--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 8 Dec 2017 21:46:16 +0000
+Subject: agp/intel: Flush all chipset writes after updating the GGTT
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+
+[ Upstream commit 8516673a996870ea0ceb337ee4f83c33c5ec3111 ]
+
+Before accessing the GGTT we must flush the PTE writes and make them
+visible to the chipset, or else the indirect access may end up in the
+wrong page. In commit 3497971a71d8 ("agp/intel: Flush chipset writes
+after updating a single PTE"), we noticed corruption of the uploads for
+pwrite and for capturing GPU error states, but it was presumed that the
+explicit calls to intel_gtt_chipset_flush() were sufficient for the
+execbuffer path. However, we have not been flushing the chipset between
+the PTE writes and access via the GTT itself.
+
+For simplicity, do the flush after any PTE update rather than try and
+batch the flushes on a just-in-time basis.
+
+References: 3497971a71d8 ("agp/intel: Flush chipset writes after updating a single PTE")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Mika Kuoppala <mika.kuoppala@intel.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171208214616.30147-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/agp/intel-gtt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -871,6 +871,8 @@ void intel_gtt_insert_sg_entries(struct
+ }
+ }
+ wmb();
++ if (intel_private.driver->chipset_flush)
++ intel_private.driver->chipset_flush();
+ }
+ EXPORT_SYMBOL(intel_gtt_insert_sg_entries);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 2 Apr 2017 23:48:24 +0900
+Subject: ALSA: firewire-digi00x: add support for console models of Digi00x series
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+
+[ Upstream commit 13e005f9f933a35b5e55c9d36f151efe2a8383ec ]
+
+Digi00x series includes two types of unit; rack and console. As long as
+reading information on config rom of Digi 002 console, 'MODEL_ID' field
+has a different value from the one on Digi 002 rack.
+
+We've already got a test report from users with Digi 003 rack. We can
+assume that console type and rack type has different value in the field.
+
+This commit adds a device entry for console type. For following commits,
+this commit also adds a member to 'struct snd_digi00x' to identify console
+type.
+
+$ cd linux-firewire-utils/src
+$ python2 ./crpp < /sys/bus/firewire/devices/fw1/config_rom
+ ROM header and bus information block
+ -----------------------------------------------------------------
+400 0404f9d0 bus_info_length 4, crc_length 4, crc 63952
+404 31333934 bus_name "1394"
+408 60647002 irmc 0, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 7 (256)
+40c 00a07e00 company_id 00a07e |
+410 00a30000 device_id 0000a30000 | EUI-64 00a07e0000a30000
+
+ root directory
+ -----------------------------------------------------------------
+414 00058a39 directory_length 5, crc 35385
+418 0c0043a0 node capabilities
+41c 04000001 hardware version
+420 0300a07e vendor
+424 81000007 --> descriptor leaf at 440
+428 d1000001 --> unit directory at 42c
+
+ unit directory at 42c
+ -----------------------------------------------------------------
+42c 00046674 directory_length 4, crc 26228
+430 120000a3 specifier id
+434 13000001 version
+438 17000001 model
+43c 81000007 --> descriptor leaf at 458
+
+ descriptor leaf at 440
+ -----------------------------------------------------------------
+440 00055913 leaf_length 5, crc 22803
+444 000050f2 descriptor_type 00, specifier_ID 50f2
+448 80000000
+44c 44696769
+450 64657369
+454 676e0000
+
+ descriptor leaf at 458
+ -----------------------------------------------------------------
+458 0004a6fd leaf_length 4, crc 42749
+45c 00000000 textual descriptor
+460 00000000 minimal ASCII
+464 44696769 "Digi"
+468 20303032 " 002"
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/digi00x/digi00x.c | 13 +++++++++++--
+ sound/firewire/digi00x/digi00x.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/sound/firewire/digi00x/digi00x.c
++++ b/sound/firewire/digi00x/digi00x.c
+@@ -13,7 +13,8 @@ MODULE_AUTHOR("Takashi Sakamoto <o-takas
+ MODULE_LICENSE("GPL v2");
+
+ #define VENDOR_DIGIDESIGN 0x00a07e
+-#define MODEL_DIGI00X 0x000002
++#define MODEL_CONSOLE 0x000001
++#define MODEL_RACK 0x000002
+
+ static int name_card(struct snd_dg00x *dg00x)
+ {
+@@ -129,6 +130,8 @@ static int snd_dg00x_probe(struct fw_uni
+ spin_lock_init(&dg00x->lock);
+ init_waitqueue_head(&dg00x->hwdep_wait);
+
++ dg00x->is_console = entry->model_id == MODEL_CONSOLE;
++
+ /* Allocate and register this sound card later. */
+ INIT_DEFERRABLE_WORK(&dg00x->dwork, do_registration);
+ snd_fw_schedule_registration(unit, &dg00x->dwork);
+@@ -183,7 +186,13 @@ static const struct ieee1394_device_id s
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
+ IEEE1394_MATCH_MODEL_ID,
+ .vendor_id = VENDOR_DIGIDESIGN,
+- .model_id = MODEL_DIGI00X,
++ .model_id = MODEL_CONSOLE,
++ },
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_MODEL_ID,
++ .vendor_id = VENDOR_DIGIDESIGN,
++ .model_id = MODEL_RACK,
+ },
+ {}
+ };
+--- a/sound/firewire/digi00x/digi00x.h
++++ b/sound/firewire/digi00x/digi00x.h
+@@ -60,6 +60,7 @@ struct snd_dg00x {
+ /* For asynchronous MIDI controls. */
+ struct snd_rawmidi_substream *in_control;
+ struct snd_fw_async_midi_port out_control;
++ bool is_console;
+ };
+
+ #define DG00X_ADDR_BASE 0xffffe0000000ull
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 2 Apr 2017 23:48:25 +0900
+Subject: ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+
+[ Upstream commit 8820a4cf0cb4cd5c6540a9a18b2cedbdfd5a6891 ]
+
+At a commit 9dc5d31cdceb ("ALSA: firewire-digi00x: handle MIDI messages in
+isochronous packets"), a functionality to handle MIDI messages on
+isochronous packet was supported. But this includes some of my
+misunderstanding. This commit is to fix them.
+
+For digi00x series, first data channel of data blocks in rx/tx packet
+includes MIDI messages. The data channel has 0x80 in 8 bit of its MSB,
+however it's against IEC 61883-6. Unique data format is applied:
+ - Upper 4 bits of LSB represent port number.
+ - 0x0: port 1.
+ - 0x2: port 2.
+ - 0xe: console port.
+ - Lower 4 bits of LSB represent the number of included MIDI message bytes;
+ 0x0/0x1/0x2.
+ - Two bytes of middle of this data channel have MIDI bytes.
+
+Especially, MIDI messages from/to console surface are also transferred by
+isochronous packets, as well as physical MIDI ports.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/digi00x/amdtp-dot.c | 53 +++++++++++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 17 deletions(-)
+
+--- a/sound/firewire/digi00x/amdtp-dot.c
++++ b/sound/firewire/digi00x/amdtp-dot.c
+@@ -28,6 +28,9 @@
+ */
+ #define MAX_MIDI_RX_BLOCKS 8
+
++/* 3 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) + 1. */
++#define MAX_MIDI_PORTS 3
++
+ /*
+ * The double-oh-three algorithm was discovered by Robin Gareus and Damien
+ * Zammit in 2012, with reverse-engineering for Digi 003 Rack.
+@@ -42,10 +45,8 @@ struct amdtp_dot {
+ unsigned int pcm_channels;
+ struct dot_state state;
+
+- unsigned int midi_ports;
+- /* 2 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) */
+- struct snd_rawmidi_substream *midi[2];
+- int midi_fifo_used[2];
++ struct snd_rawmidi_substream *midi[MAX_MIDI_PORTS];
++ int midi_fifo_used[MAX_MIDI_PORTS];
+ int midi_fifo_limit;
+
+ void (*transfer_samples)(struct amdtp_stream *s,
+@@ -124,8 +125,8 @@ int amdtp_dot_set_parameters(struct amdt
+ return -EBUSY;
+
+ /*
+- * A first data channel is for MIDI conformant data channel, the rest is
+- * Multi Bit Linear Audio data channel.
++ * A first data channel is for MIDI messages, the rest is Multi Bit
++ * Linear Audio data channel.
+ */
+ err = amdtp_stream_set_parameters(s, rate, pcm_channels + 1);
+ if (err < 0)
+@@ -135,11 +136,6 @@ int amdtp_dot_set_parameters(struct amdt
+
+ p->pcm_channels = pcm_channels;
+
+- if (s->direction == AMDTP_IN_STREAM)
+- p->midi_ports = DOT_MIDI_IN_PORTS;
+- else
+- p->midi_ports = DOT_MIDI_OUT_PORTS;
+-
+ /*
+ * We do not know the actual MIDI FIFO size of most devices. Just
+ * assume two bytes, i.e., one byte can be received over the bus while
+@@ -281,13 +277,25 @@ static void write_midi_messages(struct a
+ b = (u8 *)&buffer[0];
+
+ len = 0;
+- if (port < p->midi_ports &&
++ if (port < MAX_MIDI_PORTS &&
+ midi_ratelimit_per_packet(s, port) &&
+ p->midi[port] != NULL)
+ len = snd_rawmidi_transmit(p->midi[port], b + 1, 2);
+
+ if (len > 0) {
+- b[3] = (0x10 << port) | len;
++ /*
++ * Upper 4 bits of LSB represent port number.
++ * - 0000b: physical MIDI port 1.
++ * - 0010b: physical MIDI port 2.
++ * - 1110b: console MIDI port.
++ */
++ if (port == 2)
++ b[3] = 0xe0;
++ else if (port == 1)
++ b[3] = 0x20;
++ else
++ b[3] = 0x00;
++ b[3] |= len;
+ midi_use_bytes(s, port, len);
+ } else {
+ b[1] = 0;
+@@ -309,11 +317,22 @@ static void read_midi_messages(struct am
+
+ for (f = 0; f < data_blocks; f++) {
+ b = (u8 *)&buffer[0];
+- port = b[3] >> 4;
++
+ len = b[3] & 0x0f;
++ if (len > 0) {
++ /*
++ * Upper 4 bits of LSB represent port number.
++ * - 0000b: physical MIDI port 1. Use port 0.
++ * - 1110b: console MIDI port. Use port 2.
++ */
++ if (b[3] >> 4 > 0)
++ port = 2;
++ else
++ port = 0;
+
+- if (port < p->midi_ports && p->midi[port] && len > 0)
+- snd_rawmidi_receive(p->midi[port], b + 1, len);
++ if (port < MAX_MIDI_PORTS && p->midi[port])
++ snd_rawmidi_receive(p->midi[port], b + 1, len);
++ }
+
+ buffer += s->data_block_quadlets;
+ }
+@@ -364,7 +383,7 @@ void amdtp_dot_midi_trigger(struct amdtp
+ {
+ struct amdtp_dot *p = s->protocol;
+
+- if (port < p->midi_ports)
++ if (port < MAX_MIDI_PORTS)
+ ACCESS_ONCE(p->midi[port]) = midi;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Wed, 22 Mar 2017 21:30:27 +0900
+Subject: ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+
+[ Upstream commit 2128f78f75a36a34dfef0e127273c2f820c5c904 ]
+
+In IEC 61883-1, when two quadlets CIP header is used, the most significant
+bit in second CIP header stands. However, packets from units with MOTU
+protocol version 3 have a quirk without this flag. Current packet streaming
+layer handles this as protocol error.
+
+This commit adds a new enumeration constant for this quirk, to handle MOTU
+protocol version 3.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/amdtp-stream.c | 5 +++--
+ sound/firewire/amdtp-stream.h | 3 +++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -471,8 +471,9 @@ static int handle_in_packet(struct amdtp
+ * This module supports 'Two-quadlet CIP header with SYT field'.
+ * For convenience, also check FMT field is AM824 or not.
+ */
+- if (((cip_header[0] & CIP_EOH_MASK) == CIP_EOH) ||
+- ((cip_header[1] & CIP_EOH_MASK) != CIP_EOH)) {
++ if ((((cip_header[0] & CIP_EOH_MASK) == CIP_EOH) ||
++ ((cip_header[1] & CIP_EOH_MASK) != CIP_EOH)) &&
++ (!(s->flags & CIP_HEADER_WITHOUT_EOH))) {
+ dev_info_ratelimited(&s->unit->device,
+ "Invalid CIP header for AMDTP: %08X:%08X\n",
+ cip_header[0], cip_header[1]);
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -29,6 +29,8 @@
+ * @CIP_JUMBO_PAYLOAD: Only for in-stream. The number of data blocks in an
+ * packet is larger than IEC 61883-6 defines. Current implementation
+ * allows 5 times as large as IEC 61883-6 defines.
++ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
++ * valid EOH.
+ */
+ enum cip_flags {
+ CIP_NONBLOCKING = 0x00,
+@@ -39,6 +41,7 @@ enum cip_flags {
+ CIP_SKIP_DBC_ZERO_CHECK = 0x10,
+ CIP_EMPTY_HAS_WRONG_DBC = 0x20,
+ CIP_JUMBO_PAYLOAD = 0x40,
++ CIP_HEADER_WITHOUT_EOH = 0x80,
+ };
+
+ /**
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Subhransu S. Prusty" <subhransu.s.prusty@intel.com>
+Date: Wed, 12 Apr 2017 09:54:00 +0530
+Subject: ALSA: hda: Add Geminilake id to SKL_PLUS
+
+From: "Subhransu S. Prusty" <subhransu.s.prusty@intel.com>
+
+
+[ Upstream commit 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 ]
+
+Geminilake is Skylake family platform. So add it's id to skl_plus check.
+
+Fixes: 126cfa2f5e15 ("ALSA: hda: Add Geminilake HDMI codec ID")
+Signed-off-by: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
+Cc: Senthilnathan Veppur <senthilnathanx.veppur@intel.com>
+Cc: Vinod Koul <vinod.koul@intel.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_intel.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -369,8 +369,10 @@ enum {
+ #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71)
+ #define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0)
+ #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
++#define IS_GLK(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x3198)
+ #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \
+- IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)
++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) || \
++ IS_GLK(pci)
+
+ static char *driver_short_names[] = {
+ [AZX_DRIVER_ICH] = "HDA Intel",
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: John Johansen <john.johansen@canonical.com>
+Date: Thu, 6 Apr 2017 06:55:24 -0700
+Subject: apparmor: Make path_max parameter readonly
+
+From: John Johansen <john.johansen@canonical.com>
+
+
+[ Upstream commit 622f6e3265707ebf02ba776ac6e68003bcc31213 ]
+
+The path_max parameter determines the max size of buffers allocated
+but it should not be setable at run time. If can be used to cause an
+oops
+
+root@ubuntu:~# echo 16777216 > /sys/module/apparmor/parameters/path_max
+root@ubuntu:~# cat /sys/module/apparmor/parameters/path_max
+Killed
+
+[ 122.141911] BUG: unable to handle kernel paging request at ffff880080945fff
+[ 122.143497] IP: [<ffffffff81228844>] d_absolute_path+0x44/0xa0
+[ 122.144742] PGD 220c067 PUD 0
+[ 122.145453] Oops: 0002 [#1] SMP
+[ 122.146204] Modules linked in: vmw_vsock_vmci_transport vsock ppdev vmw_balloon snd_ens1371 btusb snd_ac97_codec gameport snd_rawmidi btrtl snd_seq_device ac97_bus btbcm btintel snd_pcm input_leds bluetooth snd_timer snd joydev soundcore serio_raw coretemp shpchp nfit parport_pc i2c_piix4 8250_fintek vmw_vmci parport mac_hid ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd vmwgfx psmouse mptspi ttm mptscsih drm_kms_helper mptbase syscopyarea scsi_transport_spi sysfillrect
+[ 122.163365] ahci sysimgblt e1000 fb_sys_fops libahci drm pata_acpi fjes
+[ 122.164747] CPU: 3 PID: 1501 Comm: bash Not tainted 4.4.0-59-generic #80-Ubuntu
+[ 122.166250] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
+[ 122.168611] task: ffff88003496aa00 ti: ffff880076474000 task.ti: ffff880076474000
+[ 122.170018] RIP: 0010:[<ffffffff81228844>] [<ffffffff81228844>] d_absolute_path+0x44/0xa0
+[ 122.171525] RSP: 0018:ffff880076477b90 EFLAGS: 00010206
+[ 122.172462] RAX: ffff880080945fff RBX: 0000000000000000 RCX: 0000000001000000
+[ 122.173709] RDX: 0000000000ffffff RSI: ffff880080946000 RDI: ffff8800348a1010
+[ 122.174978] RBP: ffff880076477bb8 R08: ffff880076477c80 R09: 0000000000000000
+[ 122.176227] R10: 00007ffffffff000 R11: ffff88007f946000 R12: ffff88007f946000
+[ 122.177496] R13: ffff880076477c80 R14: ffff8800348a1010 R15: ffff8800348a2400
+[ 122.178745] FS: 00007fd459eb4700(0000) GS:ffff88007b6c0000(0000) knlGS:0000000000000000
+[ 122.180176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 122.181186] CR2: ffff880080945fff CR3: 0000000073422000 CR4: 00000000001406e0
+[ 122.182469] Stack:
+[ 122.182843] 00ffffff00000001 ffff880080946000 0000000000000000 0000000000000000
+[ 122.184409] 00000000570f789c ffff880076477c30 ffffffff81385671 ffff88007a2e7a58
+[ 122.185810] 0000000000000000 ffff880076477c88 01000000008a1000 0000000000000000
+[ 122.187231] Call Trace:
+[ 122.187680] [<ffffffff81385671>] aa_path_name+0x81/0x370
+[ 122.188637] [<ffffffff813875dd>] profile_transition+0xbd/0xb80
+[ 122.190181] [<ffffffff811af9bc>] ? zone_statistics+0x7c/0xa0
+[ 122.191674] [<ffffffff81389b20>] apparmor_bprm_set_creds+0x9b0/0xac0
+[ 122.193288] [<ffffffff812e1971>] ? ext4_xattr_get+0x81/0x220
+[ 122.194793] [<ffffffff812e800c>] ? ext4_xattr_security_get+0x1c/0x30
+[ 122.196392] [<ffffffff813449b9>] ? get_vfs_caps_from_disk+0x69/0x110
+[ 122.198004] [<ffffffff81232d4f>] ? mnt_may_suid+0x3f/0x50
+[ 122.199737] [<ffffffff81344b03>] ? cap_bprm_set_creds+0xa3/0x600
+[ 122.201377] [<ffffffff81346e53>] security_bprm_set_creds+0x33/0x50
+[ 122.203024] [<ffffffff81214ce5>] prepare_binprm+0x85/0x190
+[ 122.204515] [<ffffffff81216545>] do_execveat_common.isra.33+0x485/0x710
+[ 122.206200] [<ffffffff81216a6a>] SyS_execve+0x3a/0x50
+[ 122.207615] [<ffffffff81838795>] stub_execve+0x5/0x5
+[ 122.208978] [<ffffffff818384f2>] ? entry_SYSCALL_64_fastpath+0x16/0x71
+[ 122.210615] Code: f8 31 c0 48 63 c2 83 ea 01 48 c7 45 e8 00 00 00 00 48 01 c6 85 d2 48 c7 45 f0 00 00 00 00 48 89 75 e0 89 55 dc 78 0c 48 8d 46 ff <c6> 46 ff 00 48 89 45 e0 48 8d 55 e0 48 8d 4d dc 48 8d 75 e8 e8
+[ 122.217320] RIP [<ffffffff81228844>] d_absolute_path+0x44/0xa0
+[ 122.218860] RSP <ffff880076477b90>
+[ 122.219919] CR2: ffff880080945fff
+[ 122.220936] ---[ end trace 506cdbd85eb6c55e ]---
+
+Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/apparmor/lsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -707,7 +707,7 @@ module_param_named(logsyscall, aa_g_logs
+
+ /* Maximum pathname length before accesses will start getting rejected */
+ unsigned int aa_g_path_max = 2 * PATH_MAX;
+-module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
++module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
+
+ /* Determines how paranoid loading of policy is and how much verification
+ * on the loaded policy is done.
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 4 Mar 2017 09:43:51 +0000
+Subject: ARM: bcm2835: Enable missing CMA settings for VC4 driver
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+
+[ Upstream commit bdd3c25423cb42171446940bca0946e0443e1a84 ]
+
+Currently bcm2835_defconfig has CMA disabled which makes the
+HDMI output on a Raspberry Pi 1 stop working during boot:
+
+ fb: switching to vc4drmfb from simple
+ Console: switching to colour dummy device 80x30
+ [drm] Initialized vc4 0.0.0 20140616 for soc:gpu on minor 0
+ [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
+ [drm] Driver supports precise vblank timestamp query.
+ vc4-drm soc:gpu: failed to allocate buffer with size 9216000
+ vc4-drm soc:gpu: Failed to set initial hw configuration.
+
+So enable CMA and DMA_CMA in bcm2835_defconfig.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: 4400d9ac05ee ("ARM: bcm2835: Enable the VC4 graphics driver in the defconfig")
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/bcm2835_defconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/configs/bcm2835_defconfig
++++ b/arch/arm/configs/bcm2835_defconfig
+@@ -1,6 +1,5 @@
+ # CONFIG_LOCALVERSION_AUTO is not set
+ CONFIG_SYSVIPC=y
+-CONFIG_FHANDLE=y
+ CONFIG_NO_HZ=y
+ CONFIG_HIGH_RES_TIMERS=y
+ CONFIG_BSD_PROCESS_ACCT=y
+@@ -32,6 +31,7 @@ CONFIG_PREEMPT_VOLUNTARY=y
+ CONFIG_AEABI=y
+ CONFIG_KSM=y
+ CONFIG_CLEANCACHE=y
++CONFIG_CMA=y
+ CONFIG_SECCOMP=y
+ CONFIG_KEXEC=y
+ CONFIG_CRASH_DUMP=y
+@@ -52,6 +52,7 @@ CONFIG_MAC80211=y
+ CONFIG_DEVTMPFS=y
+ CONFIG_DEVTMPFS_MOUNT=y
+ # CONFIG_STANDALONE is not set
++CONFIG_DMA_CMA=y
+ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_SCSI_CONSTANTS=y
+@@ -62,7 +63,6 @@ CONFIG_USB_NET_SMSC95XX=y
+ CONFIG_ZD1211RW=y
+ CONFIG_INPUT_EVDEV=y
+ # CONFIG_LEGACY_PTYS is not set
+-# CONFIG_DEVKMEM is not set
+ CONFIG_SERIAL_AMBA_PL011=y
+ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+ CONFIG_TTY_PRINTK=y
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Al Cooper <alcooperx@gmail.com>
+Date: Thu, 9 Mar 2017 10:51:18 -0800
+Subject: ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals
+
+From: Al Cooper <alcooperx@gmail.com>
+
+
+[ Upstream commit 3c51b9c7f1fae00c25f1e34da649a288e3fea1ae ]
+
+Some Host Controller hardware blocks, like the OHCI, EHCI and SDIO
+controllers, have hardware blocks that are not capable of doing 64 bit
+DMA. These host controllers fail on boards with >3GB of memory because
+the memory above 3GB is located physically >= 0x100000000 and can only
+be accessed using 64 DMA. The way Linux is currently configured for
+BRCMSTB systems, the memory given to drivers for DMA through functions
+like dma_alloc_coherent() comes from CMA memory and CMA memory is taken
+from the top of physical memory. When these drivers get a DMA buffer
+with an address >=0x100000000, they end up dropping the upper 32 bit of
+the address causing the hardware to DMA to incorrect memory, typically
+BMEM (custom memory carveout). This issue was discovered on a
+BCM97449SSV_DDR4 system with 4GB or memory.
+
+The fix is to enable CONFIG_ZONE_DMA. On ARM systems this makes sure
+that all DMA memory is located within the first 32 bits of address
+space.
+
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-bcm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-bcm/Kconfig
++++ b/arch/arm/mach-bcm/Kconfig
+@@ -199,6 +199,7 @@ config ARCH_BRCMSTB
+ select BRCMSTB_L2_IRQ
+ select BCM7120_L2_IRQ
+ select ARCH_DMA_ADDR_T_64BIT if ARM_LPAE
++ select ZONE_DMA if ARM_LPAE
+ select SOC_BRCMSTB
+ select SOC_BUS
+ help
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 13 Mar 2017 13:53:16 +0200
+Subject: ARM: DRA7: hwmod_data: Prevent wait_target_disable error for usb_otg_ss
+
+From: Roger Quadros <rogerq@ti.com>
+
+
+[ Upstream commit e2d54fe76997301b49311bde7ba8ef52b47896f9 ]
+
+It seems that if L3_INIT clkdomain is kept in HW_AUTO while usb_otg_ss
+is in use then there are random chances that the usb_otg_ss module
+will fail to completely idle. i.e. IDLEST = 0x2 instead of 0x3.
+
+Preventing L3_INIT from HW_AUTO while usb_otg_ss module is in use
+fixes this issue.
+
+We don't know yet if usb_otg_ss instances 3 and 4 are affected by this
+issue or not so don't add this flag for those instances.
+
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+@@ -2572,6 +2572,7 @@ static struct omap_hwmod dra7xx_usb_otg_
+ .class = &dra7xx_usb_otg_ss_hwmod_class,
+ .clkdm_name = "l3init_clkdm",
+ .main_clk = "dpll_core_h13x2_ck",
++ .flags = HWMOD_CLKDM_NOAUTO,
+ .prcm = {
+ .omap4 = {
+ .clkctrl_offs = DRA7XX_CM_L3INIT_USB_OTG_SS1_CLKCTRL_OFFSET,
+@@ -2593,6 +2594,7 @@ static struct omap_hwmod dra7xx_usb_otg_
+ .class = &dra7xx_usb_otg_ss_hwmod_class,
+ .clkdm_name = "l3init_clkdm",
+ .main_clk = "dpll_core_h13x2_ck",
++ .flags = HWMOD_CLKDM_NOAUTO,
+ .prcm = {
+ .omap4 = {
+ .clkctrl_offs = DRA7XX_CM_L3INIT_USB_OTG_SS2_CLKCTRL_OFFSET,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sat, 18 Mar 2017 17:40:01 +0100
+Subject: ARM: dts: Adjust moxart IRQ controller and flags
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+
+[ Upstream commit c2a736b698008d296c5010ec39077eeb5796109f ]
+
+The moxart interrupt line flags were not respected in previous
+driver: instead of assigning them per-consumer, a fixes mask
+was set in the controller.
+
+With the migration to a standard Faraday driver we need to
+set up and handle the consumer flags correctly. Also remove
+the Moxart-specific flags when switching to using real consumer
+flags.
+
+Extend the register window to 0x100 bytes as we may have a few
+more registers in there and it doesn't hurt.
+
+Tested-by: Jonas Jensen <jonas.jensen@gmail.com>
+Signed-off-by: Jonas Jensen <jonas.jensen@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +-
+ arch/arm/boot/dts/moxart.dtsi | 17 +++++++++--------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/boot/dts/moxart-uc7112lx.dts
++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts
+@@ -6,7 +6,7 @@
+ */
+
+ /dts-v1/;
+-/include/ "moxart.dtsi"
++#include "moxart.dtsi"
+
+ / {
+ model = "MOXA UC-7112-LX";
+--- a/arch/arm/boot/dts/moxart.dtsi
++++ b/arch/arm/boot/dts/moxart.dtsi
+@@ -6,6 +6,7 @@
+ */
+
+ /include/ "skeleton.dtsi"
++#include <dt-bindings/interrupt-controller/irq.h>
+
+ / {
+ compatible = "moxa,moxart";
+@@ -36,8 +37,8 @@
+ ranges;
+
+ intc: interrupt-controller@98800000 {
+- compatible = "moxa,moxart-ic";
+- reg = <0x98800000 0x38>;
++ compatible = "moxa,moxart-ic", "faraday,ftintc010";
++ reg = <0x98800000 0x100>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ interrupt-mask = <0x00080000>;
+@@ -59,7 +60,7 @@
+ timer: timer@98400000 {
+ compatible = "moxa,moxart-timer";
+ reg = <0x98400000 0x42>;
+- interrupts = <19 1>;
++ interrupts = <19 IRQ_TYPE_EDGE_FALLING>;
+ clocks = <&clk_apb>;
+ };
+
+@@ -80,7 +81,7 @@
+ dma: dma@90500000 {
+ compatible = "moxa,moxart-dma";
+ reg = <0x90500080 0x40>;
+- interrupts = <24 0>;
++ interrupts = <24 IRQ_TYPE_LEVEL_HIGH>;
+ #dma-cells = <1>;
+ };
+
+@@ -93,7 +94,7 @@
+ sdhci: sdhci@98e00000 {
+ compatible = "moxa,moxart-sdhci";
+ reg = <0x98e00000 0x5C>;
+- interrupts = <5 0>;
++ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_apb>;
+ dmas = <&dma 5>,
+ <&dma 5>;
+@@ -120,7 +121,7 @@
+ mac0: mac@90900000 {
+ compatible = "moxa,moxart-mac";
+ reg = <0x90900000 0x90>;
+- interrupts = <25 0>;
++ interrupts = <25 IRQ_TYPE_LEVEL_HIGH>;
+ phy-handle = <ðphy0>;
+ phy-mode = "mii";
+ status = "disabled";
+@@ -129,7 +130,7 @@
+ mac1: mac@92000000 {
+ compatible = "moxa,moxart-mac";
+ reg = <0x92000000 0x90>;
+- interrupts = <27 0>;
++ interrupts = <27 IRQ_TYPE_LEVEL_HIGH>;
+ phy-handle = <ðphy1>;
+ phy-mode = "mii";
+ status = "disabled";
+@@ -138,7 +139,7 @@
+ uart0: uart@98200000 {
+ compatible = "ns16550a";
+ reg = <0x98200000 0x20>;
+- interrupts = <31 8>;
++ interrupts = <31 IRQ_TYPE_LEVEL_HIGH>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clock-frequency = <14745600>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 11:13:56 -0600
+Subject: ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
+
+From: "Andrew F. Davis" <afd@ti.com>
+
+
+[ Upstream commit e153db03c6b7a035c797bcdf35262586f003ee93 ]
+
+The correct DT property for specifying a GPIO used for reset
+is "reset-gpios", fix this here.
+
+Fixes: 4341881d0562 ("ARM: dts: Add devicetree for Gumstix Pepper board")
+
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am335x-pepper.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/am335x-pepper.dts
++++ b/arch/arm/boot/dts/am335x-pepper.dts
+@@ -139,7 +139,7 @@
+ &audio_codec {
+ status = "okay";
+
+- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>;
++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>;
+ AVDD-supply = <&ldo3_reg>;
+ IOVDD-supply = <&ldo3_reg>;
+ DRVDD-supply = <&ldo3_reg>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Mon, 30 Jan 2017 20:44:39 +0200
+Subject: ARM: dts: bcm2835: add index to the ethernet alias
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+
+[ Upstream commit 10b6c0c2e2bb8cd1be682f8d36ef597e3419cb88 ]
+
+An alias name should have an index number even when it is the only of its type.
+This allows U-Boot to add the local-mac-address property. Otherwise U-Boot
+skips the alias.
+
+Fixes: 6a93792774 ("ARM: bcm2835: dt: Add the ethernet to the device trees")
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Acked-by: Lubomir Rintel <lkundrak@v3.sk>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi | 2 +-
+ arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
++++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
+@@ -1,6 +1,6 @@
+ / {
+ aliases {
+- ethernet = ðernet;
++ ethernet0 = ðernet;
+ };
+ };
+
+--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
++++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
+@@ -1,6 +1,6 @@
+ / {
+ aliases {
+- ethernet = ðernet;
++ ethernet0 = ðernet;
+ };
+ };
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Simon Shields <simon@lineageos.org>
+Date: Tue, 21 Nov 2017 22:24:24 +1100
+Subject: ARM: dts: exynos: Correct Trats2 panel reset line
+
+From: Simon Shields <simon@lineageos.org>
+
+
+[ Upstream commit 1b377924841df1e13ab5b225be3a83f807a92b52 ]
+
+Trats2 uses gpf2-1 as the panel reset GPIO. gpy4-5 was only used
+on early revisions of the board.
+
+Fixes: 420ae8451a22 ("ARM: dts: exynos4412-trats2: add panel node")
+Signed-off-by: Simon Shields <simon@lineageos.org>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/exynos4412-trats2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/exynos4412-trats2.dts
++++ b/arch/arm/boot/dts/exynos4412-trats2.dts
+@@ -408,7 +408,7 @@
+ reg = <0>;
+ vdd3-supply = <&lcd_vdd3_reg>;
+ vci-supply = <&ldo25_reg>;
+- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>;
+ power-on-delay= <50>;
+ reset-delay = <100>;
+ init-delay = <100>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 3 Apr 2017 11:55:19 +0200
+Subject: ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit ebf06af55c7594ed1fc18469a5cddf911c40e687 ]
+
+The X2 crystal oscillator on the Koelsch development board provides a
+74.25 MHz clock, not a 148.5 MHz clock.
+
+Fixes: cd21cb46e14aae3a ("ARM: shmobile: koelsch: Add DU external pixel clocks to DT")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7791-koelsch.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
+@@ -279,7 +279,7 @@
+ x2_clk: x2-clock {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <148500000>;
++ clock-frequency = <74250000>;
+ };
+
+ x13_clk: x13-clock {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 11:13:59 -0600
+Subject: ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
+
+From: "Andrew F. Davis" <afd@ti.com>
+
+
+[ Upstream commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 ]
+
+The correct DT property for specifying a GPIO used for reset
+is "reset-gpios", fix this here.
+
+Fixes: 14e3e295b2b9 ("ARM: dts: omap3-n900: Add TLV320AIC3X support")
+
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap3-n900.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -510,7 +510,7 @@
+ tlv320aic3x: tlv320aic3x@18 {
+ compatible = "ti,tlv320aic3x";
+ reg = <0x18>;
+- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
+ ai3x-gpio-func = <
+ 0 /* AIC3X_GPIO1_FUNC_DISABLED */
+ 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */
+@@ -527,7 +527,7 @@
+ tlv320aic3x_aux: tlv320aic3x@19 {
+ compatible = "ti,tlv320aic3x";
+ reg = <0x19>;
+- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
+
+ AVDD-supply = <&vmmc2>;
+ DRVDD-supply = <&vmmc2>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Thu, 30 Mar 2017 14:16:09 -0700
+Subject: ARM: dts: r7s72100: fix ethernet clock parent
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+
+[ Upstream commit 91a7c50cb4fabfba218549dfa84356069918bfbf ]
+
+Technically, the Ethernet block is run off the 133MHz Bus (B) clock, not
+the 33MHz Peripheral 0 (P0) clock.
+
+Fixes: 969244f9c720 ("ARM: dts: r7s72100: add ethernet clock to device tree")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r7s72100.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r7s72100.dtsi
++++ b/arch/arm/boot/dts/r7s72100.dtsi
+@@ -112,7 +112,7 @@
+ #clock-cells = <1>;
+ compatible = "renesas,r7s72100-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0xfcfe0430 4>;
+- clocks = <&p0_clk>;
++ clocks = <&b_clk>;
+ clock-indices = <R7S72100_CLK_ETHER>;
+ clock-output-names = "ether";
+ };
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 3 Apr 2017 11:45:41 +0200
+Subject: ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit d13d4e063d4a08eb1686e890e9183dde709871bf ]
+
+The SSI-ALL gate clock is located in between the P clock and the
+individual SSI[0-9] clocks, hence the former should be listed as their
+parent.
