP
+
+From: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+
+[ Upstream commit b860801e3237ec4c74cf8de0be4816996757ae5c ]
+
+For non-VHE systems host kernel runs at EL1 and jumps to EL2 whenever
+hypervisor code should be executed. In this case ETM4x driver must
+restrict configuration to EL1 when it setups kernel tracing.
+However, there is no separate hypervisor privilege level when VHE
+is enabled, the host kernel runs at EL2.
+
+This patch fixes configuration of TRCACATRn register for VHE systems
+so that ETM_EXLEVEL_NS_HYP bit is used instead of ETM_EXLEVEL_NS_OS
+to on/off kernel tracing. At the same time, it moves common code
+to new helper.
+
+Signed-off-by: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.c | 40 +++++++++----------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 44d6c29e26448..22079f886f452 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -35,6 +35,7 @@
+ #include <linux/pm_runtime.h>
+ #include <asm/sections.h>
+ #include <asm/local.h>
++#include <asm/virt.h>
+
+ #include "coresight-etm4x.h"
+ #include "coresight-etm-perf.h"
+@@ -615,7 +616,7 @@ static void etm4_set_default_config(struct etmv4_config *config)
+ config->vinst_ctrl |= BIT(0);
+ }
+
+-static u64 etm4_get_access_type(struct etmv4_config *config)
++static u64 etm4_get_ns_access_type(struct etmv4_config *config)
+ {
+ u64 access_type = 0;
+
+@@ -626,17 +627,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config)
+ * Bit[13] Exception level 1 - OS
+ * Bit[14] Exception level 2 - Hypervisor
+ * Bit[15] Never implemented
+- *
+- * Always stay away from hypervisor mode.
+ */
+- access_type = ETM_EXLEVEL_NS_HYP;
+-
+- if (config->mode & ETM_MODE_EXCL_KERN)
+- access_type |= ETM_EXLEVEL_NS_OS;
++ if (!is_kernel_in_hyp_mode()) {
++ /* Stay away from hypervisor mode for non-VHE */
++ access_type = ETM_EXLEVEL_NS_HYP;
++ if (config->mode & ETM_MODE_EXCL_KERN)
++ access_type |= ETM_EXLEVEL_NS_OS;
++ } else if (config->mode & ETM_MODE_EXCL_KERN) {
++ access_type = ETM_EXLEVEL_NS_HYP;
++ }
+
+ if (config->mode & ETM_MODE_EXCL_USER)
+ access_type |= ETM_EXLEVEL_NS_APP;
+
++ return access_type;
++}
++
++static u64 etm4_get_access_type(struct etmv4_config *config)
++{
++ u64 access_type = etm4_get_ns_access_type(config);
++
+ /*
+ * EXLEVEL_S, bits[11:8], don't trace anything happening
+ * in secure state.
+@@ -890,20 +900,10 @@ void etm4_config_trace_mode(struct etmv4_config *config)
+
+ addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP];
+ /* clear default config */
+- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS);
++ addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS |
++ ETM_EXLEVEL_NS_HYP);
+
+- /*
+- * EXLEVEL_NS, bits[15:12]
+- * The Exception levels are:
+- * Bit[12] Exception level 0 - Application
+- * Bit[13] Exception level 1 - OS
+- * Bit[14] Exception level 2 - Hypervisor
+- * Bit[15] Never implemented
+- */
+- if (mode & ETM_MODE_EXCL_KERN)
+- addr_acc |= ETM_EXLEVEL_NS_OS;
+- else
+- addr_acc |= ETM_EXLEVEL_NS_APP;
++ addr_acc |= etm4_get_ns_access_type(config);
+
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc;
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc;
+--
+2.20.1
+
--- /dev/null
+From 4538d90856dd4c9f5f90d056fc23b3d7eb444c35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:45 -0600
+Subject: coresight: Fix handling of sinks
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit c71369de02b285d9da526a526d8f2affc7b17c59 ]
+
+The coresight components could be operated either in sysfs mode or in perf
+mode. For some of the components, the mode of operation doesn't matter as
+they simply relay the data to the next component in the trace path. But for
+sinks, they need to be able to provide the trace data back to the user.
+Thus we need to make sure that "mode" is handled appropriately. e.g,
+the sysfs mode could have multiple sources driving the trace data, while
+perf mode doesn't allow sharing the sink.
+
+The coresight_enable_sink() however doesn't really allow this check to
+trigger as it skips the "enable_sink" callback if the component is
+already enabled, irrespective of the mode. This could cause mixing
+of data from different modes or even same mode (in perf), if the
+sources are different. Also, if we fail to enable the sink while
+enabling a path (where sink is the first component enabled),
+we could end up in disabling the components in the "entire"
+path which were not enabled in this trial, causing disruptions
+in the existing trace paths.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 398e44a9ec45d..5ffabc388630e 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -132,12 +132,14 @@ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+ {
+ int ret;
+
+- if (!csdev->enable) {
+- if (sink_ops(csdev)->enable) {
+- ret = sink_ops(csdev)->enable(csdev, mode);
+- if (ret)
+- return ret;
+- }
++ /*
++ * We need to make sure the "new" session is compatible with the
++ * existing "mode" of operation.
++ */
++ if (sink_ops(csdev)->enable) {
++ ret = sink_ops(csdev)->enable(csdev, mode);
++ if (ret)
++ return ret;
+ csdev->enable = true;
+ }
+
+@@ -331,8 +333,14 @@ int coresight_enable_path(struct list_head *path, u32 mode)
+ switch (type) {
+ case CORESIGHT_DEV_TYPE_SINK:
+ ret = coresight_enable_sink(csdev, mode);
++ /*
++ * Sink is the first component turned on. If we
++ * failed to enable the sink, there are no components
++ * that need disabling. Disabling the path here
++ * would mean we could disrupt an existing session.
++ */
+ if (ret)
+- goto err;
++ goto out;
+ break;
+ case CORESIGHT_DEV_TYPE_SOURCE:
+ /* sources are enabled from either sysFS or Perf */
+--
+2.20.1
+
--- /dev/null
+From e7d1b12732e548dccf4ed1d1861f0433ff335966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:02 -0600
+Subject: coresight: tmc: Fix byte-address alignment for RRP
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit e7753f3937610633a540f2be81be87531f96ff04 ]
+
+>From the comment in the code, it claims the requirement for byte-address
+alignment for RRP register: 'for 32-bit, 64-bit and 128-bit wide trace
+memory, the four LSBs must be 0s. For 256-bit wide trace memory, the
+five LSBs must be 0s'. This isn't consistent with the program, the
+program sets five LSBs as zeros for 32/64/128-bit wide trace memory and
+set six LSBs zeros for 256-bit wide trace memory.
+
+After checking with the CoreSight Trace Memory Controller technical
+reference manual (ARM DDI 0461B, section 3.3.4 RAM Read Pointer
+Register), it proves the comment is right and the program does wrong
+setting.
+
+This patch fixes byte-address alignment for RRP by following correct
+definition in the technical reference manual.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index d6941ea24d8df..14df4e34c21cf 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -425,10 +425,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
+ case TMC_MEM_INTF_WIDTH_32BITS:
+ case TMC_MEM_INTF_WIDTH_64BITS:
+ case TMC_MEM_INTF_WIDTH_128BITS:
+- mask = GENMASK(31, 5);
++ mask = GENMASK(31, 4);
+ break;
+ case TMC_MEM_INTF_WIDTH_256BITS:
+- mask = GENMASK(31, 6);
++ mask = GENMASK(31, 5);
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3163536035784be9324d20f930d9e2b3174d259e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:24 -0700
+Subject: cpufeature: avoid warning when compiling with clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to warnings when building the kernel with Clang:
+ arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable
+ 'cpu_feature_match_AES' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ module_cpu_feature_match(AES, aes_init);
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h
+index 986c06c88d814..84d3c81b59781 100644
+--- a/include/linux/cpufeature.h
++++ b/include/linux/cpufeature.h
+@@ -45,7 +45,7 @@
+ * 'asm/cpufeature.h' of your favorite architecture.
+ */
+ #define module_cpu_feature_match(x, __initfunc) \
+-static struct cpu_feature const cpu_feature_match_ ## x[] = \
++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \
+ { { .feature = cpu_feature(x) }, { } }; \
+ MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \
+ \
+--
+2.20.1
+
--- /dev/null
+From c37b5a43c157cd012d047ebfe929138664730d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 20:24:32 +0300
+Subject: crypto: fix a memory leak in rsa-kcs1pad's encryption mode
+
+From: Dan Aloni <dan@kernelim.com>
+
+[ Upstream commit 3944f139d5592790b70bc64f197162e643a8512b ]
+
+The encryption mode of pkcs1pad never uses out_sg and out_buf, so
+there's no need to allocate the buffer, which presently is not even
+being freed.
+
+CC: Herbert Xu <herbert@gondor.apana.org.au>
+CC: linux-crypto@vger.kernel.org
+CC: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Dan Aloni <dan@kernelim.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/rsa-pkcs1pad.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 7830d304dff6f..d58224d808675 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -267,15 +267,6 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
+ pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
+ ctx->key_size - 1 - req->src_len, req->src);
+
+- req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
+- if (!req_ctx->out_buf) {
+- kfree(req_ctx->in_buf);
+- return -ENOMEM;
+- }
+-
+- pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+- ctx->key_size, NULL);
+-
+ akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+ pkcs1pad_encrypt_sign_complete_cb, req);
+--
+2.20.1
+
--- /dev/null
+From 9b39badf2081f0ac94eb306ed378429085fb1a9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:09:28 +0200
+Subject: crypto: s5p-sss: Fix Fix argument list alignment
+
+From: Christoph Manszewski <c.manszewski@samsung.com>
+
+[ Upstream commit 6c12b6ba45490eeb820fdceccf5a53f42a26799c ]
+
+Fix misalignment of continued argument list.
+
+Signed-off-by: Christoph Manszewski <c.manszewski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/s5p-sss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index 500e4090e2fd4..5a37c075ee553 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -298,7 +298,7 @@ static void s5p_unset_indata(struct s5p_aes_dev *dev)
+ }
+
+ static int s5p_make_sg_cpy(struct s5p_aes_dev *dev, struct scatterlist *src,
+- struct scatterlist **dst)
++ struct scatterlist **dst)
+ {
+ void *pages;
+ int len;
+@@ -510,7 +510,7 @@ static int s5p_set_indata_start(struct s5p_aes_dev *dev,
+ }
+
+ static int s5p_set_outdata_start(struct s5p_aes_dev *dev,
+- struct ablkcipher_request *req)
++ struct ablkcipher_request *req)
+ {
+ struct scatterlist *sg;
+ int err;
+--
+2.20.1
+
--- /dev/null
+From 31f7f3242207b1f8df37c4012ebfc8ba7760743e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 14:36:27 +0530
+Subject: cxgb4: Fix endianness issue in t4_fwcache()
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ]
+
+Do not put host-endian 0 or 1 into big endian feild.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index ebeeb3581b9c5..b4b435276a18d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3541,7 +3541,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op)
+ c.param[0].mnem =
+ cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) |
+ FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE));
+- c.param[0].val = (__force __be32)op;
++ c.param[0].val = cpu_to_be32(op);
+
+ return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL);
+ }
+--
+2.20.1
+
--- /dev/null
+From cde908e8454f143e1f5967d4c6b93ecb1fa481de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:48 +0200
+Subject: dmaengine: dma-jz4780: Don't depend on MACH_JZ4780
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit c558ecd21c852c97ff98dc6c61f715ba420ec251 ]
+
+If we make this driver depend on MACH_JZ4780, that means it can be
+enabled only if we're building a kernel specially crafted for a
+JZ4780-based board, while most GNU/Linux distributions will want one
+generic MIPS kernel that works on multiple boards.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index 141aefbe37ec9..b0f798244a897 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -120,7 +120,7 @@ config DMA_JZ4740
+
+ config DMA_JZ4780
+ tristate "JZ4780 DMA support"
+- depends on MACH_JZ4780 || COMPILE_TEST
++ depends on MIPS || COMPILE_TEST
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+--
+2.20.1
+
--- /dev/null
+From c4d48f3d62751d9901ec8ee66e5b586d938f1522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:56 +0200
+Subject: dmaengine: dma-jz4780: Further residue status fix
+
+From: Daniel Silsby <dansilsby@gmail.com>
+
+[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ]
+
+Func jz4780_dma_desc_residue() expects the index to the next hw
+descriptor as its last parameter. Caller func jz4780_dma_tx_status(),
+however, applied modulus before passing it. When the current hw
+descriptor was last in the list, the index passed became zero.
+
+The resulting excess of reported residue especially caused problems
+with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which
+rely on this for determining current DMA location within buffer.
+
+Combined with the recent and related residue-reporting fixes, spurious
+ALSA audio underruns on jz4770 hardware are now fixed.
+
+Signed-off-by: Daniel Silsby <dansilsby@gmail.com>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 803cfb4523b08..aca2d6fd92d56 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -580,7 +580,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ to_jz4780_dma_desc(vdesc), 0);
+ } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+ txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
+- (jzchan->curr_hwdesc + 1) % jzchan->desc->count);
++ jzchan->curr_hwdesc + 1);
+ } else
+ txstate->residue = 0;
+
+--
+2.20.1
+
--- /dev/null
+From a1cff22b306126a4162cd719f2a846203d86bb57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 09:34:49 -0500
+Subject: EDAC: Raise the maximum number of memory controllers
+
+From: Justin Ernst <justin.ernst@hpe.com>
+
+[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ]
+
+We observe an oops in the skx_edac module during boot:
+
+ EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0
+ EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ ...
+ EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1
+ Too many memory controllers: 16
+ EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0
+
+We observe there are two memory controllers per socket, with a limit
+of 16. Raise the maximum number of memory controllers from 16 to 2 *
+MAX_NUMNODES (1024).
+
+[ bp: This is just a band-aid fix until we've sorted out the whole issue
+ with the bus_type association and handling in EDAC and can get rid of
+ this arbitrary limit. ]
+
+Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Russ Anderson <russ.anderson@hpe.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/edac.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index 9e0d78966552c..c6233227720c7 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -17,6 +17,7 @@
+ #include <linux/completion.h>
+ #include <linux/workqueue.h>
+ #include <linux/debugfs.h>
++#include <linux/numa.h>
+
+ struct device;
+
+@@ -778,6 +779,6 @@ struct mem_ctl_info {
+ /*
+ * Maximum number of memory controllers in the coherent fabric.
+ */
+-#define EDAC_MAX_MCS 16
++#define EDAC_MAX_MCS 2 * MAX_NUMNODES
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 03020215e3ae8d2a26a3016ccf09be87adc043de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 14:54:02 +0800
+Subject: f2fs: fix memory leak of percpu counter in fill_super()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 4a70e255449c9a13eed7a6eeecc85a1ea63cef76 ]
+
+In fill_super -> init_percpu_info, we should destroy percpu counter
+in error path, otherwise memory allcoated for percpu counter will
+leak.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 9eff18c1f3e46..e0ac676e0a35c 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1650,8 +1650,12 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ if (err)
+ return err;
+
+- return percpu_counter_init(&sbi->total_valid_inode_count, 0,
++ err = percpu_counter_init(&sbi->total_valid_inode_count, 0,
+ GFP_KERNEL);
++ if (err)
++ percpu_counter_destroy(&sbi->alloc_valid_block_count);
++
++ return err;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From ceaa5e575903e6972ce5afaa457ce47bac41e234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 17:41:30 +0800
+Subject: f2fs: fix to recover inode's uid/gid during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit dc4cd1257c86451cec3e8e352cc376348e4f4af4 ]
+
+Step to reproduce this bug:
+1. logon as root
+2. mount -t f2fs /dev/sdd /mnt;
+3. touch /mnt/file;
+4. chown system /mnt/file; chgrp system /mnt/file;
+5. xfs_io -f /mnt/file -c "fsync";
+6. godown /mnt;
+7. umount /mnt;
+8. mount -t f2fs /dev/sdd /mnt;
+
+After step 8) we will expect file's uid/gid are all system, but during
+recovery, these two fields were not been recovered, fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 9de1480a86bd3..e87b7d7e80fc7 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -179,6 +179,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+ char *name;
+
+ inode->i_mode = le16_to_cpu(raw->i_mode);
++ i_uid_write(inode, le32_to_cpu(raw->i_uid));
++ i_gid_write(inode, le32_to_cpu(raw->i_gid));
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_mtime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+--
+2.20.1
+
--- /dev/null
+From 80eec71082506f14173f772d7b652d4ad5ad2047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:29:29 +0300
+Subject: fuse: use READ_ONCE on congestion_threshold and max_background
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ]
+
+Since they are of unsigned int type, it's allowed to read them
+unlocked during reporting to userspace. Let's underline this fact
+with READ_ONCE() macroses.
+
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index e25c40c10f4fa..97ac2f5843fcc 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->max_background;
++ val = READ_ONCE(fc->max_background);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->congestion_threshold;
++ val = READ_ONCE(fc->congestion_threshold);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+--
+2.20.1
+
--- /dev/null
+From 6e813da1f4374a06014fbf004656436f4a0584fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 10:32:13 -0500
+Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ]
+
+The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when
+a rgrp buffer is valid. It's cleared when the glock is invalidated,
+signifying that the buffer data is now invalid. But before this
+patch, function update_rgrp_lvb was setting the flag when it
+determined it had a valid lvb. But that's an invalid assumption:
+just because you have a valid lvb doesn't mean you have valid
+buffers. After all, another node may have made the lvb valid,
+and this node just fetched it from the glock via dlm.
+
+Consider this scenario:
+1. The file system is mounted with RGRPLVB option.
+2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks
+ to GL_SKIP, it skips the gfs2_rgrp_bh_get.
+3. Since loops == 0 and the allocation target (ap->target) is
+ bigger than the largest known chunk of blocks in the rgrp
+ (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses
+ the call to gfs2_rgrp_bh_get there as well.
+4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses
+ gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due
+ to this invalid assumption.
+5. The next time update_rgrp_lvb is called, it sees the bit is set
+ and just returns 0, assuming both the lvb and rgrp are both
+ uptodate. But since this is a smaller allocation, or space has
+ been freed by another node, thus adjusting the lvb values,
+ it decides to use the rgrp for allocations, with invalid rd_free
+ due to the fact it was never updated.
+
+This patch changes update_rgrp_lvb so it doesn't set the UPTODATE
+flag anymore. That way, it has no choice but to fetch the latest
+values.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 0731267072706..f77a38755aea6 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1211,7 +1211,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
+ rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
+ rl_flags &= ~GFS2_RDF_MASK;
+ rgd->rd_flags &= GFS2_RDF_MASK;
+- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK);
+ if (rgd->rd_rgl->rl_unlinked == 0)
+ rgd->rd_flags &= ~GFS2_RDF_CHECK;
+ rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free);
+--
+2.20.1
+
--- /dev/null
+From ff1f12cb4140cdcefa4a76ca4b40817aafd0ca5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:03 -0700
+Subject: i40e: hold the rtnl lock on clearing interrupt scheme
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ]
+
+Hold the rtnl lock when we're clearing interrupt scheme
+in i40e_shutdown and in i40e_remove.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 886378c5334fa..043b69b5843b0 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11360,6 +11360,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ mutex_destroy(&hw->aq.asq_mutex);
+
+ /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i]) {
+@@ -11368,6 +11369,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ pf->vsi[i] = NULL;
+ }
+ }
++ rtnl_unlock();
+
+ for (i = 0; i < I40E_MAX_VEB; i++) {
+ kfree(pf->veb[i]);
+@@ -11513,7 +11515,13 @@ static void i40e_shutdown(struct pci_dev *pdev)
+ wr32(hw, I40E_PFPM_WUFC,
+ (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
+
++ /* Since we're going to destroy queues during the
++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this
++ * whole section
++ */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
++ rtnl_unlock();
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ pci_wake_from_d3(pdev, pf->wol_en);
+--
+2.20.1
+
--- /dev/null
+From 710aec22613fd069ec86338559b106b8e1fc7b39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:09 -0700
+Subject: i40e: Prevent deleting MAC address from VF when set by PF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ]
+
+To prevent VF from deleting MAC address that was assigned by the
+PF we need to check for that scenario when we try to delete a MAC
+address from a VF.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 54b8ee2583f14..7484ad3c955db 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2000,6 +2000,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
+ ret = I40E_ERR_INVALID_MAC_ADDR;
+ goto error_param;
+ }
++
++ if (vf->pf_set_mac &&
++ ether_addr_equal(al->list[i].addr,
++ vf->default_lan_addr.addr)) {
++ dev_err(&pf->pdev->dev,
++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n",
++ vf->default_lan_addr.addr, vf->vf_id);
++ ret = I40E_ERR_PARAM;
++ goto error_param;
++ }
+ }
+ vsi = pf->vsi[vf->lan_vsi_idx];
+
+--
+2.20.1
+
--- /dev/null
+From 2f57a4ca6a399cc71ff10b7159c3283dbb129907 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:30 -0700
+Subject: i40e: use correct length for strncpy
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ]
+
+Caught by GCC 8. When we provide a length for strncpy, we should not
+include the terminating null. So we must tell it one less than the size
+of the destination buffer.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+index f1feceab758a5..41cbcb0ac2d94 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -604,7 +604,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf)
+ if (!IS_ERR_OR_NULL(pf->ptp_clock))
+ return 0;
+
+- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name));
++ strncpy(pf->ptp_caps.name, i40e_driver_name,
++ sizeof(pf->ptp_caps.name) - 1);
+ pf->ptp_caps.owner = THIS_MODULE;
+ pf->ptp_caps.max_adj = 999999999;
+ pf->ptp_caps.n_ext_ts = 0;
+--
+2.20.1
+
--- /dev/null
+From b6aaea8199692e61a3747aa8081f45915cba96ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 09:44:18 +0000
+Subject: IB/iser: Fix possible NULL deref at iser_inv_desc()
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 65f07f5a09dacf3b60619f196f096ea3671a5eda ]
+
+In case target remote invalidates bogus rkey and signature is not used,
+pi_ctx is NULL deref.
+
+The commit also fails the connection on bogus remote invalidation.
+
+Fixes: 59caaed7a72a ("IB/iser: Support the remote invalidation exception")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_initiator.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 81ae2e30dd125..27a7e4406f343 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -590,13 +590,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc)
+ ib_conn->post_recv_buf_count--;
+ }
+
+-static inline void
++static inline int
+ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ {
+- if (likely(rkey == desc->rsc.mr->rkey))
++ if (likely(rkey == desc->rsc.mr->rkey)) {
+ desc->rsc.mr_valid = 0;
+- else if (likely(rkey == desc->pi_ctx->sig_mr->rkey))
++ } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) {
+ desc->pi_ctx->sig_mr_valid = 0;
++ } else {
++ iser_err("Bogus remote invalidation for rkey %#x\n", rkey);
++ return -EINVAL;
++ }
++
++ return 0;
+ }
+
+ static int
+@@ -624,12 +630,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn,
+
+ if (iser_task->dir[ISER_DIR_IN]) {
+ desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+
+ if (iser_task->dir[ISER_DIR_OUT]) {
+ desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+ } else {
+ iser_err("failed to get task for itt=%d\n", hdr->itt);
+--
+2.20.1
+
--- /dev/null
+From 6f6c615ef7f8b44f67873054261695c6676cc5ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jun 2018 18:48:07 -0700
+Subject: IB/rxe: fixes for rdma read retry
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit 030e46e495af855a13964a0aab9753ea82a96edc ]
+
+When a read request is retried for the remaining partial
+data, the response may restart from read response first
+or read response only. So support those cases.
+
+Do not advance the comp psn beyond the current wqe's last_psn
+as that could skip over an entire read wqe and will cause the
+req_retry() logic to set an incorrect req psn.
+An example sequence is as follows:
+Write PSN 40 -- this is the current WQE.
+Read request PSN 41
+Write PSN 42
+Receive ACK PSN 42 -- this will complete the current WQE
+for PSN 40, and set the comp psn to 42 which is a problem
+because the read request at PSN 41 has been skipped over.
+So when req_retry() tries to retransmit the read request,
+it sets the req psn to 42 which is incorrect.
+
+When retrying a read request, calculate the number of psns
+completed based on the dma resid instead of the wqe first_psn.
+The wqe first_psn could have moved if the read request was
+retried multiple times.
+
+Set the reth length to the dma resid to handle read retries for
+the remaining partial data.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 21 ++++++++++++++++-----
+ drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++------
+ 2 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index df15b6d7b645e..b03a6206d9be7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -250,6 +250,17 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ if (pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE &&
+ pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_LAST) {
++ /* read retries of partial data may restart from
++ * read response first or response only.
++ */
++ if ((pkt->psn == wqe->first_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) ||
++ (wqe->first_psn == wqe->last_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_ONLY))
++ break;
++
+ return COMPST_ERROR;
+ }
+ break;
+@@ -486,11 +497,11 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt,
+ struct rxe_send_wqe *wqe)
+ {
+- qp->comp.opcode = -1;
+-
+- if (pkt) {
+- if (psn_compare(pkt->psn, qp->comp.psn) >= 0)
+- qp->comp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ if (pkt && wqe->state == wqe_state_pending) {
++ if (psn_compare(wqe->last_psn, qp->comp.psn) >= 0) {
++ qp->comp.psn = (wqe->last_psn + 1) & BTH_PSN_MASK;
++ qp->comp.opcode = -1;
++ }
+
+ if (qp->req.wait_psn) {
+ qp->req.wait_psn = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 0f9fe2ca2a91a..6fb771290c566 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -72,9 +72,6 @@ static void req_retry(struct rxe_qp *qp)
+ int npsn;
+ int first = 1;
+
+- wqe = queue_head(qp->sq.queue);
+- npsn = (qp->comp.psn - wqe->first_psn) & BTH_PSN_MASK;
+-
+ qp->req.wqe_index = consumer_index(qp->sq.queue);
+ qp->req.psn = qp->comp.psn;
+ qp->req.opcode = -1;
+@@ -106,11 +103,17 @@ static void req_retry(struct rxe_qp *qp)
+ if (first) {
+ first = 0;
+
+- if (mask & WR_WRITE_OR_SEND_MASK)
++ if (mask & WR_WRITE_OR_SEND_MASK) {
++ npsn = (qp->comp.psn - wqe->first_psn) &
++ BTH_PSN_MASK;
+ retry_first_write_send(qp, wqe, mask, npsn);
++ }
+
+- if (mask & WR_READ_MASK)
++ if (mask & WR_READ_MASK) {
++ npsn = (wqe->dma.length - wqe->dma.resid) /
++ qp->mtu;
+ wqe->iova += npsn * qp->mtu;
++ }
+ }
+
+ wqe->state = wqe_state_posted;
+@@ -439,7 +442,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ if (pkt->mask & RXE_RETH_MASK) {
+ reth_set_rkey(pkt, ibwr->wr.rdma.rkey);
+ reth_set_va(pkt, wqe->iova);
+- reth_set_len(pkt, wqe->dma.length);
++ reth_set_len(pkt, wqe->dma.resid);
+ }
+
+ if (pkt->mask & RXE_IMMDT_MASK)
+--
+2.20.1
+
--- /dev/null
+From f9230da01c634592b7bb4e92c9b9cfd9252d26c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 22:24:40 +0200
+Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ]
+
+Do not try to write negative values and make sure that the write goes well.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/mcp4922.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c
+index 3854d201a5d6c..68dd0be1ac076 100644
+--- a/drivers/iio/dac/mcp4922.c
++++ b/drivers/iio/dac/mcp4922.c
+@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev,
+ long mask)
+ {
+ struct mcp4922_state *state = iio_priv(indio_dev);
++ int ret;
+
+ if (val2 != 0)
+ return -EINVAL;
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val > GENMASK(chan->scan_type.realbits-1, 0))
++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0))
+ return -EINVAL;
+ val <<= chan->scan_type.shift;
+- state->value[chan->channel] = val;
+- return mcp4922_spi_write(state, chan->channel, val);
++
++ ret = mcp4922_spi_write(state, chan->channel, val);
++ if (!ret)
++ state->value[chan->channel] = val;
++ return ret;
++
+ default:
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From ae6aa100e14d8c214f39fc80b51c01599ee2965d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 12:26:47 +0800
+Subject: ip_gre: fix parsing gre header in ipgre_err
+
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+
+[ Upstream commit b0350d51f001e6edc13ee4f253b98b50b05dd401 ]
+
+gre_parse_header stops parsing when csum_err is encountered, which means
+tpi->key is undefined and ip_tunnel_lookup will return NULL improperly.