+
+Fixes: bcde372254386872 ("ARM: shmobile: r8a7790: add MSTP10 support on DTSI")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7790.dtsi | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7790.dtsi
++++ b/arch/arm/boot/dts/r8a7790.dtsi
+@@ -1437,8 +1437,11 @@
+ compatible = "renesas,r8a7790-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>;
+ clocks = <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>,
+ <&p_clk>,
+ <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>,
+ <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 3 Apr 2017 11:45:42 +0200
+Subject: ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 16fe68dcab5702a024d85229ff7e98979cb701a5 ]
+
+The SSI-ALL gate clock is located in between the P clock and the
+individual SSI[0-9] clocks, hence the former should be listed as their
+parent.
+
+Fixes: ee9141522dcf13f8 ("ARM: shmobile: r8a7791: add MSTP10 support on DTSI")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7791.dtsi | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7791.dtsi
++++ b/arch/arm/boot/dts/r8a7791.dtsi
+@@ -1437,8 +1437,11 @@
+ compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>;
+ clocks = <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>,
+ <&p_clk>,
+ <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>,
+ <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 6 Mar 2017 17:40:40 +0100
+Subject: ARM: dts: r8a7791: Remove unit-address and reg from integrated cache
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 5d6a2165abd4635ecf5ece3d02fe8677f00d32c5 ]
+
+The Cortex-A15 cache controller is an integrated controller, and thus
+the device node representing it should not have a unit-addresses or reg
+property.
+
+Fixes: 6f9314ce258c8504 ("ARM: dts: r8a7791: Fix W=1 dtc warnings")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7791.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7791.dtsi
++++ b/arch/arm/boot/dts/r8a7791.dtsi
+@@ -74,9 +74,8 @@
+ next-level-cache = <&L2_CA15>;
+ };
+
+- L2_CA15: cache-controller@0 {
++ L2_CA15: cache-controller-0 {
+ compatible = "cache";
+- reg = <0>;
+ power-domains = <&sysc R8A7791_PD_CA15_SCU>;
+ cache-unified;
+ cache-level = <2>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 6 Mar 2017 17:40:41 +0100
+Subject: ARM: dts: r8a7792: Remove unit-address and reg from integrated cache
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit a0504f0880c11da301dc2b5a5135bd02376e367e ]
+
+The Cortex-A15 cache controller is an integrated controller, and thus
+the device node representing it should not have a unit-addresses or reg
+property.
+
+Fixes: 7c4163aae3d8e5b9 ("ARM: dts: r8a7792: initial SoC device tree")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7792.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7792.dtsi
++++ b/arch/arm/boot/dts/r8a7792.dtsi
+@@ -58,9 +58,8 @@
+ next-level-cache = <&L2_CA15>;
+ };
+
+- L2_CA15: cache-controller@0 {
++ L2_CA15: cache-controller-0 {
+ compatible = "cache";
+- reg = <0>;
+ cache-unified;
+ cache-level = <2>;
+ power-domains = <&sysc R8A7792_PD_CA15_SCU>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 3 Apr 2017 11:45:43 +0200
+Subject: ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 1cd9028027c7a7c10b774df698c3cfafec6aa67d ]
+
+The SSI-ALL gate clock is located in between the P clock and the
+individual SSI[0-9] clocks, hence the former should be listed as their
+parent.
+
+Fixes: 072d326542e49187 ("ARM: dts: r8a7793: add MSTP10 clocks to device tree")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7793.dtsi | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7793.dtsi
++++ b/arch/arm/boot/dts/r8a7793.dtsi
+@@ -1234,8 +1234,11 @@
+ compatible = "renesas,r8a7793-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>;
+ clocks = <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
+- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>,
++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>,
+ <&p_clk>,
+ <&mstp10_clks R8A7793_CLK_SCU_ALL>, <&mstp10_clks R8A7793_CLK_SCU_ALL>,
+ <&mstp10_clks R8A7793_CLK_SCU_ALL>, <&mstp10_clks R8A7793_CLK_SCU_ALL>,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 6 Mar 2017 17:40:42 +0100
+Subject: ARM: dts: r8a7793: Remove unit-address and reg from integrated cache
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit beffa8872a3680ef804eb0320ec77037170f4686 ]
+
+The Cortex-A15 cache controller is an integrated controller, and thus
+the device node representing it should not have a unit-addresses or reg
+property.
+
+Fixes: ad53f5f00b095a0d ("ARM: dts: r8a7793: Fix W=1 dtc warnings")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7793.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7793.dtsi
++++ b/arch/arm/boot/dts/r8a7793.dtsi
+@@ -65,9 +65,8 @@
+ power-domains = <&sysc R8A7793_PD_CA15_CPU1>;
+ };
+
+- L2_CA15: cache-controller@0 {
++ L2_CA15: cache-controller-0 {
+ compatible = "cache";
+- reg = <0>;
+ power-domains = <&sysc R8A7793_PD_CA15_SCU>;
+ cache-unified;
+ cache-level = <2>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 28 Mar 2017 12:45:31 +0200
+Subject: ARM: dts: r8a7794: Correct clock of DU1
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 89675f36c9e17512812b9d14d9824f8ef92782c3 ]
+
+The second channel of the display unit uses a different module clock
+than the first channel.
+
+Fixes: 46c4f13d04d729fa ("ARM: shmobile: r8a7794: Add DU node to device tree")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7794.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a7794.dtsi
++++ b/arch/arm/boot/dts/r8a7794.dtsi
+@@ -916,7 +916,7 @@
+ interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp7_clks R8A7794_CLK_DU0>,
+- <&mstp7_clks R8A7794_CLK_DU0>;
++ <&mstp7_clks R8A7794_CLK_DU1>;
+ clock-names = "du.0", "du.1";
+ status = "disabled";
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 6 Mar 2017 17:40:43 +0100
+Subject: ARM: dts: r8a7794: Remove unit-address and reg from integrated cache
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 65d0b7ed40f8a3a41a0ac5ed5ca4d1874c6aaf2d ]
+
+The Cortex-A7 cache controller is an integrated controller, and thus the
+device node representing it should not have a unit-addresses or reg
+property.
+
+Fixes: 34ea4b4a827b4ee7 ("ARM: dts: r8a7794: Fix W=1 dtc warnings")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7794.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7794.dtsi
++++ b/arch/arm/boot/dts/r8a7794.dtsi
+@@ -56,9 +56,8 @@
+ next-level-cache = <&L2_CA7>;
+ };
+
+- L2_CA7: cache-controller@0 {
++ L2_CA7: cache-controller-0 {
+ compatible = "cache";
+- reg = <0>;
+ power-domains = <&sysc R8A7794_PD_CA7_SCU>;
+ cache-unified;
+ cache-level = <2>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 28 Mar 2017 12:45:33 +0200
+Subject: ARM: dts: silk: Correct clock of DU1
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 403fe77e22eb72c962c3889efc9d4fa62e454737 ]
+
+The second channel of the display unit uses a different module clock
+than the first channel.
+
+Fixes: 84e734f497cd48f6 ("ARM: dts: silk: add DU DT support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7794-silk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a7794-silk.dts
++++ b/arch/arm/boot/dts/r8a7794-silk.dts
+@@ -425,7 +425,7 @@
+ status = "okay";
+
+ clocks = <&mstp7_clks R8A7794_CLK_DU0>,
+- <&mstp7_clks R8A7794_CLK_DU0>,
++ <&mstp7_clks R8A7794_CLK_DU1>,
+ <&x2_clk>, <&x3_clk>;
+ clock-names = "du.0", "du.1", "dclkin.0", "dclkin.1";
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 3 Mar 2017 14:18:17 +0100
+Subject: arm64: dts: r8a7796: Remove unit-address and reg from integrated cache
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 57a4fd420c6e8a04b6a87ff24d34250cd7c48f15 ]
+
+The Cortex-A57 cache controller is an integrated controller, and thus
+the device node representing it should not have a unit-addresses or reg
+property.
+
+Fixes: 1561f20760ec96db ("arm64: dts: r8a7796: Add Renesas R8A7796 SoC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
+@@ -36,9 +36,8 @@
+ enable-method = "psci";
+ };
+
+- L2_CA57: cache-controller@0 {
++ L2_CA57: cache-controller-0 {
+ compatible = "cache";
+- reg = <0>;
+ power-domains = <&sysc R8A7796_PD_CA57_SCU>;
+ cache-unified;
+ cache-level = <2>;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 9 Dec 2017 14:52:28 +0300
+Subject: ASoC: nuc900: Fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ]
+
+We should be finishing the loop with timeout set to zero but because
+this is a post-op we finish with timeout == -1.
+
+Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/nuc900/nuc900-ac97.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/nuc900/nuc900-ac97.c
++++ b/sound/soc/nuc900/nuc900-ac97.c
+@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(s
+
+ /* polling the AC_R_FINISH */
+ while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH)
+- && timeout--)
++ && --timeout)
+ mdelay(1);
+
+ if (!timeout) {
+@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd
+
+ /* polling the AC_W_FINISH */
+ while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH)
+- && timeout--)
++ && --timeout)
+ mdelay(1);
+
+ if (!timeout)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Wed, 22 Mar 2017 04:02:43 +0000
+Subject: ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+
+[ Upstream commit 6b8530cc056efd4a11b034ca5b1e9f7e9563f553 ]
+
+R-Car Datasheet is indicating "SSICR.CKDV = 000 is invalid when
+SSIWSR.WS_MODE = 1 or SSIWSR.CONT = 1".
+Current driver will set CONT, thus, we shouldn't use CKDV = 000.
+This patch fixup it.
+
+Reported-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/ssi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -233,6 +233,15 @@ static int rsnd_ssi_master_clk_start(str
+ for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) {
+
+ /*
++ * It will set SSIWSR.CONT here, but SSICR.CKDV = 000
++ * with it is not allowed. (SSIWSR.WS_MODE with
++ * SSICR.CKDV = 000 is not allowed either).
++ * Skip it. See SSICR.CKDV
++ */
++ if (j == 0)
++ continue;
++
++ /*
+ * this driver is assuming that
+ * system word is 32bit x chan
+ * see rsnd_ssi_init()
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Tue, 4 Apr 2017 15:26:30 -0400
+Subject: ASoC: rt5677: Add OF device ID table
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+
+[ Upstream commit 7b87463edf3e2c16d72eeea3d1cf3c12bb5487c6 ]
+
+The driver doesn't have a struct of_device_id table but supported devices
+are registered via Device Trees. This is working on the assumption that a
+I2C device registered via OF will always match a legacy I2C device ID and
+that the MODALIAS reported will always be of the form i2c:<device>.
+
+But this could change in the future so the correct approach is to have an
+OF device ID table if the devices are registered via OF.
+
+Before this patch:
+
+$ modinfo sound/soc/codecs/snd-soc-rt5677.ko | grep alias
+alias: i2c:RT5677CE:00
+alias: i2c:rt5676
+alias: i2c:rt5677
+
+After this patch:
+
+$ modinfo sound/soc/codecs/snd-soc-rt5677.ko | grep alias
+alias: of:N*T*Crealtek,rt5677C*
+alias: of:N*T*Crealtek,rt5677
+alias: i2c:RT5677CE:00
+alias: i2c:rt5676
+alias: i2c:rt5677
+
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/rt5677.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -5035,6 +5035,12 @@ static const struct i2c_device_id rt5677
+ };
+ MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
+
++static const struct of_device_id rt5677_of_match[] = {
++ { .compatible = "realtek,rt5677", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, rt5677_of_match);
++
+ static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
+ static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
+ static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
+@@ -5294,6 +5300,7 @@ static int rt5677_i2c_remove(struct i2c_
+ static struct i2c_driver rt5677_i2c_driver = {
+ .driver = {
+ .name = "rt5677",
++ .of_match_table = rt5677_of_match,
+ },
+ .probe = rt5677_i2c_probe,
+ .remove = rt5677_i2c_remove,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Date: Wed, 22 Feb 2017 21:03:11 +0530
+Subject: ath10k: disallow DFS simulation if DFS channel is not enabled
+
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+
+
+[ Upstream commit ca07baab0b1e627ae1d4a55d190fb1c9d32a3445 ]
+
+If DFS is not enabled in hostapd (ieee80211h=0) DFS channels shall
+not be available for use even though the hardware may have the capability
+to support DFS. With this configuration (DFS disabled in hostapd) trying to
+bring up ath10k device in DFS channel for AP mode fails and trying to
+simulate DFS in ath10k debugfs results in a warning in cfg80211 complaining
+invalid channel and this should be avoided in the driver itself rather than
+false propogating RADAR detection to mac80211/cfg80211. Fix this by
+checking for the first vif 'is_started' state(should work for client mode
+as well) as all the vifs shall be configured for the same channel
+
+sys/kernel/debug/ieee80211/phy1/ath10k# echo 1 > dfs_simulate_radar
+
+WARNING: at net/wireless/chan.c:265 cfg80211_radar_event+0x24/0x60
+Workqueue: phy0 ieee80211_dfs_radar_detected_work [mac80211]
+[<c022f2d4>] (warn_slowpath_null) from
+[<bf72dab8>] (cfg80211_radar_event+0x24/0x60 [cfg80211])
+[<bf72dab8>] (cfg80211_radar_event [cfg80211]) from
+[<bf7813e0>] (ieee80211_dfs_radar_detected_work+0x94/0xa0 [mac80211])
+[<bf7813e0>] (ieee80211_dfs_radar_detected_work [mac80211]) from
+[<c0242320>] (process_one_work+0x20c/0x32c)
+
+WARNING: at net/wireless/nl80211.c:2488 nl80211_get_mpath+0x13c/0x4cc
+ Workqueue: phy0 ieee80211_dfs_radar_detected_work [mac80211]
+[<c022f2d4>] (warn_slowpath_null) from
+[<bf72dab8>] (cfg80211_radar_event+0x24/0x60 [cfg80211])
+[<bf72dab8>] (cfg80211_radar_event [cfg80211]) from
+[<bf7813e0>] (ieee80211_dfs_radar_detected_work+0x94/0xa0 [mac80211])
+[<bf7813e0>] (ieee80211_dfs_radar_detected_work [mac80211]) from
+[<c0242320>] (process_one_work+0x20c/0x32c)
+
+Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/debug.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/debug.c
++++ b/drivers/net/wireless/ath/ath10k/debug.c
+@@ -1942,6 +1942,15 @@ static ssize_t ath10k_write_simulate_rad
+ size_t count, loff_t *ppos)
+ {
+ struct ath10k *ar = file->private_data;
++ struct ath10k_vif *arvif;
++
++ /* Just check for for the first vif alone, as all the vifs will be
++ * sharing the same channel and if the channel is disabled, all the
++ * vifs will share the same 'is_started' state.
++ */
++ arvif = list_first_entry(&ar->arvifs, typeof(*arvif), list);
++ if (!arvif->is_started)
++ return -EINVAL;
+
+ ieee80211_radar_detected(ar->hw);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Date: Wed, 8 Mar 2017 13:52:06 +0200
+Subject: ath10k: fix a warning during channel switch with multiple vaps
+
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+
+
+[ Upstream commit c73f8c00330f59ce9b1ace9ff698aca83390d358 ]
+
+Doing a channel switch via hostapd_cli seems to update
+the new channel context for each VAP's appropriately as below
+in 'ath10k_mac_update_vif_chan', hence we can safely suppress the
+warning that shows up during this operation and dump the warning only
+if no vaps are available for channel switch
+
+hostapd_cli -i wlan0 chan_switch 5 5200
+OK
+
+ath10k_pci : mac chanctx switch n_vifs 3 mode 1
+ath10k_pci : mac chanctx switch vdev_id 2 freq 5180->5200 width 0->0
+ath10k_pci : mac chanctx switch vdev_id 1 freq 5180->5200 width 0->0
+ath10k_pci : mac chanctx switch vdev_id 0 freq 5180->5200 width 0->0
+
+Call Trace:
+
+WARNING: backports-20161201-3.14.77-9ab3068/drivers/net/wireless/ath/ath10k/mac.c:7126
+[<c022f2d4>] (warn_slowpath_null) from [<bf7f150c>]
+(ath10k_reconfig_complete+0xe4/0x25c [ath10k_core])
+[<bf7f150c>] (ath10k_reconfig_complete [ath10k_core])
+[<bf7f35f0>] (ath10k_mac_vif_ap_csa_work+0x214/0x370 [ath10k_core])
+[<bf7f38b8>] (ath10k_mac_op_change_chanctx+0x108/0x128 [ath10k_core])
+[<bf782ac0>] (ieee80211_recalc_chanctx_min_def+0x30c/0x430 [mac80211])
+[<bf7830a4>] (ieee80211_recalc_smps_chanctx+0x2ec/0x840 [mac80211])
+[<bf7843e8>] (ieee80211_vif_use_reserved_context+0x7c/0xf8 [mac80211])
+[<bf7843e8>] (ieee80211_vif_use_reserved_context [mac80211])
+[<bf76e5d4>] (ieee80211_csa_finalize_work+0x5c/0x88 [mac80211])
+
+Fixes: d7bf4b4aba05 ("ath10k: fix ar->rx_channel updating logic")
+Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -7070,7 +7070,7 @@ ath10k_mac_update_rx_channel(struct ath1
+ lockdep_assert_held(&ar->data_lock);
+
+ WARN_ON(ctx && vifs);
+- WARN_ON(vifs && n_vifs != 1);
++ WARN_ON(vifs && !n_vifs);
+
+ /* FIXME: Sort of an optimization and a workaround. Peers and vifs are
+ * on a linked list now. Doing a lookup peer -> vif -> chanctx for each
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Date: Tue, 4 Apr 2017 22:22:56 +0530
+Subject: ath10k: fix compile time sanity check for CE4 buffer size
+
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+
+
+[ Upstream commit 62ca0690cd495bb7c1414cdf0cf790c2922a1d79 ]
+
+In 'ath10k_ce_alloc_pipe' the compile time sanity check to
+ensure that there is sufficient buffers in CE4 for HTT Tx
+MSDU descriptors, but this did not take into account of the
+case with 'peer flow control' enabled, fix this.
+
+Cc: Michal Kazior <michal.kazior@tieto.com>
+Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/ce.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/ce.c
++++ b/drivers/net/wireless/ath/ath10k/ce.c
+@@ -1059,7 +1059,7 @@ int ath10k_ce_alloc_pipe(struct ath10k *
+ */
+ BUILD_BUG_ON(2 * TARGET_NUM_MSDU_DESC >
+ (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+- BUILD_BUG_ON(2 * TARGET_10X_NUM_MSDU_DESC >
++ BUILD_BUG_ON(2 * TARGET_10_4_NUM_MSDU_DESC_PFC >
+ (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+ BUILD_BUG_ON(2 * TARGET_TLV_NUM_MSDU_DESC >
+ (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Date: Wed, 8 Mar 2017 18:03:32 +0530
+Subject: ath10k: fix fetching channel during potential radar detection
+
+From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+
+
+[ Upstream commit a28f6f27a88f047f03f04b9246ca260ebc91455e ]
+
+Fetch target operating channel during potential radar detection when
+the interface is just brought up, but no channel is assigned from
+userspace. In this scenario rx_channel may not be having a valid pointer
+hence fetch the target operating channel to avoid warnings as below
+which can be triggered by the commands with DFS testing over longer run
+
+comamnds:
+iw wlan1 set type mesh
+ifconfig wlan1 up (valid tgt_oper_chan only)
+iw wlan1 cac trigger freq 5260 HT20 (valid rx_channel, tgt_oper_chan)
+iw wlan1 cac trigger freq 5280 HT20
+iw wlan1 cac trigger freq 5300 HT20
+
+Once the CAC expires, current channel context will be removed and
+we are only left with the fallback option of using 'target operating
+channel'
+
+Firmware and driver log:
+ath: phy1: DFS: radar found on freq=5300: id=1, pri=1125, count=5,
+count_false=4
+ath: phy1: DFS: radar found on freq=5260: id=5, pri=3151, count=6,
+count_false=11
+ath: phy1: DFS: radar found on freq=5280: id=1, pri=1351, count=6,
+count_false=4
+ath: phy1: DFS: radar found on freq=5300: id=1, pri=1125, count=5,
+count_false=4
+ath10k_pci 0001:01:00.0: failed to derive channel for radar pulse,
+treating as radar
+ath10k_pci 0001:01:00.0: failed to derive channel for radar pulse,
+treating as radar
+
+Call trace:
+
+WARNING: CPU: 1 PID: 2145 at
+backports-20161201-3.14.77-9ab3068/net/wireless/chan.c:265
+cfg80211_set_dfs_state+0x3c/0x88 [cfg80211]()
+
+ Workqueue: phy1 ieee80211_dfs_radar_detected_work
+[mac80211]
+[<c0320770>] (warn_slowpath_null) from [<bf79b90c>]
+(cfg80211_set_dfs_state+0x3c/0x88 [cfg80211])
+[<bf79b90c>] (cfg80211_set_dfs_state [cfg80211]) from
+[<bf79697c>] (cfg80211_radar_event+0xc4/0x140 [cfg80211])
+[<bf79697c>] (cfg80211_radar_event [cfg80211]) from
+[<bf83c058>] (ieee80211_dfs_radar_detected_work+0xa8/0xb4 [mac80211])
+[<bf83c058>] (ieee80211_dfs_radar_detected_work
+[mac80211]) from [<c0339518>] (process_one_work+0x298/0x4a4)
+
+Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -3638,6 +3638,11 @@ static void ath10k_dfs_radar_report(stru
+
+ spin_lock_bh(&ar->data_lock);
+ ch = ar->rx_channel;
++
++ /* fetch target operating channel during channel change */
++ if (!ch)
++ ch = ar->tgt_oper_chan;
++
+ spin_unlock_bh(&ar->data_lock);
+
+ if (!ch) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Ben Greear <greearb@candelatech.com>
+Date: Sat, 2 Dec 2017 16:50:49 +0200
+Subject: ath10k: fix invalid STS_CAP_OFFSET_MASK
+
+From: Ben Greear <greearb@candelatech.com>
+
+
+[ Upstream commit 8cec57f5277ef0e354e37a0bf909dc71bc1f865b ]
+
+The 10.4 firmware defines this as a 3-bit field, as does the
+mac80211 stack. The 4th bit is defined as CONF_IMPLICIT_BF
+at least in the firmware header I have seen. This patch
+fixes the ath10k wmi header to match the firmware.
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -5017,7 +5017,8 @@ enum wmi_10_4_vdev_param {
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3)
+
+ #define WMI_TXBF_STS_CAP_OFFSET_LSB 4
+-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0
++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70
++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7)
+ #define WMI_BF_SOUND_DIM_OFFSET_LSB 8
+ #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+Date: Mon, 6 Nov 2017 13:39:31 +0530
+Subject: ath10k: update tdls teardown state to target
+
+From: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+
+
+[ Upstream commit 424ea0d174e82365f85c6770225dba098b8f1d5f ]
+
+It is required to update the teardown state of the peer when
+a tdls link with that peer is terminated. This information is
+useful for the target to perform some cleanups wrt the tdls peer.
+
+Without proper cleanup, target assumes that the peer is connected and
+blocks future connection requests, updating the teardown state of the
+peer addresses the problem.
+
+Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6054,6 +6054,16 @@ static int ath10k_sta_state(struct ieee8
+ "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
+ arvif->vdev_id, sta->addr, sta);
+
++ if (sta->tdls) {
++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
++ sta,
++ WMI_TDLS_PEER_STATE_TEARDOWN);
++ if (ret)
++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n",
++ sta->addr,
++ WMI_TDLS_PEER_STATE_TEARDOWN, ret);
++ }
++
+ ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
+ if (ret)
+ ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Andreas Pape <APape@phoenixcontact.com>
+Date: Mon, 5 Sep 2016 13:20:29 +0200
+Subject: batman-adv: handle race condition for claims between gateways
+
+From: Andreas Pape <APape@phoenixcontact.com>
+
+
+[ Upstream commit a3a5129e122709306cfa6409781716c2933df99b ]
+
+Consider the following situation which has been found in a test setup:
+Gateway B has claimed client C and gateway A has the same backbone
+network as B. C sends a broad- or multicast to B and directly after
+this packet decides to send another packet to A due to a better TQ
+value. B will forward the broad-/multicast into the backbone as it is
+the responsible gw and after that A will claim C as it has been
+chosen by C as the best gateway. If it now happens that A claims C
+before it has received the broad-/multicast forwarded by B (due to
+backbone topology or due to some delay in B when forwarding the
+packet) we get a critical situation: in the current code A will
+immediately unclaim C when receiving the multicast due to the
+roaming client scenario although the position of C has not changed
+in the mesh. If this happens the multi-/broadcast forwarded by B
+will be sent back into the mesh by A and we have looping packets
+until one of the gateways claims C again.
+In order to prevent this, unclaiming of a client due to the roaming
+client scenario is only done after a certain time is expired after
+the last claim of the client. 100 ms are used here, which should be
+slow enough for big backbones and slow gateways but fast enough not
+to break the roaming client use case.
+
+Acked-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Andreas Pape <apape@phoenixcontact.com>
+[sven@narfation.org: fix conflicts with current version]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/bridge_loop_avoidance.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -1964,10 +1964,22 @@ bool batadv_bla_tx(struct batadv_priv *b
+ /* if yes, the client has roamed and we have
+ * to unclaim it.
+ */
+- batadv_handle_unclaim(bat_priv, primary_if,
+- primary_if->net_dev->dev_addr,
+- ethhdr->h_source, vid);
+- goto allow;
++ if (batadv_has_timed_out(claim->lasttime, 100)) {
++ /* only unclaim if the last claim entry is
++ * older than 100 ms to make sure we really
++ * have a roaming client here.
++ */
++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Roaming client %pM detected. Unclaim it.\n",
++ ethhdr->h_source);
++ batadv_handle_unclaim(bat_priv, primary_if,
++ primary_if->net_dev->dev_addr,
++ ethhdr->h_source, vid);
++ goto allow;
++ } else {
++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Race for claim %pM detected. Drop packet.\n",
++ ethhdr->h_source);
++ goto handled;
++ }
+ }
+
+ /* check if it is a multicast/broadcast frame */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Shaohua Li <shli@fb.com>
+Date: Mon, 27 Mar 2017 10:51:36 -0700
+Subject: blk-throttle: make sure expire time isn't too big
+
+From: Shaohua Li <shli@fb.com>
+
+
+[ Upstream commit 06cceedcca67a93ac7f7aa93bbd9980c7496d14e ]
+
+cgroup could be throttled to a limit but when all cgroups cross high
+limit, queue enters a higher state and so the group should be throttled
+to a higher limit. It's possible the cgroup is sleeping because of
+throttle and other cgroups don't dispatch IO any more. In this case,
+nobody can trigger current downgrade/upgrade logic. To fix this issue,
+we could either set up a timer to wakeup the cgroup if other cgroups are
+idle or make sure this cgroup doesn't sleep too long. Setting up a timer
+means we must change the timer very frequently. This patch chooses the
+latter. Making cgroup sleep time not too big wouldn't change cgroup
+bps/iops, but could make it wakeup more frequently, which isn't a big
+issue because throtl_slice * 8 is already quite big.
+
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-throttle.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -499,6 +499,17 @@ static void throtl_dequeue_tg(struct thr
+ static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
+ unsigned long expires)
+ {
++ unsigned long max_expire = jiffies + 8 * throtl_slice;
++
++ /*
++ * Since we are adjusting the throttle limit dynamically, the sleep
++ * time calculated according to previous limit might be invalid. It's
++ * possible the cgroup sleep time is very long and no other cgroups
++ * have IO running so notify the limit changes. Make sure the cgroup
++ * doesn't sleep too long to avoid the missed notification.
++ */
++ if (time_after(expires, max_expire))
++ expires = max_expire;
+ mod_timer(&sq->pending_timer, expires);
+ throtl_log(sq, "schedule timer. delay=%lu jiffies=%lu",
+ expires - jiffies, jiffies);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Michael Scott <michael.scott@linaro.org>
+Date: Tue, 28 Mar 2017 23:10:54 -0700
+Subject: Bluetooth: 6lowpan: fix delay work init in add_peer_chan()
+
+From: Michael Scott <michael.scott@linaro.org>
+
+
+[ Upstream commit d2891c4d071d807f01cc911dc42a68f4568d65cf ]
+
+When adding 6lowpan devices very rapidly we sometimes see a crash:
+[23122.306615] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.0-43-arm64 #1 Debian 4.9.9.linaro.43-1
+[23122.315400] Hardware name: HiKey Development Board (DT)
+[23122.320623] task: ffff800075443080 task.stack: ffff800075484000
+[23122.326551] PC is at expire_timers+0x70/0x150
+[23122.330907] LR is at run_timer_softirq+0xa0/0x1a0
+[23122.335616] pc : [<ffff000008142dd8>] lr : [<ffff000008142f58>] pstate: 600001c5
+
+This was due to add_peer_chan() unconditionally initializing the
+lowpan_btle_dev->notify_peers delayed work structure, even if the
+lowpan_btle_dev passed into add_peer_chan() had previously been
+initialized.
+
+Normally, this would go unnoticed as the delayed work timer is set for
+100 msec, however when calling add_peer_chan() faster than 100 msec it
+clears out a previously queued delay work causing the crash above.
+
+To fix this, let add_peer_chan() know when a new lowpan_btle_dev is passed
+in so that it only performs the delay work initialization when needed.
+
+Signed-off-by: Michael Scott <michael.scott@linaro.org>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/6lowpan.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -755,7 +755,8 @@ static void set_ip_addr_bits(u8 addr_typ
+ }
+
+ static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan,
+- struct lowpan_btle_dev *dev)
++ struct lowpan_btle_dev *dev,
++ bool new_netdev)
+ {
+ struct lowpan_peer *peer;
+
+@@ -786,7 +787,8 @@ static struct l2cap_chan *add_peer_chan(
+ spin_unlock(&devices_lock);
+
+ /* Notifying peers about us needs to be done without locks held */
+- INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers);
++ if (new_netdev)
++ INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers);
+ schedule_delayed_work(&dev->notify_peers, msecs_to_jiffies(100));
+
+ return peer->chan;
+@@ -843,6 +845,7 @@ out:
+ static inline void chan_ready_cb(struct l2cap_chan *chan)
+ {
+ struct lowpan_btle_dev *dev;
++ bool new_netdev = false;
+
+ dev = lookup_dev(chan->conn);
+
+@@ -853,12 +856,13 @@ static inline void chan_ready_cb(struct
+ l2cap_chan_del(chan, -ENOENT);
+ return;
+ }
++ new_netdev = true;
+ }
+
+ if (!try_module_get(THIS_MODULE))
+ return;
+
+- add_peer_chan(chan, dev);
++ add_peer_chan(chan, dev, new_netdev);
+ ifup(dev->netdev);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dean Jenkins <Dean_Jenkins@mentor.com>
+Date: Fri, 10 Mar 2017 11:34:46 +0000
+Subject: Bluetooth: Avoid bt_accept_unlink() double unlinking
+
+From: Dean Jenkins <Dean_Jenkins@mentor.com>
+
+
+[ Upstream commit 27bfbc21a0c0f711fa5382de026c7c0700c9ea28 ]
+
+There is a race condition between a thread calling bt_accept_dequeue()
+and a different thread calling bt_accept_unlink(). Protection against
+concurrency is implemented using sk locking. However, sk locking causes
+serialisation of the bt_accept_dequeue() and bt_accept_unlink() threads.
+This serialisation can cause bt_accept_dequeue() to obtain the sk from the
+parent list but becomes blocked waiting for the sk lock held by the
+bt_accept_unlink() thread. bt_accept_unlink() unlinks sk and this thread
+releases the sk lock unblocking bt_accept_dequeue() which potentially runs
+bt_accept_unlink() again on the same sk causing a crash. The attempt to
+double unlink the same sk from the parent list can cause a NULL pointer
+dereference crash due to bt_sk(sk)->parent becoming NULL on the first
+unlink, followed by the second unlink trying to execute
+bt_sk(sk)->parent->sk_ack_backlog-- in bt_accept_unlink() which crashes.
+
+When sk is in the parent list, bt_sk(sk)->parent will be not be NULL.
+When sk is removed from the parent list, bt_sk(sk)->parent is set to
+NULL. Therefore, add a defensive check for bt_sk(sk)->parent not being
+NULL to ensure that sk is still in the parent list after the sk lock has
+been taken in bt_accept_dequeue(). If bt_sk(sk)->parent is detected as
+being NULL then restart the loop so that the loop variables are refreshed
+to use the latest values. This is necessary as list_for_each_entry_safe()
+is not thread safe so causing a risk of an infinite loop occurring as sk
+could point to itself.
+
+In addition, in bt_accept_dequeue() increase the sk reference count to
+protect against early freeing of sk. Early freeing can be possible if the
+bt_accept_unlink() thread calls l2cap_sock_kill() or rfcomm_sock_kill()
+functions before bt_accept_dequeue() gets the sk lock.
+
+For test purposes, the probability of failure can be increased by putting
+a msleep of 1 second in bt_accept_dequeue() between getting the sk and
+waiting for the sk lock. This exposes the fact that the loop
+list_for_each_entry_safe(p, n, &bt_sk(parent)->accept_q) is not safe from
+threads that unlink sk from the list in parallel with the loop which can
+cause sk to become stale within the loop.
+
+Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/af_bluetooth.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -163,6 +163,9 @@ void bt_accept_enqueue(struct sock *pare
+ }
+ EXPORT_SYMBOL(bt_accept_enqueue);
+
++/* Calling function must hold the sk lock.
++ * bt_sk(sk)->parent must be non-NULL meaning sk is in the parent list.
++ */
+ void bt_accept_unlink(struct sock *sk)
+ {
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+@@ -181,11 +184,32 @@ struct sock *bt_accept_dequeue(struct so
+
+ BT_DBG("parent %p", parent);
+
++restart:
+ list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) {
+ sk = (struct sock *)s;
+
++ /* Prevent early freeing of sk due to unlink and sock_kill */
++ sock_hold(sk);
+ lock_sock(sk);
+
++ /* Check sk has not already been unlinked via
++ * bt_accept_unlink() due to serialisation caused by sk locking
++ */
++ if (!bt_sk(sk)->parent) {
++ BT_DBG("sk %p, already unlinked", sk);
++ release_sock(sk);
++ sock_put(sk);
++
++ /* Restart the loop as sk is no longer in the list
++ * and also avoid a potential infinite loop because
++ * list_for_each_entry_safe() is not thread safe.
++ */
++ goto restart;
++ }
++
++ /* sk is safely in the parent list so reduce reference count */
++ sock_put(sk);
++
+ /* FIXME: Is this check still needed */
+ if (sk->sk_state == BT_CLOSED) {
+ bt_accept_unlink(sk);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Wed, 6 Dec 2017 17:31:22 -0500
+Subject: bnxt_en: Don't print "Link speed -1 no longer supported" messages.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+
+[ Upstream commit a8168b6cee6e9334dfebb4b9108e8d73794f6088 ]
+
+On some dual port NICs, the 2 ports have to be configured with compatible
+link speeds. Under some conditions, a port's configured speed may no
+longer be supported. The firmware will send a message to the driver
+when this happens.
+
+Improve this logic that prints out the warning by only printing it if
+we can determine the link speed that is no longer supported. If the
+speed is unknown or it is in autoneg mode, skip the warning message.
+
+Reported-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Tested-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1498,12 +1498,16 @@ static int bnxt_async_event_process(stru
+
+ if (BNXT_VF(bp))
+ goto async_event_process_exit;
+- if (data1 & 0x20000) {
++
++ /* print unsupported speed warning in forced speed mode only */
++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED) &&
++ (data1 & 0x20000)) {
+ u16 fw_speed = link_info->force_link_speed;
+ u32 speed = bnxt_fw_to_ethtool_speed(fw_speed);
+
+- netdev_warn(bp->dev, "Link speed %d no longer supported\n",
+- speed);
++ if (speed != SPEED_UNKNOWN)
++ netdev_warn(bp->dev, "Link speed %d no longer supported\n",
++ speed);
+ }
+ set_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, &bp->sp_event);
+ /* fall thru */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mahesh Bandewar <maheshb@google.com>
+Date: Mon, 27 Mar 2017 11:37:35 -0700
+Subject: bonding: make speed, duplex setting consistent with link state
+
+From: Mahesh Bandewar <maheshb@google.com>
+
+
+[ Upstream commit c4adfc822bf5d8e97660b6114b5a8892530ce8cb ]
+
+bond_update_speed_duplex() retrieves speed and duplex settings. There
+is a possibility of failure in retrieving these values but caller has
+to assume it's always successful. This leads to having inconsistent
+slave link settings. If these (speed, duplex) values cannot be
+retrieved, then keeping the link UP causes problems.