+
+This patch introduce a NULL pointer as csum_err parameter. Even when
+csum_err is encountered, it won't return error and continue parsing gre
+header as expected.
+
+Fixes: 9f57c67c379d ("gre: Remove support for sharing GRE protocol hook.")
+Reported-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/gre_demux.c | 7 ++++---
+ net/ipv4/ip_gre.c | 9 +++------
+ 2 files changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index b798862b6be5d..7efe740c06ebf 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -86,13 +86,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+
+ options = (__be32 *)(greh + 1);
+ if (greh->flags & GRE_CSUM) {
+- if (skb_checksum_simple_validate(skb)) {
++ if (!skb_checksum_simple_validate(skb)) {
++ skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
++ null_compute_pseudo);
++ } else if (csum_err) {
+ *csum_err = true;
+ return -EINVAL;
+ }
+
+- skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+- null_compute_pseudo);
+ options++;
+ }
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 576f705d81809..9609ad71dd260 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -224,13 +224,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
+ const int type = icmp_hdr(skb)->type;
+ const int code = icmp_hdr(skb)->code;
+ struct tnl_ptk_info tpi;
+- bool csum_err = false;
+
+- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+- iph->ihl * 4) < 0) {
+- if (!csum_err) /* ignore csum errors. */
+- return;
+- }
++ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
++ iph->ihl * 4) < 0)
++ return;
+
+ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+--
+2.20.1
+
--- /dev/null
+From 0e780de4bdc70511e72b407b64ec2b10da1bd8b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 May 2018 15:12:08 +0300
+Subject: iwlwifi: mvm: avoid sending too many BARs
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 1a19c139be18ed4d6d681049cc48586fae070120 ]
+
+When we receive TX response, we may release a few packets
+due to a hole that was closed in the transmission window.
+
+However, if that frame failed, we will mark all the released
+frames as failed and will send multiple BARs.
+
+This affects statistics badly, and cause unnecessary frames
+transmission.
+
+Instead, mark all the following packets as success, with the
+desired result of sending a bar for the failed frame only.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 1aa74b87599ff..63dcea640d076 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1303,6 +1303,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ break;
+ }
+
++ /*
++ * If we are freeing multiple frames, mark all the frames
++ * but the first one as acked, since they were acknowledged
++ * before
++ * */
++ if (skb_freed > 1)
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ iwl_mvm_tx_status_check_trigger(mvm, status);
+
+ info->status.rates[0].count = tx_resp->failure_frame + 1;
+--
+2.20.1
+
--- /dev/null
+From d17d65100773b8d23ebe78030f07fd85c9434f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jul 2018 17:52:47 +0000
+Subject: kernfs: Fix range checks in kernfs_get_target_path
+
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+
+[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ]
+
+The terminating NUL byte is only there because the buffer is
+allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the
+range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the
+returned string may not be zero-terminated if it is exactly
+PATH_MAX characters long. Furthermore also the initial loop
+may theoretically exceed PATH_MAX and cause a fault.
+
+Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/symlink.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index 80317b04c84a2..e431a850f2f2b 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (base == kn)
+ break;
+
++ if ((s - path) + 3 >= PATH_MAX)
++ return -ENAMETOOLONG;
++
+ strcpy(s, "../");
+ s += 3;
+ base = base->parent;
+@@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (len < 2)
+ return -EINVAL;
+ len--;
+- if ((s - path) + len > PATH_MAX)
++ if ((s - path) + len >= PATH_MAX)
+ return -ENAMETOOLONG;
+
+ /* reverse fillup of target string from target to base */
+--
+2.20.1
+
--- /dev/null
+From 450245029c9959b89f1d0c1c0c1b9821c0692569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 19:21:09 +0900
+Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ]
+
+Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe
+list, just remove it from the list and keep it on kprobe hash list
+as same as other in-use kprobes.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 11863e2b01c25..1b75fb8c7735e 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -514,8 +514,14 @@ static void do_free_cleaned_kprobes(void)
+ struct optimized_kprobe *op, *tmp;
+
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+- BUG_ON(!kprobe_unused(&op->kp));
+ list_del_init(&op->list);
++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) {
++ /*
++ * This must not happen, but if there is a kprobe
++ * still in use, keep it on kprobes hash list.
++ */
++ continue;
++ }
+ free_aggr_kprobe(&op->kp);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 3825d077cb3889f76bfb502e1accfaa7df4d8880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 15:16:22 -0500
+Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ]
+
+The next update of libfdt has a new dependency on INT_MAX. Update the
+instances of libfdt_env.h in the kernel to either include the necessary
+header with the definition or define it locally.
+
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/libfdt_env.h | 2 ++
+ arch/powerpc/boot/libfdt_env.h | 2 ++
+ include/linux/libfdt_env.h | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index 17ae0f3efac8e..005bf4ff1b4cb 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -5,6 +5,8 @@
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index 7e3789ea396b8..0b3db6322c793 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -4,6 +4,8 @@
+ #include <types.h>
+ #include <string.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ #include "of.h"
+
+ typedef u32 uint32_t;
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index 2a663c6bb4285..8850e243c9406 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -1,6 +1,7 @@
+ #ifndef _LIBFDT_ENV_H
+ #define _LIBFDT_ENV_H
+
++#include <linux/kernel.h> /* For INT_MAX */
+ #include <linux/string.h>
+
+ #include <asm/byteorder.h>
+--
+2.20.1
+
--- /dev/null
+From b86bee0ce40d127a76fcdd6c7d3d48900129fabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 11:42:06 -0700
+Subject: llc: avoid blocking in llc_sap_close()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ]
+
+llc_sap_close() is called by llc_sap_put() which
+could be called in BH context in llc_rcv(). We can't
+block in BH.
+
+There is no reason to block it here, kfree_rcu() should
+be sufficient.
+
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/llc.h | 1 +
+ net/llc/llc_core.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/llc.h b/include/net/llc.h
+index 82d989995d18a..95e5ced4c1339 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -66,6 +66,7 @@ struct llc_sap {
+ int sk_count;
+ struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+ struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
++ struct rcu_head rcu;
+ };
+
+ static inline
+diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
+index e896a2c53b120..f1e442a39db8d 100644
+--- a/net/llc/llc_core.c
++++ b/net/llc/llc_core.c
+@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap)
+ list_del_rcu(&sap->node);
+ spin_unlock_bh(&llc_sap_list_lock);
+
+- synchronize_rcu();
+-
+- kfree(sap);
++ kfree_rcu(sap, rcu);
+ }
+
+ static struct packet_type llc_packet_type __read_mostly = {
+--
+2.20.1
+
--- /dev/null
+From b77a09fde0368908cbc9291ff7667bbda1c2fcd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:07:49 -0400
+Subject: media: au0828: Fix incorrect error messages
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit f347596f2bf114a3af3d80201c6e6bef538d884f ]
+
+Correcting red herring error messages.
+
+Where appropriate, replaces au0282_dev_register with:
+- au0828_analog_register
+- au0828_dvb_register
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/au0828/au0828-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index 38e73ee5c8fb1..78f0bf8ee084c 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -639,7 +639,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Analog TV */
+ retval = au0828_analog_register(dev, interface);
+ if (retval) {
+- pr_err("%s() au0282_dev_register failed to register on V4L2\n",
++ pr_err("%s() au0828_analog_register failed to register on V4L2\n",
+ __func__);
+ goto done;
+ }
+@@ -647,7 +647,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Digital TV */
+ retval = au0828_dvb_register(dev);
+ if (retval)
+- pr_err("%s() au0282_dev_register failed\n",
++ pr_err("%s() au0828_dvb_register failed\n",
+ __func__);
+
+ /* Remote controller */
+--
+2.20.1
+
--- /dev/null
+From 3be8f176a060ea5428394072e6c901990522f386 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 02:16:15 -0400
+Subject: media: davinci: Fix implicit enum conversion warning
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit
+conversion from enumeration type 'enum osd_v_exp_ratio' to different
+enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion]
+ layer_info->h_exp = V_EXP_6_OVER_5;
+ ~ ^~~~~~~~~~~~~~
+1 warning generated.
+
+This appears to be a copy and paste error judging from the couple of
+lines directly above this statement and the way that height is handled
+in the if block above this one.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index a9bc0175e4d3d..c839003953a74 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -518,7 +518,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev,
+ else if (v_scale == 4)
+ layer_info->v_zoom = ZOOM_X4;
+ if (v_exp)
+- layer_info->h_exp = V_EXP_6_OVER_5;
++ layer_info->v_exp = V_EXP_6_OVER_5;
+ } else {
+ /* no scaling, only cropping. Set display area to crop area */
+ cfg->ysize = expected_ysize;
+--
+2.20.1
+
--- /dev/null
+From 10738b332054bbd3d74a7099fd7be63c89aa1cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:56:21 -0400
+Subject: media: dvb: fix compat ioctl translation
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 ]
+
+The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but
+it never worked because the command number is wrong.
+
+Using the right command number means we have a better chance of them
+actually doing the right thing, though clearly nobody has ever tried
+it successfully.
+
+I noticed these while auditing the remaining users of compat_time_t
+for y2038 bugs. This one is fine in that regard, it just never did
+anything.
+
+Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/compat_ioctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 4b7da4409c60c..5b832e83772a6 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -160,6 +160,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -171,7 +172,7 @@ static int do_video_get_event(struct file *file,
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -190,6 +191,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -212,7 +214,7 @@ static int do_video_stillpicture(struct file *file,
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1484,9 +1486,9 @@ static long do_ioctl_trans(unsigned int cmd,
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ case VIDEO_SET_SPU_PALETTE:
+ return do_video_set_spu_palette(file, cmd, argp);
+--
+2.20.1
+
--- /dev/null
+From b050f096e3ecc5b1881bffc539ef00b591d09da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jul 2018 08:15:53 -0400
+Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary
+ access
+
+From: Lao Wei <zrlw@qq.com>
+
+[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ]
+
+Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter
+'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying
+pass different arbitrary address.
+Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1
+
+Signed-off-by: Lao Wei <zrlw@qq.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/meye/meye.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
+index ba887e8e1b171..a85c5199ccd30 100644
+--- a/drivers/media/pci/meye/meye.c
++++ b/drivers/media/pci/meye/meye.c
+@@ -1469,7 +1469,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long page, pos;
+
+ mutex_lock(&meye.lock);
+- if (size > gbuffers * gbufsize) {
++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) {
+ mutex_unlock(&meye.lock);
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From e1df996034337b16aa048956973e1a3b530f7999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 07:44:09 -0400
+Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in
+ ivtv_yuv_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ]
+
+The driver may sleep in a interrupt handler.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] kzalloc(GFP_KERNEL)
+drivers/media/pci/ivtv/ivtv-yuv.c, 938:
+ kzalloc in ivtv_yuv_init
+drivers/media/pci/ivtv/ivtv-yuv.c, 960:
+ ivtv_yuv_init in ivtv_yuv_next_free
+drivers/media/pci/ivtv/ivtv-yuv.c, 1126:
+ ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame
+drivers/media/pci/ivtv/ivtv-irq.c, 827:
+ ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req
+drivers/media/pci/ivtv/ivtv-irq.c, 1013:
+ ivtv_irq_dec_data_req in ivtv_irq_handler
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-yuv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
+index f7299d3d82449..bcb51e87c72f0 100644
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv)
+ }
+
+ /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
+- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN);
+ if (yi->blanking_ptr) {
+ yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
+ } else {
+--
+2.20.1
+
--- /dev/null
+From b55db85a027c4a9ec53e57adc26637935c4c7958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Aug 2018 22:20:23 +0300
+Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+
+[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ]
+
+Setting GPIO 21 high seems to be required to enable power to USB ports
+on the WNDR3400v3. As there is already similar code for WNR3500L,
+make the existing USB power GPIO code generic and use that.
+
+Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20259/
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/workarounds.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
+index e81ce4623070e..06fb94370c7c9 100644
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -4,9 +4,8 @@
+ #include <bcm47xx_board.h>
+ #include <bcm47xx.h>
+
+-static void __init bcm47xx_workarounds_netgear_wnr3500l(void)
++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power)
+ {
+- const int usb_power = 12;
+ int err;
+
+ err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power");
+@@ -22,7 +21,10 @@ void __init bcm47xx_workarounds(void)
+
+ switch (board) {
+ case BCM47XX_BOARD_NETGEAR_WNR3500L:
+- bcm47xx_workarounds_netgear_wnr3500l();
++ bcm47xx_workarounds_enable_usb_power(12);
++ break;
++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++ bcm47xx_workarounds_enable_usb_power(21);
+ break;
+ default:
+ /* No workaround(s) needed */
+--
+2.20.1
+
--- /dev/null
+From d897512ba35f0306eff60a5470f05807bb02a1b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:49:23 -0700
+Subject: MIPS: kexec: Relax memory restriction
+
+From: Dengcheng Zhu <dzhu@wavecomp.com>
+
+[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ]
+
+We can rely on the system kernel and the dump capture kernel themselves in
+memory usage.
+
+Being restrictive with 512MB limit may cause kexec tool failure on some
+platforms.
+
+Tested-by: Rachel Mozes <rachel.mozes@intel.com>
+Reported-by: Rachel Mozes <rachel.mozes@intel.com>
+Signed-off-by: Dengcheng Zhu <dzhu@wavecomp.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20568/
+Cc: pburton@wavecomp.com
+Cc: ralf@linux-mips.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/kexec.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h
+index 493a3cc7c39ad..cfdbe66575f4d 100644
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -12,11 +12,11 @@
+ #include <asm/stacktrace.h>
+
+ /* Maximum physical address we can use pages from */
+-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can use for the control code buffer */
+-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+ /* Reserve 3*4096 bytes for board-specific info */
+ #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+
+--
+2.20.1
+
--- /dev/null
+From 2098606a59bbe06e0231eabdf73eba48128ac88c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 12:19:19 +0800
+Subject: mips: txx9: fix iounmap related issue
+
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+
+[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ]
+
+if device_register return error, iounmap should be called, also iounmap
+need to call before put_device.
+
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Reviewed-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20476/
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/txx9/generic/setup.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
+index a1d98b5c8fd67..5c53b8aa43d26 100644
+--- a/arch/mips/txx9/generic/setup.c
++++ b/arch/mips/txx9/generic/setup.c
+@@ -959,12 +959,11 @@ void __init txx9_sramc_init(struct resource *r)
+ goto exit_put;
+ err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr);
+ if (err) {
+- device_unregister(&dev->dev);
+ iounmap(dev->base);
+- kfree(dev);
++ device_unregister(&dev->dev);
+ }
+ return;
+ exit_put:
++ iounmap(dev->base);
+ put_device(&dev->dev);
+- return;
+ }
+--
+2.20.1
+
--- /dev/null
+From eb3c2f7795b7593370fbe9c57f03a47746fd8f60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:29:13 +0800
+Subject: misc: genwqe: should return proper error value.
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ]
+
+The function should return -EFAULT when copy_from_user fails. Even
+though the caller does not distinguish them. but we should keep backward
+compatibility.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_utils.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index b642b4fd731b6..95584bffa4eaf 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages)
+ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ void __user *user_addr, size_t user_size)
+ {
+- int rc;
++ int ret = -ENOMEM;
+ struct pci_dev *pci_dev = cd->pci_dev;
+
+ sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
+@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (get_order(sgl->sgl_size) > MAX_ORDER) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: too much memory requested!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
+@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (sgl->sgl == NULL) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: no memory available!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ /* Only use buffering on incomplete pages */
+@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+ user_addr, sgl->fpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out;
+ }
+ }
+@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out2;
+ }
+ }
+@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
+- return -ENOMEM;
++
++ return ret;
+ }
+
+ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+--
+2.20.1
+
--- /dev/null
+From d89bb381be986981fbfcbe1aae47868ed8fc7262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:44:03 -0700
+Subject: misc: kgdbts: Fix restrict error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ]
+
+kgdbts current fails when compiled with restrict:
+
+drivers/misc/kgdbts.c: In function ‘configure_kgdbts’:
+drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict]
+ strcpy(config, opt);
+ ^~~~~~~~~~~~~~~~~~~
+
+As the error says, config is being used in both the source and destination.
+Refactor the code to avoid the extra copy and put the parsing closer to
+the actual location.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index bb3a76ad80da2..fc8cb855c6e66 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -979,6 +979,12 @@ static void kgdbts_run_tests(void)
+ int nmi_sleep = 0;
+ int i;
+
++ verbose = 0;
++ if (strstr(config, "V1"))
++ verbose = 1;
++ if (strstr(config, "V2"))
++ verbose = 2;
++
+ ptr = strchr(config, 'F');
+ if (ptr)
+ fork_test = simple_strtol(ptr + 1, NULL, 10);
+@@ -1062,13 +1068,6 @@ static int kgdbts_option_setup(char *opt)
+ return -ENOSPC;
+ }
+ strcpy(config, opt);
+-
+- verbose = 0;
+- if (strstr(config, "V1"))
+- verbose = 1;
+- if (strstr(config, "V2"))
+- verbose = 2;
+-
+ return 0;
+ }
+
+@@ -1080,9 +1079,6 @@ static int configure_kgdbts(void)
+
+ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+- err = kgdbts_option_setup(config);
+- if (err)
+- goto noconfig;
+
+ final_ack = 0;
+ run_plant_and_detach_test(1);
+--
+2.20.1
+
--- /dev/null
+From 26173c5e0377850a6f9d0d32b8f58b036ed841f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 09:21:24 +0300
+Subject: mlxsw: spectrum: Init shaper for TCs 8..15
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit a9f36656b519a9a21309793c306941a3cd0eeb8f ]
+
+With introduction of MC-aware mode to mlxsw, it became necessary to
+configure TCs above 7 as well. There is now code in mlxsw to disable ETS
+for these higher classes, but disablement of max shaper was neglected.
+
+By default, max shaper is currently disabled to begin with, so the
+problem is just cosmetic. However, for symmetry, do like we do for ETS
+configuration, and call mlxsw_sp_port_ets_maxrate_set() for both TC i
+and i + 8.
+
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 585a40cc6470b..8460c4807567c 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2191,6 +2191,13 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ MLXSW_REG_QEEC_MAS_DIS);
+ if (err)
+ return err;
++
++ err = mlxsw_sp_port_ets_maxrate_set(mlxsw_sp_port,
++ MLXSW_REG_QEEC_HIERARCY_TC,
++ i + 8, i,
++ MLXSW_REG_QEEC_MAS_DIS);
++ if (err)
++ return err;
+ }
+
+ /* Map all priorities to traffic class 0. */
+--
+2.20.1
+
--- /dev/null
+From 19a29a3705ed8f25602dc7ebeb6b3351b5436f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:50:17 +0800
+Subject: net: amd: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/am79c961a.c | 2 +-
+ drivers/net/ethernet/amd/atarilance.c | 6 ++++--
+ drivers/net/ethernet/amd/declance.c | 2 +-
+ drivers/net/ethernet/amd/sun3lance.c | 6 ++++--
+ drivers/net/ethernet/amd/sunlance.c | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++--
+ 6 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
+index fcdf5dda448f9..77d99c532917c 100644
+--- a/drivers/net/ethernet/amd/am79c961a.c
++++ b/drivers/net/ethernet/amd/am79c961a.c
+@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev)
+ /*
+ * Transmit a packet
+ */
+-static int
++static netdev_tx_t
+ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dev_priv *priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index d2bc8e5dcd23b..35a9f252ceb6c 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -770,7 +771,8 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index 9e80a76c3dfe1..76393ae4cf0aa 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 3d8c6b2cdea4c..09271665712da 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -235,7 +235,8 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 3153465d4d02f..acbbe4e5a2f8c 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 1e4e8b245cd55..1df7f5da8411f 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1390,7 +1390,7 @@ static int xgbe_close(struct net_device *netdev)
+ return 0;
+ }
+
+-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct xgbe_prv_data *pdata = netdev_priv(netdev);
+ struct xgbe_hw_if *hw_if = &pdata->hw_if;
+@@ -1399,7 +1399,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ struct xgbe_ring *ring;
+ struct xgbe_packet_data *packet;
+ struct netdev_queue *txq;
+- int ret;
++ netdev_tx_t ret;
+
+ DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len);
+
+--
+2.20.1
+
--- /dev/null
+From 0df62b5f995c26b1ccce48a7f3ba25c5e624b194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:45:12 +0800
+Subject: net: broadcom: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++--
+ drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index c4078401b7ded..900f2f706cbc7 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
+ u32 len_stat;
+- int ret;
++ netdev_tx_t ret;
+
+ priv = netdev_priv(dev);
+
+diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
+index f1b81187a2010..dc7953894c351 100644
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -299,7 +299,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *,
+ static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff);
+ static uint64_t sbmac_addr2reg(unsigned char *ptr);
+ static irqreturn_t sbmac_intr(int irq, void *dev_instance);
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
+ static void sbmac_setmulti(struct sbmac_softc *sc);
+ static int sbmac_init(struct platform_device *pldev, long long base);
+ static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed);
+@@ -2032,7 +2032,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance)
+ * Return value:
+ * nothing
+ ********************************************************************* */
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sbmac_softc *sc = netdev_priv(dev);
+ unsigned long flags;
+--
+2.20.1
+
--- /dev/null
+From cf68edc263545119215701cca8a3626b8941ce83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 19:29:09 +0200
+Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ]
+
+We need to bail out if lan78xx_get_endpoints() fails, otherwise the
+result is overwritten.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Raghuram Chary Jallipalli <raghuramchary.jallipalli@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index e143a7fe93201..a3f9d8f05db4a 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2621,6 +2621,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ int i;
+
+ ret = lan78xx_get_endpoints(dev, intf);
++ if (ret) {
++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
++ ret);
++ return ret;
++ }
+
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+--
+2.20.1
+
--- /dev/null
+From 495aa6076b75dcddb210c2b0a0284f229792a531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:42:15 +0800
+Subject: net: micrel: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8695net.c | 2 +-
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index 20cb85bc0c5f8..6135d90f368fa 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 2fc5cd56c0a84..8dc1f0277117d 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ * spin_lock_irqsave is required because tx and rx should be mutual exclusive.
+ * So while tx is in-progress, prevent IRQ interrupt from happenning.
+ */
+-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+- int retv = NETDEV_TX_OK;
++ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
+
+ disable_irq(netdev->irq);
+--
+2.20.1
+
--- /dev/null
+From abbb4964a0693bf48af063405b0ac71e0fd44581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:06:29 +0800
+Subject: net: smsc: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc911x.c | 3 ++-
+ drivers/net/ethernet/smsc/smc91x.c | 3 ++-
+ drivers/net/ethernet/smsc/smsc911x.c | 3 ++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index cb49c9654f0a7..323b3ac16bc0e 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -514,7 +514,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 73212590d04a3..b0c72167badec 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -637,7 +637,8 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 734caa7a557be..4143659615e10 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1776,7 +1776,8 @@ static int smsc911x_stop(struct net_device *dev)
+ }
+
+ /* Entry point for transmitting a packet */
+-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
+ unsigned int freespace;
+--
+2.20.1
+
--- /dev/null
+From 174c9e0bfe5c4ac6a3d52325a778664366801df6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:23:39 +0800
+Subject: net: toshiba: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +-
+ drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/tc35815.c | 6 ++++--
+ 4 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 272f2b1cb7add..34f8437955310 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card,
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, <0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct gelic_card *card = netdev_card(netdev);
+ struct gelic_descr *descr;
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index 8505196be9f52..d123644bd720b 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card);
+ void gelic_card_down(struct gelic_card *card);
+ int gelic_net_open(struct net_device *netdev);
+ int gelic_net_stop(struct net_device *netdev);
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+ void gelic_net_set_multi(struct net_device *netdev);
+ void gelic_net_tx_timeout(struct net_device *netdev);
+ int gelic_net_change_mtu(struct net_device *netdev, int new_mtu);
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index 36a6e8b54d941..1085987946212 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -880,9 +880,9 @@ out:
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, !0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-static int
++static netdev_tx_t
+ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int cnt;
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index 47ebac456ae57..9b84ee736fdc1 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -474,7 +474,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_
+ /* Index to functions, as function prototypes. */
+
+ static int tc35815_open(struct net_device *dev);
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t tc35815_interrupt(int irq, void *dev_id);
+ static int tc35815_rx(struct net_device *dev, int limit);
+ static int tc35815_poll(struct napi_struct *napi, int budget);
+@@ -1249,7 +1250,8 @@ tc35815_open(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tc35815_local *lp = netdev_priv(dev);
+ struct TxFD *txfd;
+--
+2.20.1
+
--- /dev/null
+From 949ebc121caaf97312af01bb5886ad42ae00f6e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:32:40 +0800
+Subject: net: xilinx: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index a9bd665fd1225..545f60877bb7d 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -673,7 +673,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 5f21ddff9e0f9..46fcf3ec2caf7 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -655,7 +655,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index aa02a03a6d8db..034b36442ee75 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1005,9 +1005,10 @@ static int xemaclite_close(struct net_device *dev)
+ * deferred and the Tx queue is stopped so that the deferred socket buffer can
+ * be transmitted when the Emaclite device is free to transmit data.
+ *
+- * Return: 0, always.
++ * Return: NETDEV_TX_OK, always.
+ */
+-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
++static netdev_tx_t
++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ {
+ struct net_local *lp = netdev_priv(dev);
+ struct sk_buff *new_skb;
+@@ -1028,7 +1029,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ /* Take the time stamp now, since we can't do this in an ISR. */
+ skb_tx_timestamp(new_skb);
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+- return 0;
++ return NETDEV_TX_OK;
+ }
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+
+@@ -1037,7 +1038,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ dev->stats.tx_bytes += len;
+ dev_consume_skb_any(new_skb);
+
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 83c7f0d1762368cdcedfc544cbcf98744413fdff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:19:35 +0100
+Subject: nvmem: core: return error code instead of NULL from nvmem_device_get
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ]
+
+nvmem_device_get() should return ERR_PTR() on error or valid pointer
+on success, but one of the code path seems to return NULL, so fix it.
+
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 9ca24e4d5d49c..2a0c5f3b0e509 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -609,7 +609,7 @@ static struct nvmem_device *nvmem_find(const char *name)
+ d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match);
+
+ if (!d)
+- return NULL;
++ return ERR_PTR(-ENOENT);
+
+ return to_nvmem_device(d);
+ }
+--
+2.20.1
+
--- /dev/null
+From 8fede1071acfe65d0cc382f5173268d8f371fed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 09:50:09 -0500
+Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ]
+
+Cache nodes under the cpu node(s) is PowerMac specific according to the
+comment above, so make the code enforce that.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index f366af135d5b7..c66cdc4307fd7 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2281,7 +2281,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
+ /* OF on pmac has nodes instead of properties named "l2-cache"
+ * beneath CPU nodes.
+ */
+- if (!strcmp(np->type, "cpu"))
++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu"))
+ for_each_child_of_node(np, child)
+ if (!strcmp(child->type, "cache"))
+ return child;
+--
+2.20.1
+
--- /dev/null
+From f9917be3f66506a40b5c087d5662e03054a187f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 04:32:11 +0000
+Subject: PCI/ACPI: Correct error message for ASPM disabling
+
+From: Sinan Kaya <okaya@kernel.org>
+
+[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ]
+
+If _OSC execution fails today for platforms without an _OSC entry, code is
+printing a misleading message saying disabling ASPM as follows:
+
+ acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
+
+We need to ensure that platform supports ASPM to begin with.
+
+Reported-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_root.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index b66815f35be6b..317ecc2e5757b 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ decode_osc_support(root, "OS supports", support);
+ status = acpi_pci_osc_support(root, support);
+ if (ACPI_FAILURE(status)) {
+- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n",
+- acpi_format_exception(status));
++ dev_info(&device->dev, "_OSC failed (%s)%s\n",
++ acpi_format_exception(status),
++ pcie_aspm_support_enabled() ? "; disabling ASPM" : "");
+ *no_aspm = 1;
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 74644614b69a5052a0367609885b26f73a2c90a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 11:44:05 +0200
+Subject: phy: phy-twl4030-usb: fix denied runtime access
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 6c7103aa026094a4ee2c2708ec6977a6dfc5331d ]
+
+When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS,
+the counter will be incremented but the resume callback not called,
+so enumeration and charging will not start properly.
+To avoid that happen, disable irq on suspend and recheck on resume.