+
+The updated bond_update_speed_duplex() returns 0 on success if it
+retrieves sane values for speed and duplex. On failure it returns 1
+and marks the link down.
+
+Signed-off-by: Mahesh Bandewar <maheshb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -371,9 +371,10 @@ down:
+ /* Get link speed and duplex from the slave's base driver
+ * using ethtool. If for some reason the call fails or the
+ * values are invalid, set speed and duplex to -1,
+- * and return.
++ * and return. Return 1 if speed or duplex settings are
++ * UNKNOWN; 0 otherwise.
+ */
+-static void bond_update_speed_duplex(struct slave *slave)
++static int bond_update_speed_duplex(struct slave *slave)
+ {
+ struct net_device *slave_dev = slave->dev;
+ struct ethtool_link_ksettings ecmd;
+@@ -383,24 +384,27 @@ static void bond_update_speed_duplex(str
+ slave->duplex = DUPLEX_UNKNOWN;
+
+ res = __ethtool_get_link_ksettings(slave_dev, &ecmd);
+- if (res < 0)
+- return;
+-
+- if (ecmd.base.speed == 0 || ecmd.base.speed == ((__u32)-1))
+- return;
+-
++ if (res < 0) {
++ slave->link = BOND_LINK_DOWN;
++ return 1;
++ }
++ if (ecmd.base.speed == 0 || ecmd.base.speed == ((__u32)-1)) {
++ slave->link = BOND_LINK_DOWN;
++ return 1;
++ }
+ switch (ecmd.base.duplex) {
+ case DUPLEX_FULL:
+ case DUPLEX_HALF:
+ break;
+ default:
+- return;
++ slave->link = BOND_LINK_DOWN;
++ return 1;
+ }
+
+ slave->speed = ecmd.base.speed;
+ slave->duplex = ecmd.base.duplex;
+
+- return;
++ return 0;
+ }
+
+ const char *bond_slave_link_status(s8 link)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 29 Mar 2017 10:45:44 -0700
+Subject: bonding: refine bond_fold_stats() wrap detection
+
+From: Eric Dumazet <edumazet@google.com>
+
+
+[ Upstream commit 142c6594acbcc32391af9c15f8cd65c6c177698f ]
+
+Some device drivers reset their stats at down/up events, possibly
+fooling bonding stats, since they operate with relative deltas.
+
+It is nearly not possible to fix drivers, since some of them compute the
+tx/rx counters based on per rx/tx queue stats, and the queues can be
+reconfigured (ethtool -L) between the down/up sequence.
+
+Lets avoid accumulating 'negative' values that render bonding stats
+useless.
+
+It is better to lose small deltas, assuming the bonding stats are
+fetched at a reasonable frequency.
+
+Fixes: 5f0c5f73e5ef ("bonding: make global bonding stats more reliable")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3331,12 +3331,17 @@ static void bond_fold_stats(struct rtnl_
+ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) {
+ u64 nv = new[i];
+ u64 ov = old[i];
++ s64 delta = nv - ov;
+
+ /* detects if this particular field is 32bit only */
+ if (((nv | ov) >> 32) == 0)
+- res[i] += (u32)nv - (u32)ov;
+- else
+- res[i] += nv - ov;
++ delta = (s64)(s32)((u32)nv - (u32)ov);
++
++ /* filter anomalies, some drivers reset their stats
++ * at down/up events.
++ */
++ if (delta > 0)
++ res[i] += delta;
+ }
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Sun, 26 Mar 2017 22:47:36 +0200
+Subject: braille-console: Fix value returned by _braille_console_setup
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+
+[ Upstream commit 2ed2b8621be2708c0f6d61fe9841e9ad8b9753f0 ]
+
+commit bbeddf52adc1 ("printk: move braille console support into
+separate braille.[ch] files") introduced _braille_console_setup()
+to outline the braille initialization code. There was however some
+confusion over the value it was supposed to return. commit 2cfe6c4ac7ee
+("printk: Fix return of braille_register_console()") tried to fix it
+but failed to.
+
+This fixes and documents the returned value according to the use
+in printk.c: non-zero return means a parsing error, and thus this
+console configuration should be ignored.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Cc: Aleksey Makarov <aleksey.makarov@linaro.org>
+Cc: Joe Perches <joe@perches.com>
+Cc: Ming Lei <ming.lei@canonical.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Acked-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/printk/braille.c | 15 ++++++++-------
+ kernel/printk/braille.h | 13 ++++++++++---
+ 2 files changed, 18 insertions(+), 10 deletions(-)
+
+--- a/kernel/printk/braille.c
++++ b/kernel/printk/braille.c
+@@ -2,12 +2,13 @@
+
+ #include <linux/kernel.h>
+ #include <linux/console.h>
++#include <linux/errno.h>
+ #include <linux/string.h>
+
+ #include "console_cmdline.h"
+ #include "braille.h"
+
+-char *_braille_console_setup(char **str, char **brl_options)
++int _braille_console_setup(char **str, char **brl_options)
+ {
+ if (!strncmp(*str, "brl,", 4)) {
+ *brl_options = "";
+@@ -15,14 +16,14 @@ char *_braille_console_setup(char **str,
+ } else if (!strncmp(*str, "brl=", 4)) {
+ *brl_options = *str + 4;
+ *str = strchr(*brl_options, ',');
+- if (!*str)
++ if (!*str) {
+ pr_err("need port name after brl=\n");
+- else
+- *((*str)++) = 0;
+- } else
+- return NULL;
++ return -EINVAL;
++ }
++ *((*str)++) = 0;
++ }
+
+- return *str;
++ return 0;
+ }
+
+ int
+--- a/kernel/printk/braille.h
++++ b/kernel/printk/braille.h
+@@ -9,7 +9,14 @@ braille_set_options(struct console_cmdli
+ c->brl_options = brl_options;
+ }
+
+-char *
++/*
++ * Setup console according to braille options.
++ * Return -EINVAL on syntax error, 0 on success (or no braille option was
++ * actually given).
++ * Modifies str to point to the serial options
++ * Sets brl_options to the parsed braille options.
++ */
++int
+ _braille_console_setup(char **str, char **brl_options);
+
+ int
+@@ -25,10 +32,10 @@ braille_set_options(struct console_cmdli
+ {
+ }
+
+-static inline char *
++static inline int
+ _braille_console_setup(char **str, char **brl_options)
+ {
+- return NULL;
++ return 0;
+ }
+
+ static inline int
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Yixun Lan <yixun.lan@amlogic.com>
+Date: Tue, 7 Nov 2017 22:12:23 +0800
+Subject: clk: meson: gxbb: fix wrong clock for SARADC/SANA
+
+From: Yixun Lan <yixun.lan@amlogic.com>
+
+
+[ Upstream commit 75eccf5ed83250c0aeaeeb76f7288254ac0a87b4 ]
+
+According to the datasheet, in Meson-GXBB/GXL series,
+The clock gate bit for SARADC is HHI_GCLK_MPEG2 bit[22],
+while clock gate bit for SANA is HHI_GCLK_MPEG0 bit[10].
+
+Test passed at gxl-s905x-p212 board.
+
+The following published datasheets are wrong and should be updated
+[1] GXBB v1.1.4
+[2] GXL v0.3_20170314
+
+Fixes: 738f66d3211d ("clk: gxbb: add AmLogic GXBB clk controller driver")
+Tested-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/meson/gxbb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -572,7 +572,7 @@ static MESON_GATE(gxbb_pl301, HHI_GCLK_M
+ static MESON_GATE(gxbb_periphs, HHI_GCLK_MPEG0, 7);
+ static MESON_GATE(gxbb_spicc, HHI_GCLK_MPEG0, 8);
+ static MESON_GATE(gxbb_i2c, HHI_GCLK_MPEG0, 9);
+-static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG0, 10);
++static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG0, 10);
+ static MESON_GATE(gxbb_smart_card, HHI_GCLK_MPEG0, 11);
+ static MESON_GATE(gxbb_rng0, HHI_GCLK_MPEG0, 12);
+ static MESON_GATE(gxbb_uart0, HHI_GCLK_MPEG0, 13);
+@@ -623,7 +623,7 @@ static MESON_GATE(gxbb_usb0_ddr_bridge,
+ static MESON_GATE(gxbb_mmc_pclk, HHI_GCLK_MPEG2, 11);
+ static MESON_GATE(gxbb_dvin, HHI_GCLK_MPEG2, 12);
+ static MESON_GATE(gxbb_uart2, HHI_GCLK_MPEG2, 15);
+-static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG2, 22);
++static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG2, 22);
+ static MESON_GATE(gxbb_vpu_intr, HHI_GCLK_MPEG2, 25);
+ static MESON_GATE(gxbb_sec_ahb_ahb3_bridge, HHI_GCLK_MPEG2, 26);
+ static MESON_GATE(gxbb_clk81_a53, HHI_GCLK_MPEG2, 29);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Wed, 6 Dec 2017 12:11:38 +0000
+Subject: clk: qcom: msm8916: fix mnd_width for codec_digcodec
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+
+[ Upstream commit d8e488e8242ecf129eebc440c92d800a99ca109d ]
+
+This patch fixes missing mnd_width for codec_digital clk, this is now set to
+8 inline with datasheet.
+
+Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/gcc-msm8916.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/qcom/gcc-msm8916.c
++++ b/drivers/clk/qcom/gcc-msm8916.c
+@@ -1437,6 +1437,7 @@ static const struct freq_tbl ftbl_codec_
+
+ static struct clk_rcg2 codec_digcodec_clk_src = {
+ .cmd_rcgr = 0x1c09c,
++ .mnd_width = 8,
+ .hid_width = 5,
+ .parent_map = gcc_xo_gpll1_emclk_sleep_map,
+ .freq_tbl = ftbl_codec_clk,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Rajendra Nayak <rnayak@codeaurora.org>
+Date: Thu, 23 Mar 2017 13:13:40 +0530
+Subject: clk: qcom: msm8996: Fix the vfe1 powerdomain name
+
+From: Rajendra Nayak <rnayak@codeaurora.org>
+
+
+[ Upstream commit a62ca337b36e31621b582cbe8f17d9404a48e120 ]
+
+Fix a typo which caused both vfe0 and vfe1 powerdomains to be
+named as vfe0.
+
+Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
+Fixes: 7e824d507909 ("clk: qcom: gdsc: Add mmcc gdscs for msm8996 family")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Michael Turquette <mturquette@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/mmcc-msm8996.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/mmcc-msm8996.c
++++ b/drivers/clk/qcom/mmcc-msm8996.c
+@@ -2984,7 +2984,7 @@ static struct gdsc vfe1_gdsc = {
+ .cxcs = (unsigned int []){ 0x36ac },
+ .cxc_count = 1,
+ .pd = {
+- .name = "vfe0",
++ .name = "vfe1",
+ },
+ .parent = &camss_gdsc.pd,
+ .pwrsts = PWRSTS_OFF_ON,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Wed, 5 Apr 2017 14:37:44 +0800
+Subject: clk: sunxi-ng: a33: Add offset and minimum value for DDR1 PLL N factor
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 68f37d862403e8f95337b2eca90af15d0b8cd5d7 ]
+
+The DDR1 PLL on the A33 is an oddball amongst the A33 CCU clocks.
+It is a clock multiplier, with the effective multiplier in the
+range of 12 ~ 255 and no offset between the multiplier value and
+the value programmed into the register.
+
+Implement the zero offset and minimum value of 12 for this clock.
+
+Fixes: d05c748bd730 ("clk: sunxi-ng: Add A33 CCU support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+@@ -159,13 +159,17 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(
+ BIT(28), /* lock */
+ CLK_SET_RATE_UNGATE);
+
+-/* TODO: Fix N */
+-static SUNXI_CCU_N_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1",
+- "osc24M", 0x04c,
+- 8, 6, /* N */
+- BIT(31), /* gate */
+- BIT(28), /* lock */
+- CLK_SET_RATE_UNGATE);
++static struct ccu_mult pll_ddr1_clk = {
++ .enable = BIT(31),
++ .lock = BIT(28),
++ .mult = _SUNXI_CCU_MULT_OFFSET_MIN_MAX(8, 6, 0, 12, 0),
++ .common = {
++ .reg = 0x04c,
++ .hw.init = CLK_HW_INIT("pll-ddr1", "osc24M",
++ &ccu_mult_ops,
++ CLK_SET_RATE_UNGATE),
++ },
++};
+
+ static const char * const cpux_parents[] = { "osc32k", "osc24M",
+ "pll-cpux" , "pll-cpux" };
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mike Leach <mike.leach@linaro.org>
+Date: Mon, 27 Mar 2017 11:09:33 -0600
+Subject: coresight: Fixes coresight DT parse to get correct output port ID.
+
+From: Mike Leach <mike.leach@linaro.org>
+
+
+[ Upstream commit eeedc5421dd3b51de73e6106405c5c77f920f281 ]
+
+Corrected to get the port numbering to allow programmable replicator driver
+to operate correctly.
+
+By convention, CoreSight devices number ports, not endpoints in
+the .dts files:-
+
+port {
+ reg<N>
+ endpoint {
+ }
+}
+
+Existing code read endpoint number - always 0x0, rather than the correct
+port number.
+
+Signed-off-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/coresight/of_coresight.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/of_coresight.c
++++ b/drivers/hwtracing/coresight/of_coresight.c
+@@ -149,7 +149,7 @@ struct coresight_platform_data *of_get_c
+ continue;
+
+ /* The local out port number */
+- pdata->outports[i] = endpoint.id;
++ pdata->outports[i] = endpoint.port;
+
+ /*
+ * Get a handle on the remote port and parent
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Tue, 14 Nov 2017 16:32:07 +0200
+Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ]
+
+To avoid race with vchan_complete, use the race free way to terminate
+running transfer.
+
+Implement the device_synchronize callback to make sure that the terminated
+descriptor is freed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm2835-dma.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str
+ * c->desc is NULL and exit.)
+ */
+ if (c->desc) {
+- bcm2835_dma_desc_free(&c->desc->vd);
++ vchan_terminate_vdesc(&c->desc->vd);
+ c->desc = NULL;
+ bcm2835_dma_abort(c->chan_base);
+
+@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str
+ return 0;
+ }
+
++static void bcm2835_dma_synchronize(struct dma_chan *chan)
++{
++ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
++
++ vchan_synchronize(&c->vc);
++}
++
+ static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id,
+ int irq, unsigned int irq_flags)
+ {
+@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat
+ od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy;
+ od->ddev.device_config = bcm2835_dma_slave_config;
+ od->ddev.device_terminate_all = bcm2835_dma_terminate_all;
++ od->ddev.device_synchronize = bcm2835_dma_synchronize;
+ od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) |
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jiada Wang <jiada_wang@mentor.com>
+Date: Thu, 16 Mar 2017 23:12:09 -0700
+Subject: dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
+
+From: Jiada Wang <jiada_wang@mentor.com>
+
+
+[ Upstream commit 7f3ff14b7eb1ffad132117f08a1973b48e653d43 ]
+
+sdma_disable_channel() cannot ensure dma is stopped to access
+module's FIFOs. There is chance SDMA core is running and accessing
+BD when disable of corresponding channel, this may cause sometimes
+even after call of .sdma_disable_channel(), SDMA core still be
+running and accessing module's FIFOs.
+
+According to NXP R&D team a delay of one BD SDMA cost time (maximum
+is 1ms) should be added after disable of the channel bit, to ensure
+SDMA core has really been stopped after SDMA clients call
+.device_terminate_all.
+
+This patch introduces adds a new function sdma_disable_channel_with_delay()
+which simply adds 1ms delay after call sdma_disable_channel(),
+and set it as .device_terminate_all.
+
+Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/imx-sdma.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -937,6 +937,21 @@ static int sdma_disable_channel(struct d
+ return 0;
+ }
+
++static int sdma_disable_channel_with_delay(struct dma_chan *chan)
++{
++ sdma_disable_channel(chan);
++
++ /*
++ * According to NXP R&D team a delay of one BD SDMA cost time
++ * (maximum is 1ms) should be added after disable of the channel
++ * bit, to ensure SDMA core has really been stopped after SDMA
++ * clients call .device_terminate_all.
++ */
++ mdelay(1);
++
++ return 0;
++}
++
+ static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac)
+ {
+ struct sdma_engine *sdma = sdmac->sdma;
+@@ -1828,7 +1843,7 @@ static int sdma_probe(struct platform_de
+ sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg;
+ sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic;
+ sdma->dma_device.device_config = sdma_config;
+- sdma->dma_device.device_terminate_all = sdma_disable_channel;
++ sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay;
+ sdma->dma_device.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ sdma->dma_device.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ sdma->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Shikhar Dogra <shidogra@cisco.com>
+Date: Mon, 27 Mar 2017 16:16:44 -0700
+Subject: driver: (adm1275) set the m,b and R coefficients correctly for power
+
+From: Shikhar Dogra <shidogra@cisco.com>
+
+
+[ Upstream commit 6faecba0b3da7b617bf72bef422bf0d3bb6dfe7d ]
+
+Seems like coefficient values for m, b and R under power have been
+put in the wrong order. Rearranging them properly to get correct
+values of coefficients for power.
+
+For specs, please refer to table 7 (page 35) on
+http://www.analog.com/media/en/technical-documentation/data-sheets/ADM1075.pdf
+
+Fixes: 904b296f308d ("hwmon: (adm1275) Introduce configuration data structure for coeffcients")
+Signed-off-by: Shikhar Dogra <shidogra@cisco.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pmbus/adm1275.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/pmbus/adm1275.c
++++ b/drivers/hwmon/pmbus/adm1275.c
+@@ -101,8 +101,8 @@ static const struct coefficients adm1075
+ [0] = { 27169, 0, -1 }, /* voltage */
+ [1] = { 806, 20475, -1 }, /* current, irange25 */
+ [2] = { 404, 20475, -1 }, /* current, irange50 */
+- [3] = { 0, -1, 8549 }, /* power, irange25 */
+- [4] = { 0, -1, 4279 }, /* power, irange50 */
++ [3] = { 8549, 0, -1 }, /* power, irange25 */
++ [4] = { 4279, 0, -1 }, /* power, irange50 */
+ };
+
+ static const struct coefficients adm1275_coefficients[] = {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Quan Nguyen <qnguyen@apm.com>
+Date: Wed, 15 Mar 2017 13:27:15 -0700
+Subject: drivers: net: phy: xgene: Fix mdio write
+
+From: Quan Nguyen <qnguyen@apm.com>
+
+
+[ Upstream commit 4b72436dc3dd2457056b22d6f147777368c869fa ]
+
+This patches fixes a typo in the argument to xgene_enet_wr_mdio_csr().
+
+Signed-off-by: Quan Nguyen <qnguyen@apm.com>
+Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mdio-xgene.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/mdio-xgene.c
++++ b/drivers/net/phy/mdio-xgene.c
+@@ -232,7 +232,7 @@ static int xgene_xfi_mdio_write(struct m
+
+ val = SET_VAL(HSTPHYADX, phy_id) | SET_VAL(HSTREGADX, reg) |
+ SET_VAL(HSTMIIMWRDAT, data);
+- xgene_enet_wr_mdio_csr(addr, MIIM_FIELD_ADDR, data);
++ xgene_enet_wr_mdio_csr(addr, MIIM_FIELD_ADDR, val);
+
+ val = HSTLDCMD | SET_VAL(HSTMIIMCMD, MIIM_CMD_LEGACY_WRITE);
+ xgene_enet_wr_mdio_csr(addr, MIIM_COMMAND_ADDR, val);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Quan Nguyen <qnguyen@apm.com>
+Date: Wed, 15 Mar 2017 13:27:16 -0700
+Subject: drivers: net: xgene: Fix hardware checksum setting
+
+From: Quan Nguyen <qnguyen@apm.com>
+
+
+[ Upstream commit e026e700d940a1ea3d3bc84d92ac668b1f015462 ]
+
+This patch fixes the hardware checksum settings by properly program
+the classifier. Otherwise, packet may be received with checksum error
+on X-Gene1 SoC.
+
+Signed-off-by: Quan Nguyen <qnguyen@apm.com>
+Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/apm/xgene/xgene_enet_hw.c | 1 +
+ drivers/net/ethernet/apm/xgene/xgene_enet_hw.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+@@ -560,6 +560,7 @@ static void xgene_enet_cle_bypass(struct
+ xgene_enet_rd_csr(pdata, CLE_BYPASS_REG0_0_ADDR, &cb);
+ cb |= CFG_CLE_BYPASS_EN0;
+ CFG_CLE_IP_PROTOCOL0_SET(&cb, 3);
++ CFG_CLE_IP_HDR_LEN_SET(&cb, 0);
+ xgene_enet_wr_csr(pdata, CLE_BYPASS_REG0_0_ADDR, cb);
+
+ xgene_enet_rd_csr(pdata, CLE_BYPASS_REG1_0_ADDR, &cb);
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+@@ -163,6 +163,7 @@ enum xgene_enet_rm {
+ #define CFG_RXCLK_MUXSEL0_SET(dst, val) xgene_set_bits(dst, val, 26, 3)
+
+ #define CFG_CLE_IP_PROTOCOL0_SET(dst, val) xgene_set_bits(dst, val, 16, 2)
++#define CFG_CLE_IP_HDR_LEN_SET(dst, val) xgene_set_bits(dst, val, 8, 5)
+ #define CFG_CLE_DSTQID0_SET(dst, val) xgene_set_bits(dst, val, 0, 12)
+ #define CFG_CLE_FPSEL0_SET(dst, val) xgene_set_bits(dst, val, 16, 4)
+ #define CFG_MACMODE_SET(dst, val) xgene_set_bits(dst, val, 18, 2)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Iyappan Subramanian <isubramanian@apm.com>
+Date: Wed, 15 Mar 2017 13:27:18 -0700
+Subject: drivers: net: xgene: Fix Rx checksum validation logic
+
+From: Iyappan Subramanian <isubramanian@apm.com>
+
+
+[ Upstream commit 0a0400c3094b5d5cedd479ddbf1329de74c09c4b ]
+
+This patch fixes Rx checksum validation logic and
+adds NETIF_F_RXCSUM flag.
+
+Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 27 ++++++++++++++---------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -505,14 +505,24 @@ static netdev_tx_t xgene_enet_start_xmit
+ return NETDEV_TX_OK;
+ }
+
+-static void xgene_enet_skip_csum(struct sk_buff *skb)
++static void xgene_enet_rx_csum(struct sk_buff *skb)
+ {
++ struct net_device *ndev = skb->dev;
+ struct iphdr *iph = ip_hdr(skb);
+
+- if (!ip_is_fragment(iph) ||
+- (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)) {
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
+- }
++ if (!(ndev->features & NETIF_F_RXCSUM))
++ return;
++
++ if (skb->protocol != htons(ETH_P_IP))
++ return;
++
++ if (ip_is_fragment(iph))
++ return;
++
++ if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)
++ return;
++
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ }
+
+ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring,
+@@ -555,10 +565,7 @@ static int xgene_enet_rx_frame(struct xg
+
+ skb_checksum_none_assert(skb);
+ skb->protocol = eth_type_trans(skb, ndev);
+- if (likely((ndev->features & NETIF_F_IP_CSUM) &&
+- skb->protocol == htons(ETH_P_IP))) {
+- xgene_enet_skip_csum(skb);
+- }
++ xgene_enet_rx_csum(skb);
+
+ rx_ring->rx_packets++;
+ rx_ring->rx_bytes += datalen;
+@@ -1725,7 +1732,7 @@ static int xgene_enet_probe(struct platf
+ xgene_enet_setup_ops(pdata);
+
+ if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII) {
+- ndev->features |= NETIF_F_TSO;
++ ndev->features |= NETIF_F_TSO | NETIF_F_RXCSUM;
+ spin_lock_init(&pdata->mss_lock);
+ }
+ ndev->hw_features = ndev->features;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Quan Nguyen <qnguyen@apm.com>
+Date: Wed, 15 Mar 2017 13:27:17 -0700
+Subject: drivers: net: xgene: Fix wrong logical operation
+
+From: Quan Nguyen <qnguyen@apm.com>
+
+
+[ Upstream commit 11623fce0f9afef30c45e3f2120b063de3809a8f ]
+
+This patch fixes the wrong logical OR operation by changing it to
+bit-wise OR operation.
+
+Fixes: 3bb502f83080 ("drivers: net: xgene: fix statistics counters race condition")
+Signed-off-by: Iyappan Subramanian <isubramanian@apm.com>
+Signed-off-by: Quan Nguyen <qnguyen@apm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -537,9 +537,9 @@ static int xgene_enet_rx_frame(struct xg
+ buf_pool->rx_skb[skb_index] = NULL;
+
+ /* checking for error */
+- status = (GET_VAL(ELERR, le64_to_cpu(raw_desc->m0)) << LERR_LEN) ||
++ status = (GET_VAL(ELERR, le64_to_cpu(raw_desc->m0)) << LERR_LEN) |
+ GET_VAL(LERR, le64_to_cpu(raw_desc->m0));
+- if (unlikely(status > 2)) {
++ if (unlikely(status)) {
+ dev_kfree_skb_any(skb);
+ xgene_enet_parse_error(rx_ring, netdev_priv(rx_ring->ndev),
+ status);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 11 Apr 2017 09:39:49 +0100
+Subject: drivers/perf: arm_pmu: handle no platform_device
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+
+[ Upstream commit 7654137071fa706e5c91f4f27bc2a5cd7e435a9b ]
+
+In armpmu_dispatch_irq() we look at arm_pmu::plat_device to acquire
+platdata, so that we can defer to platform-specific IRQ handling,
+required on some 32-bit parts. With the advent of ACPI we won't always
+have a platform_device, and so we must avoid trying to dereference
+fields from it.
+
+This patch fixes up armpmu_dispatch_irq() to avoid doing so, introducing
+a new armpmu_get_platdata() helper.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Jeremy Linton <jeremy.linton@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/perf/arm_pmu.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -322,10 +322,16 @@ validate_group(struct perf_event *event)
+ return 0;
+ }
+
++static struct arm_pmu_platdata *armpmu_get_platdata(struct arm_pmu *armpmu)
++{
++ struct platform_device *pdev = armpmu->plat_device;
++
++ return pdev ? dev_get_platdata(&pdev->dev) : NULL;
++}
++
+ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev)
+ {
+ struct arm_pmu *armpmu;
+- struct platform_device *plat_device;
+ struct arm_pmu_platdata *plat;
+ int ret;
+ u64 start_clock, finish_clock;
+@@ -337,8 +343,8 @@ static irqreturn_t armpmu_dispatch_irq(i
+ * dereference.
+ */
+ armpmu = *(void **)dev;
+- plat_device = armpmu->plat_device;
+- plat = dev_get_platdata(&plat_device->dev);
++
++ plat = armpmu_get_platdata(armpmu);
+
+ start_clock = sched_clock();
+ if (plat && plat->handle_irq)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+Date: Wed, 29 Mar 2017 15:02:11 +1100
+Subject: drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
+
+From: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+
+
+[ Upstream commit 1769152ac64b0b07583f696b621624df2ca4c840 ]
+
+Any use of the framebuffer will migrate it to VRAM, which is not sensible for
+an imported dma-buf.
+
+v2: Use DRM_DEBUG_KMS to prevent userspace accidentally spamming dmesg.
+
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+CC: amd-gfx@lists.freedesktop.org
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -533,6 +533,12 @@ amdgpu_user_framebuffer_create(struct dr
+ return ERR_PTR(-ENOENT);
+ }
+
++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */
++ if (obj->import_attach) {
++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n");
++ return ERR_PTR(-EINVAL);
++ }
++
+ amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
+ if (amdgpu_fb == NULL) {
+ drm_gem_object_unreference_unlocked(obj);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Yong Zhao <yong.zhao@amd.com>
+Date: Fri, 8 Dec 2017 23:08:48 -0500
+Subject: drm/amdkfd: Fix memory leaks in kfd topology
+
+From: Yong Zhao <yong.zhao@amd.com>
+
+
+[ Upstream commit 5108d768408abc80e4e8d99f5b406a73cb04056b ]
+
+Kobject created using kobject_create_and_add() can be freed using
+kobject_put() when there is no referenece any more. However,
+kobject memory allocated with kzalloc() has to set up a release
+callback in order to free it when the counter decreases to 0.
+Otherwise it causes memory leak.
+
+Signed-off-by: Yong Zhao <yong.zhao@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -519,11 +519,17 @@ static ssize_t sysprops_show(struct kobj
+ return ret;
+ }
+
++static void kfd_topology_kobj_release(struct kobject *kobj)
++{
++ kfree(kobj);
++}
++
+ static const struct sysfs_ops sysprops_ops = {
+ .show = sysprops_show,
+ };
+
+ static struct kobj_type sysprops_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &sysprops_ops,
+ };
+
+@@ -559,6 +565,7 @@ static const struct sysfs_ops iolink_ops
+ };
+
+ static struct kobj_type iolink_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &iolink_ops,
+ };
+
+@@ -586,6 +593,7 @@ static const struct sysfs_ops mem_ops =
+ };
+
+ static struct kobj_type mem_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &mem_ops,
+ };
+
+@@ -625,6 +633,7 @@ static const struct sysfs_ops cache_ops
+ };
+
+ static struct kobj_type cache_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &cache_ops,
+ };
+
+@@ -747,6 +756,7 @@ static const struct sysfs_ops node_ops =
+ };
+
+ static struct kobj_type node_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &node_ops,
+ };
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 15 Mar 2017 20:40:25 +0000
+Subject: drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+
+[ Upstream commit 608b20506941969ea30d8c08dc9ae02bb87dbf7d ]
+
+On vblank instant-off systems, we can get into a situation where the cost
+of enabling and disabling the vblank IRQ around a drmWaitVblank query
+dominates. And with the advent of even deeper hardware sleep state,
+touching registers becomes ever more expensive. However, we know that if
+the user wants the current vblank counter, they are also very likely to
+immediately queue a vblank wait and so we can keep the interrupt around
+and only turn it off if we have no further vblank requests queued within
+the interrupt interval.
+
+After vblank event delivery, this patch adds a shadow of one vblank where
+the interrupt is kept alive for the user to query and queue another vblank
+event. Similarly, if the user is using blocking drmWaitVblanks, the
+interrupt will be disabled on the IRQ following the wait completion.
+However, if the user is simply querying the current vblank counter and
+timestamp, the interrupt will be disabled after every IRQ and the user
+will enabled it again on the first query following the IRQ.
+
+v2: Mario Kleiner -
+After testing this, one more thing that would make sense is to move
+the disable block at the end of drm_handle_vblank() instead of at the
+top.
+
+Turns out that if high precision timestaming is disabled or doesn't
+work for some reason (as can be simulated by echo 0 >
+/sys/module/drm/parameters/timestamp_precision_usec), then with your
+delayed disable code at its current place, the vblank counter won't
+increment anymore at all for instant queries, ie. with your other
+"instant query" patches. Clients which repeatedly query the counter
+and wait for it to progress will simply hang, spinning in an endless
+query loop. There's that comment in vblank_disable_and_save:
+
+"* Skip this step if there isn't any high precision timestamp
+ * available. In that case we can't account for this and just
+ * hope for the best.
+ */
+
+With the disable happening after leading edge of vblank (== hw counter
+increment already happened) but before the vblank counter/timestamp
+handling in drm_handle_vblank, that step is needed to keep the counter
+progressing, so skipping it is bad.
+
+Now without high precision timestamping support, a kms driver must not
+set dev->vblank_disable_immediate = true, as this would cause problems
+for clients, so this shouldn't matter, but it would be good to still
+make this robust against a future kms driver which might have
+unreliable high precision timestamping, e.g., high precision
+timestamping that intermittently doesn't work.
+
+v3: Patch before coffee needs extra coffee.
+
+Testcase: igt/kms_vblank
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Michel Dänzer <michel@daenzer.net>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Dave Airlie <airlied@redhat.com>,
+Cc: Mario Kleiner <mario.kleiner.de@gmail.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170315204027.20160-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_irq.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -1202,9 +1202,9 @@ static void drm_vblank_put(struct drm_de
+ if (atomic_dec_and_test(&vblank->refcount)) {
+ if (drm_vblank_offdelay == 0)
+ return;
+- else if (dev->vblank_disable_immediate || drm_vblank_offdelay < 0)
++ else if (drm_vblank_offdelay < 0)
+ vblank_disable_fn((unsigned long)vblank);
+- else
++ else if (!dev->vblank_disable_immediate)
+ mod_timer(&vblank->disable_timer,
+ jiffies + ((drm_vblank_offdelay * HZ)/1000));
+ }
+@@ -1819,6 +1819,16 @@ bool drm_handle_vblank(struct drm_device
+ wake_up(&vblank->queue);
+ drm_handle_vblank_events(dev, pipe);
+
++ /* With instant-off, we defer disabling the interrupt until after
++ * we finish processing the following vblank. The disable has to
++ * be last (after drm_handle_vblank_events) so that the timestamp
++ * is always accurate.
++ */
++ if (dev->vblank_disable_immediate &&
++ drm_vblank_offdelay > 0 &&
++ !atomic_read(&vblank->refcount))
++ vblank_disable_fn((unsigned long)vblank);
++
+ spin_unlock_irqrestore(&dev->event_lock, irqflags);
+
+ return true;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 1 Nov 2017 16:20:58 +0200
+Subject: drm/edid: set ELD connector type in drm_edid_to_eld()
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+
+[ Upstream commit 1d1c36650752b7fb81cee515a9bba4131cac4b7c ]
+
+Since drm_edid_to_eld() knows the connector type, we can set the type in
+ELD while at it. Most connectors this gets called on are not DP
+encoders, and with the HDMI type being 0, this does not change behaviour
+for non-DP.
+
+For i915 having this in place earlier would have saved a considerable
+amount of debugging that lead to the fix 2d8f63297b9f ("drm/i915: always
+update ELD connector type after get modes"). I don't see other drivers,
+even the ones calling drm_edid_to_eld() on DP connectors, setting the
+connector type in ELD.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Archit Taneja <architt@codeaurora.org>
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Mark Yao <mark.yao@rock-chips.com>
+Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Cc: Vincent Abriou <vincent.abriou@st.com>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: Eric Anholt <eric@anholt.net>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/d527b31619528c477c2c136f25cdf118bc0cfc1d.1509545641.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_edid.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -3347,8 +3347,7 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name)
+ * @edid: EDID to parse
+ *
+ * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The
+- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to
+- * fill in.
++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in.
+ */
+ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid)
+ {
+@@ -3426,6 +3425,12 @@ void drm_edid_to_eld(struct drm_connecto
+ }
+ eld[5] |= total_sad_count << 4;
+
++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
++ connector->connector_type == DRM_MODE_CONNECTOR_eDP)
++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP;
++ else
++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI;
++
+ eld[DRM_ELD_BASELINE_ELD_LEN] =
+ DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+Date: Mon, 27 Feb 2017 17:33:30 -0300
+Subject: drm: qxl: Don't alloc fbdev if emulation is not supported
+
+From: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+
+
+[ Upstream commit 861078381ba56b56808113736000d9e7ead349c8 ]
+
+If fbdev emulation is disabled, the QXL shutdown path will try to clean
+a framebuffer that wasn't initialized, hitting the Oops below. The
+problem is that even when FBDEV_EMULATION is disabled we allocate the
+qfbdev strutucture, but we don't initialize it. The fix is to stop
+allocating the memory, since it won't be used. This allows the existing
+verification in the cleanup hook to do it's job preventing the oops.