+
+Practically this happens when the device is woken up from suspend by
+plugging in usb.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/phy-twl4030-usb.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
+index 547ca7b3f0985..ddb530ee2255c 100644
+--- a/drivers/phy/phy-twl4030-usb.c
++++ b/drivers/phy/phy-twl4030-usb.c
+@@ -144,6 +144,7 @@
+ #define PMBR1 0x0D
+ #define GPIO_USB_4PIN_ULPI_2430C (3 << 0)
+
++static irqreturn_t twl4030_usb_irq(int irq, void *_twl);
+ /*
+ * If VBUS is valid or ID is ground, then we know a
+ * cable is present and we need to be runtime-enabled
+@@ -392,6 +393,33 @@ static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
+ WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+ }
+
++static int __maybe_unused twl4030_usb_suspend(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ /*
++ * we need enabled runtime on resume,
++ * so turn irq off here, so we do not get it early
++ * note: wakeup on usb plug works independently of this
++ */
++ dev_dbg(twl->dev, "%s\n", __func__);
++ disable_irq(twl->irq);
++
++ return 0;
++}
++
++static int __maybe_unused twl4030_usb_resume(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ dev_dbg(twl->dev, "%s\n", __func__);
++ enable_irq(twl->irq);
++ /* check whether cable status changed */
++ twl4030_usb_irq(0, twl);
++
++ return 0;
++}
++
+ static int __maybe_unused twl4030_usb_runtime_suspend(struct device *dev)
+ {
+ struct twl4030_usb *twl = dev_get_drvdata(dev);
+@@ -652,6 +680,7 @@ static const struct phy_ops ops = {
+ static const struct dev_pm_ops twl4030_usb_pm_ops = {
+ SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend,
+ twl4030_usb_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(twl4030_usb_suspend, twl4030_usb_resume)
+ };
+
+ static int twl4030_usb_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 46377165febb4d8035dc084dc39710c9a9381553 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 14:42:13 +0200
+Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ]
+
+Sharing the same irqchip with multiple gpiochips is not a good
+practice. For instance, when installing hooks, we change the state
+of the irqchip. The initial state of the irqchip for the second
+gpiochip to register is then disrupted.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 9f09041859099..9401a0630e80b 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1545,16 +1545,6 @@ void at91_pinctrl_gpio_resume(void)
+ #define gpio_irq_set_wake NULL
+ #endif /* CONFIG_PM */
+
+-static struct irq_chip gpio_irqchip = {
+- .name = "GPIO",
+- .irq_ack = gpio_irq_ack,
+- .irq_disable = gpio_irq_mask,
+- .irq_mask = gpio_irq_mask,
+- .irq_unmask = gpio_irq_unmask,
+- /* .irq_set_type is set dynamically */
+- .irq_set_wake = gpio_irq_set_wake,
+-};
+-
+ static void gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+@@ -1595,12 +1585,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
++ struct irq_chip *gpio_irqchip;
+ int ret, i;
+
++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL);
++ if (!gpio_irqchip)
++ return -ENOMEM;
++
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+- /* Setup proper .irq_set_type function */
+- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++ gpio_irqchip->name = "GPIO";
++ gpio_irqchip->irq_ack = gpio_irq_ack;
++ gpio_irqchip->irq_disable = gpio_irq_mask;
++ gpio_irqchip->irq_mask = gpio_irq_mask;
++ gpio_irqchip->irq_unmask = gpio_irq_unmask;
++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake,
++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type;
+
+ /* Disable irqs of this PIO controller */
+ writel_relaxed(~0, at91_gpio->regbase + PIO_IDR);
+@@ -1611,7 +1611,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ * interrupt.
+ */
+ ret = gpiochip_irqchip_add(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ 0,
+ handle_edge_irq,
+ IRQ_TYPE_NONE);
+@@ -1629,7 +1629,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ if (!gpiochip_prev) {
+ /* Then register the chain on the parent IRQ */
+ gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ at91_gpio->pioc_virq,
+ gpio_irq_handler);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 88d560eea85306ea53b566743049f52faaf1d18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:37:45 +0300
+Subject: pinctrl: at91-pio4: fix has_config check in
+ atmel_pctl_dt_subnode_to_map()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ]
+
+Smatch complains about this condition:
+
+ if (has_config && num_pins >= 1)
+
+The "has_config" variable is either uninitialized or true. The
+"num_pins" variable is unsigned and we verified that it is non-zero on
+the lines before so we know "num_pines >= 1" is true. Really, we could
+just check "num_configs" directly and remove the "has_config" variable.
+
+Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 88ba9c50cc8ed..b596f45426ea0 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -479,7 +479,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned num_pins, num_configs, reserve;
+ unsigned long *configs;
+ struct property *pins;
+- bool has_config;
+ u32 pinfunc;
+ int ret, i;
+
+@@ -495,9 +494,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ return ret;
+ }
+
+- if (num_configs)
+- has_config = true;
+-
+ num_pins = pins->length / sizeof(u32);
+ if (!num_pins) {
+ dev_err(pctldev->dev, "no pins found in node %s\n",
+@@ -511,7 +507,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ * map for each pin.
+ */
+ reserve = 1;
+- if (has_config && num_pins >= 1)
++ if (num_configs)
+ reserve++;
+ reserve *= num_pins;
+ ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps,
+@@ -534,7 +530,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps,
+ group, func);
+
+- if (has_config) {
++ if (num_configs) {
+ ret = pinctrl_utils_add_map_configs(pctldev, map,
+ reserved_maps, num_maps, group,
+ configs, num_configs,
+--
+2.20.1
+
--- /dev/null
+From 22ca56090beda547963957f6a4b76f7e9c53e7fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 14:50:11 +0300
+Subject: power: reset: at91-poweroff: do not procede if at91_shdwc is
+ allocated
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 9f1e44774be578fb92776add95f1fcaf8284d692 ]
+
+There should be only one instance of struct shdwc in the system. This is
+referenced through at91_shdwc. Return in probe if at91_shdwc is already
+allocated.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/at91-sama5d2_shdwc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index 90b0b5a70ce52..04ca990e8f6cb 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -246,6 +246,9 @@ static int __init at91_shdwc_probe(struct platform_device *pdev)
+ if (!pdev->dev.of_node)
+ return -ENODEV;
+
++ if (at91_shdwc)
++ return -EBUSY;
++
+ at91_shdwc = devm_kzalloc(&pdev->dev, sizeof(*at91_shdwc), GFP_KERNEL);
+ if (!at91_shdwc)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 094f489c94fa541d61ad0b178169f52afe4b93c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:39:04 +0300
+Subject: power: supply: ab8500_fg: silence uninitialized variable warnings
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ]
+
+If kstrtoul() fails then we print "charge_full" when it's uninitialized.
+The debug printk doesn't add anything so I deleted it and cleaned these
+two functions up a bit.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_fg.c | 31 ++++++++++++-------------------
+ 1 file changed, 12 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 2199f673118c0..ea8c26a108f00 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2437,17 +2437,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_full;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_full);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full);
+-
+- if (!ret) {
+- di->bat_cap.max_mah = (int) charge_full;
+- ret = count;
+- }
+- return ret;
++ di->bat_cap.max_mah = (int) charge_full;
++ return count;
+ }
+
+ static ssize_t charge_now_show(struct ab8500_fg *di, char *buf)
+@@ -2459,20 +2456,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_now;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_now);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d",
+- ret, charge_now, di->bat_cap.prev_mah);
+-
+- if (!ret) {
+- di->bat_cap.user_mah = (int) charge_now;
+- di->flags.user_cap = true;
+- ret = count;
+- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
+- }
+- return ret;
++ di->bat_cap.user_mah = (int) charge_now;
++ di->flags.user_cap = true;
++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
++ return count;
+ }
+
+ static struct ab8500_fg_sysfs_entry charge_full_attr =
+--
+2.20.1
+
--- /dev/null
+From 31858512cff37cc7dfc7bc1c1f6e3942a1b922a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jul 2018 18:05:07 +0200
+Subject: power: supply: max8998-charger: Fix platform data retrieval
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Figa <tomasz.figa@gmail.com>
+
+[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ]
+
+Since the max8998 MFD driver supports instantiation by DT, platform data
+retrieval is handled in MFD probe and cell drivers should get use
+the pdata field of max8998_dev struct to obtain them.
+
+Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree")
+Signed-off-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max8998_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max8998_charger.c b/drivers/power/supply/max8998_charger.c
+index b64cf0f141425..66438029bdd0c 100644
+--- a/drivers/power/supply/max8998_charger.c
++++ b/drivers/power/supply/max8998_charger.c
+@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = {
+ static int max8998_battery_probe(struct platform_device *pdev)
+ {
+ struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev);
++ struct max8998_platform_data *pdata = iodev->pdata;
+ struct power_supply_config psy_cfg = {};
+ struct max8998_battery_data *max8998;
+ struct i2c_client *i2c;
+--
+2.20.1
+
--- /dev/null
+From 2d515f292cf20dba027e5b6a13c13b84ca6c1e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:00:07 +0200
+Subject: power: supply: twl4030_charger: disable eoc interrupt on linear
+ charge
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ]
+
+This avoids getting woken up from suspend after power interruptions
+when the bci wrongly thinks the battery is full just because
+of input current going low because of low input power
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 27 +++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index 14fed11e8f6e3..5b1f147b11cb0 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -469,6 +469,7 @@ static void twl4030_current_worker(struct work_struct *data)
+ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ {
+ int ret;
++ u32 reg;
+
+ if (bci->usb_mode == CHARGE_OFF)
+ enable = false;
+@@ -482,14 +483,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ bci->usb_enabled = 1;
+ }
+
+- if (bci->usb_mode == CHARGE_AUTO)
++ if (bci->usb_mode == CHARGE_AUTO) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC |
++ TWL4030_TBATOR2 | TWL4030_TBATOR1 |
++ TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */
+ ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB);
++ }
+
+ /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */
+ ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0,
+ TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4);
+ if (bci->usb_mode == CHARGE_LINEAR) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 |
++ TWL4030_TBATOR1 | TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0);
+ /* Watch dog key: WOVF acknowledge */
+ ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33,
+--
+2.20.1
+
--- /dev/null
+From 8593a2a9dcf1938a6b8e8c77979f476a47f284e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:20:35 +0200
+Subject: power: supply: twl4030_charger: fix charging current out-of-bounds
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ]
+
+the charging current uses unsigned int variables, if we step back
+if the current is still low, we would run into negative which
+means setting the target to a huge value.
+Better add checks here.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index bcd4dc304f270..14fed11e8f6e3 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -449,7 +449,8 @@ static void twl4030_current_worker(struct work_struct *data)
+
+ if (v < USB_MIN_VOLT) {
+ /* Back up and stop adjusting. */
+- bci->usb_cur -= USB_CUR_STEP;
++ if (bci->usb_cur >= USB_CUR_STEP)
++ bci->usb_cur -= USB_CUR_STEP;
+ bci->usb_cur_target = bci->usb_cur;
+ } else if (bci->usb_cur >= bci->usb_cur_target ||
+ bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
+--
+2.20.1
+
--- /dev/null
+From 806286ff7fd65b3c99024cbc8a1a3335348803f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 01:30:45 +1000
+Subject: powerpc/64s/hash: Fix stab_rr off by one initialization
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ]
+
+This causes SLB alloation to start 1 beyond the start of the SLB.
+There is no real problem because after it wraps it stats behaving
+properly, it's just surprisig to see when looking at SLB traces.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/slb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 64c9a91773af4..96c41b55b106b 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -321,7 +321,7 @@ void slb_initialize(void)
+ #endif
+ }
+
+- get_paca()->stab_rr = SLB_NUM_BOLTED;
++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1;
+
+ lflags = SLB_VSID_KERNEL | linear_llp;
+ vflags = SLB_VSID_KERNEL | vmalloc_llp;
+--
+2.20.1
+
--- /dev/null
+From e2639deec4f677bd100a812506e038cd39b90ce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 15:44:48 -0300
+Subject: powerpc/iommu: Avoid derefence before pointer check
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ]
+
+The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check
+if it is not NULL.
+
+Just moving the dereference code to after the check, where there will
+be guarantee that 'tbl' will not be NULL.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index 5f202a566ec5f..9bfdd2510fd5e 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -765,9 +765,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl,
+
+ vaddr = page_address(page) + offset;
+ uaddr = (unsigned long)vaddr;
+- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+
+ if (tbl) {
++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+ align = 0;
+ if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE &&
+ ((unsigned long)vaddr & ~PAGE_MASK) == 0)
+--
+2.20.1
+
--- /dev/null
+From fe44480f5a62fa61c905f4cb13fd03b4ae067ba5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 14:14:02 -0500
+Subject: powerpc/pseries: Disable CPU hotplug across migrations
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ]
+
+When performing partition migrations all present CPUs must be online
+as all present CPUs must make the H_JOIN call as part of the migration
+process. Once all present CPUs make the H_JOIN call, one CPU is returned
+to make the rtas call to perform the migration to the destination system.
+
+During testing of migration and changing the SMT state we have found
+instances where CPUs are offlined, as part of the SMT state change,
+before they make the H_JOIN call. This results in a hung system where
+every CPU is either in H_JOIN or offline.
+
+To prevent this this patch disables CPU hotplug during the migration
+process.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index a309a7a29cc60..641f3e4c33808 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -984,6 +984,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ goto out;
+ }
+
++ cpu_hotplug_disable();
+ stop_topology_update();
+
+ /* Call function on all CPUs. One of us will make the
+@@ -998,6 +999,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ printk(KERN_ERR "Error doing global join\n");
+
+ start_topology_update();
++ cpu_hotplug_enable();
+
+ /* Take down CPUs not online prior to suspend */
+ cpuret = rtas_offline_cpus_mask(offline_mask);
+--
+2.20.1
+
--- /dev/null
+From d381cc74f4786d9821df7b13bfe2a1cd5ea6a595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:10:04 +0930
+Subject: powerpc/vdso: Correct call frame information
+
+From: Alan Modra <amodra@gmail.com>
+
+[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ]
+
+Call Frame Information is used by gdb for back-traces and inserting
+breakpoints on function return for the "finish" command. This failed
+when inside __kernel_clock_gettime. More concerning than difficulty
+debugging is that CFI is also used by stack frame unwinding code to
+implement exceptions. If you have an app that needs to handle
+asynchronous exceptions for some reason, and you are unlucky enough to
+get one inside the VDSO time functions, your app will crash.