+
+Now that we don't allocate the unused fbdev structure, we need to be
+careful when dereferencing it in the PM suspend hook.
+
+[ 24.284684] BUG: unable to handle kernel NULL pointer dereference at 00000000000002e0
+[ 24.285627] IP: mutex_lock+0x18/0x30
+[ 24.286049] PGD 78cdf067
+[ 24.286050] PUD 7940f067
+[ 24.286344] PMD 0
+[ 24.286649]
+[ 24.287072] Oops: 0002 [#1] SMP
+[ 24.287422] Modules linked in: qxl
+[ 24.287806] CPU: 0 PID: 2328 Comm: bash Not tainted 4.10.0-rc5+ #97
+[ 24.288515] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
+[ 24.289681] task: ffff88007c4c0000 task.stack: ffffc90001b58000
+[ 24.290354] RIP: 0010:mutex_lock+0x18/0x30
+[ 24.290812] RSP: 0018:ffffc90001b5bcb0 EFLAGS: 00010246
+[ 24.291401] RAX: 0000000000000000 RBX: 00000000000002e0 RCX: 0000000000000000
+[ 24.292209] RDX: ffff88007c4c0000 RSI: 0000000000000001 RDI: 00000000000002e0
+[ 24.292987] RBP: ffffc90001b5bcb8 R08: fffffffffffffffe R09: 0000000000000001
+[ 24.293797] R10: ffff880078d80b80 R11: 0000000000011400 R12: 0000000000000000
+[ 24.294601] R13: 00000000000002e0 R14: ffffffffa0009c28 R15: 0000000000000060
+[ 24.295439] FS: 00007f30e3acbb40(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
+[ 24.296364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 24.296997] CR2: 00000000000002e0 CR3: 0000000078c7b000 CR4: 00000000000006f0
+[ 24.297813] Call Trace:
+[ 24.298097] drm_framebuffer_cleanup+0x1f/0x70
+[ 24.298612] qxl_fbdev_fini+0x68/0x90 [qxl]
+[ 24.299074] qxl_modeset_fini+0xd/0x30 [qxl]
+[ 24.299562] qxl_pci_remove+0x22/0x50 [qxl]
+[ 24.300025] pci_device_remove+0x34/0xb0
+[ 24.300507] device_release_driver_internal+0x150/0x200
+[ 24.301082] device_release_driver+0xd/0x10
+[ 24.301587] unbind_store+0x108/0x150
+[ 24.301993] drv_attr_store+0x20/0x30
+[ 24.302402] sysfs_kf_write+0x32/0x40
+[ 24.302827] kernfs_fop_write+0x108/0x190
+[ 24.303269] __vfs_write+0x23/0x120
+[ 24.303678] ? security_file_permission+0x36/0xb0
+[ 24.304193] ? rw_verify_area+0x49/0xb0
+[ 24.304636] vfs_write+0xb0/0x190
+[ 24.305004] SyS_write+0x41/0xa0
+[ 24.305362] entry_SYSCALL_64_fastpath+0x1a/0xa9
+[ 24.305887] RIP: 0033:0x7f30e31d9620
+[ 24.306285] RSP: 002b:00007ffc54b47e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+[ 24.307128] RAX: ffffffffffffffda RBX: 00007f30e3497600 RCX: 00007f30e31d9620
+[ 24.307928] RDX: 000000000000000d RSI: 0000000000da2008 RDI: 0000000000000001
+[ 24.308727] RBP: 000000000070bc60 R08: 00007f30e3498760 R09: 00007f30e3acbb40
+[ 24.309504] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000001
+[ 24.310295] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc54b47f34
+[ 24.311095] Code: 0e 01 e9 7b fe ff ff 66 90 66 2e 0f 1f 84 00 00 00 00 00
+55 48 89 e5 53 48 89 fb e8 83 e8 ff ff 65 48 8b 14 25 40 c4 00 00 31 c0 <3e>
+48 0f b1 13 48 85 c0 74 08 48 89 df e8 66 fd ff ff 5b 5d c3
+[ 24.313182] RIP: mutex_lock+0x18/0x30 RSP: ffffc90001b5bcb0
+[ 24.313811] CR2: 00000000000002e0
+[ 24.314208] ---[ end trace 29669c1593cae14b ]---
+
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170227203330.18542-1-krisman@collabora.co.uk
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/qxl/qxl_fb.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
++++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -387,9 +387,11 @@ static const struct drm_fb_helper_funcs
+
+ int qxl_fbdev_init(struct qxl_device *qdev)
+ {
++ int ret = 0;
++
++#ifdef CONFIG_DRM_FBDEV_EMULATION
+ struct qxl_fbdev *qfbdev;
+ int bpp_sel = 32; /* TODO: parameter from somewhere? */
+- int ret;
+
+ qfbdev = kzalloc(sizeof(struct qxl_fbdev), GFP_KERNEL);
+ if (!qfbdev)
+@@ -423,6 +425,8 @@ fini:
+ drm_fb_helper_fini(&qfbdev->helper);
+ free:
+ kfree(qfbdev);
++#endif
++
+ return ret;
+ }
+
+@@ -438,6 +442,9 @@ void qxl_fbdev_fini(struct qxl_device *q
+
+ void qxl_fbdev_set_suspend(struct qxl_device *qdev, int state)
+ {
++ if (!qdev->mode_info.qfbdev)
++ return;
++
+ drm_fb_helper_set_suspend(&qdev->mode_info.qfbdev->helper, state);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+Date: Wed, 29 Mar 2017 15:00:54 +1100
+Subject: drm/radeon: Fail fb creation from imported dma-bufs.
+
+From: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+
+
+[ Upstream commit a294043b2fbd8de69d161457ed0c7a4026bbfa5a ]
+
+Any use of the framebuffer will migrate it to VRAM, which is not sensible for
+an imported dma-buf.
+
+v2: Use DRM_DEBUG_KMS to prevent userspace accidentally spamming dmesg.
+
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
+CC: amd-gfx@lists.freedesktop.org
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -1352,6 +1352,12 @@ radeon_user_framebuffer_create(struct dr
+ return ERR_PTR(-ENOENT);
+ }
+
++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */
++ if (obj->import_attach) {
++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n");
++ return ERR_PTR(-EINVAL);
++ }
++
+ radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL);
+ if (radeon_fb == NULL) {
+ drm_gem_object_unreference_unlocked(obj);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Fri, 10 Feb 2017 13:30:35 +0200
+Subject: drm: rcar-du: Handle event when disabling CRTCs
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+
+[ Upstream commit 6dd47cfd03a058d08b8caffb06194aa0eb109cf1 ]
+
+The driver currently handles vblank events only when updating planes on
+a CRTC. The atomic update API however allows requesting an event when
+disabling a CRTC. This currently leads to event objects being leaked in
+the kernel and to events not being sent out. Fix it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -512,6 +512,13 @@ static void rcar_du_crtc_disable(struct
+ rcar_du_crtc_stop(rcrtc);
+ rcar_du_crtc_put(rcrtc);
+
++ spin_lock_irq(&crtc->dev->event_lock);
++ if (crtc->state->event) {
++ drm_crtc_send_vblank_event(crtc, crtc->state->event);
++ crtc->state->event = NULL;
++ }
++ spin_unlock_irq(&crtc->dev->event_lock);
++
+ rcrtc->outputs = 0;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+Date: Thu, 6 Apr 2017 20:31:20 +0800
+Subject: drm/rockchip: vop: Enable pm domain before vop_initial
+
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+
+
+[ Upstream commit 5e570373c015b60a68828b1cd9d475cb33d3be4b ]
+
+We're trying to access vop registers here, so need to make sure
+the pm domain is on.
+
+Normally it should be enabled by the bootloader, but there's no
+guarantee of it. And if we wanna do unbind/bind, it would also
+cause the device to hang.
+
+And this patch also does these:
+1/ move vop_initial to the end of vop_bind for eaiser error handling.
+2/ correct the err_put_pm_runtime of vop_enable.
+
+Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/1491481885-13775-8-git-send-email-jeffy.chen@rock-chips.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 29 ++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -503,7 +503,7 @@ static int vop_enable(struct drm_crtc *c
+ ret = pm_runtime_get_sync(vop->dev);
+ if (ret < 0) {
+ dev_err(vop->dev, "failed to get pm runtime: %d\n", ret);
+- goto err_put_pm_runtime;
++ return ret;
+ }
+
+ ret = clk_enable(vop->hclk);
+@@ -1348,10 +1348,16 @@ static int vop_initial(struct vop *vop)
+ return PTR_ERR(vop->dclk);
+ }
+
++ ret = pm_runtime_get_sync(vop->dev);
++ if (ret < 0) {
++ dev_err(vop->dev, "failed to get pm runtime: %d\n", ret);
++ return ret;
++ }
++
+ ret = clk_prepare(vop->dclk);
+ if (ret < 0) {
+ dev_err(vop->dev, "failed to prepare dclk\n");
+- return ret;
++ goto err_put_pm_runtime;
+ }
+
+ /* Enable both the hclk and aclk to setup the vop */
+@@ -1411,6 +1417,8 @@ static int vop_initial(struct vop *vop)
+
+ vop->is_enabled = false;
+
++ pm_runtime_put_sync(vop->dev);
++
+ return 0;
+
+ err_disable_aclk:
+@@ -1419,6 +1427,8 @@ err_disable_hclk:
+ clk_disable_unprepare(vop->hclk);
+ err_unprepare_dclk:
+ clk_unprepare(vop->dclk);
++err_put_pm_runtime:
++ pm_runtime_put_sync(vop->dev);
+ return ret;
+ }
+
+@@ -1519,12 +1529,6 @@ static int vop_bind(struct device *dev,
+ if (!vop->regsbak)
+ return -ENOMEM;
+
+- ret = vop_initial(vop);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "cannot initial vop dev - err %d\n", ret);
+- return ret;
+- }
+-
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+ dev_err(dev, "cannot find irq for vop\n");
+@@ -1551,8 +1555,17 @@ static int vop_bind(struct device *dev,
+
+ pm_runtime_enable(&pdev->dev);
+
++ ret = vop_initial(vop);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "cannot initial vop dev - err %d\n", ret);
++ goto err_disable_pm_runtime;
++ }
++
+ return 0;
+
++err_disable_pm_runtime:
++ pm_runtime_disable(&pdev->dev);
++ vop_destroy_crtc(vop);
+ err_enable_irq:
+ enable_irq(vop->irq); /* To balance out the disable_irq above */
+ return ret;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Thu, 9 Mar 2017 18:05:24 +0800
+Subject: drm/sun4i: Fix TCON clock and regmap initialization sequence
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 4c7f16d14a33a9cfb4af9cb780d8a73bcca64a92 ]
+
+The TCON driver calls sun4i_tcon_init_regmap and sun4i_tcon_init_clocks
+in its bind function. The former creates a regmap and writes to several
+register to clear its configuration to a known default. The latter
+initializes various clocks. This includes enabling the bus clock for
+register access and creating the dotclock.
+
+In order for the first step's writes to work, the bus clock must be
+enabled which is done in the second step. but the dotclock's ops use
+the regmap created in the first step.
+
+Rearrange the function calls such that the clocks are initialized before
+the regmap, and split out the dot clock creation to after the regmap is
+initialized.
+
+Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -336,12 +336,11 @@ static int sun4i_tcon_init_clocks(struct
+ }
+ }
+
+- return sun4i_dclk_create(dev, tcon);
++ return 0;
+ }
+
+ static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
+ {
+- sun4i_dclk_free(tcon);
+ clk_disable_unprepare(tcon->clk);
+ }
+
+@@ -506,22 +505,28 @@ static int sun4i_tcon_bind(struct device
+ return ret;
+ }
+
++ ret = sun4i_tcon_init_clocks(dev, tcon);
++ if (ret) {
++ dev_err(dev, "Couldn't init our TCON clocks\n");
++ goto err_assert_reset;
++ }
++
+ ret = sun4i_tcon_init_regmap(dev, tcon);
+ if (ret) {
+ dev_err(dev, "Couldn't init our TCON regmap\n");
+- goto err_assert_reset;
++ goto err_free_clocks;
+ }
+
+- ret = sun4i_tcon_init_clocks(dev, tcon);
++ ret = sun4i_dclk_create(dev, tcon);
+ if (ret) {
+- dev_err(dev, "Couldn't init our TCON clocks\n");
+- goto err_assert_reset;
++ dev_err(dev, "Couldn't create our TCON dot clock\n");
++ goto err_free_clocks;
+ }
+
+ ret = sun4i_tcon_init_irq(dev, tcon);
+ if (ret) {
+ dev_err(dev, "Couldn't init our TCON interrupts\n");
+- goto err_free_clocks;
++ goto err_free_dotclock;
+ }
+
+ ret = sun4i_rgb_init(drm);
+@@ -530,6 +535,8 @@ static int sun4i_tcon_bind(struct device
+
+ return 0;
+
++err_free_dotclock:
++ sun4i_dclk_free(tcon);
+ err_free_clocks:
+ sun4i_tcon_free_clocks(tcon);
+ err_assert_reset:
+@@ -542,6 +549,7 @@ static void sun4i_tcon_unbind(struct dev
+ {
+ struct sun4i_tcon *tcon = dev_get_drvdata(dev);
+
++ sun4i_dclk_free(tcon);
+ sun4i_tcon_free_clocks(tcon);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 17 Feb 2017 11:13:25 +0800
+Subject: drm/sun4i: Fix up error path cleanup for master bind function
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 9d56defb44b15427f4342c543a70fb7886fc06f5 ]
+
+The master bind function calls numerous drm functions which initialize
+underlying structures. It also tries to bind the various components
+of the display pipeline, some of which may add additional drm objects.
+
+This patch adds proper cleanup functions in the error path of the
+master bind function.
+
+This requires the patch "drm/sun4i: Move drm_mode_config_cleanup call
+to main driver", which splits out drm_mode_config_cleanup from
+sun4i_framebuffer_free so we can call it separately.
+
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_drv.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
+@@ -145,7 +145,7 @@ static int sun4i_drv_bind(struct device
+ ret = component_bind_all(drm->dev, drm);
+ if (ret) {
+ dev_err(drm->dev, "Couldn't bind all pipelines components\n");
+- goto free_drm;
++ goto cleanup_mode_config;
+ }
+
+ /* Create our layers */
+@@ -153,7 +153,7 @@ static int sun4i_drv_bind(struct device
+ if (IS_ERR(drv->layers)) {
+ dev_err(drm->dev, "Couldn't create the planes\n");
+ ret = PTR_ERR(drv->layers);
+- goto free_drm;
++ goto cleanup_mode_config;
+ }
+
+ /* Create our CRTC */
+@@ -161,7 +161,7 @@ static int sun4i_drv_bind(struct device
+ if (!drv->crtc) {
+ dev_err(drm->dev, "Couldn't create the CRTC\n");
+ ret = -EINVAL;
+- goto free_drm;
++ goto cleanup_mode_config;
+ }
+ drm->irq_enabled = true;
+
+@@ -173,7 +173,7 @@ static int sun4i_drv_bind(struct device
+ if (IS_ERR(drv->fbdev)) {
+ dev_err(drm->dev, "Couldn't create our framebuffer\n");
+ ret = PTR_ERR(drv->fbdev);
+- goto free_drm;
++ goto cleanup_mode_config;
+ }
+
+ /* Enable connectors polling */
+@@ -181,10 +181,16 @@ static int sun4i_drv_bind(struct device
+
+ ret = drm_dev_register(drm, 0);
+ if (ret)
+- goto free_drm;
++ goto finish_poll;
+
+ return 0;
+
++finish_poll:
++ drm_kms_helper_poll_fini(drm);
++ sun4i_framebuffer_free(drm);
++cleanup_mode_config:
++ drm_mode_config_cleanup(drm);
++ drm_vblank_cleanup(drm);
+ free_drm:
+ drm_dev_unref(drm);
+ return ret;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Thu, 23 Feb 2017 16:05:34 +0800
+Subject: drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 7544860733d158e3edbf309f27e79e258c8f66bd ]
+
+The way drm_of_find_possible_crtcs works is it tries to match the
+remote-endpoint of the given node's various endpoints to all the
+crtc's .port field. Thus we need to set drm_crtc.port to the output
+port node of the underlying TCON.
+
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_crtc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c
+@@ -19,6 +19,7 @@
+ #include <linux/clk-provider.h>
+ #include <linux/ioport.h>
+ #include <linux/of_address.h>
++#include <linux/of_graph.h>
+ #include <linux/of_irq.h>
+ #include <linux/regmap.h>
+
+@@ -136,5 +137,9 @@ struct sun4i_crtc *sun4i_crtc_init(struc
+
+ drm_crtc_helper_add(&scrtc->crtc, &sun4i_crtc_helper_funcs);
+
++ /* Set crtc.port to output port node of the tcon */
++ scrtc->crtc.port = of_graph_get_port_by_id(drv->tcon->dev->of_node,
++ 1);
++
+ return scrtc;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Nicolai Hähnle" <nicolai.haehnle@amd.com>
+Date: Tue, 14 Feb 2017 09:37:12 +0100
+Subject: drm/ttm: never add BO that failed to validate to the LRU list
+
+From: "Nicolai Hähnle" <nicolai.haehnle@amd.com>
+
+
+[ Upstream commit c2c139cf435b18939204800fa72c53a7207bdd68 ]
+
+Fixes a potential race condition in amdgpu that looks as follows:
+
+Task 1: attempt ttm_bo_init, but ttm_bo_validate fails
+Task 1: add BO to global list anyway
+Task 2: grabs hold of the BO, waits on its reservation lock
+Task 1: releases its reference of the BO; never gives up the
+ reservation lock
+
+The patch "drm/amdgpu: fix a potential deadlock in
+amdgpu_bo_create_restricted()" attempts to fix that by releasing
+the reservation lock in amdgpu code; unfortunately, it introduces
+a use-after-free when this race _doesn't_ happen.
+
+This patch should fix the race properly by never adding the BO
+to the global list in the first place.
+
+Cc: zhoucm1 <david1.zhou@amd.com>
+Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
+Tested-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1209,18 +1209,20 @@ int ttm_bo_init(struct ttm_bo_device *bd
+ if (likely(!ret))
+ ret = ttm_bo_validate(bo, placement, interruptible, false);
+
+- if (!resv) {
++ if (!resv)
+ ttm_bo_unreserve(bo);
+
+- } else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
++ if (unlikely(ret)) {
++ ttm_bo_unref(&bo);
++ return ret;
++ }
++
++ if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
+ spin_lock(&bo->glob->lru_lock);
+ ttm_bo_add_to_lru(bo);
+ spin_unlock(&bo->glob->lru_lock);
+ }
+
+- if (unlikely(ret))
+- ttm_bo_unref(&bo);
+-
+ return ret;
+ }
+ EXPORT_SYMBOL(ttm_bo_init);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Sinclair Yeh <syeh@vmware.com>
+Date: Thu, 23 Mar 2017 14:28:21 -0700
+Subject: drm/vmwgfx: Fixes to vmwgfx_fb
+
+From: Sinclair Yeh <syeh@vmware.com>
+
+
+[ Upstream commit aa74f0687cfe998e59b20d6454f45e8aa4403c45 ]
+
+1. When unsetting a mode, num_connector should be set to zero
+2. The pixel_format field needs to be initialized as newer DRM internal
+ functions checks this field
+3. Take the drm_modeset_lock_all() because vmw_fb_kms_detach() can
+ change current mode
+
+Signed-off-by: Sinclair Yeh <syeh@vmware.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -433,7 +433,7 @@ static int vmw_fb_kms_detach(struct vmw_
+ set.y = 0;
+ set.mode = NULL;
+ set.fb = NULL;
+- set.num_connectors = 1;
++ set.num_connectors = 0;
+ set.connectors = &par->con;
+ ret = drm_mode_set_config_internal(&set);
+ if (ret) {
+@@ -821,7 +821,9 @@ int vmw_fb_off(struct vmw_private *vmw_p
+ flush_delayed_work(&par->local_work);
+
+ mutex_lock(&par->bo_mutex);
++ drm_modeset_lock_all(vmw_priv->dev);
+ (void) vmw_fb_kms_detach(par, true, false);
++ drm_modeset_unlock_all(vmw_priv->dev);
+ mutex_unlock(&par->bo_mutex);
+
+ return 0;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Thor Thayer <thor.thayer@linux.intel.com>
+Date: Wed, 5 Apr 2017 13:01:02 -0500
+Subject: EDAC, altera: Fix peripheral warnings for Cyclone5
+
+From: Thor Thayer <thor.thayer@linux.intel.com>
+
+
+[ Upstream commit 25b223ddfe2a557307c05fe673e09d94ae950877 ]
+
+The peripherals' RAS functionality only exist on the Arria10 SoCFPGA.
+The Cyclone5 initialization generates EDAC warnings when the peripherals
+aren't found in the device tree. Fix by checking for Arria10 in the init
+functions.
+
+Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/1491415262-5018-1-git-send-email-thor.thayer@linux.intel.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/altera_edac.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1020,13 +1020,23 @@ out:
+ return ret;
+ }
+
++static int socfpga_is_a10(void)
++{
++ return of_machine_is_compatible("altr,socfpga-arria10");
++}
++
+ static int validate_parent_available(struct device_node *np);
+ static const struct of_device_id altr_edac_a10_device_of_match[];
+ static int __init __maybe_unused altr_init_a10_ecc_device_type(char *compat)
+ {
+ int irq;
+- struct device_node *child, *np = of_find_compatible_node(NULL, NULL,
+- "altr,socfpga-a10-ecc-manager");
++ struct device_node *child, *np;
++
++ if (!socfpga_is_a10())
++ return -ENODEV;
++
++ np = of_find_compatible_node(NULL, NULL,
++ "altr,socfpga-a10-ecc-manager");
+ if (!np) {
+ edac_printk(KERN_ERR, EDAC_DEVICE, "ECC Manager not found\n");
+ return -ENODEV;
+@@ -1542,8 +1552,12 @@ static const struct edac_device_prv_data
+ static int __init socfpga_init_sdmmc_ecc(void)
+ {
+ int rc = -ENODEV;
+- struct device_node *child = of_find_compatible_node(NULL, NULL,
+- "altr,socfpga-sdmmc-ecc");
++ struct device_node *child;
++
++ if (!socfpga_is_a10())
++ return -ENODEV;
++
++ child = of_find_compatible_node(NULL, NULL, "altr,socfpga-sdmmc-ecc");
+ if (!child) {
+ edac_printk(KERN_WARNING, EDAC_DEVICE, "SDMMC node not found\n");
+ return -ENODEV;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Greg KH <gregkh@linuxfoundation.org>
+Date: Wed, 8 Mar 2017 19:03:03 +0100
+Subject: eventpoll.h: fix epoll event masks
+
+From: Greg KH <gregkh@linuxfoundation.org>
+
+
+[ Upstream commit 6f051e4a685b768f3704c7c069aa1edee3010622 ]
+
+[resend due to me forgetting to cc: linux-api the first time around I
+posted these back on Feb 23]
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+When userspace tries to use these defines, it complains that it needs to
+be an unsigned 1 that is shifted, so libc implementations have to create
+their own version. Fix this by defining it properly so that libcs can
+just use the kernel uapi header.
+
+Reported-by: Elliott Hughes <enh@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/eventpoll.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/include/uapi/linux/eventpoll.h
++++ b/include/uapi/linux/eventpoll.h
+@@ -40,7 +40,7 @@
+ #define EPOLLRDHUP 0x00002000
+
+ /* Set exclusive wakeup mode for the target file descriptor */
+-#define EPOLLEXCLUSIVE (1 << 28)
++#define EPOLLEXCLUSIVE (1U << 28)
+
+ /*
+ * Request the handling of system wakeup events so as to prevent system suspends
+@@ -52,13 +52,13 @@
+ *
+ * Requires CAP_BLOCK_SUSPEND
+ */
+-#define EPOLLWAKEUP (1 << 29)
++#define EPOLLWAKEUP (1U << 29)
+
+ /* Set the One Shot behaviour for the target file descriptor */
+-#define EPOLLONESHOT (1 << 30)
++#define EPOLLONESHOT (1U << 30)
+
+ /* Set the Edge Triggered behaviour for the target file descriptor */
+-#define EPOLLET (1 << 31)
++#define EPOLLET (1U << 31)
+
+ /*
+ * On x86-64 make the 64bit structure have the same alignment as the
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Tue, 21 Mar 2017 10:59:50 -0400
+Subject: f2fs: relax node version check for victim data in gc
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+
+[ Upstream commit c13ff37e359bb3eacf4e1760dcea8d9760aa7459 ]
+
+- has_not_enough_free_secs
+node_secs: 0 dent_secs: 0 freed:0 free_segments:103 reserved:104
+
+ - f2fs_gc
+ - get_victim_by_default
+alloc_mode 0, gc_mode 1, max_search 2672, offset 4654, ofs_unit 1
+
+ - do_garbage_collect
+start_segno 3976, end_segno 3977 type 0
+
+ - is_alive
+nid 22797, blkaddr 2131882, ofs_in_node 0, version 0x8/0x0
+
+ - gc_data_segment 766, segno 3976, block 512/426 not alive
+
+So, this patch fixes subtle corrupted case where node version does not match
+to summary version which results in infinite loop by gc.
+
+Reported-by: Yunlei He <heyunlei@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/gc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -538,8 +538,10 @@ static bool is_alive(struct f2fs_sb_info
+ get_node_info(sbi, nid, dni);
+
+ if (sum->version != dni->version) {
+- f2fs_put_page(node_page, 1);
+- return false;
++ f2fs_msg(sbi->sb, KERN_WARNING,
++ "%s: valid data with mismatched node version.",
++ __func__);
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ }
+
+ *nofs = ofs_of_node(node_page);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Phil Turnbull <phil.turnbull@oracle.com>
+Date: Wed, 23 Nov 2016 13:33:58 -0500
+Subject: fm10k: correctly check if interface is removed
+
+From: Phil Turnbull <phil.turnbull@oracle.com>
+
+
+[ Upstream commit 540fca35e38d15777b310f450f63f056e63039f5 ]
+
+FM10K_REMOVED expects a hardware address, not a 'struct fm10k_hw'.
+
+Fixes: 5cb8db4a4cbc ("fm10k: Add support for VF")
+Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
+Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+@@ -942,7 +942,7 @@ static void fm10k_self_test(struct net_d
+
+ memset(data, 0, sizeof(*data) * FM10K_TEST_LEN);
+
+- if (FM10K_REMOVED(hw)) {
++ if (FM10K_REMOVED(hw->hw_addr)) {
+ netif_err(interface, drv, dev,
+ "Interface removed - test blocked\n");
+ eth_test->flags |= ETH_TEST_FL_FAILED;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Tomasz Kramkowski <tk@the-tk.com>
+Date: Tue, 14 Mar 2017 13:29:13 +0000
+Subject: HID: clamp input to logical range if no null state
+
+From: Tomasz Kramkowski <tk@the-tk.com>
+
+
+[ Upstream commit c3883fe06488a483658ba5d849b70e49bee15e7c ]
+
+This patch fixes an issue in drivers/hid/hid-input.c where values
+outside of the logical range are not clamped when "null state" bit of
+the input control is not set.
+
+This was discussed on the lists [1] and this change stems from the fact
+due to the ambiguity of the HID specification it might be appropriate to
+follow Microsoft's own interpretation of the specification. As noted in
+Microsoft's documentation [2] in the section titled "Required HID usages
+for digitizers" it is noted that values reported outside the logical
+range "will be considered as invalid data and the value will be changed
+to the nearest boundary value (logical min/max)."
+
+This patch fixes an issue where the (1292:4745) Innomedia INNEX
+GENESIS/ATARI reports out of range values for its X and Y axis of the
+DPad which, due to the null state bit being unset, are forwarded to
+userspace as is. Now these values will get clamped to the logical range
+before being forwarded to userspace. This device was also used to test
+this patch.
+
+This patch expands on commit 3f3752705dbd ("HID: reject input outside
+logical range only if null state is set").
+
+[1]: http://lkml.kernel.org/r/20170307131036.GA853@gaia.local
+[2]: https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp
+
+Signed-off-by: Tomasz Kramkowski <tk@the-tk.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-input.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1149,19 +1149,26 @@ void hidinput_hid_event(struct hid_devic
+
+ /*
+ * Ignore out-of-range values as per HID specification,
+- * section 5.10 and 6.2.25.
++ * section 5.10 and 6.2.25, when NULL state bit is present.
++ * When it's not, clamp the value to match Microsoft's input
++ * driver as mentioned in "Required HID usages for digitizers":
++ * https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp
+ *
+ * The logical_minimum < logical_maximum check is done so that we
+ * don't unintentionally discard values sent by devices which
+ * don't specify logical min and max.
+ */
+ if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+- (field->flags & HID_MAIN_ITEM_NULL_STATE) &&
+- (field->logical_minimum < field->logical_maximum) &&
+- (value < field->logical_minimum ||
+- value > field->logical_maximum)) {
+- dbg_hid("Ignoring out-of-range value %x\n", value);
+- return;
++ (field->logical_minimum < field->logical_maximum)) {
++ if (field->flags & HID_MAIN_ITEM_NULL_STATE &&
++ (value < field->logical_minimum ||
++ value > field->logical_maximum)) {
++ dbg_hid("Ignoring out-of-range value %x\n", value);
++ return;
++ }
++ value = clamp(value,
++ field->logical_minimum,
++ field->logical_maximum);
+ }
+
+ /*
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Wed, 22 Nov 2017 11:19:51 +0100
+Subject: HID: elo: clear BTN_LEFT mapping
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+
+[ Upstream commit 9abd04af951e5734c9d5cfee9b49790844b734cf ]
+
+ELO devices have one Button usage in GenDesk field, which makes hid-input map
+it to BTN_LEFT; that confuses userspace, which then considers the device to be
+a mouse/touchpad instead of touchscreen.
+
+Fix that by unmapping BTN_LEFT and keeping only BTN_TOUCH in place.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-elo.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hid/hid-elo.c
++++ b/drivers/hid/hid-elo.c
+@@ -42,6 +42,12 @@ static int elo_input_configured(struct h
+ {
+ struct input_dev *input = hidinput->input;
+
++ /*
++ * ELO devices have one Button usage in GenDesk field, which makes
++ * hid-input map it to BTN_LEFT; that confuses userspace, which then
++ * considers the device to be a mouse/touchpad instead of touchscreen.
++ */
++ clear_bit(BTN_LEFT, input->keybit);
+ set_bit(BTN_TOUCH, input->keybit);
+ set_bit(ABS_PRESSURE, input->absbit);
+ input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Valtteri Heikkilä" <rnd@nic.fi>
+Date: Tue, 14 Feb 2017 23:14:32 +0000
+Subject: HID: reject input outside logical range only if null state is set
+
+From: "Valtteri Heikkilä" <rnd@nic.fi>
+
+
+[ Upstream commit 3f3752705dbd50b66b66ad7b4d54fe33d2f746ed ]
+
+This patch fixes an issue in drivers/hid/hid-input.c where USB HID
+control null state flag is not checked upon rejecting inputs outside
+logical minimum-maximum range. The check should be made according to USB
+HID specification 1.11, section 6.2.2.5, p.31. The fix will resolve
+issues with some game controllers, such as:
+https://bugzilla.kernel.org/show_bug.cgi?id=68621
+
+[tk@the-tk.com: shortened and fixed spelling in commit message]
+Signed-off-by: Valtteri Heikkilä <rnd@nic.fi>
+Signed-off-by: Tomasz Kramkowski <tk@the-tk.com>
+Acked-By: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-input.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1156,6 +1156,7 @@ void hidinput_hid_event(struct hid_devic
+ * don't specify logical min and max.
+ */
+ if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
++ (field->flags & HID_MAIN_ITEM_NULL_STATE) &&
+ (field->logical_minimum < field->logical_maximum) &&
+ (value < field->logical_minimum ||
+ value > field->logical_maximum)) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Aaron Salter <aaron.k.salter@intel.com>
+Date: Fri, 2 Dec 2016 12:33:02 -0800
+Subject: i40e: Acquire NVM lock before reads on all devices
+
+From: Aaron Salter <aaron.k.salter@intel.com>
+
+
+[ Upstream commit 96a39aed25e6559b160786117df124084feb9080 ]
+
+Acquire NVM lock before reads on all devices. Previously, locks were
+only used for X722 and later. Fixes an issue where simultaneous X710
+NVM accesses were interfering with each other.
+
+Change-ID: If570bb7acf958cef58725ec2a2011cead6f80638
+Signed-off-by: Aaron Salter <aaron.k.salter@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_nvm.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+@@ -292,14 +292,14 @@ i40e_status i40e_read_nvm_word(struct i4
+ {
+ enum i40e_status_code ret_code = 0;
+
+- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) {
+- ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
+- if (!ret_code) {
++ ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
++ if (!ret_code) {
++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) {
+ ret_code = i40e_read_nvm_word_aq(hw, offset, data);
+- i40e_release_nvm(hw);
++ } else {
++ ret_code = i40e_read_nvm_word_srctl(hw, offset, data);
+ }
+- } else {
+- ret_code = i40e_read_nvm_word_srctl(hw, offset, data);
++ i40e_release_nvm(hw);
+ }
+ return ret_code;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Lihong Yang <lihong.yang@intel.com>
+Date: Mon, 30 Jan 2017 12:29:32 -0800
+Subject: i40e: fix ethtool to get EEPROM data from X722 interface
+
+From: Lihong Yang <lihong.yang@intel.com>
+
+
+[ Upstream commit c271dd6c391b535226cf1a81aaad9f33cb5899d3 ]
+
+Currently ethtool -e will error out with a X722 interface
+as its EEPROM has a scope limit at offset 0x5B9FFF.
+This patch fixes the issue by setting the EEPROM length to
+the scope limit to avoid NVM read failure beyond that.
+
+Change-ID: I0b7d4dd6c7f2a57cace438af5dffa0f44c229372
+Signed-off-by: Lihong Yang <lihong.yang@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -1135,6 +1135,11 @@ static int i40e_get_eeprom_len(struct ne
+ struct i40e_hw *hw = &np->vsi->back->hw;
+ u32 val;
+
++#define X722_EEPROM_SCOPE_LIMIT 0x5B9FFF
++ if (hw->mac.type == I40E_MAC_X722) {
++ val = X722_EEPROM_SCOPE_LIMIT + 1;
++ return val;
++ }
+ val = (rd32(hw, I40E_GLPCI_LBARCTRL)
+ & I40E_GLPCI_LBARCTRL_FL_SIZE_MASK)
+ >> I40E_GLPCI_LBARCTRL_FL_SIZE_SHIFT;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Tue, 21 Feb 2017 15:55:41 -0800
+Subject: i40e/i40evf: Fix use after free in Rx cleanup path
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+
+[ Upstream commit 741b8b832a57402380be79d7d11a59eaf57fff3b ]
+
+We need to reset skb back to NULL when we have freed it in the Rx cleanup
+path. I found one spot where this wasn't occurring so this patch fixes it.
+
+Change-ID: Iaca68934200732cd4a63eb0bd83b539c95f8c4dd
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 1 +
+ drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -1820,6 +1820,7 @@ static int i40e_clean_rx_irq(struct i40e
+ */
+ if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) {
+ dev_kfree_skb_any(skb);
++ skb = NULL;
+ continue;
+ }
+
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -1262,6 +1262,7 @@ static int i40e_clean_rx_irq(struct i40e
+ */
+ if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) {
+ dev_kfree_skb_any(skb);
++ skb = NULL;
+ continue;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mitch Williams <mitch.a.williams@intel.com>
+Date: Tue, 4 Apr 2017 12:40:16 -0700
+Subject: i40e: only register client on iWarp-capable devices
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+
+[ Upstream commit 004eb614c4d2fcc12a98714fd887a860582f203a ]
+
+The client interface is only intended for use on devices that support
+iWarp. Only register with the client if this is the case.
+
+This fixes a panic when loading i40iw on X710 devices.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Reported-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11142,10 +11142,12 @@ static int i40e_probe(struct pci_dev *pd
+ round_jiffies(jiffies + pf->service_timer_period));
+
+ /* add this PF to client device list and launch a client service task */
+- err = i40e_lan_add_device(pf);
+- if (err)
+- dev_info(&pdev->dev, "Failed to add PF to client API service list: %d\n",
+- err);
++ if (pf->flags & I40E_FLAG_IWARP_ENABLED) {
++ err = i40e_lan_add_device(pf);
++ if (err)
++ dev_info(&pdev->dev, "Failed to add PF to client API service list: %d\n",
++ err);
++ }
+
+ #ifdef I40E_FCOE
+ /* create FCoE interface */
+@@ -11323,10 +11325,11 @@ static void i40e_remove(struct pci_dev *
+ i40e_vsi_release(pf->vsi[pf->lan_vsi]);
+
+ /* remove attached clients */
+- ret_code = i40e_lan_del_device(pf);
+- if (ret_code) {
+- dev_warn(&pdev->dev, "Failed to delete client device: %d\n",
+- ret_code);
++ if (pf->flags & I40E_FLAG_IWARP_ENABLED) {
++ ret_code = i40e_lan_del_device(pf);
++ if (ret_code)
++ dev_warn(&pdev->dev, "Failed to delete client device: %d\n",
++ ret_code);
+ }
+
+ /* shutdown and destroy the HMC */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Easwar Hariharan <easwar.hariharan@intel.com>
+Date: Mon, 20 Mar 2017 17:25:42 -0700
+Subject: IB/hfi1: Check for QSFP presence before attempting reads
+
+From: Easwar Hariharan <easwar.hariharan@intel.com>
+
+
+[ Upstream commit fb897ad315643e5dc1092a115b3cec914b66df9d ]
+
+Attempting to read the status of a QSFP cable creates noise in the logs
+and misses out on setting an appropriate Offline/Disabled Reason if the
+cable is not plugged in. Check for this prior to attempting the read and
+attendant retries.
+
+Fixes: 673b975f1fba ("IB/hfi1: Add QSFP sanity pre-check")
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Easwar Hariharan <easwar.hariharan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -9489,8 +9489,11 @@ static int test_qsfp_read(struct hfi1_pp
+ int ret;
+ u8 status;
+
+- /* report success if not a QSFP */
+- if (ppd->port_type != PORT_TYPE_QSFP)
++ /*
++ * Report success if not a QSFP or, if it is a QSFP, but the cable is
++ * not present
++ */
++ if (ppd->port_type != PORT_TYPE_QSFP || !qsfp_mod_present(ppd))
+ return 0;
+
+ /* read byte 2, the status byte */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Date: Wed, 8 Nov 2017 07:38:28 -0500
+Subject: ima: relax requiring a file signature for new files with zero length
+
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+
+[ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ]
+
+Custom policies can require file signatures based on LSM labels. These
+files are normally created and only afterwards labeled, requiring them
+to be signed.
+
+Instead of requiring file signatures based on LSM labels, entire
+filesystems could require file signatures. In this case, we need the
+ability of writing new files without requiring file signatures.
+
+The definition of a "new" file was originally defined as any file with
+a length of zero. Subsequent patches redefined a "new" file to be based
+on the FILE_CREATE open flag. By combining the open flag with a file
+size of zero, this patch relaxes the file signature requirement.
+
+Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/ima_appraise.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -207,7 +207,8 @@ int ima_appraise_measurement(enum ima_ho
+ if (opened & FILE_CREATED)
+ iint->flags |= IMA_NEW_FILE;
+ if ((iint->flags & IMA_NEW_FILE) &&
+- !(iint->flags & IMA_DIGSIG_REQUIRED))
++ (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
++ (inode->i_size == 0)))
+ status = INTEGRITY_PASS;
+ goto out;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Thu, 23 Mar 2017 13:33:12 -0700
+Subject: Input: qt1070 - add OF device ID table
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+
+[ Upstream commit cf5cd9d4480a87da78768718cac194a71079b5cb ]
+
+The driver doesn't have a struct of_device_id table but supported devices
+are registered via Device Trees. This is working on the assumption that a
+I2C device registered via OF will always match a legacy I2C device ID and
+that the MODALIAS reported will always be of the form i2c:<device>.
+
+But this could change in the future so the correct approach is to have an
+OF device ID table if the devices are registered via OF.
+
+The compatible strings don't have a vendor prefix because that's how it's
+used currently, and changing this will be a Device Tree ABI break.
+
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/keyboard/qt1070.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/input/keyboard/qt1070.c
++++ b/drivers/input/keyboard/qt1070.c
+@@ -274,9 +274,18 @@ static const struct i2c_device_id qt1070
+ };
+ MODULE_DEVICE_TABLE(i2c, qt1070_id);
+
++#ifdef CONFIG_OF
++static const struct of_device_id qt1070_of_match[] = {
++ { .compatible = "qt1070", },
++ { },
++};
++MODULE_DEVICE_TABLE(of, qt1070_of_match);
++#endif
++
+ static struct i2c_driver qt1070_driver = {
+ .driver = {
+ .name = "qt1070",
++ .of_match_table = of_match_ptr(qt1070_of_match),
+ .pm = &qt1070_pm_ops,
+ },
+ .id_table = qt1070_id,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Fri, 17 Feb 2017 12:51:19 -0800
+Subject: Input: tsc2007 - check for presence and power down tsc2007 during probe
+
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+
+
+[ Upstream commit 934df23171e7c5b71d937104d4957891c39748ff ]
+
+1. check if chip is really present and don't succeed if it isn't.
+2. if it succeeds, power down the chip until accessed
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/tsc2007.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/input/touchscreen/tsc2007.c
++++ b/drivers/input/touchscreen/tsc2007.c
+@@ -455,6 +455,14 @@ static int tsc2007_probe(struct i2c_clie
+
+ tsc2007_stop(ts);
+
++ /* power down the chip (TSC2007_SETUP does not ACK on I2C) */
++ err = tsc2007_xfer(ts, PWRDOWN);
++ if (err < 0) {
++ dev_err(&client->dev,
++ "Failed to setup chip: %d\n", err);
++ return err; /* usually, chip does not respond */
++ }
++
+ err = input_register_device(input_dev);
+ if (err) {
+ dev_err(&client->dev,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Nate Watterson <nwatters@codeaurora.org>
+Date: Fri, 7 Apr 2017 01:36:20 -0400
+Subject: iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
+
+From: Nate Watterson <nwatters@codeaurora.org>
+
+
+[ Upstream commit 5016bdb796b3726eec043ca0ce3be981f712c756 ]
+
+Normally, calling alloc_iova() using an iova_domain with insufficient
+pfns remaining between start_pfn and dma_limit will fail and return a
+NULL pointer. Unexpectedly, if such a "full" iova_domain contains an
+iova with pfn_lo == 0, the alloc_iova() call will instead succeed and
+return an iova containing invalid pfns.
+
+This is caused by an underflow bug in __alloc_and_insert_iova_range()
+that occurs after walking the "full" iova tree when the search ends
+at the iova with pfn_lo == 0 and limit_pfn is then adjusted to be just
+below that (-1). This (now huge) limit_pfn gives the impression that a
+vast amount of space is available between it and start_pfn and thus
+a new iova is allocated with the invalid pfn_hi value, 0xFFF.... .
+
+To rememdy this, a check is introduced to ensure that adjustments to
+limit_pfn will not underflow.
+
+This issue has been observed in the wild, and is easily reproduced with
+the following sample code.
+
+ struct iova_domain *iovad = kzalloc(sizeof(*iovad), GFP_KERNEL);
+ struct iova *rsvd_iova, *good_iova, *bad_iova;
+ unsigned long limit_pfn = 3;
+ unsigned long start_pfn = 1;
+ unsigned long va_size = 2;
+
+ init_iova_domain(iovad, SZ_4K, start_pfn, limit_pfn);
+ rsvd_iova = reserve_iova(iovad, 0, 0);
+ good_iova = alloc_iova(iovad, va_size, limit_pfn, true);
+ bad_iova = alloc_iova(iovad, va_size, limit_pfn, true);
+
+Prior to the patch, this yielded:
+ *rsvd_iova == {0, 0} /* Expected */
+ *good_iova == {2, 3} /* Expected */
+ *bad_iova == {-2, -1} /* Oh no... */
+
+After the patch, bad_iova is NULL as expected since inadequate
+space remains between limit_pfn and start_pfn after allocating
+good_iova.
+
+Signed-off-by: Nate Watterson <nwatters@codeaurora.org>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iova.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -138,7 +138,7 @@ static int __alloc_and_insert_iova_range
+ break; /* found a free slot */
+ }
+ adjust_limit_pfn:
+- limit_pfn = curr_iova->pfn_lo - 1;
++ limit_pfn = curr_iova->pfn_lo ? (curr_iova->pfn_lo - 1) : 0;
+ move_left:
+ prev = curr;
+ curr = rb_prev(curr);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mahesh Bandewar <maheshb@google.com>
+Date: Thu, 7 Dec 2017 15:15:43 -0800
+Subject: ipvlan: add L2 check for packets arriving via virtual devices
+
+From: Mahesh Bandewar <maheshb@google.com>
+
+
+[ Upstream commit 92ff42645028fa6f9b8aa767718457b9264316b4 ]
+
+Packets that don't have dest mac as the mac of the master device should
+not be entertained by the IPvlan rx-handler. This is mostly true as the
+packet path mostly takes care of that, except when the master device is
+a virtual device. As demonstrated in the following case -
+
+ ip netns add ns1
+ ip link add ve1 type veth peer name ve2
+ ip link add link ve2 name iv1 type ipvlan mode l2
+ ip link set dev iv1 netns ns1
+ ip link set ve1 up
+ ip link set ve2 up
+ ip -n ns1 link set iv1 up
+ ip addr add 192.168.10.1/24 dev ve1
+ ip -n ns1 addr 192.168.10.2/24 dev iv1
+ ping -c2 192.168.10.2
+ <Works!>
+ ip neigh show dev ve1
+ ip neigh show 192.168.10.2 lladdr <random> dev ve1
+ ping -c2 192.168.10.2
+ <Still works! Wrong!!>
+
+This patch adds that missing check in the IPvlan rx-handler.
+
+Reported-by: Amit Sikka <amit.sikka@ericsson.com>
+Signed-off-by: Mahesh Bandewar <maheshb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -299,6 +299,10 @@ static int ipvlan_rcv_frame(struct ipvl_
+ if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS)
+ success = true;
+ } else {
++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest,
++ ipvlan->phy_dev->dev_addr))
++ skb->pkt_type = PACKET_OTHERHOST;
++
+ ret = RX_HANDLER_ANOTHER;
+ success = true;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 14 Dec 2016 13:48:04 +0100
+Subject: iwlwifi: mvm: fix RX SKB header size and align it properly
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit 5cddd05c9cbe420436799716d009bc0372ef8268 ]
+
+When receiving a frame, we currently pull in sizeof(*hdr) plus
+some extra (crypto/snap), which is too much, most headers aren't
+actually sizeof(*hdr) since that takes into account the 4-address
+format but doesn't take into account QoS. As a result, a typical
+frame will have 4 bytes of the payload in the SKB header already.
+
+Fix this by calculating the correct header length, and now that
+we have that, align the end of the SKB header to a multiple of 4
+so that the IP header will be aligned properly when pulled in.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -104,7 +104,20 @@ static void iwl_mvm_pass_packet_to_mac80
+ u8 crypt_len,
+ struct iwl_rx_cmd_buffer *rxb)
+ {
+- unsigned int hdrlen, fraglen;
++ unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
++ unsigned int fraglen;
++
++ /*
++ * The 'hdrlen' (plus the 8 bytes for the SNAP and the crypt_len,
++ * but those are all multiples of 4 long) all goes away, but we
++ * want the *end* of it, which is going to be the start of the IP
++ * header, to be aligned when it gets pulled in.
++ * The beginning of the skb->data is aligned on at least a 4-byte
++ * boundary after allocation. Everything here is aligned at least
++ * on a 2-byte boundary so we can just take hdrlen & 3 and pad by
++ * the result.
++ */
++ skb_reserve(skb, hdrlen & 3);
+
+ /* If frame is small enough to fit in skb->head, pull it completely.
+ * If not, only pull ieee80211_hdr (including crypto if present, and
+@@ -118,8 +131,7 @@ static void iwl_mvm_pass_packet_to_mac80
+ * If the latter changes (there are efforts in the standards group
+ * to do so) we should revisit this and ieee80211_data_to_8023().
+ */
+- hdrlen = (len <= skb_tailroom(skb)) ? len :
+- sizeof(*hdr) + crypt_len + 8;
++ hdrlen = (len <= skb_tailroom(skb)) ? len : hdrlen + crypt_len + 8;
+
+ memcpy(skb_put(skb, hdrlen), hdr, hdrlen);
+ fraglen = len - hdrlen;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 19 Oct 2017 21:36:04 +0300
+Subject: iwlwifi: mvm: rs: don't override the rate history in the search cycle
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+
+[ Upstream commit 992172e3aec19e5b0ea5b757ba40a146b9282d1e ]
+
+When we are in a search cycle, we try different combinations
+of parameters. Those combinations are called 'columns'.
+When we switch to a new column, we first need to check if
+this column has a suitable rate, if not, we can't try it.
+This means we must not erase the statistics we gathered
+for the previous column until we are sure that we are
+indeed switching column.
+
+The code that tries to switch to a new column first sets
+a whole bunch of things for the new column, and only then
+checks that we can find suitable rates in that column.
+While doing that, the code mistakenly erased the rate
+statistics. This code was right until
+struct iwl_scale_tbl_info grew up for TPC.
+
+Fix this to make sure we don't erase the rate statistics
+until we are sure that we can indeed switch to the new
+column.
+
+Note that this bug is really harmless since it causes a
+change in the behavior only when we can't find any rate
+in the new column which should really not happen. In the
+case we do find a suitable we reset the rate statistics
+a few lines later anyway.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1867,12 +1867,10 @@ static int rs_switch_to_column(struct iw
+ struct rs_rate *rate = &search_tbl->rate;
+ const struct rs_tx_column *column = &rs_tx_columns[col_id];
+ const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
+- u32 sz = (sizeof(struct iwl_scale_tbl_info) -
+- (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
+ unsigned long rate_mask = 0;
+ u32 rate_idx = 0;
+
+- memcpy(search_tbl, tbl, sz);
++ memcpy(search_tbl, tbl, offsetof(struct iwl_scale_tbl_info, win));
+
+ rate->sgi = column->sgi;
+ rate->ant = column->ant;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Wed, 29 Mar 2017 13:56:56 +0900
+Subject: kprobes/x86: Fix kprobe-booster not to boost far call instructions
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+
+[ Upstream commit bd0b90676c30fe640e7ead919b3e38846ac88ab7 ]
+
+Fix the kprobe-booster not to boost far call instruction,
+because a call may store the address in the single-step
+execution buffer to the stack, which should be modified
+after single stepping.
+
+Currently, this instruction will be filtered as not
+boostable in resume_execution(), so this is not a
+critical issue.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ye Xiaolong <xiaolong.ye@intel.com>
+Link: http://lkml.kernel.org/r/149076340615.22469.14066273186134229909.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/kprobes/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -199,6 +199,8 @@ retry:
+ return (opcode != 0x62 && opcode != 0x67);
+ case 0x70:
+ return 0; /* can't boost conditional jump */
++ case 0x90:
++ return opcode != 0x9a; /* can't boost call far */
+ case 0xc0:
+ /* can't boost software-interruptions */
+ return (0xc1 < opcode && opcode < 0xcc) || opcode == 0xcf;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Wed, 29 Mar 2017 14:02:46 +0900
+Subject: kprobes/x86: Set kprobes pages read-only
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+
+[ Upstream commit d0381c81c2f782fa2131178d11e0cfb23d50d631 ]
+
+Set the pages which is used for kprobes' singlestep buffer
+and optprobe's trampoline instruction buffer to readonly.
+This can prevent unexpected (or unintended) instruction
+modification.
+
+This also passes rodata_test as below.
+
+Without this patch, rodata_test shows a warning:
+
+ WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:235 note_page+0x7a9/0xa20
+ x86/mm: Found insecure W+X mapping at address ffffffffa0000000/0xffffffffa0000000
+
+With this fix, no W+X pages are found:
+
+ x86/mm: Checked W+X mappings: passed, no W+X pages found.
+ rodata_test: all tests were successful
+
+Reported-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ye Xiaolong <xiaolong.ye@intel.com>
+Link: http://lkml.kernel.org/r/149076375592.22469.14174394514338612247.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/kprobes/core.c | 4 ++++
+ arch/x86/kernel/kprobes/opt.c | 3 +++
+ 2 files changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -409,6 +409,8 @@ static int arch_copy_kprobe(struct kprob
+ {
+ int ret;
+
++ set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
++
+ /* Copy an instruction with recovering if other optprobe modifies it.*/
+ ret = __copy_instruction(p->ainsn.insn, p->addr);
+ if (!ret)
+@@ -423,6 +425,8 @@ static int arch_copy_kprobe(struct kprob
+ else
+ p->ainsn.boostable = -1;
+
++ set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
++
+ /* Check whether the instruction modifies Interrupt Flag or not */
+ p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn);
+
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -371,6 +371,7 @@ int arch_prepare_optimized_kprobe(struct
+ }
+
+ buf = (u8 *)op->optinsn.insn;
++ set_memory_rw((unsigned long)buf & PAGE_MASK, 1);
+
+ /* Copy instructions into the out-of-line buffer */
+ ret = copy_optimized_instructions(buf + TMPL_END_IDX, op->kp.addr);
+@@ -393,6 +394,8 @@ int arch_prepare_optimized_kprobe(struct
+ synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
+ (u8 *)op->kp.addr + op->optinsn.size);
+
++ set_memory_ro((unsigned long)buf & PAGE_MASK, 1);
++
+ flush_icache_range((unsigned long) buf,
+ (unsigned long) buf + TMPL_END_IDX +
+ op->optinsn.size + RELATIVEJUMP_SIZE);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jim Mattson <jmattson@google.com>
+Date: Wed, 5 Apr 2017 09:14:40 -0700
+Subject: kvm: nVMX: Disallow userspace-injected exceptions in guest mode
+
+From: Jim Mattson <jmattson@google.com>
+
+
+[ Upstream commit 28d06353881939703c34d82a1465136af176c620 ]
+
+The userspace exception injection API and code path are entirely
+unprepared for exceptions that might cause a VM-exit from L2 to L1, so
+the best course of action may be to simply disallow this for now.
+
+1. The API provides no mechanism for userspace to specify the new DR6
+bits for a #DB exception or the new CR2 value for a #PF
+exception. Presumably, userspace is expected to modify these registers
+directly with KVM_SET_SREGS before the next KVM_RUN ioctl. However, in
+the event that L1 intercepts the exception, these registers should not
+be changed. Instead, the new values should be provided in the
+exit_qualification field of vmcs12 (Intel SDM vol 3, section 27.1).
+
+2. In the case of a userspace-injected #DB, inject_pending_event()
+clears DR7.GD before calling vmx_queue_exception(). However, in the
+event that L1 intercepts the exception, this is too early, because
+DR7.GD should not be modified by a #DB that causes a VM-exit directly
+(Intel SDM vol 3, section 27.1).
+
+3. If the injected exception is a #PF, nested_vmx_check_exception()
+doesn't properly check whether or not L1 is interested in the
+associated error code (using the #PF error code mask and match fields
+from vmcs12). It may either return 0 when it should call
+nested_vmx_vmexit() or vice versa.
+
+4. nested_vmx_check_exception() assumes that it is dealing with a
+hardware-generated exception intercept from L2, with some of the
+relevant details (the VM-exit interruption-information and the exit
+qualification) live in vmcs02. For userspace-injected exceptions, this
+is not the case.
+
+5. prepare_vmcs12() assumes that when its exit_intr_info argument
+specifies valid information with a valid error code that it can VMREAD
+the VM-exit interruption error code from vmcs02. For
+userspace-injected exceptions, this is not the case.
+
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/x86.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3070,7 +3070,8 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_e
+ return -EINVAL;
+
+ if (events->exception.injected &&
+- (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR))
++ (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR ||
++ is_guest_mode(vcpu)))
+ return -EINVAL;
+
+ /* INITs are latched while in SMM */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Borislav Petkov <bp@suse.de>
+Date: Sun, 26 Mar 2017 23:51:24 +0200
+Subject: kvm/svm: Setup MCG_CAP on AMD properly
+
+From: Borislav Petkov <bp@suse.de>
+
+
+[ Upstream commit 74f169090b6f36b867c9df0454366dd9af6f62d1 ]
+
+MCG_CAP[63:9] bits are reserved on AMD. However, on an AMD guest, this
+MSR returns 0x100010a. More specifically, bit 24 is set, which is simply
+wrong. That bit is MCG_SER_P and is present only on Intel. Thus, clean
+up the reserved bits in order not to confuse guests.
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5449,6 +5449,12 @@ static inline void avic_post_state_resto
+ avic_handle_ldr_update(vcpu);
+ }
+
++static void svm_setup_mce(struct kvm_vcpu *vcpu)
++{
++ /* [63:9] are reserved. */
++ vcpu->arch.mcg_cap &= 0x1ff;
++}
++
+ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
+ .cpu_has_kvm_support = has_svm,
+ .disabled_by_bios = is_disabled,
+@@ -5564,6 +5570,7 @@ static struct kvm_x86_ops svm_x86_ops __
+ .pmu_ops = &amd_pmu_ops,
+ .deliver_posted_interrupt = svm_deliver_avic_intr,
+ .update_pi_irte = svm_update_pi_irte,
++ .setup_mce = svm_setup_mce,
+ };
+
+ static int __init svm_init(void)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 30 Nov 2017 21:16:56 -0800
+Subject: leds: pm8058: Silence pointer to integer size warning
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+
+[ Upstream commit 8f52df50d9366f770a894d14ef724e5e04574e98 ]
+
+The pointer returned by of_device_get_match_data() doesn't have the same
+size as u32 on 64-bit architectures, causing a compile warning when
+compile-testing the driver on such platform.
+
+Cast the return value of of_device_get_match_data() to unsigned long and
+then to u32 to silence this warning.
+
+Fixes: 7f866986e705 ("leds: add PM8058 LEDs driver")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/leds-pm8058.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/leds-pm8058.c
++++ b/drivers/leds/leds-pm8058.c
+@@ -106,7 +106,7 @@ static int pm8058_led_probe(struct platf
+ if (!led)
+ return -ENOMEM;
+
+- led->ledtype = (u32)of_device_get_match_data(&pdev->dev);
++ led->ledtype = (u32)(unsigned long)of_device_get_match_data(&pdev->dev);
+
+ map = dev_get_regmap(pdev->dev.parent, NULL);
+ if (!map) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 28 Mar 2017 11:57:27 +0200
+Subject: lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 7064dc7fc13b2994d33ae540ffb7a3a05ac463bf ]
+
+I ran into a link error on ARM64 for lkdtm_rodata_do_nothing:
+
+drivers/misc/built-in.o: In function `lkdtm_rodata_do_nothing':
+:(.rodata+0x68c8): relocation truncated to fit: R_AARCH64_CALL26 against symbol `__sanitizer_cov_trace_pc' defined in .text section in kernel/built-in.o
+
+I did not analyze this further, but my theory is that we would need a trampoline
+to call __sanitizer_cov_trace_pc(), but the linker (correctly) only adds trampolines
+for callers in executable sections.
+
+Disabling KCOV for this one file avoids the build failure with no
+other practical downsides I can think of.
+
+The problem can only happen on kernels that contain both kcov and
+lkdtm, so if we want to backport this, it should be in the earliest
+version that has both (v4.8).
+
+Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
+Fixes: 9a49a528dcf3 ("lkdtm: add function for testing .rodata section")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Dmitry Vyukov <dvyukov@google.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -61,6 +61,8 @@ lkdtm-$(CONFIG_LKDTM) += lkdtm_perms.o
+ lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o
+ lkdtm-$(CONFIG_LKDTM) += lkdtm_usercopy.o
+
++KCOV_INSTRUMENT_lkdtm_rodata.o := n
++
+ OBJCOPYFLAGS :=
+ OBJCOPYFLAGS_lkdtm_rodata_objcopy.o := \
+ --set-section-flags .text=alloc,readonly \
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 15 May 2017 02:07:23 -0700
+Subject: locking/locktorture: Fix num reader/writer corner cases
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+
+[ Upstream commit 2ce77d16db4240dd2e422fc0a5c26d3e2ec03446 ]
+
+Things can explode for locktorture if the user does combinations
+of nwriters_stress=0 nreaders_stress=0. Fix this by not assuming
+we always want to torture writer threads.
+
+Reported-by: Jeremy Linton <jeremy.linton@arm.com>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
+Tested-by: Jeremy Linton <jeremy.linton@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/locktorture.c | 76 ++++++++++++++++++++++++-------------------
+ 1 file changed, 44 insertions(+), 32 deletions(-)
+
+--- a/kernel/locking/locktorture.c
++++ b/kernel/locking/locktorture.c
+@@ -641,8 +641,7 @@ static void __torture_print_stats(char *
+ {
+ bool fail = 0;
+ int i, n_stress;
+- long max = 0;
+- long min = statp[0].n_lock_acquired;
++ long max = 0, min = statp ? statp[0].n_lock_acquired : 0;
+ long long sum = 0;
+
+ n_stress = write ? cxt.nrealwriters_stress : cxt.nrealreaders_stress;
+@@ -749,7 +748,7 @@ static void lock_torture_cleanup(void)
+ * such, only perform the underlying torture-specific cleanups,
+ * and avoid anything related to locktorture.
+ */
+- if (!cxt.lwsa)
++ if (!cxt.lwsa && !cxt.lrsa)
+ goto end;
+
+ if (writer_tasks) {
+@@ -823,6 +822,13 @@ static int __init lock_torture_init(void
+ firsterr = -EINVAL;
+ goto unwind;
+ }
++
++ if (nwriters_stress == 0 && nreaders_stress == 0) {
++ pr_alert("lock-torture: must run at least one locking thread\n");
++ firsterr = -EINVAL;
++ goto unwind;
++ }
++
+ if (cxt.cur_ops->init)
+ cxt.cur_ops->init();
+
+@@ -846,17 +852,19 @@ static int __init lock_torture_init(void
+ #endif
+
+ /* Initialize the statistics so that each run gets its own numbers. */
++ if (nwriters_stress) {
++ lock_is_write_held = 0;
++ cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
++ if (cxt.lwsa == NULL) {
++ VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
++ firsterr = -ENOMEM;
++ goto unwind;
++ }
+
+- lock_is_write_held = 0;
+- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
+- if (cxt.lwsa == NULL) {
+- VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
+- firsterr = -ENOMEM;
+- goto unwind;
+- }
+- for (i = 0; i < cxt.nrealwriters_stress; i++) {
+- cxt.lwsa[i].n_lock_fail = 0;
+- cxt.lwsa[i].n_lock_acquired = 0;
++ for (i = 0; i < cxt.nrealwriters_stress; i++) {
++ cxt.lwsa[i].n_lock_fail = 0;
++ cxt.lwsa[i].n_lock_acquired = 0;
++ }
+ }
+
+ if (cxt.cur_ops->readlock) {
+@@ -873,19 +881,21 @@ static int __init lock_torture_init(void
+ cxt.nrealreaders_stress = cxt.nrealwriters_stress;
+ }
+
+- lock_is_read_held = 0;
+- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
+- if (cxt.lrsa == NULL) {
+- VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
+- firsterr = -ENOMEM;
+- kfree(cxt.lwsa);
+- cxt.lwsa = NULL;
+- goto unwind;
+- }
+-
+- for (i = 0; i < cxt.nrealreaders_stress; i++) {
+- cxt.lrsa[i].n_lock_fail = 0;
+- cxt.lrsa[i].n_lock_acquired = 0;
++ if (nreaders_stress) {
++ lock_is_read_held = 0;
++ cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
++ if (cxt.lrsa == NULL) {
++ VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
++ firsterr = -ENOMEM;
++ kfree(cxt.lwsa);
++ cxt.lwsa = NULL;
++ goto unwind;
++ }
++
++ for (i = 0; i < cxt.nrealreaders_stress; i++) {
++ cxt.lrsa[i].n_lock_fail = 0;
++ cxt.lrsa[i].n_lock_acquired = 0;
++ }
+ }
+ }
+
+@@ -915,12 +925,14 @@ static int __init lock_torture_init(void
+ goto unwind;
+ }
+
+- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
+- GFP_KERNEL);
+- if (writer_tasks == NULL) {
+- VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
+- firsterr = -ENOMEM;
+- goto unwind;
++ if (nwriters_stress) {
++ writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
++ GFP_KERNEL);
++ if (writer_tasks == NULL) {
++ VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
++ firsterr = -ENOMEM;
++ goto unwind;
++ }
+ }
+
+ if (cxt.cur_ops->readlock) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Sun, 29 Oct 2017 11:51:10 +0200
+Subject: mac80211: remove BUG() when interface type is invalid
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+
+[ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ]
+
+In the ieee80211_setup_sdata() we check if the interface type is valid
+and, if not, call BUG(). This should never happen, but if there is
+something wrong with the code, it will not be caught until the bug
+happens when an interface is being set up. Calling BUG() is too
+extreme for this and a WARN_ON() would be better used instead. Change
+that.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/iface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1520,7 +1520,7 @@ static void ieee80211_setup_sdata(struct
+ break;
+ case NL80211_IFTYPE_UNSPECIFIED:
+ case NUM_NL80211_IFTYPES:
+- BUG();
++ WARN_ON(1);
+ break;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Adiel Aloni <adiel.aloni@intel.com>
+Date: Fri, 1 Dec 2017 13:50:53 +0200
+Subject: mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
+
+From: Adiel Aloni <adiel.aloni@intel.com>
+
+
+[ Upstream commit e16ea4bb516bc21ea2202f2107718b29218bea59 ]
+
+Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll,
+only if PS_ENABLED was set before.
+This is required due to commit c9491367b759 ("mac80211: always update the
+PM state of a peer on MGMT / DATA frames") that enforces the ap to
+check only mgmt/data frames ps bit, and then update station's power save
+accordingly.
+When sending only ps-poll (control frame) the ap will not be aware that
+the station entered power save.
+Setting ps enable before triggering ps_poll, will send NDP with PM bit
+enabled first.
+
+Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -728,16 +728,21 @@ static int hwsim_fops_ps_write(void *dat
+ val != PS_MANUAL_POLL)
+ return -EINVAL;
+
+- old_ps = data->ps;
+- data->ps = val;
+-
+- local_bh_disable();
+ if (val == PS_MANUAL_POLL) {
++ if (data->ps != PS_ENABLED)
++ return -EINVAL;
++ local_bh_disable();
+ ieee80211_iterate_active_interfaces_atomic(
+ data->hw, IEEE80211_IFACE_ITER_NORMAL,
+ hwsim_send_ps_poll, data);
+- data->ps_poll_pending = true;
+- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
++ local_bh_enable();
++ return 0;
++ }
++ old_ps = data->ps;
++ data->ps = val;
++
++ local_bh_disable();
++ if (old_ps == PS_DISABLED && val != PS_DISABLED) {
+ ieee80211_iterate_active_interfaces_atomic(
+ data->hw, IEEE80211_IFACE_ITER_NORMAL,
+ hwsim_send_nullfunc_ps, data);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 13 Apr 2017 10:31:16 +0200
+Subject: mac80211_hwsim: use per-interface power level
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit 1d5e9f80ab021e3e1f9436627a4ad07a143ccb2c ]
+
+When channel contexts are used, there's no global power level
+(the power_level is always 0). Use the per-interface TX power
+in mac80211_hwsim to have a proper setting for both cases.
+
+This fixes the bgscan_simple and bgscan_learn test cases when
+the number of channels advertised by hwsim is >1 by default.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -552,8 +552,6 @@ struct mac80211_hwsim_data {
+ /* wmediumd portid responsible for netgroup of this radio */
+ u32 wmediumd;
+
+- int power_level;
+-
+ /* difference between this hw's clock and the real clock, in usecs */
+ s64 tsf_offset;
+ s64 bcn_delta;
+@@ -1208,7 +1206,9 @@ static bool mac80211_hwsim_tx_frame_no_n
+ if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+ rx_status.flag |= RX_FLAG_SHORT_GI;
+ /* TODO: simulate real signal strength (and optional packet loss) */
+- rx_status.signal = data->power_level - 50;
++ rx_status.signal = -50;
++ if (info->control.vif)
++ rx_status.signal += info->control.vif->bss_conf.txpower;
+
+ if (data->ps != PS_DISABLED)
+ hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+@@ -1607,7 +1607,6 @@ static int mac80211_hwsim_config(struct
+
+ WARN_ON(data->channel && data->use_chanctx);
+
+- data->power_level = conf->power_level;
+ if (!data->started || !data->beacon_int)
+ tasklet_hrtimer_cancel(&data->beacon_timer);
+ else if (!hrtimer_is_queued(&data->beacon_timer.timer)) {
+@@ -2212,7 +2211,6 @@ static const char mac80211_hwsim_gstring
+ "d_tx_failed",
+ "d_ps_mode",
+ "d_group",
+- "d_tx_power",
+ };
+
+ #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
+@@ -2249,7 +2247,6 @@ static void mac80211_hwsim_get_et_stats(
+ data[i++] = ar->tx_failed;
+ data[i++] = ar->ps;
+ data[i++] = ar->group;
+- data[i++] = ar->power_level;
+
+ WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: NeilBrown <neilb@suse.com>
+Date: Mon, 3 Apr 2017 12:11:32 +1000
+Subject: md/raid6: Fix anomily when recovering a single device in RAID6.
+
+From: NeilBrown <neilb@suse.com>
+
+
+[ Upstream commit 7471fb77ce4dc4cb81291189947fcdf621a97987 ]
+
+When recoverying a single missing/failed device in a RAID6,
+those stripes where the Q block is on the missing device are
+handled a bit differently. In these cases it is easy to
+check that the P block is correct, so we do. This results
+in the P block be destroy. Consequently the P block needs
+to be read a second time in order to compute Q. This causes
+lots of seeks and hurts performance.
+
+It shouldn't be necessary to re-read P as it can be computed
+from the DATA. But we only compute blocks on missing
+devices, since c337869d9501 ("md: do not compute parity
+unless it is on a failed drive").
+
+So relax the change made in that commit to allow computing
+of the P block in a RAID6 which it is the only missing that
+block.
+
+This makes RAID6 recovery run much faster as the disk just
+"before" the recovering device is no longer seeking
+back-and-forth.
+
+Reported-by-tested-by: Brad Campbell <lists2009@fnarfbargle.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3391,9 +3391,20 @@ static int fetch_block(struct stripe_hea
+ BUG_ON(test_bit(R5_Wantcompute, &dev->flags));
+ BUG_ON(test_bit(R5_Wantread, &dev->flags));
+ BUG_ON(sh->batch_head);
++
++ /*
++ * In the raid6 case if the only non-uptodate disk is P
++ * then we already trusted P to compute the other failed
++ * drives. It is safe to compute rather than re-read P.
++ * In other cases we only compute blocks from failed
++ * devices, otherwise check/repair might fail to detect
++ * a real inconsistency.