+
+What's wrong: There is control flow in __kernel_clock_gettime that
+reaches label 99 without saving lr in r12. CFI info however is
+interpreted by the unwinder without reference to control flow: It's a
+simple matter of "Execute all the CFI opcodes up to the current
+address". That means the unwinder thinks r12 contains the return
+address at label 99. Disabuse it of that notion by resetting CFI for
+the return address at label 99.
+
+Note that the ".cfi_restore lr" could have gone anywhere from the
+"mtlr r12" a few instructions earlier to the instruction at label 99.
+I put the CFI as late as possible, because in general that's best
+practice (and if possible grouped with other CFI in order to reduce
+the number of CFI opcodes executed when unwinding). Using r12 as the
+return address is perfectly fine after the "mtlr r12" since r12 on
+that code path still contains the return address.
+
+__get_datapage also has a CFI error. That function temporarily saves
+lr in r0, and reflects that fact with ".cfi_register lr,r0". A later
+use of r0 means the CFI at that point isn't correct, as r0 no longer
+contains the return address. Fix that too.
+
+Signed-off-by: Alan Modra <amodra@gmail.com>
+Tested-by: Reza Arbab <arbab@linux.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso32/datapage.S | 1 +
+ arch/powerpc/kernel/vdso32/gettimeofday.S | 1 +
+ arch/powerpc/kernel/vdso64/datapage.S | 1 +
+ arch/powerpc/kernel/vdso64/gettimeofday.S | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S
+index 3745113fcc652..2a7eb5452aba7 100644
+--- a/arch/powerpc/kernel/vdso32/datapage.S
++++ b/arch/powerpc/kernel/vdso32/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 6b2b69616e776..7b341b86216c2 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index abf17feffe404..bf96686915116 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index 3820213248836..09b2a49f6dd53 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+--
+2.20.1
+
--- /dev/null
+From 3fa2da82f0d9fe8013741cf060f25304ec391680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 16:07:07 +0200
+Subject: RDMA/i40iw: Fix incorrect iterator type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <Haakon.Bugge@oracle.com>
+
+[ Upstream commit 802fa45cd320de319e86c93bca72abec028ba059 ]
+
+Commit f27b4746f378 ("i40iw: add connection management code") uses an
+incorrect rcu iterator, whilst holding the rtnl_lock. Since the
+critical region invokes i40iw_manage_qhash(), which is a sleeping
+function, the rcu locking and traversal cannot be used.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 85637696f6e96..282a726351c81 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1652,7 +1652,7 @@ static enum i40iw_status_code i40iw_add_mqh_6(struct i40iw_device *iwdev,
+ unsigned long flags;
+
+ rtnl_lock();
+- for_each_netdev_rcu(&init_net, ip_dev) {
++ for_each_netdev(&init_net, ip_dev) {
+ if ((((rdma_vlan_dev_vlan_id(ip_dev) < I40IW_NO_VLAN) &&
+ (rdma_vlan_dev_real_dev(ip_dev) == iwdev->netdev)) ||
+ (ip_dev == iwdev->netdev)) && (ip_dev->flags & IFF_UP)) {
+--
+2.20.1
+
--- /dev/null
+From 00a506c272d2970081e1b870d4d5f957ba34224e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 13:48:31 -0500
+Subject: rtl8187: Fix warning generated when strncpy() destination length
+ matches the sixe argument
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ]
+
+In gcc8, when the 3rd argument (size) of a call to strncpy() matches the
+length of the first argument, the compiler warns of the possibility of an
+unterminated string. Using strlcpy() forces a null at the end.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+index c2d5b495c179a..c089540116fa7 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
+ led->dev = dev;
+ led->ledpin = ledpin;
+ led->is_radio = is_radio;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
+--
+2.20.1
+
--- /dev/null
+From 9fc05c2134e7fdb8904bffa1e9d6f701927d8504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:36:06 +0200
+Subject: s390/qeth: invoke softirqs after napi_schedule()
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ]
+
+Calling napi_schedule() from process context does not ensure that the
+NET_RX softirq is run in a timely fashion. So trigger it manually.
+
+This is no big issue with current code. A call to ndo_open() is usually
+followed by a ndo_set_rx_mode() call, and for qeth this contains a
+spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out
+early.
+Nevertheless it's best to not depend on this behaviour, and just fix
+the issue at its source like all other drivers do. For instance see
+commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule").
+
+Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 3 +++
+ drivers/s390/net/qeth_l3_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 6ba4e921d2fd3..51152681aba6e 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -991,7 +991,10 @@ static int __qeth_l2_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 6e6ba1baf9c48..b40a61d9ad9ec 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3005,7 +3005,10 @@ static int __qeth_l3_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 26c328dd1fcad20620b2b45ef167550991f4b7f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 10:56:52 +0800
+Subject: scsi: libsas: always unregister the old device if going to discover
+ new
+
+From: Jason Yan <yanaijie@huawei.com>
+
+[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ]
+
+If we went into sas_rediscover_dev() the attached_sas_addr was already insured
+not to be zero. So it's unnecessary to check if the attached_sas_addr is zero.
+
+And although if the sas address is not changed, we always have to unregister
+the old device when we are going to register a new one. We cannot just leave
+the device there and bring up the new.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+CC: John Garry <john.garry@huawei.com>
+CC: Johannes Thumshirn <jthumshirn@suse.de>
+CC: Ewan Milne <emilne@redhat.com>
+CC: Christoph Hellwig <hch@lst.de>
+CC: Tomas Henzl <thenzl@redhat.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 400eee9d77832..d44f18f773c0f 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2049,14 +2049,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ return res;
+ }
+
+- /* delete the old link */
+- if (SAS_ADDR(phy->attached_sas_addr) &&
+- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) {
+- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
+- SAS_ADDR(dev->sas_addr), phy_id,
+- SAS_ADDR(phy->attached_sas_addr));
+- sas_unregister_devs_sas_addr(dev, phy_id, last);
+- }
++ /* we always have to delete the old device when we went here */
++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
++ SAS_ADDR(dev->sas_addr), phy_id,
++ SAS_ADDR(phy->attached_sas_addr));
++ sas_unregister_devs_sas_addr(dev, phy_id, last);
+
+ return sas_discover_new(dev, phy_id);
+ }
+--
+2.20.1
+
--- /dev/null
+From 2434f6ad1b5f95433f7a5bcf112f0b9ec38dc749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Check for invalid reselection target
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 7ef55f6744c45e3d7c85a3f74ada39b67ac741dd ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION", that "the
+initiator shall not respond to a RESELECTION phase if other than two SCSI ID
+bits are on the DATA BUS." This issue (too many bits set) has been observed in
+the wild, so add a check.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 35419ba32c467..15c0fff7519be 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2102,6 +2102,11 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(MODE_REG, MR_BASE);
+
+ target_mask = NCR5380_read(CURRENT_SCSI_DATA_REG) & ~(hostdata->id_mask);
++ if (!target_mask || target_mask & (target_mask - 1)) {
++ shost_printk(KERN_WARNING, instance,
++ "reselect: bad target_mask 0x%02x\n", target_mask);
++ return;
++ }
+
+ dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+
+--
+2.20.1
+
--- /dev/null
+From 69f16e423f61b61c8ac7c58ba2bc8b0fe364d517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Clear all unissued commands on host reset
+
+From: Hannes Reinecke <hare@suse.com>
+
+[ Upstream commit 1aeeeed7f03c576f096eede7b0384f99a98f588c ]
+
+When doing a host reset we should be clearing all outstanding commands, not
+just the command triggering the reset.
+
+[mkp: adjusted Hannes' SoB address]
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Ondrey Zary <linux@rainbow-software.org>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 3cfab8868c989..ba7b3aef3ef0b 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2392,7 +2392,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd)
+ spin_lock_irqsave(&hostdata->lock, flags);
+
+ #if (NDEBUG & NDEBUG_ANY)
+- scmd_printk(KERN_INFO, cmd, __func__);
++ shost_printk(KERN_INFO, instance, __func__);
+ #endif
+ NCR5380_dprint(NDEBUG_ANY, instance);
+ NCR5380_dprint_phase(NDEBUG_ANY, instance);
+@@ -2410,10 +2410,13 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- if (list_del_cmd(&hostdata->unissued, cmd)) {
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
++
+ cmd->result = DID_RESET << 16;
+ cmd->scsi_done(cmd);
+ }
++ INIT_LIST_HEAD(&hostdata->unissued);
+
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+--
+2.20.1
+
--- /dev/null
+From cc5954743ffc1e91b35726cf6a4ea17d5541d5f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't call dsprintk() following reselection interrupt
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 08267216b3f8aa5adc204bdccf8deb72c1cd7665 ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION",
+
+ ... The reselected initiator shall then assert the BSY signal
+ within a selection abort time of its most recent detection of being
+ reselected; this is required for correct operation of the time-out
+ procedure.
+
+The selection abort time is only 200 us which may be insufficient time for a
+printk() call. Move the diagnostics to the error paths.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index a4856eeac26f6..03f9ddbc37fbb 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2109,8 +2109,6 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ return;
+ }
+
+- dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+-
+ /*
+ * At this point, we have detected that our SCSI ID is on the bus,
+ * SEL is true and BSY was false for at least one bus settle delay
+@@ -2123,6 +2121,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_BSY);
+ if (NCR5380_poll_politely(instance,
+ STATUS_REG, SR_SEL, 0, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: !SEL timeout\n");
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ return;
+ }
+@@ -2134,6 +2133,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(instance,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From c8f1dc70c76118223520c64cd1f23f14745d0409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't clear busy flag when abort fails
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 45ddc1b24806cc8f1a09f23dd4e7b6e4a8ae36e1 ]
+
+When NCR5380_abort() returns FAILED, the driver forgets that the target is
+still busy. Hence, further commands may be sent to the target, which may fail
+during selection and produce the error message, "reselection after won
+arbitration?". Prevent this by leaving the busy flag set when NCR5380_abort()
+fails.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 15c0fff7519be..a4856eeac26f6 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -626,8 +626,6 @@ static void complete_cmd(struct Scsi_Host *instance,
+ hostdata->sensing = NULL;
+ }
+
+- hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+-
+ cmd->scsi_done(cmd);
+ }
+
+@@ -1799,6 +1797,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ return;
+ #endif
+ case PHASE_DATAIN:
+@@ -1881,6 +1880,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd, scmd_id(cmd), cmd->device->lun);
+
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+
+ cmd->result &= ~0xffff;
+ cmd->result |= cmd->SCp.Status;
+@@ -2040,6 +2040,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ NCR5380_transfer_pio(instance, &phase, &len, &data);
+ if (msgout == ABORT) {
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ maybe_release_dma_irq(instance);
+@@ -2194,13 +2195,16 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ dsprintk(NDEBUG_RESELECTION | NDEBUG_QUEUES, instance,
+ "reselect: removed %p from disconnected queue\n", tmp);
+ } else {
++ int target = ffs(target_mask) - 1;
++
+ shost_printk(KERN_ERR, instance, "target bitmask 0x%02x lun %d not in disconnected queue.\n",
+ target_mask, lun);
+ /*
+ * Since we have an established nexus that we can't do anything
+ * with, we must abort it.