++ */
++
+ if ((s->uptodate == disks - 1) &&
++ ((sh->qd_idx >= 0 && sh->pd_idx == disk_idx) ||
+ (s->failed && (disk_idx == s->failed_num[0] ||
+- disk_idx == s->failed_num[1]))) {
++ disk_idx == s->failed_num[1])))) {
+ /* have disk failed, and we're requested to fetch it;
+ * do compute it
+ */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Zhilong Liu <zlliu@suse.com>
+Date: Mon, 10 Apr 2017 14:15:55 +0800
+Subject: md.c:didn't unlock the mddev before return EINVAL in array_size_store
+
+From: Zhilong Liu <zlliu@suse.com>
+
+
+[ Upstream commit b670883bb9e55ba63a278d83e034faefc01ce2cf ]
+
+md.c: it needs to release the mddev lock before
+the array_size_store() returns.
+
+Fixes: ab5a98b132fd ("md-cluster: change array_sectors and update size are not supported")
+
+Signed-off-by: Zhilong Liu <zlliu@suse.com>
+Reviewed-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4826,8 +4826,10 @@ array_size_store(struct mddev *mddev, co
+ return err;
+
+ /* cluster raid doesn't support change array_sectors */
+- if (mddev_is_clustered(mddev))
++ if (mddev_is_clustered(mddev)) {
++ mddev_unlock(mddev);
+ return -EINVAL;
++ }
+
+ if (strncmp(buf, "default", 7) == 0) {
+ if (mddev->pers)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 9 Nov 2017 16:28:14 -0500
+Subject: media: cpia2: Fix a couple off by one bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ]
+
+The cam->buffers[] array has cam->num_frames elements so the > needs to
+be changed to >= to avoid going beyond the end of the array. The
+->buffers[] array is allocated in cpia2_allocate_buffers() if you want
+to confirm.
+
+Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/cpia2/cpia2_v4l.c
++++ b/drivers/media/usb/cpia2/cpia2_v4l.c
+@@ -812,7 +812,7 @@ static int cpia2_querybuf(struct file *f
+ struct camera_data *cam = video_drvdata(file);
+
+ if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE ||
+- buf->index > cam->num_frames)
++ buf->index >= cam->num_frames)
+ return -EINVAL;
+
+ buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer;
+@@ -863,7 +863,7 @@ static int cpia2_qbuf(struct file *file,
+
+ if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE ||
+ buf->memory != V4L2_MEMORY_MMAP ||
+- buf->index > cam->num_frames)
++ buf->index >= cam->num_frames)
+ return -EINVAL;
+
+ DBG("QBUF #%d\n", buf->index);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Wed, 15 Jun 2016 19:29:50 -0300
+Subject: [media] media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+
+[ Upstream commit 54449af0e0b2ea43a8166611c95b730c850c3184 ]
+
+After changes to v4l2_clk API introduced in v4.1 by commits a37462b919
+'[media] V4L: remove clock name from v4l2_clk API' and 4f528afcfb
+'[media] V4L: add CCF support to the v4l2_clk API', ov6650 sensor
+stopped responding because v4l2_clk_get(), still called with
+depreciated V4L2 clock name "mclk", started to return respective CCF
+clock instead of the V4l2 one registered by soc_camera. Fix it by
+calling v4l2_clk_get() with NULL clock name.
+
+Created and tested on Amstrad Delta against Linux-4.7-rc3 with
+omap1_camera fixes.
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -1033,7 +1033,7 @@ static int ov6650_probe(struct i2c_clien
+ priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+ priv->colorspace = V4L2_COLORSPACE_JPEG;
+
+- priv->clk = v4l2_clk_get(&client->dev, "mclk");
++ priv->clk = v4l2_clk_get(&client->dev, NULL);
+ if (IS_ERR(priv->clk)) {
+ ret = PTR_ERR(priv->clk);
+ goto eclkget;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Date: Mon, 4 Dec 2017 06:01:11 -0500
+Subject: media: vsp1: Prevent suspending and resuming DRM pipelines
+
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+
+
+[ Upstream commit a17d2d6cd9985ca09a9e384f1bc71d710f7e5203 ]
+
+When used as part of a display pipeline, the VSP is stopped and
+restarted explicitly by the DU from its suspend and resume handlers.
+There is thus no need to stop or restart pipelines in the VSP suspend
+and resume handlers, and doing so would cause the hardware to be
+left in a misconfigured state.
+
+Ensure that the VSP suspend and resume handlers do not affect DRM-based
+pipelines.
+
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vsp1/vsp1_drv.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -509,7 +509,13 @@ static int __maybe_unused vsp1_pm_suspen
+ {
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+
+- vsp1_pipelines_suspend(vsp1);
++ /*
++ * When used as part of a display pipeline, the VSP is stopped and
++ * restarted explicitly by the DU.
++ */
++ if (!vsp1->drm)
++ vsp1_pipelines_suspend(vsp1);
++
+ pm_runtime_force_suspend(vsp1->dev);
+
+ return 0;
+@@ -520,7 +526,13 @@ static int __maybe_unused vsp1_pm_resume
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+
+ pm_runtime_force_resume(vsp1->dev);
+- vsp1_pipelines_resume(vsp1);
++
++ /*
++ * When used as part of a display pipeline, the VSP is stopped and
++ * restarted explicitly by the DU.
++ */
++ if (!vsp1->drm)
++ vsp1_pipelines_resume(vsp1);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: David Daney <david.daney@cavium.com>
+Date: Tue, 14 Mar 2017 14:21:44 -0700
+Subject: MIPS: BPF: Fix multiple problems in JIT skb access helpers.
+
+From: David Daney <david.daney@cavium.com>
+
+
+[ Upstream commit a81507c79f4ae9a0f9fb1054b59b62a090620dd9 ]
+
+o Socket data is unsigned, so use unsigned accessors instructions.
+
+ o Fix path result pointer generation arithmetic.
+
+ o Fix half-word byte swapping code for unsigned semantics.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Steven J. Hill <steven.hill@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/15747/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/net/bpf_jit_asm.S | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/arch/mips/net/bpf_jit_asm.S
++++ b/arch/mips/net/bpf_jit_asm.S
+@@ -90,18 +90,14 @@ FEXPORT(sk_load_half_positive)
+ is_offset_in_header(2, half)
+ /* Offset within header boundaries */
+ PTR_ADDU t1, $r_skb_data, offset
+- .set reorder
+- lh $r_A, 0(t1)
+- .set noreorder
++ lhu $r_A, 0(t1)
+ #ifdef CONFIG_CPU_LITTLE_ENDIAN
+ # if defined(__mips_isa_rev) && (__mips_isa_rev >= 2)
+- wsbh t0, $r_A
+- seh $r_A, t0
++ wsbh $r_A, $r_A
+ # else
+- sll t0, $r_A, 24
+- andi t1, $r_A, 0xff00
+- sra t0, t0, 16
+- srl t1, t1, 8
++ sll t0, $r_A, 8
++ srl t1, $r_A, 8
++ andi t0, t0, 0xff00
+ or $r_A, t0, t1
+ # endif
+ #endif
+@@ -115,7 +111,7 @@ FEXPORT(sk_load_byte_positive)
+ is_offset_in_header(1, byte)
+ /* Offset within header boundaries */
+ PTR_ADDU t1, $r_skb_data, offset
+- lb $r_A, 0(t1)
++ lbu $r_A, 0(t1)
+ jr $r_ra
+ move $r_ret, zero
+ END(sk_load_byte)
+@@ -139,6 +135,11 @@ FEXPORT(sk_load_byte_positive)
+ * (void *to) is returned in r_s0
+ *
+ */
++#ifdef CONFIG_CPU_LITTLE_ENDIAN
++#define DS_OFFSET(SIZE) (4 * SZREG)
++#else
++#define DS_OFFSET(SIZE) ((4 * SZREG) + (4 - SIZE))
++#endif
+ #define bpf_slow_path_common(SIZE) \
+ /* Quick check. Are we within reasonable boundaries? */ \
+ LONG_ADDIU $r_s1, $r_skb_len, -SIZE; \
+@@ -150,7 +151,7 @@ FEXPORT(sk_load_byte_positive)
+ PTR_LA t0, skb_copy_bits; \
+ PTR_S $r_ra, (5 * SZREG)($r_sp); \
+ /* Assign low slot to a2 */ \
+- move a2, $r_sp; \
++ PTR_ADDIU a2, $r_sp, DS_OFFSET(SIZE); \
+ jalr t0; \
+ /* Reset our destination slot (DS but it's ok) */ \
+ INT_S zero, (4 * SZREG)($r_sp); \
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: David Daney <david.daney@cavium.com>
+Date: Tue, 14 Mar 2017 14:21:43 -0700
+Subject: MIPS: BPF: Quit clobbering callee saved registers in JIT code.
+
+From: David Daney <david.daney@cavium.com>
+
+
+[ Upstream commit 1ef0910cfd681f0bd0b81f8809935b2006e9cfb9 ]
+
+If bpf_needs_clear_a() returns true, only actually clear it if it is
+ever used. If it is not used, we don't save and restore it, so the
+clearing has the nasty side effect of clobbering caller state.
+
+Also, don't emit stack pointer adjustment instructions if the
+adjustment amount is zero.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Steven J. Hill <steven.hill@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/15745/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/net/bpf_jit.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/net/bpf_jit.c
++++ b/arch/mips/net/bpf_jit.c
+@@ -526,7 +526,8 @@ static void save_bpf_jit_regs(struct jit
+ u32 sflags, tmp_flags;
+
+ /* Adjust the stack pointer */
+- emit_stack_offset(-align_sp(offset), ctx);
++ if (offset)
++ emit_stack_offset(-align_sp(offset), ctx);
+
+ tmp_flags = sflags = ctx->flags >> SEEN_SREG_SFT;
+ /* sflags is essentially a bitmap */
+@@ -578,7 +579,8 @@ static void restore_bpf_jit_regs(struct
+ emit_load_stack_reg(r_ra, r_sp, real_off, ctx);
+
+ /* Restore the sp and discard the scrach memory */
+- emit_stack_offset(align_sp(offset), ctx);
++ if (offset)
++ emit_stack_offset(align_sp(offset), ctx);
+ }
+
+ static unsigned int get_stack_depth(struct jit_ctx *ctx)
+@@ -625,8 +627,14 @@ static void build_prologue(struct jit_ct
+ if (ctx->flags & SEEN_X)
+ emit_jit_reg_move(r_X, r_zero, ctx);
+
+- /* Do not leak kernel data to userspace */
+- if (bpf_needs_clear_a(&ctx->skf->insns[0]))
++ /*
++ * Do not leak kernel data to userspace, we only need to clear
++ * r_A if it is ever used. In fact if it is never used, we
++ * will not save/restore it, so clearing it in this case would
++ * corrupt the state of the caller.
++ */
++ if (bpf_needs_clear_a(&ctx->skf->insns[0]) &&
++ (ctx->flags & SEEN_A))
+ emit_jit_reg_move(r_A, r_zero, ctx);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Aleksandar Markovic <aleksandar.markovic@imgtec.com>
+Date: Mon, 13 Mar 2017 16:36:36 +0100
+Subject: MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
+
+From: Aleksandar Markovic <aleksandar.markovic@imgtec.com>
+
+
+[ Upstream commit 411dac79cc2ed80f7e348ccc23eb4d8b0ba9f6d5 ]
+
+Add missing clearing of BLTZALL and BGEZALL emulation counters in
+function mipsr2_stats_clear_show().
+
+Previously, it was not possible to reset BLTZALL and BGEZALL
+emulation counters - their value remained the same even after
+explicit request via debugfs. As far as other related counters
+are concerned, they all seem to be properly cleared.
+
+This change affects debugfs operation only, core R2 emulation
+functionality is not affected.
+
+Signed-off-by: Aleksandar Markovic <aleksandar.markovic@imgtec.com>
+Reviewed-by: Paul Burton <paul.burton@imgtec.com>
+Cc: james.hogan@imgtec.com
+Cc: leonid.yegoshin@imgtec.com
+Cc: douglas.leung@imgtec.com
+Cc: petar.jovanovic@imgtec.com
+Cc: miodrag.dinic@imgtec.com
+Cc: goran.ferenc@imgtec.com
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/15517/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kernel/mips-r2-to-r6-emul.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
+@@ -2339,6 +2339,8 @@ static int mipsr2_stats_clear_show(struc
+ __this_cpu_write((mipsr2bremustats).bgezl, 0);
+ __this_cpu_write((mipsr2bremustats).bltzll, 0);
+ __this_cpu_write((mipsr2bremustats).bgezll, 0);
++ __this_cpu_write((mipsr2bremustats).bltzall, 0);
++ __this_cpu_write((mipsr2bremustats).bgezall, 0);
+ __this_cpu_write((mipsr2bremustats).bltzal, 0);
+ __this_cpu_write((mipsr2bremustats).bgezal, 0);
+ __this_cpu_write((mipsr2bremustats).beql, 0);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
+Date: Mon, 13 Mar 2017 16:36:35 +0100
+Subject: MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
+
+From: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
+
+
+[ Upstream commit 5bba7aa4958e271c3ffceb70d47d3206524cf489 ]
+
+Fix the problem of inaccurate identification of instructions BLEZL and
+BGTZL in R2 emulation code by making sure all necessary encoding
+specifications are met.
+
+Previously, certain R6 instructions could be identified as BLEZL or
+BGTZL. R2 emulation routine didn't take into account that both BLEZL
+and BGTZL instructions require their rt field (bits 20 to 16 of
+instruction encoding) to be 0, and that, at same time, if the value in
+that field is not 0, the encoding may represent a legitimate MIPS R6
+instruction.
+
+This means that a problem could occur after emulation optimization,
+when emulation routine tried to pipeline emulation, picked up a next
+candidate, and subsequently misrecognized an R6 instruction as BLEZL
+or BGTZL.
+
+It should be said that for single pass strategy, the problem does not
+happen because CPU doesn't trap on branch-compacts which share opcode
+space with BLEZL/BGTZL (but have rt field != 0, of course).
+
+Signed-off-by: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
+Signed-off-by: Miodrag Dinic <miodrag.dinic@imgtech.com>
+Signed-off-by: Aleksandar Markovic <aleksandar.markovic@imgtech.com>
+Reported-by: Douglas Leung <douglas.leung@imgtec.com>
+Reviewed-by: Paul Burton <paul.burton@imgtec.com>
+Cc: james.hogan@imgtec.com
+Cc: petar.jovanovic@imgtec.com
+Cc: goran.ferenc@imgtec.com
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/15456/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kernel/mips-r2-to-r6-emul.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
+@@ -1096,10 +1096,20 @@ repeat:
+ }
+ break;
+
+- case beql_op:
+- case bnel_op:
+ case blezl_op:
+ case bgtzl_op:
++ /*
++ * For BLEZL and BGTZL, rt field must be set to 0. If this
++ * is not the case, this may be an encoding of a MIPS R6
++ * instruction, so return to CPU execution if this occurs
++ */
++ if (MIPSInst_RT(inst)) {
++ err = SIGILL;
++ break;
++ }
++ /* fall through */
++ case beql_op:
++ case bnel_op:
+ if (delay_slot(regs)) {
+ err = SIGILL;
+ break;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 24 Mar 2017 14:13:05 +0300
+Subject: mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
+
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+
+
+[ Upstream commit 591a3d7c09fa08baff48ad86c2347dbd28a52753 ]
+
+0day testing by Fengguang Wu triggered this crash while running Trinity:
+
+ kernel BUG at include/linux/pagemap.h:151!
+ ...
+ CPU: 0 PID: 458 Comm: trinity-c0 Not tainted 4.11.0-rc2-00251-g2947ba0 #1
+ ...
+ Call Trace:
+ __get_user_pages_fast()
+ get_user_pages_fast()
+ get_futex_key()
+ futex_requeue()
+ do_futex()
+ SyS_futex()
+ do_syscall_64()
+ entry_SYSCALL64_slow_path()
+
+It' VM_BUG_ON() due to false-negative in_atomic(). We call
+page_cache_get_speculative() with disabled local interrupts.
+It should be atomic enough.
+
+So let's check for disabled interrupts in the VM_BUG_ON() condition
+too, to resolve this.
+
+( This got triggered by the conversion of the x86 GUP code to the
+ generic GUP code. )
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Cc: LKP <lkp@01.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-mm@kvack.org
+Link: http://lkml.kernel.org/r/20170324114709.pcytvyb3d6ajux33@black.fi.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/pagemap.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -148,7 +148,7 @@ static inline int page_cache_get_specula
+
+ #ifdef CONFIG_TINY_RCU
+ # ifdef CONFIG_PREEMPT_COUNT
+- VM_BUG_ON(!in_atomic());
++ VM_BUG_ON(!in_atomic() && !irqs_disabled());
+ # endif
+ /*
+ * Preempt must be disabled here - we rely on rcu_read_lock doing
+@@ -186,7 +186,7 @@ static inline int page_cache_add_specula
+
+ #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU)
+ # ifdef CONFIG_PREEMPT_COUNT
+- VM_BUG_ON(!in_atomic());
++ VM_BUG_ON(!in_atomic() && !irqs_disabled());
+ # endif
+ VM_BUG_ON_PAGE(page_count(page) == 0, page);
+ page_ref_add(page, count);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Wed, 8 Nov 2017 17:00:27 +0100
+Subject: mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
+
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+
+
+[ Upstream commit df467899da0b71465760b4e35127bce837244eee ]
+
+Some drivers (like nand_hynix.c) call ->cmdfunc() with NAND_CMD_NONE
+and a column address and expect the controller to only send address
+cycles. Right now, the default ->cmdfunc() implementations provided by
+the core do not filter out the command cycle in this case and forwards
+the request to the controller driver through the ->cmd_ctrl() method.
+The thing is, NAND controller drivers can get this wrong and send a
+command cycle with a NAND_CMD_NONE opcode and since NAND_CMD_NONE is
+-1, and the command field is usually casted to an u8, we end up sending
+the 0xFF command which is actually a RESET operation.
+
+Add conditions in nand_command[_lp]() functions to sending the initial
+command cycle when command == NAND_CMD_NONE.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/nand_base.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -715,7 +715,8 @@ static void nand_command(struct mtd_info
+ chip->cmd_ctrl(mtd, readcmd, ctrl);
+ ctrl &= ~NAND_CTRL_CHANGE;
+ }
+- chip->cmd_ctrl(mtd, command, ctrl);
++ if (command != NAND_CMD_NONE)
++ chip->cmd_ctrl(mtd, command, ctrl);
+
+ /* Address cycle, when necessary */
+ ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE;
+@@ -744,6 +745,7 @@ static void nand_command(struct mtd_info
+ */
+ switch (command) {
+
++ case NAND_CMD_NONE:
+ case NAND_CMD_PAGEPROG:
+ case NAND_CMD_ERASE1:
+ case NAND_CMD_ERASE2:
+@@ -806,7 +808,9 @@ static void nand_command_lp(struct mtd_i
+ }
+
+ /* Command latch cycle */
+- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
++ if (command != NAND_CMD_NONE)
++ chip->cmd_ctrl(mtd, command,
++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
+
+ if (column != -1 || page_addr != -1) {
+ int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE;
+@@ -842,6 +846,7 @@ static void nand_command_lp(struct mtd_i
+ */
+ switch (command) {
+
++ case NAND_CMD_NONE:
+ case NAND_CMD_CACHEDPROG:
+ case NAND_CMD_PAGEPROG:
+ case NAND_CMD_ERASE1:
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jagdish Gediya <jagdish.gediya@nxp.com>
+Date: Thu, 23 Nov 2017 17:04:31 +0530
+Subject: mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
+
+From: Jagdish Gediya <jagdish.gediya@nxp.com>
+
+
+[ Upstream commit bccb06c353af3764ca86d9da47652458e6c2eb41 ]
+
+Bufnum mask is used to calculate page position in the internal SRAM.
+
+As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
+versions which had 8KB. Hence bufnum mask needs to be updated.
+
+Signed-off-by: Jagdish Gediya <jagdish.gediya@nxp.com>
+Signed-off-by: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/fsl_ifc_nand.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mtd/nand/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/fsl_ifc_nand.c
+@@ -907,6 +907,13 @@ static int fsl_ifc_chip_init(struct fsl_
+ if (ctrl->version == FSL_IFC_VERSION_1_1_0)
+ fsl_ifc_sram_init(priv);
+
++ /*
++ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
++ * versions which had 8KB. Hence bufnum mask needs to be updated.
++ */
++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
++ priv->bufnum_mask = (priv->bufnum_mask * 2) + 1;
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Limin Zhu <liminzhu@marvell.com>
+Date: Thu, 30 Nov 2017 14:22:34 +0800
+Subject: mwifiex: cfg80211: do not change virtual interface during scan processing
+
+From: Limin Zhu <liminzhu@marvell.com>
+
+
+[ Upstream commit c61cfe49f0f0f0d1f8b56d0b045838d597e8c3a3 ]
+
+(1) Change virtual interface operation in cfg80211 process reset and
+reinitilize private data structure.
+(2) Scan result event processed in main process will dereference private
+data structure concurrently, ocassionly crash the kernel.
+
+The cornel case could be trigger by below steps:
+(1) wpa_cli mlan0 scan
+(2) ./hostapd mlan0.conf
+
+Cfg80211 asynchronous scan procedure is not all the time operated
+under rtnl lock, here we add the protect to serialize the cfg80211
+scan and change_virtual interface operation.
+
+Signed-off-by: Limin Zhu <liminzhu@marvell.com>
+Signed-off-by: Xinming Hu <huxm@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -1109,6 +1109,12 @@ mwifiex_cfg80211_change_virtual_intf(str
+ struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+ enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype;
+
++ if (priv->scan_request) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "change virtual interface: scan in process\n");
++ return -EBUSY;
++ }
++
+ switch (curr_iftype) {
+ case NL80211_IFTYPE_ADHOC:
+ switch (type) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Ganapathi Bhat <gbhat@marvell.com>
+Date: Tue, 4 Apr 2017 10:16:28 +0530
+Subject: mwifiex: Fix invalid port issue
+
+From: Ganapathi Bhat <gbhat@marvell.com>
+
+
+[ Upstream commit ecd7eb7c2bcf99f6c23d68ad56ce15949da848a1 ]
+
+We have to use start port, for TX/RX of single packet,
+instead of current aggregating port. This will fix SDIO
+CMD53(TX/RX) returning -ETIMEDOUT and halting the data path.
+
+Fixes: 0cb52aac4d19 ("mwifiex: do not set multiport flag for tx/rx single packet")
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/sdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
+@@ -1458,7 +1458,7 @@ static int mwifiex_sdio_card_to_host_mp_
+ }
+
+ if (card->mpa_rx.pkt_cnt == 1)
+- mport = adapter->ioport + port;
++ mport = adapter->ioport + card->mpa_rx.start_port;
+
+ if (mwifiex_read_data_sync(adapter, card->mpa_rx.buf,
+ card->mpa_rx.buf_len, mport, 1))
+@@ -1891,7 +1891,7 @@ static int mwifiex_host_to_card_mp_aggr(
+ }
+
+ if (card->mpa_tx.pkt_cnt == 1)
+- mport = adapter->ioport + port;
++ mport = adapter->ioport + card->mpa_tx.start_port;
+
+ ret = mwifiex_write_data_to_card(adapter, card->mpa_tx.buf,
+ card->mpa_tx.buf_len, mport);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Andrey Vagin <avagin@openvz.org>
+Date: Wed, 15 Mar 2017 17:41:14 -0700
+Subject: net/8021q: create device with all possible features in wanted_features
+
+From: Andrey Vagin <avagin@openvz.org>
+
+
+[ Upstream commit 88997e4208aea117627898e5f6f9801cf3cd42d2 ]
+
+wanted_features is a set of features which have to be enabled if a
+hardware allows that.
+
+Currently when a vlan device is created, its wanted_features is set to
+current features of its base device.
+
+The problem is that the base device can get new features and they are
+not propagated to vlan-s of this device.
+
+If we look at bonding devices, they doesn't have this problem and this
+patch suggests to fix this issue by the same way how it works for bonding
+devices.
+
+We meet this problem, when we try to create a vlan device over a bonding
+device. When a system are booting, real devices require time to be
+initialized, so bonding devices created without slaves, then vlan
+devices are created and only then ethernet devices are added to the
+bonding device. As a result we have vlan devices with disabled
+scatter-gather.
+
+* create a bonding device
+ $ ip link add bond0 type bond
+ $ ethtool -k bond0 | grep scatter
+ scatter-gather: off
+ tx-scatter-gather: off [requested on]
+ tx-scatter-gather-fraglist: off [requested on]
+
+* create a vlan device
+ $ ip link add link bond0 name bond0.10 type vlan id 10
+ $ ethtool -k bond0.10 | grep scatter
+ scatter-gather: off
+ tx-scatter-gather: off
+ tx-scatter-gather-fraglist: off
+
+* Add a slave device to bond0
+ $ ip link set dev eth0 master bond0
+
+And now we can see that the bond0 device has got the scatter-gather
+feature, but the bond0.10 hasn't got it.
+[root@laptop linux-task-diag]# ethtool -k bond0 | grep scatter
+scatter-gather: on
+ tx-scatter-gather: on
+ tx-scatter-gather-fraglist: on
+[root@laptop linux-task-diag]# ethtool -k bond0.10 | grep scatter
+scatter-gather: off
+ tx-scatter-gather: off
+ tx-scatter-gather-fraglist: off
+
+With this patch the vlan device will get all new features from the
+bonding device.
+
+Here is a call trace how features which are set in this patch reach
+dev->wanted_features.
+
+register_netdevice
+ vlan_dev_init
+ ...
+ dev->hw_features = NETIF_F_HW_CSUM | NETIF_F_SG |
+ NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE |
+ NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
+ NETIF_F_ALL_FCOE;
+
+ dev->features |= dev->hw_features;
+ ...
+ dev->wanted_features = dev->features & dev->hw_features;
+ __netdev_update_features(dev);
+ vlan_dev_fix_features
+ ...
+
+Cc: Alexey Kuznetsov <kuznet@virtuozzo.com>
+Cc: Patrick McHardy <kaber@trash.net>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Andrei Vagin <avagin@openvz.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/8021q/vlan_dev.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -562,8 +562,7 @@ static int vlan_dev_init(struct net_devi
+ NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
+ NETIF_F_ALL_FCOE;
+
+- dev->features |= real_dev->vlan_features | NETIF_F_LLTX |
+- NETIF_F_GSO_SOFTWARE;
++ dev->features |= dev->hw_features | NETIF_F_LLTX;
+ dev->gso_max_size = real_dev->gso_max_size;
+ dev->gso_max_segs = real_dev->gso_max_segs;
+ if (dev->features & NETIF_F_VLAN_FEATURES)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Steve Lin <steven.lin1@broadcom.com>
+Date: Thu, 16 Mar 2017 11:48:58 -0400
+Subject: net: ethernet: bgmac: Allow MAC address to be specified in DTB
+
+From: Steve Lin <steven.lin1@broadcom.com>
+
+
+[ Upstream commit 2f771399a3a2c371c140ff33544a583c6fbc5fd9 ]
+
+Allows the BCMA version of the bgmac driver to obtain MAC address
+from the device tree. If no MAC address is specified there, then
+the previous behavior (obtaining MAC address from SPROM) is
+used.
+
+Signed-off-by: Steve Lin <steven.lin1@broadcom.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Jon Mason <jon.mason@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c | 39 +++++++++++++++++------------
+ 1 file changed, 23 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -11,6 +11,7 @@
+ #include <linux/bcma/bcma.h>
+ #include <linux/brcmphy.h>
+ #include <linux/etherdevice.h>
++#include <linux/of_net.h>
+ #include "bgmac.h"
+
+ static inline bool bgmac_is_bcm4707_family(struct bcma_device *core)
+@@ -96,7 +97,7 @@ static int bgmac_probe(struct bcma_devic
+ struct ssb_sprom *sprom = &core->bus->sprom;
+ struct mii_bus *mii_bus;
+ struct bgmac *bgmac;
+- u8 *mac;
++ const u8 *mac = NULL;
+ int err;
+
+ bgmac = kzalloc(sizeof(*bgmac), GFP_KERNEL);
+@@ -110,21 +111,27 @@ static int bgmac_probe(struct bcma_devic
+
+ bcma_set_drvdata(core, bgmac);
+
+- switch (core->core_unit) {
+- case 0:
+- mac = sprom->et0mac;
+- break;
+- case 1:
+- mac = sprom->et1mac;
+- break;
+- case 2:
+- mac = sprom->et2mac;
+- break;
+- default:
+- dev_err(bgmac->dev, "Unsupported core_unit %d\n",
+- core->core_unit);
+- err = -ENOTSUPP;
+- goto err;
++ if (bgmac->dev->of_node)
++ mac = of_get_mac_address(bgmac->dev->of_node);
++
++ /* If no MAC address assigned via device tree, check SPROM */
++ if (!mac) {
++ switch (core->core_unit) {
++ case 0:
++ mac = sprom->et0mac;
++ break;
++ case 1:
++ mac = sprom->et1mac;
++ break;
++ case 2:
++ mac = sprom->et2mac;
++ break;
++ default:
++ dev_err(bgmac->dev, "Unsupported core_unit %d\n",
++ core->core_unit);
++ err = -ENOTSUPP;
++ goto err;
++ }
+ }
+
+ ether_addr_copy(bgmac->mac_addr, mac);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Sun, 2 Apr 2017 20:20:47 +0200
+Subject: net/faraday: Add missing include of of.h
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+
+[ Upstream commit d39004ab136ebb6949a7dda9d24376f3d6209295 ]
+
+Breaking the include loop netdevice.h, dsa.h, devlink.h broke this
+driver, it depends on includes brought in by these headers. Adding
+linux/of.h fixes it.
+
+Fixes: ed0e39e97d34 ("net: break include loop netdevice.h, dsa.h, devlink.h")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/faraday/ftgmac100.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -28,6 +28,7 @@
+ #include <linux/io.h>
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
++#include <linux/of.h>
+ #include <linux/phy.h>
+ #include <linux/platform_device.h>
+ #include <net/ip.h>
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Fugang Duan <fugang.duan@nxp.com>
+Date: Tue, 11 Apr 2017 19:13:06 +0800
+Subject: net: fec: add phy-reset-gpios PROBE_DEFER check
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+
+[ Upstream commit 9269e5560b261eb9ee157497890dc0948db76cf8 ]
+
+Many boards use i2c/spi expander gpio as phy-reset-gpios and these
+gpios maybe registered after fec port, driver should check the return
+value of .of_get_named_gpio().
+
+Signed-off-by: Fugang Duan <B38611@freescale.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3209,7 +3209,7 @@ static int fec_enet_init(struct net_devi
+ }
+
+ #ifdef CONFIG_OF
+-static void fec_reset_phy(struct platform_device *pdev)
++static int fec_reset_phy(struct platform_device *pdev)
+ {
+ int err, phy_reset;
+ bool active_high = false;
+@@ -3217,7 +3217,7 @@ static void fec_reset_phy(struct platfor
+ struct device_node *np = pdev->dev.of_node;
+
+ if (!np)
+- return;
++ return 0;
+
+ of_property_read_u32(np, "phy-reset-duration", &msec);
+ /* A sane reset duration should not be longer than 1s */
+@@ -3225,8 +3225,10 @@ static void fec_reset_phy(struct platfor
+ msec = 1;
+
+ phy_reset = of_get_named_gpio(np, "phy-reset-gpios", 0);
+- if (!gpio_is_valid(phy_reset))
+- return;
++ if (phy_reset == -EPROBE_DEFER)
++ return phy_reset;
++ else if (!gpio_is_valid(phy_reset))
++ return 0;
+
+ active_high = of_property_read_bool(np, "phy-reset-active-high");
+
+@@ -3235,7 +3237,7 @@ static void fec_reset_phy(struct platfor
+ "phy-reset");
+ if (err) {
+ dev_err(&pdev->dev, "failed to get phy-reset-gpios: %d\n", err);
+- return;
++ return err;
+ }
+
+ if (msec > 20)
+@@ -3244,14 +3246,17 @@ static void fec_reset_phy(struct platfor
+ usleep_range(msec * 1000, msec * 1000 + 1000);
+
+ gpio_set_value_cansleep(phy_reset, !active_high);
++
++ return 0;
+ }
+ #else /* CONFIG_OF */
+-static void fec_reset_phy(struct platform_device *pdev)
++static int fec_reset_phy(struct platform_device *pdev)
+ {
+ /*
+ * In case of platform probe, the reset has been done
+ * by machine code.
+ */
++ return 0;
+ }
+ #endif /* CONFIG_OF */
+
+@@ -3422,6 +3427,7 @@ fec_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev,
+ "Failed to enable phy regulator: %d\n", ret);
++ clk_disable_unprepare(fep->clk_ipg);
+ goto failed_regulator;
+ }
+ } else {
+@@ -3434,7 +3440,9 @@ fec_probe(struct platform_device *pdev)
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- fec_reset_phy(pdev);
++ ret = fec_reset_phy(pdev);
++ if (ret)
++ goto failed_reset;
+
+ if (fep->bufdesc_ex)
+ fec_ptp_init(pdev);
+@@ -3495,8 +3503,10 @@ failed_init:
+ fec_ptp_stop(pdev);
+ if (fep->reg_phy)
+ regulator_disable(fep->reg_phy);
++failed_reset:
++ pm_runtime_put(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
+ failed_regulator:
+- clk_disable_unprepare(fep->clk_ipg);
+ failed_clk_ipg:
+ fec_enet_clk_enable(ndev, false);
+ failed_clk:
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: lipeng <lipeng321@huawei.com>
+Date: Sat, 1 Apr 2017 12:03:39 +0100
+Subject: net: hns: Correct HNS RSS key set function
+
+From: lipeng <lipeng321@huawei.com>
+
+
+[ Upstream commit 64ec10dc2ab8ef5bc6e76b1d4bc8203c08a6da1e ]
+
+This patch fixes below ethtool configuration error:
+
+localhost:~ # ethtool -X eth0 hkey XX:XX:XX...
+Cannot set Rx flow hash configuration: Operation not supported
+
+Signed-off-by: lipeng <lipeng321@huawei.com>
+Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 27 +++++++++++++---------
+ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 9 +++----
+ 2 files changed, 20 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -773,8 +773,9 @@ static int hns_ae_get_rss(struct hnae_ha
+ memcpy(key, ppe_cb->rss_key, HNS_PPEV2_RSS_KEY_SIZE);
+
+ /* update the current hash->queue mappings from the shadow RSS table */
+- memcpy(indir, ppe_cb->rss_indir_table,
+- HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir));
++ if (indir)
++ memcpy(indir, ppe_cb->rss_indir_table,
++ HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir));
+
+ return 0;
+ }
+@@ -785,15 +786,19 @@ static int hns_ae_set_rss(struct hnae_ha
+ struct hns_ppe_cb *ppe_cb = hns_get_ppe_cb(handle);
+
+ /* set the RSS Hash Key if specififed by the user */
+- if (key)
+- hns_ppe_set_rss_key(ppe_cb, (u32 *)key);
+-
+- /* update the shadow RSS table with user specified qids */
+- memcpy(ppe_cb->rss_indir_table, indir,
+- HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir));
+-
+- /* now update the hardware */
+- hns_ppe_set_indir_table(ppe_cb, ppe_cb->rss_indir_table);
++ if (key) {
++ memcpy(ppe_cb->rss_key, key, HNS_PPEV2_RSS_KEY_SIZE);
++ hns_ppe_set_rss_key(ppe_cb, ppe_cb->rss_key);
++ }
++
++ if (indir) {
++ /* update the shadow RSS table with user specified qids */
++ memcpy(ppe_cb->rss_indir_table, indir,
++ HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir));
++
++ /* now update the hardware */
++ hns_ppe_set_indir_table(ppe_cb, ppe_cb->rss_indir_table);
++ }
+
+ return 0;
+ }
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -1243,6 +1243,7 @@ hns_set_rss(struct net_device *netdev, c
+ {
+ struct hns_nic_priv *priv = netdev_priv(netdev);
+ struct hnae_ae_ops *ops;
++ int ret;
+
+ if (AE_IS_VER1(priv->enet_ver)) {
+ netdev_err(netdev,
+@@ -1252,12 +1253,10 @@ hns_set_rss(struct net_device *netdev, c
+
+ ops = priv->ae_handle->dev->ops;
+
+- /* currently hfunc can only be Toeplitz hash */
+- if (key ||
+- (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP))
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) {
++ netdev_err(netdev, "Invalid hfunc!\n");
+ return -EOPNOTSUPP;
+- if (!indir)
+- return 0;
++ }
+
+ return ops->set_rss(priv->ae_handle, indir, key, hfunc);
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Tue, 28 Nov 2017 13:53:12 +0100
+Subject: net: ieee802154: adf7242: Fix bug if defined DEBUG
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+
+[ Upstream commit 388b3b2b03701f3b3c10975c272892d7f78080df ]
+
+This fixes undefined reference to struct adf7242_local *lp in
+case DEBUG is defined.