+ */
+- do_abort(instance);
++ if (do_abort(instance) == 0)
++ hostdata->busy[target] &= ~(1 << lun);
+ return;
+ }
+
+@@ -2368,8 +2372,10 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ out:
+ if (result == FAILED)
+ dsprintk(NDEBUG_ABORT, instance, "abort: failed to abort %p\n", cmd);
+- else
++ else {
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ dsprintk(NDEBUG_ABORT, instance, "abort: successfully aborted %p\n", cmd);
++ }
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
+--
+2.20.1
+
--- /dev/null
+From 03dbdb33ee1e9e8ef2f3230ecf6e0aa911d65fc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Handle BUS FREE during reselection
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit ca694afad707cb3ae2fdef3b28454444d9ac726e ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.2 RESELECTION time-out
+procedure", that a target may assert RST or go to BUS FREE phase if the
+initiator does not respond within 200 us. Something like this has been
+observed with AztecMonster II target. When it happens, all we can do is wait
+for the target to try again.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 03f9ddbc37fbb..27270631c70c2 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2133,6 +2133,9 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(instance,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ if ((NCR5380_read(STATUS_REG) & (SR_BSY | SR_SEL)) == 0)
++ /* BUS FREE phase */
++ return;
+ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+--
+2.20.1
+
--- /dev/null
+From e01243a9784887b3a6da16bc187e0fd7e0b4c9df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 070356513963be6196142acff56acc8359069fa1 ]
+
+When sense data is valid, call set_driver_byte(cmd, DRIVER_SENSE). Otherwise
+some callers of scsi_execute() will ignore sense data. Don't set DID_ERROR or
+DID_RESET just because sense data is missing.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index ba7b3aef3ef0b..35419ba32c467 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -617,11 +617,12 @@ static void complete_cmd(struct Scsi_Host *instance,
+
+ if (hostdata->sensing == cmd) {
+ /* Autosense processing ends here */
+- if ((cmd->result & 0xff) != SAM_STAT_GOOD) {
++ if (status_byte(cmd->result) != GOOD) {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
+- set_host_byte(cmd, DID_ERROR);
+- } else
++ } else {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
++ set_driver_byte(cmd, DRIVER_SENSE);
++ }
+ hostdata->sensing = NULL;
+ }
+
+@@ -2356,7 +2357,6 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ if (list_del_cmd(&hostdata->autosense, cmd)) {
+ dsprintk(NDEBUG_ABORT, instance,
+ "abort: removed %p from sense queue\n", cmd);
+- set_host_byte(cmd, DID_ERROR);
+ complete_cmd(instance, cmd);
+ }
+
+@@ -2435,7 +2435,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd)
+ list_for_each_entry(ncmd, &hostdata->autosense, list) {
+ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+
+- set_host_byte(cmd, DID_RESET);
+ cmd->scsi_done(cmd);
+ }
+ INIT_LIST_HEAD(&hostdata->autosense);
+--
+2.20.1
+
--- /dev/null
+From 6366fe23f880714b90b8fea3205f85e9ef75f508 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:03 +0530
+Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ]
+
+For the function dma_unmap_sg(), the <nents> parameter should be number of
+elements in the scatter list prior to the mapping, not after the mapping.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index ce584c31d36e5..d1fcd21f7f7dd 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -466,7 +466,7 @@ err_out:
+ dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+ if (!sas_protocol_ata(t->task_proto))
+ if (n_elem)
+- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter,
+ t->data_dir);
+ out_done:
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From a32174b76e37a9f22a86200e98d44cba1788ae8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:04 +0530
+Subject: scsi: pm80xx: Fixed system hang issue during kexec boot
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ]
+
+When the firmware is not responding, execution of kexec boot causes a system
+hang. When firmware assertion happened, driver get notified with interrupt
+vector updated in MPI configuration table. Then, the driver will read
+scratchpad register and set controller_fatal_error flag to true.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 6 +++
+ drivers/scsi/pm8001/pm8001_sas.c | 7 +++
+ drivers/scsi/pm8001/pm8001_sas.h | 1 +
+ drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++---
+ drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++
+ 5 files changed, 91 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 10546faac58c6..f374abfb7f1f8 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+ } else {
+ u32 producer_index;
+ void *pi_virt = circularQ->pi_virt;
++ /* spurious interrupt during setup if
++ * kexec-ing and driver doing a doorbell access
++ * with the pre-kexec oq interrupt setup
++ */
++ if (!pi_virt)
++ break;
+ /* Update the producer index from SPC */
+ producer_index = pm8001_read_32(pi_virt);
+ circularQ->producer_index = cpu_to_le32(producer_index);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index d1fcd21f7f7dd..e64a13f0bce17 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -374,6 +374,13 @@ static int pm8001_task_exec(struct sas_task *task,
+ return 0;
+ }
+ pm8001_ha = pm8001_find_ha_by_dev(task->dev);
++ if (pm8001_ha->controller_fatal_error) {
++ struct task_status_struct *ts = &t->task_status;
++
++ ts->resp = SAS_TASK_UNDELIVERED;
++ t->task_done(t);
++ return 0;
++ }
+ PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ do {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 6628cc38316c2..d8768ac41ebbf 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -531,6 +531,7 @@ struct pm8001_hba_info {
+ u32 logging_level;
+ u32 fw_status;
+ u32 smp_exp_mode;
++ bool controller_fatal_error;
+ const struct firmware *fw_image;
+ struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
+ };
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index eb4fee61df729..9edd61c063a1a 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size);
+ pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity);
++ /* Update Fatal error interrupt vector */
++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=
++ ((pm8001_ha->number_of_intr - 1) << 8);
+ pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt);
+ pm8001_mw32(address, MAIN_EVENT_CRC_CHECK,
+@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha)
+ return -EBUSY;
+ }
+
++ /* Initialize the controller fatal error flag */
++ pm8001_ha->controller_fatal_error = false;
++
+ /* Initialize pci space address eg: mpi offset */
+ init_pci_device_addresses(pm8001_ha);
+ init_default_table_values(pm8001_ha);
+@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha)
+ u32 bootloader_state;
+ u32 ibutton0, ibutton1;
+
+- /* Check if MPI is in ready state to reset */
+- if (mpi_uninit_check(pm8001_ha) != 0) {
+- PM8001_FAIL_DBG(pm8001_ha,
+- pm8001_printk("MPI state is not ready\n"));
+- return -1;
++ /* Process MPI table uninitialization only if FW is ready */
++ if (!pm8001_ha->controller_fatal_error) {
++ /* Check if MPI is in ready state to reset */
++ if (mpi_uninit_check(pm8001_ha) != 0) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "MPI state is not ready scratch1 :0x%x\n",
++ regval));
++ return -1;
++ }
+ }
+-
+ /* checked for reset register normal state; 0x0 */
+ regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET);
+ PM8001_INIT_DBG(pm8001_ha,
+@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ }
+ }
+
++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha)
++{
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7)));
++}
++
+ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ u8 uninitialized_var(bc);
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
++ u32 regval;
+
++ if (vec == (pm8001_ha->number_of_intr - 1)) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ if ((regval & SCRATCH_PAD_MIPSALL_READY) !=
++ SCRATCH_PAD_MIPSALL_READY) {
++ pm8001_ha->controller_fatal_error = true;
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "Firmware Fatal error! Regval:0x%x\n", regval));
++ print_scratchpad_registers(pm8001_ha);
++ return ret;
++ }
++ }
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ circularQ = &pm8001_ha->outbnd_q_tbl[vec];
+ do {
++ /* spurious interrupt during setup if kexec-ing and
++ * driver doing a doorbell access w/ the pre-kexec oq
++ * interrupt setup.
++ */
++ if (!circularQ->pi_virt)
++ break;
+ ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+ if (MPI_IO_STATUS_SUCCESS == ret) {
+ /* process the outbound message */
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 7a443bad61634..411b414a9a0ef 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
+ #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0
+ #define SCRATCH_PAD_IOP0_READY 0xC00
+ #define SCRATCH_PAD_IOP1_READY 0x3000
++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \
++ SCRATCH_PAD_IOP0_READY | \
++ SCRATCH_PAD_RAAE_READY)
+
+ /* boot loader state */
+ #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */
+--
+2.20.1
+
--- /dev/null
+From 4211a356110397027d739aec789a807e290dbf0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 11:38:16 -0400
+Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ]
+
+sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before
+using it in debug message prints.
+
+Suggested-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Acked-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index c6425e3df5a04..f1c7714377524 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym
+ OUTB(np, HS_PRT, HS_BUSY);
+ }
+
++#define sym_printk(lvl, tp, cp, fmt, v...) do { \
++ if (cp) \
++ scmd_printk(lvl, cp->cmd, fmt, ##v); \
++ else \
++ starget_printk(lvl, tp->starget, fmt, ##v); \
++} while (0)
++
+ /*
+ * chip exception handler for programmed interrupts.
+ */
+@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * been selected with ATN. We do not want to handle that.
+ */
+ case SIR_SEL_ATN_NO_MSG_OUT:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG OUT phase after selection with ATN\n");
+ goto out_stuck;
+ /*
+@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * having reselected the initiator.
+ */
+ case SIR_RESEL_NO_MSG_IN:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG IN phase after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * an IDENTIFY.
+ */
+ case SIR_RESEL_NO_IDENTIFY:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No IDENTIFY after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ case SIR_RESEL_ABORTED:
+ np->lastmsg = np->msgout[0];
+ np->msgout[0] = M_NOOP;
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ goto out;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 896fa25ebac769fad7dd708f3e771f2c45e1f359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:59:05 +0300
+Subject: serial: mxs-auart: Fix potential infinite loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anton Vasilyev <vasilyev@ispras.ru>
+
+[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ]
+
+On the error path of mxs_auart_request_gpio_irq() is performed
+backward iterating with index i of enum type. Underline enum type
+may be unsigned char. In this case check (--i >= 0) will be always
+true and error handling goes into infinite loop.
+
+The patch changes the check so that it is valid for signed and unsigned
+types.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/mxs-auart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 1d9d778828bae..515bf18c82943 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1635,8 +1635,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)
+
+ /*
+ * If something went wrong, rollback.
++ * Be careful: i may be unsigned.
+ */
+- while (err && (--i >= 0))
++ while (err && (i-- > 0))
+ if (irq[i] >= 0)
+ free_irq(irq[i], s);
+
+--
+2.20.1
+
mm-memcg-switch-to-css_tryget-in-get_mem_cgroup_from_mm.patch
mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch
mmc-sdhci-of-at91-fix-quirk2-overwrite.patch
+ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch
+iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch
+alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch
+arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch
+arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch
+cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch
+alsa-seq-do-error-checks-at-creating-system-ports.patch
+ath9k-fix-tx99-with-monitor-mode-interface.patch
+gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch
+asoc-dpcm-properly-initialise-hw-rate_max.patch
+mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch
+arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch
+arm-dts-exynos-fix-regulators-configuration-on-peach.patch
+i40e-use-correct-length-for-strncpy.patch
+i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch
+i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch
+ib-rxe-fixes-for-rdma-read-retry.patch
+iwlwifi-mvm-avoid-sending-too-many-bars.patch
+arm-dts-pxa-fix-power-i2c-base-address.patch
+rtl8187-fix-warning-generated-when-strncpy-destinati.patch
+net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch
+asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch
+arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch
+ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch
+mips-txx9-fix-iounmap-related-issue.patch
+asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch
+of-make-powermac-cache-node-search-conditional-on-co.patch
+arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch
+arm-dts-omap3-gta04-fixes-for-tvout-venc.patch
+arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch
+arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch
+arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch
+arm-dts-omap3-gta04-keep-vpll2-always-on.patch
+dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch
+dmaengine-dma-jz4780-further-residue-status-fix.patch
+ath9k-add-back-support-for-using-active-monitor-inte.patch
+signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch
+signal-properly-deliver-sigill-from-uprobes.patch
+signal-properly-deliver-sigsegv-from-x86-uprobes.patch
+f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch
+scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch
+arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch
+scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch
+scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch
+kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch
+nvmem-core-return-error-code-instead-of-null-from-nv.patch
+media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch
+media-dvb-fix-compat-ioctl-translation.patch
+alsa-intel8x0m-register-irq-handler-after-register-i.patch
+pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch
+llc-avoid-blocking-in-llc_sap_close.patch
+arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch
+powerpc-vdso-correct-call-frame-information.patch
+arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch
+pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch
+cxgb4-fix-endianness-issue-in-t4_fwcache.patch
+power-supply-ab8500_fg-silence-uninitialized-variabl.patch
+power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch
+power-supply-max8998-charger-fix-platform-data-retri.patch
+component-fix-loop-condition-to-call-unbind-if-bind-.patch
+kernfs-fix-range-checks-in-kernfs_get_target_path.patch
+ip_gre-fix-parsing-gre-header-in-ipgre_err.patch
+arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch
+ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch
+s390-qeth-invoke-softirqs-after-napi_schedule.patch
+pci-acpi-correct-error-message-for-aspm-disabling.patch
+serial-mxs-auart-fix-potential-infinite-loop.patch
+powerpc-iommu-avoid-derefence-before-pointer-check.patch
+powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch
+powerpc-pseries-disable-cpu-hotplug-across-migration.patch
+rdma-i40iw-fix-incorrect-iterator-type.patch
+libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch
+power-supply-twl4030_charger-fix-charging-current-ou.patch
+power-supply-twl4030_charger-disable-eoc-interrupt-o.patch
+net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch
+net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch
+net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch
+net-amd-fix-return-type-of-ndo_start_xmit-function.patch
+usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch
+usb-chipidea-fix-otg-event-handler.patch
+mlxsw-spectrum-init-shaper-for-tcs-8.15.patch
+arm-dts-am335x-evm-fix-number-of-cpsw.patch
+f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch
+arm-dts-ux500-correct-scu-unit-address.patch
+arm-dts-ux500-fix-lcda-clock-line-muxing.patch
+arm-dts-ste-fix-spi-controller-node-names.patch
+spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch
+cpufeature-avoid-warning-when-compiling-with-clang.patch
+arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch
+bnx2x-ignore-bandwidth-attention-in-single-function-.patch
+net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch
+x86-cpu-use-correct-macros-for-cyrix-calls.patch
+mips-kexec-relax-memory-restriction.patch
+media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch
+media-au0828-fix-incorrect-error-messages.patch
+media-davinci-fix-implicit-enum-conversion-warning.patch
+usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch
+usb-gadget-uvc-configfs-prevent-format-changes-after.patch
+phy-phy-twl4030-usb-fix-denied-runtime-access.patch
+usb-gadget-uvc-factor-out-video-usb-request-queueing.patch
+usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch
+coresight-fix-handling-of-sinks.patch
+coresight-etm4x-configure-el2-exception-level-when-k.patch
+coresight-tmc-fix-byte-address-alignment-for-rrp.patch
+misc-kgdbts-fix-restrict-error.patch
+misc-genwqe-should-return-proper-error-value.patch
+vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch
+vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch
+scsi-libsas-always-unregister-the-old-device-if-goin.patch
+arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch
+arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch
+arm-dts-paz00-fix-wakeup-gpio-keycode.patch
+net-smsc-fix-return-type-of-ndo_start_xmit-function.patch
+edac-raise-the-maximum-number-of-memory-controllers.patch
+arm-dts-realview-fix-spi-controller-node-names.patch
+bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch
+crypto-s5p-sss-fix-fix-argument-list-alignment.patch
+crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch
+scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch
+scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch
+scsi-ncr5380-check-for-invalid-reselection-target.patch
+scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch
+scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch
+scsi-ncr5380-handle-bus-free-during-reselection.patch
+arm64-dts-amd-fix-spi-bus-warnings.patch
+arm64-dts-lg-fix-spi-controller-node-names.patch
+arm-dts-lpc32xx-fix-spi-controller-node-names.patch
+usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch
+fuse-use-read_once-on-congestion_threshold-and-max_b.patch
+ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch
--- /dev/null
+From ebde3207089ebf6fc04c86c3272fb75be515e6f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 19:47:27 -0500
+Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ]
+
+If the first process started (aka /sbin/init) receives a SIGKILL it
+will panic the system if it is delivered. Making the system unusable
+and undebugable. It isn't much better if the first process started
+receives SIGSTOP.
+
+So always ignore SIGSTOP and SIGKILL sent to init.
+
+This is done in a separate clause in sig_task_ignored as force_sig_info
+can clear SIG_UNKILLABLE and this protection should work even then.
+
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 2bb1f9dc86c7d..30914b3c76b21 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -71,6 +71,10 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+
+ handler = sig_handler(t, sig);
+
++ /* SIGKILL and SIGSTOP may not be sent to the global init */
++ if (unlikely(is_global_init(t) && sig_kernel_only(sig)))
++ return true;
++
+ if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From bb07409ddd536fa127f338a92280d8ff3d436d71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:33:53 -0500
+Subject: signal: Properly deliver SIGILL from uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ]
+
+For userspace to tell the difference between a random signal and an
+exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result
+in userspace seeing si_code == SI_USER (like a random signal) instead
+of si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current)
+with force_sig(SIG_ILL, current) which gets this right and is
+shorter and easier to type.
+
+Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails")
+Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index fbfab5722254a..8ddd29476c0dc 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1846,7 +1846,7 @@ static void handle_trampoline(struct pt_regs *regs)
+
+ sigill:
+ uprobe_warn(current, "handle uretprobe, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+
+ }
+
+@@ -1962,7 +1962,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
+
+ if (unlikely(err)) {
+ uprobe_warn(current, "execute the probed insn, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4f9cb56ceda8453beebec05107b9334f03f097ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:48:30 -0500
+Subject: signal: Properly deliver SIGSEGV from x86 uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ]
+
+For userspace to tell the difference between an random signal
+and an exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in
+userspace seeing si_code == SI_USER (like a random signal) instead of
+si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current)
+with force_sig(SIG_SEGV, current) which gets this right and is shorter
+and easier to type.
+
+Fixes: 791eca10107f ("uretprobes/x86: Hijack return address")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index e35466afe989d..eac679ab543f6 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -983,7 +983,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
+ pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
+ "%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
+
+- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
++ force_sig(SIGSEGV, current);
+ }
+
+ return -1;
+--
+2.20.1
+
--- /dev/null
+From 388107a72fa45b3a70a9cdacdacd6fb37d6e976b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:13:37 -0700
+Subject: spi: pic32: Use proper enum in dmaengine_prep_slave_rg
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8cfde7847d5ed0bb77bace41519572963e43cd17 ]
+
+Clang warns when one enumerated type is converted implicitly to another:
+
+drivers/spi/spi-pic32.c:323:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_FROM_DEVICE,
+ ^~~~~~~~~~~~~~~
+drivers/spi/spi-pic32.c:333:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_TO_DEVICE,
+ ^~~~~~~~~~~~~
+2 warnings generated.
+
+Use the proper enums from dma_transfer_direction (DMA_FROM_DEVICE =
+DMA_DEV_TO_MEM = 2, DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1) to satify Clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/159
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pic32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index fefb688a34328..2f4df804c4d80 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -320,7 +320,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_rx = dmaengine_prep_slave_sg(master->dma_rx,
+ xfer->rx_sg.sgl,
+ xfer->rx_sg.nents,
+- DMA_FROM_DEVICE,
++ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_rx) {
+ ret = -EINVAL;
+@@ -330,7 +330,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_tx = dmaengine_prep_slave_sg(master->dma_tx,
+ xfer->tx_sg.sgl,
+ xfer->tx_sg.nents,
+- DMA_TO_DEVICE,
++ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+ ret = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From fc0d4b8f538607c45d55671fe63027c27be17b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 17:18:58 +0200
+Subject: usb: chipidea: Fix otg event handler
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ]
+
+At OTG work running time, it's possible that several events need to be
+addressed (e.g. ID and VBUS events). The current implementation handles
+only one event at a time which leads to ignoring the other one. Fix it.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/otg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index f36a1ac3bfbdf..b8650210be0f7 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work)
+ }
+
+ pm_runtime_get_sync(ci->dev);
++
+ if (ci->id_event) {
+ ci->id_event = false;
+ ci_handle_id_switch(ci);
+- } else if (ci->b_sess_valid_event) {
++ }
++
++ if (ci->b_sess_valid_event) {
+ ci->b_sess_valid_event = false;
+ ci_handle_vbus_change(ci);
+- } else
+- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__);
++ }
++
+ pm_runtime_put_sync(ci->dev);
+
+ enable_irq(ci->irq);
+--
+2.20.1
+
--- /dev/null
+From b5e9622c03079b44ae79500dbfae87c98044412f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:59:56 +0200
+Subject: usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is
+ already started
+
+From: Nicolas Adell <nicolas.adell@actia.fr>
+
+[ Upstream commit 1dedbdf2bbb1ede8d96f35f9845ecae179dc1988 ]
+
+When initializing the USB subsystem before starting the kernel,
+OTG overcurrent detection is disabled. In case the OTG polarity of
+overcurrent is low active, the overcurrent detection is never enabled
+again and events cannot be reported as expected. Because imx usb
+overcurrent polarity is low active by default, only detection needs
+to be enable in usbmisc init function.
+
+Signed-off-by: Nicolas Adell <nicolas.adell@actia.fr>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/usbmisc_imx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index 20d02a5e418d9..c6577f489d0f6 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -273,6 +273,8 @@ static int usbmisc_imx6q_init(struct imx_usbmisc_data *data)
+ } else if (data->oc_polarity == 1) {
+ /* High active */
+ reg &= ~(MX6_BM_OVER_CUR_DIS | MX6_BM_OVER_CUR_POLARITY);
++ } else {
++ reg &= ~(MX6_BM_OVER_CUR_DIS);
+ }
+ writel(reg, usbmisc->base + data->index * 4);
+
+--
+2.20.1
+
--- /dev/null
+From 73f5353b29b143b3e01d8671dcf4daa7ff2383c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 00:14:00 +0300
+Subject: usb: gadget: uvc: configfs: Drop leaked references to config items
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ]
+
+Some of the .allow_link() and .drop_link() operations implementations
+call config_group_find_item() and then leak the reference to the
+returned item. Fix this by dropping those references where needed.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index d7dcd39fe12cb..3803dda54666b 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -543,6 +543,7 @@ static int uvcg_control_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -584,6 +585,7 @@ static int uvcg_control_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2047,6 +2049,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2091,6 +2094,7 @@ static int uvcg_streaming_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From b6ee7c4fe87d04ca210c6a5382eb0b6bb6d17a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 21:02:12 +0200
+Subject: usb: gadget: uvc: configfs: Prevent format changes after linking
+ header
+
+From: Joel Pepper <joel.pepper@rwth-aachen.de>
+
+[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ]
+
+While checks are in place to avoid attributes and children of a format
+being manipulated after the format is linked into the streaming header,
+the linked flag was never actually set, invalidating the protections.
+Update the flag as appropriate in the header link calls.
+
+Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index 3803dda54666b..3d843e14447bb 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -772,6 +772,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src,
+ format_ptr->fmt = target_fmt;
+ list_add_tail(&format_ptr->entry, &src_hdr->formats);
+ ++src_hdr->num_fmt;
++ ++target_fmt->linked;
+
+ out:
+ mutex_unlock(&opts->lock);
+@@ -810,6 +811,8 @@ static int uvcg_streaming_header_drop_link(struct config_item *src,
+ break;
+ }
+
++ --target_fmt->linked;
++
+ out:
+ mutex_unlock(&opts->lock);
+ mutex_unlock(su_mutex);
+--
+2.20.1
+
--- /dev/null
+From d579e3b6addbb64ebc2577b80ed2ab1f681d0a7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:42:03 +0300
+Subject: usb: gadget: uvc: Factor out video USB request queueing
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ]
+
+USB requests for video data are queued from two different locations in
+the driver, with the same code block occurring twice. Factor it out to a
+function.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 0f01c04d7cbd8..540917f54506a 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -129,6 +129,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
+ * Request handling
+ */
+
++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
++{
++ int ret;
++
++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ if (ret < 0) {
++ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
++ usb_ep_set_halt(video->ep);
++ }
++
++ return ret;
++}
++
+ /*
+ * I somehow feel that synchronisation won't be easy to achieve here. We have
+ * three events that control USB requests submission:
+@@ -193,14 +206,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+
+ video->encode(req, video, buf);
+
+- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) {
+- printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(ep);
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&video->queue.irqlock, flags);
++
++ if (ret < 0) {
+ uvcg_queue_cancel(queue, 0);
+ goto requeue;
+ }
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
+
+ return;
+
+@@ -320,15 +332,13 @@ int uvcg_video_pump(struct uvc_video *video)
+ video->encode(req, video, buf);
+
+ /* Queue the USB request */
+- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&queue->irqlock, flags);
++
+ if (ret < 0) {
+- printk(KERN_INFO "Failed to queue request (%d)\n", ret);
+- usb_ep_set_halt(video->ep);
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ uvcg_queue_cancel(queue, 0);
+ break;
+ }
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ }
+
+ spin_lock_irqsave(&video->req_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From a35cc23d1be374183bd31bf1b481c1fa159740fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:44:57 +0300
+Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ]
+
+When USB requests for video data fail to be submitted, the driver
+signals a problem to the host by halting the video streaming endpoint.
+This is only valid in bulk mode, as isochronous transfers have no
+handshake phase and can't thus report a stall. The usb_ep_set_halt()
+call returns an error when using isochronous endpoints, which we happily
+ignore, but some UDCs complain in the kernel log. Fix this by only
+trying to halt the endpoint in bulk mode.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 540917f54506a..d6bab12b0b47d 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -136,7 +136,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
+ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
+ if (ret < 0) {
+ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(video->ep);
++ /* Isochronous endpoints can't be halted. */
++ if (usb_endpoint_xfer_bulk(video->ep->desc))
++ usb_ep_set_halt(video->ep);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From b3a90fe54a15ec722732a9c8710ecbcd3597e540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 19:13:32 +0300
+Subject: usb: xhci-mtk: fix ISOC error when interval is zero
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 87173acc0d8f0987bda8827da35fff67f52ad15d ]
+
+If the interval equal zero, needn't round up to power of two
+for the number of packets in each ESIT, so fix it.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mtk-sch.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 73f763c4f5f59..144674913c788 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -122,7 +122,9 @@ static void setup_sch_info(struct usb_device *udev,
+ }
+
+ if (ep_type == ISOC_IN_EP || ep_type == ISOC_OUT_EP) {
+- if (esit_pkts <= sch_ep->esit)
++ if (sch_ep->esit == 1)
++ sch_ep->pkts = esit_pkts;
++ else if (esit_pkts <= sch_ep->esit)
+ sch_ep->pkts = 1;
+ else
+ sch_ep->pkts = roundup_pow_of_two(esit_pkts)
+--
+2.20.1
+
--- /dev/null
+From 087faafc00d7bbc6ef8413e5bf075dc4f3ab1ebe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len
+
+From: Li Qiang <liq3ea@gmail.com>
+
+[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ]
+
+Free allocated vdev->msi_perm in error path.
+
+Signed-off-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 7b8a957b008d2..06a20ea183dd6 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1182,8 +1182,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
+ return -ENOMEM;
+
+ ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
+- if (ret)
++ if (ret) {
++ kfree(vdev->msi_perm);
+ return ret;
++ }
+
+ return len;
+ }
+--
+2.20.1
+
--- /dev/null
+From b8a0dd2c0f81f5ab3760c86f02ad58ee83f0da55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Mask buggy SR-IOV VF INTx support
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit db04264fe9bc0f2b62e036629f9afb530324b693 ]
+
+The SR-IOV spec requires that VFs must report zero for the INTx pin
+register as VFs are precluded from INTx support. It's much easier for
+the host kernel to understand whether a device is a VF and therefore
+whether a non-zero pin register value is bogus than it is to do the
+same in userspace. Override the INTx count for such devices and
+virtualize the pin register to provide a consistent view of the device
+to the user.
+
+As this is clearly a spec violation, warn about it to support hardware
+validation, but also provide a known whitelist as it doesn't do much
+good to continue complaining if the hardware vendor doesn't plan to
+fix it.
+
+Known devices with this issue: 8086:270c
+
+Tested-by: Gage Eads <gage.eads@intel.com>
+Reviewed-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 8 ++++++--
+ drivers/vfio/pci/vfio_pci_config.c | 27 +++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a1a712d18e028..da3f0ed18c769 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -426,10 +426,14 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type)
+ {
+ if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) {
+ u8 pin;
++
++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) ||
++ vdev->nointx || vdev->pdev->is_virtfn)
++ return 0;
++
+ pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin);
+- if (IS_ENABLED(CONFIG_VFIO_PCI_INTX) && !vdev->nointx && pin)
+- return 1;
+
++ return pin ? 1 : 0;
+ } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) {
+ u8 pos;
+ u16 flags;
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 06a20ea183dd6..84905d074c4ff 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1608,6 +1608,15 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
+ return 0;
+ }
+
++/*
++ * Nag about hardware bugs, hopefully to have vendors fix them, but at least
++ * to collect a list of dependencies for the VF INTx pin quirk below.
++ */
++static const struct pci_device_id known_bogus_vf_intx_pin[] = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x270c) },
++ {}
++};
++
+ /*
+ * For each device we allocate a pci_config_map that indicates the
+ * capability occupying each dword and thus the struct perm_bits we
+@@ -1673,6 +1682,24 @@ int vfio_config_init(struct vfio_pci_device *vdev)
+ if (pdev->is_virtfn) {
+ *(__le16 *)&vconfig[PCI_VENDOR_ID] = cpu_to_le16(pdev->vendor);
+ *(__le16 *)&vconfig[PCI_DEVICE_ID] = cpu_to_le16(pdev->device);
++
++ /*
++ * Per SR-IOV spec rev 1.1, 3.4.1.18 the interrupt pin register
++ * does not apply to VFs and VFs must implement this register
++ * as read-only with value zero. Userspace is not readily able
++ * to identify whether a device is a VF and thus that the pin
++ * definition on the device is bogus should it violate this
++ * requirement. We already virtualize the pin register for
++ * other purposes, so we simply need to replace the bogus value
++ * and consider VFs when we determine INTx IRQ count.
++ */
++ if (vconfig[PCI_INTERRUPT_PIN] &&
++ !pci_match_id(known_bogus_vf_intx_pin, pdev))
++ pci_warn(pdev,
++ "Hardware bug: VF reports bogus INTx pin %d\n",
++ vconfig[PCI_INTERRUPT_PIN]);
++
++ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */
+ }
+
+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx)
+--
+2.20.1
+
--- /dev/null
+From 4e91555f823f4a34e9f7d62c8974befb0cfdad27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:40 -0400
+Subject: x86/CPU: Use correct macros for Cyrix calls
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ]
+
+There are comments in processor-cyrix.h advising you to _not_ make calls
+using the deprecated macros in this style:
+
+ setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
+
+This is because it expands the macro into a non-functioning calling
+sequence. The calling order must be:
+
+ outb(CX86_CCR2, 0x22);
+ inb(0x23);
+
+From the comments:
+
+ * When using the old macros a line like
+ * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+ * gets expanded to:
+ * do {
+ * outb((CX86_CCR2), 0x22);
+ * outb((({
+ * outb((CX86_CCR2), 0x22);
+ * inb(0x23);
+ * }) | 0x88), 0x23);
+ * } while (0);
+
+The new macros fix this problem, so use them instead.
+
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jia Zhang <qianyue.zj@alibaba-inc.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/cyrix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index 311d0fad17e6b..a4f6e0ec4ba0f 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -434,7 +434,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c)
+ /* enable MAPEN */
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);
+ /* enable cpuid */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80);
+ /* disable MAPEN */
+ setCx86(CX86_CCR3, ccr3);
+ local_irq_restore(flags);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