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/adf7242.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -888,7 +888,7 @@ static struct ieee802154_ops adf7242_ops
+ .set_cca_ed_level = adf7242_set_cca_ed_level,
+ };
+
+-static void adf7242_debug(u8 irq1)
++static void adf7242_debug(struct adf7242_local *lp, u8 irq1)
+ {
+ #ifdef DEBUG
+ u8 stat;
+@@ -932,7 +932,7 @@ static irqreturn_t adf7242_isr(int irq,
+ dev_err(&lp->spi->dev, "%s :ERROR IRQ1 = 0x%X\n",
+ __func__, irq1);
+
+- adf7242_debug(irq1);
++ adf7242_debug(lp, irq1);
+
+ xmit = test_bit(FLAG_XMIT, &lp->flags);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 7 Mar 2017 16:53:19 +0100
+Subject: net: mvpp2: set dma mask and coherent dma mask on PPv2.2
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+
+[ Upstream commit 2067e0a13cfe0b1bdca7b91bc5e4f2740b07d478 ]
+
+On PPv2.2, the streaming mappings can be anywhere in the first 40 bits
+of the physical address space. However, for the coherent mappings, we
+still need them to be in the first 32 bits of the address space,
+because all BM pools share a single register to store the high 32 bits
+of the BM pool address, which means all BM pools must be allocated in
+the same 4GB memory area.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -6420,6 +6420,20 @@ static int mvpp2_probe(struct platform_d
+ /* Get system's tclk rate */
+ priv->tclk = clk_get_rate(priv->pp_clk);
+
++ if (priv->hw_version == MVPP22) {
++ err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40));
++ if (err)
++ goto err_mg_clk;
++ /* Sadly, the BM pools all share the same register to
++ * store the high 32 bits of their address. So they
++ * must all have the same high 32 bits, which forces
++ * us to restrict coherent memory to DMA_BIT_MASK(32).
++ */
++ err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
++ if (err)
++ goto err_mg_clk;
++ }
++
+ /* Initialize network controller */
+ err = mvpp2_init(pdev, priv);
+ if (err < 0) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Sunil Goutham <sgoutham@cavium.com>
+Date: Fri, 24 Nov 2017 15:04:03 +0300
+Subject: net: thunderx: Set max queue count taking XDP_TX into account
+
+From: Sunil Goutham <sgoutham@cavium.com>
+
+
+[ Upstream commit 87de083857aa269fb171ef0b39696b2888361c58 ]
+
+on T81 there are only 4 cores, hence setting max queue count to 4
+would leave nothing for XDP_TX. This patch fixes this by doubling
+max queue count in above scenarios.
+
+Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
+Signed-off-by: cjacob <cjacob@caviumnetworks.com>
+Signed-off-by: Aleksey Makarov <aleksey.makarov@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -1576,6 +1576,11 @@ static int nicvf_probe(struct pci_dev *p
+ nic->pdev = pdev;
+ nic->pnicvf = nic;
+ nic->max_queues = qcount;
++ /* If no of CPUs are too low, there won't be any queues left
++ * for XDP_TX, hence double it.
++ */
++ if (!nic->t88)
++ nic->max_queues *= 2;
+
+ /* MAP VF's configuration registers */
+ nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Lorenzo Colitti <lorenzo@google.com>
+Date: Mon, 20 Nov 2017 19:26:02 +0900
+Subject: net: xfrm: allow clearing socket xfrm policies.
+
+From: Lorenzo Colitti <lorenzo@google.com>
+
+
+[ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ]
+
+Currently it is possible to add or update socket policies, but
+not clear them. Therefore, once a socket policy has been applied,
+the socket cannot be used for unencrypted traffic.
+
+This patch allows (privileged) users to clear socket policies by
+passing in a NULL pointer and zero length argument to the
+{IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both
+the incoming and outgoing policies being cleared.
+
+The simple approach taken in this patch cannot clear socket
+policies in only one direction. If desired this could be added
+in the future, for example by continuing to pass in a length of
+zero (which currently is guaranteed to return EMSGSIZE) and
+making the policy be a pointer to an integer that contains one
+of the XFRM_POLICY_{IN,OUT} enum values.
+
+An alternative would have been to interpret the length as a
+signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the
+input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output
+policy.
+
+Tested: https://android-review.googlesource.com/539816
+Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_policy.c | 2 +-
+ net/xfrm/xfrm_state.c | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1346,7 +1346,7 @@ EXPORT_SYMBOL(xfrm_policy_delete);
+
+ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
+ {
+- struct net *net = xp_net(pol);
++ struct net *net = sock_net(sk);
+ struct xfrm_policy *old_pol;
+
+ #ifdef CONFIG_XFRM_SUB_POLICY
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1883,6 +1883,13 @@ int xfrm_user_policy(struct sock *sk, in
+ struct xfrm_mgr *km;
+ struct xfrm_policy *pol = NULL;
+
++ if (!optval && !optlen) {
++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
++ __sk_dst_reset(sk);
++ return 0;
++ }
++
+ if (optlen <= 0 || optlen > PAGE_SIZE)
+ return -EMSGSIZE;
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Nik Unger <njunger@uwaterloo.ca>
+Date: Mon, 13 Mar 2017 10:16:58 -0700
+Subject: netem: apply correct delay when rate throttling
+
+From: Nik Unger <njunger@uwaterloo.ca>
+
+
+[ Upstream commit 5080f39e8c72e01cf37e8359023e7018e2a4901e ]
+
+I recently reported on the netem list that iperf network benchmarks
+show unexpected results when a bandwidth throttling rate has been
+configured for netem. Specifically:
+
+1) The measured link bandwidth *increases* when a higher delay is added
+2) The measured link bandwidth appears higher than the specified limit
+3) The measured link bandwidth for the same very slow settings varies significantly across
+ machines
+
+The issue can be reproduced by using tc to configure netem with a
+512kbit rate and various (none, 1us, 50ms, 100ms, 200ms) delays on a
+veth pair between network namespaces, and then using iperf (or any
+other network benchmarking tool) to test throughput. Complete detailed
+instructions are in the original email chain here:
+https://lists.linuxfoundation.org/pipermail/netem/2017-February/001672.html
+
+There appear to be two underlying bugs causing these effects:
+
+- The first issue causes long delays when the rate is slow and no
+ delay is configured (e.g., "rate 512kbit"). This is because SKBs are
+ not orphaned when no delay is configured, so orphaning does not
+ occur until *after* the rate-induced delay has been applied. For
+ this reason, adding a tiny delay (e.g., "rate 512kbit delay 1us")
+ dramatically increases the measured bandwidth.
+
+- The second issue is that rate-induced delays are not correctly
+ applied, allowing SKB delays to occur in parallel. The indended
+ approach is to compute the delay for an SKB and to add this delay to
+ the end of the current queue. However, the code does not detect
+ existing SKBs in the queue due to improperly testing sch->q.qlen,
+ which is nonzero even when packets exist only in the
+ rbtree. Consequently, new SKBs do not wait for the current queue to
+ empty. When packet delays vary significantly (e.g., if packet sizes
+ are different), then this also causes unintended reordering.
+
+I modified the code to expect a delay (and orphan the SKB) when a rate
+is configured. I also added some defensive tests that correctly find
+the latest scheduled delivery time, even if it is (unexpectedly) for a
+packet in sch->q. I have tested these changes on the latest kernel
+(4.11.0-rc1+) and the iperf / ping test results are as expected.
+
+Signed-off-by: Nik Unger <njunger@uwaterloo.ca>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_netem.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -462,7 +462,7 @@ static int netem_enqueue(struct sk_buff
+ /* If a delay is expected, orphan the skb. (orphaning usually takes
+ * place at TX completion time, so _before_ the link transit delay)
+ */
+- if (q->latency || q->jitter)
++ if (q->latency || q->jitter || q->rate)
+ skb_orphan_partial(skb);
+
+ /*
+@@ -530,21 +530,31 @@ static int netem_enqueue(struct sk_buff
+ now = psched_get_time();
+
+ if (q->rate) {
+- struct sk_buff *last;
++ struct netem_skb_cb *last = NULL;
++
++ if (sch->q.tail)
++ last = netem_skb_cb(sch->q.tail);
++ if (q->t_root.rb_node) {
++ struct sk_buff *t_skb;
++ struct netem_skb_cb *t_last;
++
++ t_skb = netem_rb_to_skb(rb_last(&q->t_root));
++ t_last = netem_skb_cb(t_skb);
++ if (!last ||
++ t_last->time_to_send > last->time_to_send) {
++ last = t_last;
++ }
++ }
+
+- if (sch->q.qlen)
+- last = sch->q.tail;
+- else
+- last = netem_rb_to_skb(rb_last(&q->t_root));
+ if (last) {
+ /*
+ * Last packet in queue is reference point (now),
+ * calculate this time bonus and subtract
+ * from delay.
+ */
+- delay -= netem_skb_cb(last)->time_to_send - now;
++ delay -= last->time_to_send - now;
+ delay = max_t(psched_tdiff_t, 0, delay);
+- now = netem_skb_cb(last)->time_to_send;
++ now = last->time_to_send;
+ }
+
+ delay += packet_len_2_sched_time(qdisc_pkt_len(skb), q);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 8 Mar 2017 08:22:37 +0300
+Subject: NFC: nfcmrvl: double free on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit ca42fb9e52d155547e6cf18cf26bce3e1a6af4ea ]
+
+The nci_spi_send() function calls kfree_skb(skb) on both error and
+success so this extra kfree_skb() is a double free.
+
+Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/nfcmrvl/spi.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/nfc/nfcmrvl/spi.c
++++ b/drivers/nfc/nfcmrvl/spi.c
+@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct n
+ /* Send the SPI packet */
+ err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
+ skb);
+- if (err != 0) {
++ if (err)
+ nfc_err(priv->dev, "spi_send failed %d", err);
+- kfree_skb(skb);
+- }
++
+ return err;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Tobias Klauser <tklauser@distanz.ch>
+Date: Wed, 26 Oct 2016 11:00:12 +0200
+Subject: NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
+
+From: Tobias Klauser <tklauser@distanz.ch>
+
+
+[ Upstream commit d916d923724d59cde99ee588f15eec59dd863bbd ]
+
+Including linux/unaligned/access_ok.h causes the allmodconfig build on
+ia64 (and maybe others) to fail with the following warnings:
+
+include/linux/unaligned/access_ok.h:7:19: error: redefinition of 'get_unaligned_le16'
+include/linux/unaligned/access_ok.h:12:19: error: redefinition of 'get_unaligned_le32'
+include/linux/unaligned/access_ok.h:17:19: error: redefinition of 'get_unaligned_le64'
+include/linux/unaligned/access_ok.h:22:19: error: redefinition of 'get_unaligned_be16'
+include/linux/unaligned/access_ok.h:27:19: error: redefinition of 'get_unaligned_be32'
+include/linux/unaligned/access_ok.h:32:19: error: redefinition of 'get_unaligned_be64'
+include/linux/unaligned/access_ok.h:37:20: error: redefinition of 'put_unaligned_le16'
+include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le32'
+include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le64'
+include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be16'
+include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be32'
+include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be64'
+
+Fix these by including asm/unaligned.h instead and leave it up to the
+architecture to decide how to implement unaligned accesses.
+
+Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Link: https://lkml.org/lkml/2016/10/22/247
+Cc: Vincent Cuissard <cuissard@marvell.com>
+Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/nfcmrvl/fw_dnld.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nfc/nfcmrvl/fw_dnld.c
++++ b/drivers/nfc/nfcmrvl/fw_dnld.c
+@@ -17,7 +17,7 @@
+ */
+
+ #include <linux/module.h>
+-#include <linux/unaligned/access_ok.h>
++#include <asm/unaligned.h>
+ #include <linux/firmware.h>
+ #include <linux/nfc.h>
+ #include <net/nfc/nci.h>
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Andrey Rusalin <arusalin@dev.rtsoft.ru>
+Date: Wed, 28 Dec 2016 20:10:57 +0300
+Subject: NFC: pn533: change order of free_irq and dev unregistration
+
+From: Andrey Rusalin <arusalin@dev.rtsoft.ru>
+
+
+[ Upstream commit 068a496c4525c638ffab56449d905b88ef97fe32 ]
+
+Change order of free_irq and dev unregistration.
+It fixes situation when device already unregistered and
+an interrupt happens and nobody can handle it.
+
+Signed-off-by: Andrey Rusalin <arusalin@dev.rtsoft.ru>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/pn533/i2c.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nfc/pn533/i2c.c
++++ b/drivers/nfc/pn533/i2c.c
+@@ -242,10 +242,10 @@ static int pn533_i2c_remove(struct i2c_c
+
+ dev_dbg(&client->dev, "%s\n", __func__);
+
+- pn533_unregister_device(phy->priv);
+-
+ free_irq(client->irq, phy);
+
++ pn533_unregister_device(phy->priv);
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Rob Herring <robh@kernel.org>
+Date: Mon, 16 Jan 2017 14:28:39 -0600
+Subject: of: fix of_device_get_modalias returned length when truncating buffers
+
+From: Rob Herring <robh@kernel.org>
+
+
+[ Upstream commit bcf54d5385abaea9c8026aae6f4eeb348671a52d ]
+
+If the length of the modalias is greater than the buffer size, then the
+modalias is truncated. However the untruncated length is returned which
+will cause an error. Fix this to return the truncated length. If an error
+in the case was desired, then then we should just return -ENOMEM.
+
+The reality is no device will ever have 4KB of compatible strings to hit
+this case.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -223,7 +223,7 @@ ssize_t of_device_get_modalias(struct de
+ str[i] = '_';
+ }
+
+- return tsize;
++ return repend;
+ }
+ EXPORT_SYMBOL_GPL(of_device_get_modalias);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Mon, 20 Mar 2017 18:30:59 +0100
+Subject: omapfb: dss: Handle return errors in dss_init_ports()
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+
+[ Upstream commit 0348aaa34412e24ebe622a2b1b013e68d6ae5412 ]
+
+dss_init_ports() is not handling return errors from dpi_init_port() and
+sdi_init_port(). It is also always returning 0 currently which results in
+part of error handling code in dss_bind() being unused.
+
+Fix dss_init_ports() to handle return errors from dpi_init_port() and
+sdi_init_port().
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Cc: tomi.valkeinen@ti.com
+[b.zolnierkie: fail early on errors, minor fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/omap2/omapfb/dss/dss.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+@@ -941,11 +941,13 @@ static int dss_init_features(struct plat
+ return 0;
+ }
+
++static void dss_uninit_ports(struct platform_device *pdev);
++
+ static int dss_init_ports(struct platform_device *pdev)
+ {
+ struct device_node *parent = pdev->dev.of_node;
+ struct device_node *port;
+- int r;
++ int r, ret = 0;
+
+ if (parent == NULL)
+ return 0;
+@@ -972,17 +974,21 @@ static int dss_init_ports(struct platfor
+
+ switch (port_type) {
+ case OMAP_DISPLAY_TYPE_DPI:
+- dpi_init_port(pdev, port);
++ ret = dpi_init_port(pdev, port);
+ break;
+ case OMAP_DISPLAY_TYPE_SDI:
+- sdi_init_port(pdev, port);
++ ret = sdi_init_port(pdev, port);
+ break;
+ default:
+ break;
+ }
+- } while ((port = omapdss_of_get_next_port(parent, port)) != NULL);
++ } while (!ret &&
++ (port = omapdss_of_get_next_port(parent, port)) != NULL);
+
+- return 0;
++ if (ret)
++ dss_uninit_ports(pdev);
++
++ return ret;
+ }
+
+ static void dss_uninit_ports(struct platform_device *pdev)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Manish Jaggi <mjaggi@caviumnetworks.com>
+Date: Thu, 30 Mar 2017 18:47:14 -0500
+Subject: PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices
+
+From: Manish Jaggi <mjaggi@caviumnetworks.com>
+
+
+[ Upstream commit b77d537d00d08fcf0bf641cd3491dd7df0ad1475 ]
+
+Only apply the Cavium ACS quirk to devices with ID in the range
+0xa000-0xa0ff. These are the on-chip PCI devices for CN81xx/CN83xx/CN88xx.
+
+Fixes: b404bcfbf035 ("PCI: Add ACS quirk for all Cavium devices")
+Reported-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Manish Jaggi <mjaggi@cavium.com>
+Acked-by: David Daney <david.daney@cavium.com>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4104,6 +4104,9 @@ static int pci_quirk_cavium_acs(struct p
+ */
+ acs_flags &= ~(PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_SV | PCI_ACS_UF);
+
++ if (!((dev->device >= 0xa000) && (dev->device <= 0xa0ff)))
++ return -ENOTTY;
++
+ return acs_flags ? 0 : 1;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Long Li <longli@microsoft.com>
+Date: Thu, 23 Mar 2017 14:58:32 -0700
+Subject: PCI: hv: Lock PCI bus on device eject
+
+From: Long Li <longli@microsoft.com>
+
+
+[ Upstream commit 414428c5da1c71986727c2fa5cdf1ed071e398d7 ]
+
+A PCI_EJECT message can arrive at the same time we are calling
+pci_scan_child_bus() in the workqueue for the previous PCI_BUS_RELATIONS
+message or in create_root_hv_pci_bus(). In this case we could potentially
+modify the bus from multiple places.
+
+Properly lock the bus access.
+
+Thanks Dexuan Cui <decui@microsoft.com> for pointing out the race condition
+in create_root_hv_pci_bus().
+
+Reported-by: Xiaofeng Wang <xiaofwan@redhat.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-hyperv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/host/pci-hyperv.c
++++ b/drivers/pci/host/pci-hyperv.c
+@@ -1206,9 +1206,11 @@ static int create_root_hv_pci_bus(struct
+ hbus->pci_bus->msi = &hbus->msi_chip;
+ hbus->pci_bus->msi->dev = &hbus->hdev->device;
+
++ pci_lock_rescan_remove();
+ pci_scan_child_bus(hbus->pci_bus);
+ pci_bus_assign_resources(hbus->pci_bus);
+ pci_bus_add_devices(hbus->pci_bus);
++ pci_unlock_rescan_remove();
+ hbus->state = hv_pcibus_installed;
+ return 0;
+ }
+@@ -1597,8 +1599,10 @@ static void hv_eject_device_work(struct
+ pdev = pci_get_domain_bus_and_slot(hpdev->hbus->sysdata.domain, 0,
+ wslot);
+ if (pdev) {
++ pci_lock_rescan_remove();
+ pci_stop_and_remove_bus_device(pdev);
+ pci_dev_put(pdev);
++ pci_unlock_rescan_remove();
+ }
+
+ memset(&ctxt, 0, sizeof(ctxt));
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Long Li <longli@microsoft.com>
+Date: Thu, 23 Mar 2017 14:58:10 -0700
+Subject: PCI: hv: Properly handle PCI bus remove
+
+From: Long Li <longli@microsoft.com>
+
+
+[ Upstream commit d3a78d8bf759d8848339dcc367c4c1678b57a08b ]
+
+hv_pci_devices_present() is called in hv_pci_remove() when we remove a PCI
+device from the host, e.g., by disabling SR-IOV on a device. In
+hv_pci_remove(), the bus is already removed before the call, so we don't
+need to rescan the bus in the workqueue scheduled from
+hv_pci_devices_present().
+
+By introducing bus state hv_pcibus_removed, we can avoid this situation.
+
+Reported-by: Xiaofeng Wang <xiaofwan@redhat.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-hyperv.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pci-hyperv.c
++++ b/drivers/pci/host/pci-hyperv.c
+@@ -351,6 +351,7 @@ enum hv_pcibus_state {
+ hv_pcibus_init = 0,
+ hv_pcibus_probed,
+ hv_pcibus_installed,
++ hv_pcibus_removed,
+ hv_pcibus_maximum
+ };
+
+@@ -1489,13 +1490,24 @@ static void pci_devices_present_work(str
+ put_pcichild(hpdev, hv_pcidev_ref_initial);
+ }
+
+- /* Tell the core to rescan bus because there may have been changes. */
+- if (hbus->state == hv_pcibus_installed) {
++ switch(hbus->state) {
++ case hv_pcibus_installed:
++ /*
++ * Tell the core to rescan bus
++ * because there may have been changes.
++ */
+ pci_lock_rescan_remove();
+ pci_scan_child_bus(hbus->pci_bus);
+ pci_unlock_rescan_remove();
+- } else {
++ break;
++
++ case hv_pcibus_init:
++ case hv_pcibus_probed:
+ survey_child_resources(hbus);
++ break;
++
++ default:
++ break;
+ }
+
+ up(&hbus->enum_sem);
+@@ -2170,6 +2182,7 @@ static int hv_pci_probe(struct hv_device
+ hbus = kzalloc(sizeof(*hbus), GFP_KERNEL);
+ if (!hbus)
+ return -ENOMEM;
++ hbus->state = hv_pcibus_init;
+
+ /*
+ * The PCI bus "domain" is what is called "segment" in ACPI and
+@@ -2312,6 +2325,7 @@ static int hv_pci_remove(struct hv_devic
+ pci_stop_root_bus(hbus->pci_bus);
+ pci_remove_root_bus(hbus->pci_bus);
+ pci_unlock_rescan_remove();
++ hbus->state = hv_pcibus_removed;
+ }
+
+ ret = hv_send_resources_released(hdev);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Thu, 26 Jan 2017 14:07:47 -0500
+Subject: PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+
+[ Upstream commit fda78d7a0ead144f4b2cdb582dcba47911f4952c ]
+
+The pci_bus_type .shutdown method, pci_device_shutdown(), is called from
+device_shutdown() in the kernel restart and shutdown paths.
+
+Previously, pci_device_shutdown() called pci_msi_shutdown() and
+pci_msix_shutdown(). This disables MSI and MSI-X, which causes the device
+to fall back to raising interrupts via INTx. But the driver is still bound
+to the device, it doesn't know about this change, and it likely doesn't
+have an INTx handler, so these INTx interrupts cause "nobody cared"
+warnings like this:
+
+ irq 16: nobody cared (try booting with the "irqpoll" option)
+ CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.2-1.el7_UNSUPPORTED.x86_64 #1
+ Hardware name: Hewlett-Packard HP Z820 Workstation/158B, BIOS J63 v03.90 06/
+ ...
+
+The MSI disabling code was added by d52877c7b1af ("pci/irq: let
+pci_device_shutdown to call pci_msi_shutdown v2") because a driver left MSI
+enabled and kdump failed because the kexeced kernel wasn't prepared to
+receive the MSI interrupts.
+
+Subsequent commits 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even
+if kernel doesn't support MSI") and e80e7edc55ba ("PCI/MSI: Initialize MSI
+capability for all architectures") changed the kexeced kernel to disable
+all MSIs itself so it no longer depends on the crashed kernel to clean up
+after itself.
+
+Stop disabling MSI/MSI-X in pci_device_shutdown(). This resolves the
+"nobody cared" unhandled IRQ issue above. It also allows PCI serial
+devices, which may rely on the MSI interrupts, to continue outputting
+messages during reboot/shutdown.
+
+[bhelgaas: changelog, drop pci_msi_shutdown() and pci_msix_shutdown() calls
+altogether]
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=187351
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Alex Williamson <alex.williamson@redhat.com>
+CC: David Arcari <darcari@redhat.com>
+CC: Myron Stowe <mstowe@redhat.com>
+CC: Lukas Wunner <lukas@wunner.de>
+CC: Keith Busch <keith.busch@intel.com>
+CC: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci-driver.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -463,8 +463,6 @@ static void pci_device_shutdown(struct d
+
+ if (drv && drv->shutdown)
+ drv->shutdown(pci_dev);
+- pci_msi_shutdown(pci_dev);
+- pci_msix_shutdown(pci_dev);
+
+ /*
+ * If this is a kexec reboot, turn off Bus Master bit on the
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Mon, 27 Mar 2017 16:10:36 +0900
+Subject: perf annotate: Fix a bug following symbolic link of a build-id file
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+
+[ Upstream commit 6ebd2547dd24daf95a21b2bc59931de8502afcc3 ]
+
+It is wrong way to read link name from a build-id file. Because a
+build-id file is not anymore a symbolic link but build-id directory of
+it is symbolic link, so fix it.
+
+For example, if build-id file name gotten from
+dso__build_id_filename() is as below,
+
+ /root/.debug/.build-id/4f/75c7d197c951659d1c1b8b5fd49bcdf8f3f8b1/elf
+
+To correctly read link name of build-id, use the build-id dir path that
+is a symbolic link, instead of the above build-id file name like below.
+
+ /root/.debug/.build-id/4f/75c7d197c951659d1c1b8b5fd49bcdf8f3f8b1
+
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/1490598638-13947-2-git-send-email-treeze.taeung@gmail.com
+Fixes: 01412261d994 ("perf buildid-cache: Use path/to/bin/buildid/elf instead of path/to/bin/buildid")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/annotate.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1250,6 +1250,7 @@ static int dso__disassemble_filename(str
+ {
+ char linkname[PATH_MAX];
+ char *build_id_filename;
++ char *build_id_path = NULL;
+
+ if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS &&
+ !dso__is_kcore(dso))
+@@ -1265,8 +1266,14 @@ static int dso__disassemble_filename(str
+ goto fallback;
+ }
+
++ build_id_path = strdup(filename);
++ if (!build_id_path)
++ return -1;
++
++ dirname(build_id_path);
++
+ if (dso__is_kcore(dso) ||
+- readlink(filename, linkname, sizeof(linkname)) < 0 ||
++ readlink(build_id_path, linkname, sizeof(linkname)) < 0 ||
+ strstr(linkname, DSO__NAME_KALLSYMS) ||
+ access(filename, R_OK)) {
+ fallback:
+@@ -1278,6 +1285,7 @@ fallback:
+ __symbol__join_symfs(filename, filename_size, dso->long_name);
+ }
+
++ free(build_id_path);
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+Date: Wed, 22 Mar 2017 15:06:20 +0200
+Subject: perf buildid: Do not assume that readlink() returns a null terminated string
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+
+[ Upstream commit 5a2342111c68e623e27ee7ea3d0492d8dad6bda0 ]
+
+Valgrind was complaining:
+
+ $ valgrind ./perf list >/dev/null
+ ==11643== Memcheck, a memory error detector
+ ==11643== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
+ ==11643== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
+ ==11643== Command: ./perf list
+ ==11643==
+ ==11643== Conditional jump or move depends on uninitialised value(s)
+ ==11643== at 0x4C30620: rindex (vg_replace_strmem.c:199)
+ ==11643== by 0x49DAA9: build_id_cache__origname (build-id.c:198)
+ ==11643== by 0x49E1C7: build_id_cache__valid_id (build-id.c:222)
+ ==11643== by 0x49E1C7: build_id_cache__list_all (build-id.c:507)
+ ==11643== by 0x4B9C8F: print_sdt_events (parse-events.c:2067)
+ ==11643== by 0x4BB0B3: print_events (parse-events.c:2313)
+ ==11643== by 0x439501: cmd_list (builtin-list.c:53)
+ ==11643== by 0x497150: run_builtin (perf.c:359)
+ ==11643== by 0x428CE0: handle_internal_command (perf.c:421)
+ ==11643== by 0x428CE0: run_argv (perf.c:467)
+ ==11643== by 0x428CE0: main (perf.c:614)
+ [...]
+
+Additionally, a zero length result from readlink() is not very interesting.
+
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20170322130624.21881-3-tommi.t.rantala@nokia.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/build-id.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/build-id.c
++++ b/tools/perf/util/build-id.c
+@@ -182,13 +182,17 @@ char *build_id_cache__origname(const cha
+ char buf[PATH_MAX];
+ char *ret = NULL, *p;
+ size_t offs = 5; /* == strlen("../..") */
++ ssize_t len;
+
+ linkname = build_id_cache__linkname(sbuild_id, NULL, 0);
+ if (!linkname)
+ return NULL;
+
+- if (readlink(linkname, buf, PATH_MAX) < 0)
++ len = readlink(linkname, buf, sizeof(buf) - 1);
++ if (len <= 0)
+ goto out;
++ buf[len] = '\0';
++
+ /* The link should be "../..<origpath>/<sbuild_id>" */
+ p = strrchr(buf, '/'); /* Cut off the "/<sbuild_id>" */
+ if (p && (p > buf + offs)) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jin Yao <yao.jin@linux.intel.com>
+Date: Fri, 7 Apr 2017 20:08:52 +0800
+Subject: perf evsel: Return exact sub event which failed with EPERM for wildcards
+
+From: Jin Yao <yao.jin@linux.intel.com>
+
+
+[ Upstream commit 32ccb130f5325abc81b32b1a538390f46e4860f6 ]
+
+The kernel has a special check for a specific irq_vectors trace event.
+
+TRACE_EVENT_PERF_PERM(irq_work_exit,
+ is_sampling_event(p_event) ? -EPERM : 0);
+
+The perf-record fails for this irq_vectors event when it is present,
+like when using a wildcard:
+
+ root@skl:/tmp# perf record -a -e irq_vectors:* sleep 2
+ Error:
+ You may not have permission to collect system-wide stats.
+
+ Consider tweaking /proc/sys/kernel/perf_event_paranoid,
+ which controls use of the performance events system by
+ unprivileged users (without CAP_SYS_ADMIN).
+
+ The current value is 2:
+
+ -1: Allow use of (almost) all events by all users
+ >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK
+ >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN
+ >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN
+
+ To make this setting permanent, edit /etc/sysctl.conf too, e.g.:
+
+ kernel.perf_event_paranoid = -1
+
+This patch prints out the exact sub event that failed with EPERM for
+wildcards to help in understanding what went wrong when this event is
+present:
+
+After the patch:
+
+ root@skl:/tmp# perf record -a -e irq_vectors:* sleep 2
+ Error:
+ No permission to enable irq_vectors:irq_work_exit event.
+
+ You may not have permission to collect system-wide stats.
+ ......
+
+Committer notes:
+
+So we have a lot of irq_vectors events:
+
+ [root@jouet ~]# perf list irq_vectors:*
+
+ List of pre-defined events (to be used in -e):
+
+ irq_vectors:call_function_entry [Tracepoint event]
+ irq_vectors:call_function_exit [Tracepoint event]
+ irq_vectors:call_function_single_entry [Tracepoint event]
+ irq_vectors:call_function_single_exit [Tracepoint event]
+ irq_vectors:deferred_error_apic_entry [Tracepoint event]
+ irq_vectors:deferred_error_apic_exit [Tracepoint event]
+ irq_vectors:error_apic_entry [Tracepoint event]
+ irq_vectors:error_apic_exit [Tracepoint event]
+ irq_vectors:irq_work_entry [Tracepoint event]
+ irq_vectors:irq_work_exit [Tracepoint event]
+ irq_vectors:local_timer_entry [Tracepoint event]
+ irq_vectors:local_timer_exit [Tracepoint event]
+ irq_vectors:reschedule_entry [Tracepoint event]
+ irq_vectors:reschedule_exit [Tracepoint event]
+ irq_vectors:spurious_apic_entry [Tracepoint event]
+ irq_vectors:spurious_apic_exit [Tracepoint event]
+ irq_vectors:thermal_apic_entry [Tracepoint event]
+ irq_vectors:thermal_apic_exit [Tracepoint event]
+ irq_vectors:threshold_apic_entry [Tracepoint event]
+ irq_vectors:threshold_apic_exit [Tracepoint event]
+ irq_vectors:x86_platform_ipi_entry [Tracepoint event]
+ irq_vectors:x86_platform_ipi_exit [Tracepoint event]
+ #
+
+And some may be sampled:
+
+ [root@jouet ~]# perf record -e irq_vectors:local* sleep 20s
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.020 MB perf.data (2 samples) ]
+ [root@jouet ~]# perf report -D | egrep 'stats:|events:'
+ Aggregated stats:
+ TOTAL events: 155
+ MMAP events: 144
+ COMM events: 2
+ EXIT events: 1
+ SAMPLE events: 2
+ MMAP2 events: 4
+ FINISHED_ROUND events: 1
+ TIME_CONV events: 1
+ irq_vectors:local_timer_entry stats:
+ TOTAL events: 1
+ SAMPLE events: 1
+ irq_vectors:local_timer_exit stats:
+ TOTAL events: 1
+ SAMPLE events: 1
+ [root@jouet ~]#
+
+But, as shown in the tracepoint definition at the start of this message,
+some, like "irq_vectors:irq_work_exit", may not be sampled, just counted,
+i.e. if we try to sample, as when using 'perf record', we get an error:
+
+ [root@jouet ~]# perf record -e irq_vectors:irq_work_exit
+ Error:
+ You may not have permission to collect system-wide stats.
+
+ Consider tweaking /proc/sys/kernel/perf_event_paranoid,
+<SNIP>
+
+The error message is misleading, this patch will help in pointing out
+what is the event causing such an error, but the error message needs
+improvement, i.e. we need to figure out a way to check if a tracepoint
+is counting only, like this one, when all we can do is to count it with
+'perf stat', at most printing the delta using interval printing, as in:
+
+ [root@jouet ~]# perf stat -I 5000 -e irq_vectors:irq_work_*
+ # time counts unit events
+ 5.000168871 0 irq_vectors:irq_work_entry
+ 5.000168871 0 irq_vectors:irq_work_exit
+ 10.000676730 0 irq_vectors:irq_work_entry
+ 10.000676730 0 irq_vectors:irq_work_exit
+ 15.001122415 0 irq_vectors:irq_work_entry
+ 15.001122415 0 irq_vectors:irq_work_exit
+ 20.001298051 0 irq_vectors:irq_work_entry
+ 20.001298051 0 irq_vectors:irq_work_exit
+ 25.001485020 1 irq_vectors:irq_work_entry
+ 25.001485020 1 irq_vectors:irq_work_exit
+ 30.001658706 0 irq_vectors:irq_work_entry
+ 30.001658706 0 irq_vectors:irq_work_exit
+ ^C 32.045711878 0 irq_vectors:irq_work_entry
+ 32.045711878 0 irq_vectors:irq_work_exit
+
+ [root@jouet ~]#
+
+But at least, when we use a wildcard, this patch helps a bit.
+
+Signed-off-by: Yao Jin <yao.jin@linux.intel.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1491566932-503-1-git-send-email-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/evsel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2400,11 +2400,17 @@ int perf_evsel__open_strerror(struct per
+ int err, char *msg, size_t size)
+ {
+ char sbuf[STRERR_BUFSIZE];
++ int printed = 0;
+
+ switch (err) {
+ case EPERM:
+ case EACCES:
+- return scnprintf(msg, size,
++ if (err == EPERM)
++ printed = scnprintf(msg, size,
++ "No permission to enable %s event.\n\n",
++ perf_evsel__name(evsel));
++
++ return scnprintf(msg + printed, size - printed,
+ "You may not have permission to collect %sstats.\n\n"
+ "Consider tweaking /proc/sys/kernel/perf_event_paranoid,\n"
+ "which controls use of the performance events system by\n"
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: David Carrillo-Cisneros <davidcc@google.com>
+Date: Mon, 10 Apr 2017 13:14:27 -0700
+Subject: perf inject: Copy events when reordering events in pipe mode
+
+From: David Carrillo-Cisneros <davidcc@google.com>
+
+
+[ Upstream commit 1e0d4f0200e4dbdfc38d818f329d8a0955f7c6f5 ]
+
+__perf_session__process_pipe_events reuses the same memory buffer to
+process all events in the pipe.
+
+When reordering is needed (e.g. -b option), events are not immediately
+flushed, but kept around until reordering is possible, causing
+memory corruption.
+
+The problem is usually observed by a "Unknown sample error" output. It
+can easily be reproduced by:
+
+ perf record -o - noploop | perf inject -b > output
+
+Committer testing:
+
+Before:
+
+ $ perf record -o - stress -t 2 -c 2 | perf inject -b > /dev/null
+ stress: info: [8297] dispatching hogs: 2 cpu, 0 io, 0 vm, 0 hdd
+ stress: info: [8297] successful run completed in 2s
+ [ perf record: Woken up 3 times to write data ]
+ [ perf record: Captured and wrote 0.000 MB - ]
+ Warning:
+ Found 1 unknown events!
+
+ Is this an older tool processing a perf.data file generated by a more recent tool?
+
+ If that is not the case, consider reporting to linux-kernel@vger.kernel.org.
+
+ $
+
+After:
+
+ $ perf record -o - stress -t 2 -c 2 | perf inject -b > /dev/null
+ stress: info: [9027] dispatching hogs: 2 cpu, 0 io, 0 vm, 0 hdd
+ stress: info: [9027] successful run completed in 2s
+ [ perf record: Woken up 3 times to write data ]
+ [ perf record: Captured and wrote 0.000 MB - ]
+ no symbols found in /usr/bin/stress, maybe install a debug package?
+ no symbols found in /usr/bin/stress, maybe install a debug package?
+ $
+
+Signed-off-by: David Carrillo-Cisneros <davidcc@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: He Kuang <hekuang@huawei.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Paul Turner <pjt@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Simon Que <sque@chromium.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/20170410201432.24807-3-davidcc@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/ordered-events.c | 3 ++-
+ tools/perf/util/session.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/ordered-events.c
++++ b/tools/perf/util/ordered-events.c
+@@ -79,7 +79,7 @@ static union perf_event *dup_event(struc
+
+ static void free_dup_event(struct ordered_events *oe, union perf_event *event)
+ {
+- if (oe->copy_on_queue) {
++ if (event && oe->copy_on_queue) {
+ oe->cur_alloc_size -= event->header.size;
+ free(event);
+ }
+@@ -150,6 +150,7 @@ void ordered_events__delete(struct order
+ list_move(&event->list, &oe->cache);
+ oe->nr_events--;
+ free_dup_event(oe, event->event);
++ event->event = NULL;
+ }
+
+ int ordered_events__queue(struct ordered_events *oe, union perf_event *event,
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1628,6 +1628,7 @@ static int __perf_session__process_pipe_
+ buf = malloc(cur_size);
+ if (!buf)
+ return -errno;
++ ordered_events__set_copy_on_queue(oe, true);
+ more:
+ event = buf;
+ err = readn(fd, event, sizeof(struct perf_event_header));
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Wed, 8 Mar 2017 12:29:07 +0530
+Subject: perf probe: Fix concat_probe_trace_events
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+
+[ Upstream commit f0a30dca5f84fe8048271799b56677ac2279de66 ]
+
+'*ntevs' contains number of elements present in 'tevs' array. If there
+are no elements in array, 'tevs2' can be directly assigned to 'tevs'
+without allocating more space. So the condition should be '*ntevs == 0'
+not 'ntevs == 0'.
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: 42bba263eb58 ("perf probe: Allow wildcard for cached events")
+Link: http://lkml.kernel.org/r/20170308065908.4128-1-ravi.bangoria@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/probe-event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -3060,7 +3060,7 @@ concat_probe_trace_events(struct probe_t
+ struct probe_trace_event *new_tevs;
+ int ret = 0;
+
+- if (ntevs == 0) {
++ if (*ntevs == 0) {
+ *tevs = *tevs2;
+ *ntevs = ntevs2;
+ *tevs2 = NULL;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Fri, 17 Mar 2017 16:16:32 +0800
+Subject: perf probe: Return errno when not hitting any event
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+
+[ Upstream commit 70946723eeb859466f026274b29c6196e39149c4 ]
+
+On old perf, when using 'perf probe -d' to delete an inexistent event,
+it returns errno, eg,
+
+ -bash-4.3# perf probe -d xxx || echo $?
+ Info: Event "*:xxx" does not exist.
+ Error: Failed to delete events.
+ 255
+
+But now perf_del_probe_events() will always set ret = 0, different from
+previous del_perf_probe_events(). After this, it returns errno again,
+eg,
+
+ -bash-4.3# ./perf probe -d xxx || echo $?
+ "xxx" does not hit any event.
+ Error: Failed to delete events.
+ 254
+
+And it is more appropriate to return -ENOENT instead of -EPERM.
+
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Hanjun Guo <guohanjun@huawei.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Fixes: dddc7ee32fa1 ("perf probe: Fix an error when deleting probes successfully")
+Link: http://lkml.kernel.org/r/1489738592-61011-1-git-send-email-wangkefeng.wang@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-probe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/builtin-probe.c
++++ b/tools/perf/builtin-probe.c
+@@ -442,9 +442,9 @@ static int perf_del_probe_events(struct
+ }
+
+ if (ret == -ENOENT && ret2 == -ENOENT)
+- pr_debug("\"%s\" does not hit any event.\n", str);
+- /* Note that this is silently ignored */
+- ret = 0;
++ pr_warning("\"%s\" does not hit any event.\n", str);
++ else
++ ret = 0;
+
+ error:
+ if (kfd >= 0)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: David Carrillo-Cisneros <davidcc@google.com>
+Date: Mon, 10 Apr 2017 13:14:30 -0700
+Subject: perf session: Don't rely on evlist in pipe mode
+
+From: David Carrillo-Cisneros <davidcc@google.com>
+
+
+[ Upstream commit 0973ad97c187e06aece61f685b9c3b2d93290a73 ]
+
+Session sets a number parameters that rely on evlist. These parameters
+are not used in pipe-mode and should not be set, since evlist is
+unavailable. Fix that.
+
+Signed-off-by: David Carrillo-Cisneros <davidcc@google.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: He Kuang <hekuang@huawei.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Paul Turner <pjt@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Simon Que <sque@chromium.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/20170410201432.24807-6-davidcc@google.com
+[ Check if file != NULL in perf_session__new(), like when used by builtin-top.c ]
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/session.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -139,8 +139,14 @@ struct perf_session *perf_session__new(s
+ if (perf_session__open(session) < 0)
+ goto out_close;
+
+- perf_session__set_id_hdr_size(session);
+- perf_session__set_comm_exec(session);
++ /*
++ * set session attributes that are present in perf.data
++ * but not in pipe-mode.
++ */
++ if (!file->is_pipe) {
++ perf_session__set_id_hdr_size(session);
++ perf_session__set_comm_exec(session);
++ }
+ }
+ } else {
+ session->machines.host.env = &perf_env;
+@@ -155,7 +161,11 @@ struct perf_session *perf_session__new(s
+ pr_warning("Cannot read kernel map\n");
+ }
+
+- if (tool && tool->ordering_requires_timestamps &&
++ /*
++ * In pipe-mode, evlist is empty until PERF_RECORD_HEADER_ATTR is
++ * processed, so perf_evlist__sample_id_all is not meaningful here.
++ */
++ if ((!file || !file->is_pipe) && tool && tool->ordering_requires_timestamps &&
+ tool->ordered_events && !perf_evlist__sample_id_all(session->evlist)) {
+ dump_printf("WARNING: No sample_id_all support, falling back to unordered processing\n");
+ tool->ordered_events = false;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Changbin Du <changbin.du@intel.com>
+Date: Mon, 13 Mar 2017 16:31:48 +0800
+Subject: perf sort: Fix segfault with basic block 'cycles' sort dimension
+
+From: Changbin Du <changbin.du@intel.com>
+
+
+[ Upstream commit 4b0b3aa6a2756e6115fdf275c521e4552a7082f3 ]
+
+Skip the sample which doesn't have branch_info to avoid segmentation
+fault:
+
+The fault can be reproduced by:
+
+ perf record -a
+ perf report -F cycles
+
+Signed-off-by: Changbin Du <changbin.du@intel.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: 0e332f033a82 ("perf tools: Add support for cycles, weight branch_info field")
+Link: http://lkml.kernel.org/r/20170313083148.23568-1-changbin.du@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/sort.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -846,6 +846,9 @@ static int hist_entry__mispredict_snprin
+ static int64_t
+ sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right)
+ {
++ if (!left->branch_info || !right->branch_info)
++ return cmp_null(left->branch_info, right->branch_info);
++
+ return left->branch_info->flags.cycles -
+ right->branch_info->flags.cycles;
+ }
+@@ -853,6 +856,8 @@ sort__cycles_cmp(struct hist_entry *left
+ static int hist_entry__cycles_snprintf(struct hist_entry *he, char *bf,
+ size_t size, unsigned int width)
+ {
++ if (!he->branch_info)
++ return scnprintf(bf, size, "%-.*s", width, "N/A");
+ if (he->branch_info->flags.cycles == 0)
+ return repsep_snprintf(bf, size, "%-*s", width, "-");
+ return repsep_snprintf(bf, size, "%-*hd", width,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Stephane Eranian <eranian@google.com>
+Date: Wed, 12 Apr 2017 11:23:01 -0700
+Subject: perf stat: Fix bug in handling events in error state
+
+From: Stephane Eranian <eranian@google.com>
+
+
+[ Upstream commit db49a71798a38f3ddf3f3462703328dca39b1ac7 ]
+
+(This is a patch has been sitting in the Intel CQM/CMT driver series for
+ a while, despite not depend on it. Sending it now independently since
+ the series is being discarded.)
+
+When an event is in error state, read() returns 0 instead of sizeof()
+buffer. In certain modes, such as interval printing, ignoring the 0
+return value may cause bogus count deltas to be computed and thus
+invalid results printed.
+
+This patch fixes this problem by modifying read_counters() to mark the
+event as not scaled (scaled = -1) to force the printout routine to show
+<NOT COUNTED>.
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Reviewed-by: David Carrillo-Cisneros <davidcc@google.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Paul Turner <pjt@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/20170412182301.44406-1-davidcc@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-stat.c | 12 +++++++++---
+ tools/perf/util/evsel.c | 4 ++--
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -311,8 +311,12 @@ static int read_counter(struct perf_evse
+ struct perf_counts_values *count;
+
+ count = perf_counts(counter->counts, cpu, thread);
+- if (perf_evsel__read(counter, cpu, thread, count))
++ if (perf_evsel__read(counter, cpu, thread, count)) {
++ counter->counts->scaled = -1;
++ perf_counts(counter->counts, cpu, thread)->ena = 0;
++ perf_counts(counter->counts, cpu, thread)->run = 0;
+ return -1;
++ }
+
+ if (STAT_RECORD) {
+ if (perf_evsel__write_stat_event(counter, cpu, thread, count)) {
+@@ -337,12 +341,14 @@ static int read_counter(struct perf_evse
+ static void read_counters(void)
+ {
+ struct perf_evsel *counter;
++ int ret;
+
+ evlist__for_each_entry(evsel_list, counter) {
+- if (read_counter(counter))
++ ret = read_counter(counter);
++ if (ret)
+ pr_debug("failed to read counter %s\n", counter->name);
+
+- if (perf_stat_process_counter(&stat_config, counter))
++ if (ret == 0 && perf_stat_process_counter(&stat_config, counter))
+ pr_warning("failed to process counter %s\n", counter->name);
+ }
+ }
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1221,7 +1221,7 @@ int perf_evsel__read(struct perf_evsel *
+ if (FD(evsel, cpu, thread) < 0)
+ return -EINVAL;
+
+- if (readn(FD(evsel, cpu, thread), count, sizeof(*count)) < 0)
++ if (readn(FD(evsel, cpu, thread), count, sizeof(*count)) <= 0)
+ return -errno;
+
+ return 0;
+@@ -1239,7 +1239,7 @@ int __perf_evsel__read_on_cpu(struct per
+ if (evsel->counts == NULL && perf_evsel__alloc_counts(evsel, cpu + 1, thread + 1) < 0)
+ return -ENOMEM;
+
+- if (readn(FD(evsel, cpu, thread), &count, nv * sizeof(u64)) < 0)
++ if (readn(FD(evsel, cpu, thread), &count, nv * sizeof(u64)) <= 0)
+ return -errno;
+
+ perf_evsel__compute_deltas(evsel, cpu, thread, &count);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Borislav Petkov <bp@suse.de>
+Date: Tue, 7 Feb 2017 01:40:05 +0100
+Subject: perf stat: Issue a HW watchdog disable hint
+
+From: Borislav Petkov <bp@suse.de>
+
+
+[ Upstream commit 02d492e5dcb72c004d213756eb87c9d62a6d76a7 ]
+
+When using perf stat on an AMD F15h system with the default hw events
+attributes, some of the events don't get counted:
+
+ Performance counter stats for 'sleep 1':
+
+ 0.749208 task-clock (msec) # 0.001 CPUs utilized
+ 1 context-switches # 0.001 M/sec
+ 0 cpu-migrations # 0.000 K/sec
+ 54 page-faults # 0.072 M/sec
+ 1,122,815 cycles # 1.499 GHz
+ 286,740 stalled-cycles-frontend # 25.54% frontend cycles idle
+ <not counted> stalled-cycles-backend (0.00%)
+ ^^^^^^^^^^^^
+ <not counted> instructions (0.00%)
+ ^^^^^^^^^^^^
+ <not counted> branches (0.00%)
+ <not counted> branch-misses (0.00%)
+
+ 1.001550070 seconds time elapsed
+
+The reason is that we have the HW watchdog consuming one PMU counter and
+when perf tries to schedule 6 events on 6 counters and some of those
+counters are constrained to only a specific subset of PMCs by the
+hardware, the event scheduling fails.
+
+So issue a hint to disable the HW watchdog around a perf stat session.
+
+Committer note:
+
+Testing it...
+
+ # perf stat -d usleep 1
+
+ Performance counter stats for 'usleep 1':
+
+ 1.180203 task-clock (msec) # 0.490 CPUs utilized
+ 1 context-switches # 0.847 K/sec
+ 0 cpu-migrations # 0.000 K/sec
+ 54 page-faults # 0.046 M/sec
+ 184,754 cycles # 0.157 GHz
+ 714,553 instructions # 3.87 insn per cycle
+ 154,661 branches # 131.046 M/sec
+ 7,247 branch-misses # 4.69% of all branches
+ 219,984 L1-dcache-loads # 186.395 M/sec
+ 17,600 L1-dcache-load-misses # 8.00% of all L1-dcache hits (90.16%)
+ <not counted> LLC-loads (0.00%)
+ <not counted> LLC-load-misses (0.00%)
+
+ 0.002406823 seconds time elapsed
+
+ Some events weren't counted. Try disabling the NMI watchdog:
+ echo 0 > /proc/sys/kernel/nmi_watchdog
+ perf stat ...
+ echo 1 > /proc/sys/kernel/nmi_watchdog
+ #
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Robert Richter <rric@kernel.org>
+Cc: Vince Weaver <vince@deater.net>
+Link: http://lkml.kernel.org/r/20170211183218.ijnvb5f7ciyuunx4@pd.tnic
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-stat.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -146,6 +146,7 @@ static aggr_get_id_t aggr_get_id;
+ static bool append_file;
+ static const char *output_name;
+ static int output_fd;
++static int print_free_counters_hint;
+
+ struct perf_stat {
+ bool record;
+@@ -1109,6 +1110,9 @@ static void printout(int id, int nr, str
+ counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
+ csv_sep);
+
++ if (counter->supported)
++ print_free_counters_hint = 1;
++
+ fprintf(stat_config.output, "%-*s%s",
+ csv_output ? 0 : unit_width,
+ counter->unit, csv_sep);
+@@ -1477,6 +1481,13 @@ static void print_footer(void)
+ avg_stats(&walltime_nsecs_stats));
+ }
+ fprintf(output, "\n\n");
++
++ if (print_free_counters_hint)
++ fprintf(output,
++"Some events weren't counted. Try disabling the NMI watchdog:\n"
++" echo 0 > /proc/sys/kernel/nmi_watchdog\n"
++" perf stat ...\n"
++" echo 1 > /proc/sys/kernel/nmi_watchdog\n");
+ }
+
+ static void print_counters(struct timespec *ts, int argc, const char **argv)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Stephane Eranian <eranian@google.com>
+Date: Wed, 15 Mar 2017 10:17:13 -0700
+Subject: perf tools: Make perf_event__synthesize_mmap_events() scale
+
+From: Stephane Eranian <eranian@google.com>
+
+
+[ Upstream commit 88b897a30c525c2eee6e7f16e1e8d0f18830845e ]
+
+This patch significantly improves the execution time of
+perf_event__synthesize_mmap_events() when running perf record on systems
+where processes have lots of threads.
+
+It just happens that cat /proc/pid/maps support uses a O(N^2) algorithm to
+generate each map line in the maps file. If you have 1000 threads, then you
+have necessarily 1000 stacks. For each vma, you need to check if it
+corresponds to a thread's stack. With a large number of threads, this can take
+a very long time. I have seen latencies >> 10mn.
+
+As of today, perf does not use the fact that a mapping is a stack, therefore we
+can work around the issue by using /proc/pid/tasks/pid/maps. This entry does
+not try to map a vma to stack and is thus much faster with no loss of
+functonality.
+
+The proc-map-timeout logic is kept in case users still want some upper limit.
+
+In V2, we fix the file path from /proc/pid/tasks/pid/maps to actual
+/proc/pid/task/pid/maps, tasks -> task. Thanks Arnaldo for catching this.
+
+Committer note:
+
+This problem seems to have been elliminated in the kernel since commit :
+b18cb64ead40 ("fs/proc: Stop trying to report thread stacks").
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20170315135059.GC2177@redhat.com
+Link: http://lkml.kernel.org/r/1489598233-25586-1-git-send-email-eranian@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/event.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -255,8 +255,8 @@ int perf_event__synthesize_mmap_events(s
+ if (machine__is_default_guest(machine))
+ return 0;
+
+- snprintf(filename, sizeof(filename), "%s/proc/%d/maps",
+- machine->root_dir, pid);
++ snprintf(filename, sizeof(filename), "%s/proc/%d/task/%d/maps",
++ machine->root_dir, pid, pid);
+
+ fp = fopen(filename, "r");
+ if (fp == NULL) {
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Wed, 29 Mar 2017 16:37:51 -0300
+Subject: perf trace: Handle unpaired raw_syscalls:sys_exit event
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+
+[ Upstream commit fd2b2975149f5f7099693027cece81b16842964a ]
+
+Which may happen when we start a tracing session and a thread is waiting
+for something like "poll" to return, in which case we better print "?"
+both for the syscall entry timestamp and for the duration.
+
+E.g.:
+
+Tracing existing mutt session:
+
+ # perf trace -p `pidof mutt`
+ ? ( ? ): mutt/17135 ... [continued]: poll()) = 1
+ 0.027 ( 0.013 ms): mutt/17135 read(buf: 0x7ffcb3c42cef, count: 1) = 1
+ 0.047 ( 0.008 ms): mutt/17135 poll(ufds: 0x7ffcb3c42c50, nfds: 1, timeout_msecs: 1000) = 1
+ 0.059 ( 0.008 ms): mutt/17135 read(buf: 0x7ffcb3c42cef, count: 1) = 1
+ <SNIP>
+
+Before it would print a large number because we'd do:
+
+ ttrace->entry_time - trace->base_time
+
+And entry_time would be 0, while base_time would be the timestamp for
+the first event 'perf trace' reads, oops.
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Luis Claudio Gonçalves <lclaudio@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/n/tip-wbcb93ofva2qdjd5ltn5eeqq@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-trace.c | 43 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 34 insertions(+), 9 deletions(-)
+
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -822,12 +822,21 @@ struct syscall {
+ void **arg_parm;
+ };
+
+-static size_t fprintf_duration(unsigned long t, FILE *fp)
++/*
++ * We need to have this 'calculated' boolean because in some cases we really
++ * don't know what is the duration of a syscall, for instance, when we start
++ * a session and some threads are waiting for a syscall to finish, say 'poll',
++ * in which case all we can do is to print "( ? ) for duration and for the
++ * start timestamp.
++ */
++static size_t fprintf_duration(unsigned long t, bool calculated, FILE *fp)
+ {
+ double duration = (double)t / NSEC_PER_MSEC;
+ size_t printed = fprintf(fp, "(");
+
+- if (duration >= 1.0)
++ if (!calculated)
++ printed += fprintf(fp, " ? ");
++ else if (duration >= 1.0)
+ printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration);
+ else if (duration >= 0.01)
+ printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration);
+@@ -1030,13 +1039,27 @@ static bool trace__filter_duration(struc
+ return t < (trace->duration_filter * NSEC_PER_MSEC);
+ }
+
+-static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
++static size_t __trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
+ {
+ double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC;
+
+ return fprintf(fp, "%10.3f ", ts);
+ }
+
++/*
++ * We're handling tstamp=0 as an undefined tstamp, i.e. like when we are
++ * using ttrace->entry_time for a thread that receives a sys_exit without
++ * first having received a sys_enter ("poll" issued before tracing session
++ * starts, lost sys_enter exit due to ring buffer overflow).
++ */
++static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
++{
++ if (tstamp > 0)
++ return __trace__fprintf_tstamp(trace, tstamp, fp);
++
++ return fprintf(fp, " ? ");
++}
++
+ static bool done = false;
+ static bool interrupted = false;
+
+@@ -1047,10 +1070,10 @@ static void sig_handler(int sig)
+ }
+
+ static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread,
+- u64 duration, u64 tstamp, FILE *fp)
++ u64 duration, bool duration_calculated, u64 tstamp, FILE *fp)
+ {
+ size_t printed = trace__fprintf_tstamp(trace, tstamp, fp);
+- printed += fprintf_duration(duration, fp);
++ printed += fprintf_duration(duration, duration_calculated, fp);
+
+ if (trace->multiple_threads) {
+ if (trace->show_comm)
+@@ -1452,7 +1475,7 @@ static int trace__printf_interrupted_ent
+
+ duration = sample->time - ttrace->entry_time;
+
+- printed = trace__fprintf_entry_head(trace, trace->current, duration, ttrace->entry_time, trace->output);
++ printed = trace__fprintf_entry_head(trace, trace->current, duration, true, ttrace->entry_time, trace->output);
+ printed += fprintf(trace->output, "%-70s) ...\n", ttrace->entry_str);
+ ttrace->entry_pending = false;
+
+@@ -1499,7 +1522,7 @@ static int trace__sys_enter(struct trace
+
+ if (sc->is_exit) {
+ if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) {
+- trace__fprintf_entry_head(trace, thread, 1, ttrace->entry_time, trace->output);
++ trace__fprintf_entry_head(trace, thread, 0, false, ttrace->entry_time, trace->output);
+ fprintf(trace->output, "%-70s)\n", ttrace->entry_str);
+ }
+ } else {
+@@ -1547,6 +1570,7 @@ static int trace__sys_exit(struct trace
+ {
+ long ret;
+ u64 duration = 0;
++ bool duration_calculated = false;
+ struct thread *thread;
+ int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0;
+ struct syscall *sc = trace__syscall_info(trace, evsel, id);
+@@ -1577,6 +1601,7 @@ static int trace__sys_exit(struct trace
+ duration = sample->time - ttrace->entry_time;
+ if (trace__filter_duration(trace, duration))
+ goto out;
++ duration_calculated = true;
+ } else if (trace->duration_filter)
+ goto out;
+
+@@ -1592,7 +1617,7 @@ static int trace__sys_exit(struct trace
+ if (trace->summary_only)
+ goto out;
+
+- trace__fprintf_entry_head(trace, thread, duration, ttrace->entry_time, trace->output);
++ trace__fprintf_entry_head(trace, thread, duration, duration_calculated, ttrace->entry_time, trace->output);
+
+ if (ttrace->entry_pending) {
+ fprintf(trace->output, "%-70s", ttrace->entry_str);
+@@ -1855,7 +1880,7 @@ static int trace__pgfault(struct trace *
+ thread__find_addr_location(thread, sample->cpumode, MAP__FUNCTION,
+ sample->ip, &al);
+
+- trace__fprintf_entry_head(trace, thread, 0, sample->time, trace->output);
++ trace__fprintf_entry_head(trace, thread, 0, true, sample->time, trace->output);
+
+ fprintf(trace->output, "%sfault [",
+ evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 22 Nov 2017 21:31:20 +0100
+Subject: power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 09edcb647542487864e23aa8d2ef26be3e08978a ]
+
+If an error occurs when we enable the backup battery charging, we should
+go through the error handling path directly.
+
+Before commit db43e6c473b5 ("ab8500-bm: Add usb power path support") this
+was the case, but this commit has added some code between the last test and
+the 'out' label.
+So, in case of error, this added code is executed and the error may be
+silently ignored.
+
+Fix it by adding the missing 'goto out', as done in all other error
+handling paths.
+
+Fixes: db43e6c473b5 ("ab8500-bm: Add usb power path support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/ab8500_charger.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -3221,8 +3221,10 @@ static int ab8500_charger_init_hw_regist
+ ret = abx500_mask_and_set_register_interruptible(di->dev,
+ AB8500_RTC, AB8500_RTC_CTRL_REG,
+ RTC_BUP_CH_ENA, RTC_BUP_CH_ENA);
+- if (ret < 0)
++ if (ret < 0) {
+ dev_err(di->dev, "%s mask and set failed\n", __func__);
++ goto out;
++ }
+
+ if (is_ab8540(di->parent)) {
+ ret = abx500_mask_and_set_register_interruptible(di->dev,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 22 Nov 2017 21:27:31 +0100
+Subject: power: supply: ab8500_charger: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit bf59fddde1c3eab89eb8dca8f3d3dc097887d2bb ]
+
+'ret' is know to be 0 at this point, because it has not been updated by the
+the previous call to 'abx500_mask_and_set_register_interruptible()'.
+
+Fix it by updating 'ret' before checking if an error occurred.
+
+Fixes: 84edbeeab67c ("ab8500-charger: AB8500 charger driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/ab8500_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -3218,7 +3218,7 @@ static int ab8500_charger_init_hw_regist
+ }
+
+ /* Enable backup battery charging */
+- abx500_mask_and_set_register_interruptible(di->dev,
++ ret = abx500_mask_and_set_register_interruptible(di->dev,
+ AB8500_RTC, AB8500_RTC_CTRL_REG,
+ RTC_BUP_CH_ENA, RTC_BUP_CH_ENA);
+ if (ret < 0)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Anton Blanchard <anton@samba.org>
+Date: Mon, 3 Apr 2017 16:41:02 +1000
+Subject: powerpc: Avoid taking a data miss on every userspace instruction miss
+
+From: Anton Blanchard <anton@samba.org>
+
+
+[ Upstream commit a7a9dcd882a67b68568868b988289fce5ffd8419 ]
+
+Early on in do_page_fault() we call store_updates_sp(), regardless of
+the type of exception. For an instruction miss this doesn't make
+sense, because we only use this information to detect if a data miss
+is the result of a stack expansion instruction or not.
+
+Worse still, it results in a data miss within every userspace
+instruction miss handler, because we try and load the very instruction
+we are about to install a pte for!
+
+A simple exec microbenchmark runs 6% faster on POWER8 with this fix:
+
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+ unsigned long left = atol(argv[1]);
+ char leftstr[16];
+
+ if (left-- == 0)
+ return 0;
+
+ sprintf(leftstr, "%ld", left);
+ execlp(argv[0], argv[0], leftstr, NULL);
+ perror("exec failed\n");
+
+ return 0;
+}
+
+Pass the number of iterations on the command line (eg 10000) and time
+how long it takes to execute.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/fault.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -294,7 +294,7 @@ int do_page_fault(struct pt_regs *regs,
+ * can result in fault, which will cause a deadlock when called with
+ * mmap_sem held
+ */
+- if (user_mode(regs))
++ if (!is_exec && user_mode(regs))
+ store_update_sp = store_updates_sp(regs);
+
+ if (user_mode(regs))
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Tue, 21 Mar 2017 22:59:56 +0530
+Subject: powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout
+
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+
+
+[ Upstream commit a525108cf1cc14651602d678da38fa627a76a724 ]
+
+Without this if firmware reports 1MB page size support we will crash
+trying to use 1MB as hugetlb page size.
+
+echo 300 > /sys/kernel/mm/hugepages/hugepages-1024kB/nr_hugepages
+
+kernel BUG at ./arch/powerpc/include/asm/hugetlb.h:19!
+.....
+....
+[c0000000e2c27b30] c00000000029dae8 .hugetlb_fault+0x638/0xda0
+[c0000000e2c27c30] c00000000026fb64 .handle_mm_fault+0x844/0x1d70
+[c0000000e2c27d70] c00000000004805c .do_page_fault+0x3dc/0x7c0
+[c0000000e2c27e30] c00000000000ac98 handle_page_fault+0x10/0x30
+
+With fix, we don't enable 1MB as hugepage size.
+
+bash-4.2# cd /sys/kernel/mm/hugepages/
+bash-4.2# ls
+hugepages-16384kB hugepages-16777216kB
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/hugetlbpage.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -765,6 +765,24 @@ static int __init add_huge_page_size(uns
+ if ((mmu_psize = shift_to_mmu_psize(shift)) < 0)
+ return -EINVAL;
+
++#ifdef CONFIG_PPC_BOOK3S_64
++ /*
++ * We need to make sure that for different page sizes reported by
++ * firmware we only add hugetlb support for page sizes that can be
++ * supported by linux page table layout.
++ * For now we have
++ * Radix: 2M
++ * Hash: 16M and 16G
++ */
++ if (radix_enabled()) {
++ if (mmu_psize != MMU_PAGE_2M)
++ return -EINVAL;
++ } else {
++ if (mmu_psize != MMU_PAGE_16M && mmu_psize != MMU_PAGE_16G)
++ return -EINVAL;
++ }
++#endif
++
+ BUG_ON(mmu_psize_defs[mmu_psize].shift != shift);
+
+ /* Return if huge page size has already been setup */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 16 Nov 2017 11:45:37 -0600
+Subject: powerpc/modules: Don't try to restore r2 after a sibling call
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+
+[ Upstream commit b9eab08d012fa093947b230f9a87257c27fb829b ]
+
+When attempting to load a livepatch module, I got the following error:
+
+ module_64: patch_module: Expect noop after relocate, got 3c820000
+
+The error was triggered by the following code in
+unregister_netdevice_queue():
+
+ 14c: 00 00 00 48 b 14c <unregister_netdevice_queue+0x14c>
+ 14c: R_PPC64_REL24 net_set_todo
+ 150: 00 00 82 3c addis r4,r2,0
+
+GCC didn't insert a nop after the branch to net_set_todo() because it's
+a sibling call, so it never returns. The nop isn't needed after the
+branch in that case.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Reviewed-and-tested-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/code-patching.h | 1 +
+ arch/powerpc/kernel/module_64.c | 12 +++++++++++-
+ arch/powerpc/lib/code-patching.c | 5 +++++
+ 3 files changed, 17 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/code-patching.h
++++ b/arch/powerpc/include/asm/code-patching.h
+@@ -30,6 +30,7 @@ int patch_branch(unsigned int *addr, uns
+ int patch_instruction(unsigned int *addr, unsigned int instr);
+
+ int instr_is_relative_branch(unsigned int instr);
++int instr_is_relative_link_branch(unsigned int instr);
+ int instr_is_branch_to_addr(const unsigned int *instr, unsigned long addr);
+ unsigned long branch_target(const unsigned int *instr);
+ unsigned int translate_branch(const unsigned int *dest,
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -494,7 +494,17 @@ static bool is_early_mcount_callsite(u32
+ restore r2. */
+ static int restore_r2(u32 *instruction, struct module *me)
+ {
+- if (is_early_mcount_callsite(instruction - 1))
++ u32 *prev_insn = instruction - 1;
++
++ if (is_early_mcount_callsite(prev_insn))
++ return 1;
++
++ /*
++ * Make sure the branch isn't a sibling call. Sibling calls aren't
++ * "link" branches and they don't return, so they don't need the r2
++ * restore afterwards.
++ */
++ if (!instr_is_relative_link_branch(*prev_insn))
+ return 1;
+
+ if (*instruction != PPC_INST_NOP) {
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -95,6 +95,11 @@ int instr_is_relative_branch(unsigned in
+ return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
+ }
+
++int instr_is_relative_link_branch(unsigned int instr)
++{
++ return instr_is_relative_branch(instr) && (instr & BRANCH_SET_LINK);
++}
++
+ static unsigned long branch_iform_target(const unsigned int *instr)
+ {
+ signed long imm;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 3 Apr 2017 12:05:55 +1000
+Subject: powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+
+[ Upstream commit 4868e3508d1934d28961f940ed6b9f1e347ab52c ]
+
+setup_initial_memory_limit() is called from early_init_devtree(), which
+runs prior to feature patching. If the kernel is built with CONFIG_JUMP_LABEL=y
+and CONFIG_JUMP_LABEL_FEATURE_CHECKS=y then we will potentially get the
+wrong value.
+
+If we also have CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG=y we get a warning
+and backtrace:
+
+ Warning! mmu_has_feature() used prior to jump label init!
+ CPU: 0 PID: 0 Comm: swapper Not tainted 4.11.0-rc4-gccN-next-20170331-g6af2434 #1
+ Call Trace:
+ [c000000000fc3d50] [c000000000a26c30] .dump_stack+0xa8/0xe8 (unreliable)
+ [c000000000fc3de0] [c00000000002e6b8] .setup_initial_memory_limit+0xa4/0x104
+ [c000000000fc3e60] [c000000000d5c23c] .early_init_devtree+0xd0/0x2f8
+ [c000000000fc3f00] [c000000000d5d3b0] .early_setup+0x90/0x11c
+ [c000000000fc3f90] [c000000000000520] start_here_multiplatform+0x68/0x80
+
+Fix it by using early_mmu_has_feature().
+
+Fixes: c12e6f24d413 ("powerpc: Add option to use jump label for mmu_has_feature()")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/tlb_nohash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/mm/tlb_nohash.c
++++ b/arch/powerpc/mm/tlb_nohash.c
+@@ -751,7 +751,7 @@ void setup_initial_memory_limit(phys_add
+ * avoid going over total available memory just in case...
+ */
+ #ifdef CONFIG_PPC_FSL_BOOK3E
+- if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
++ if (early_mmu_has_feature(MMU_FTR_TYPE_FSL_E)) {
+ unsigned long linear_sz;
+ unsigned int num_cams;
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+Date: Wed, 22 Mar 2017 16:27:49 -0300
+Subject: powerpc/xmon: Fix an unexpected xmon on/off state change
+
+From: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+
+
+[ Upstream commit 3b5bf42b81d56085fd58692b5117f69aa77fdff7 ]
+
+Once xmon is triggered by sysrq-x, it is enabled always afterwards even
+if it is disabled during boot. This will cause a system reset interrupt
+fail to dump. So keep xmon in its original state after exit.
+
+We have several ways to set xmon on or off.
+1) by a build config CONFIG_XMON_DEFAULT.
+2) by a boot cmdline with xmon or xmon=early or xmon=on to enable xmon
+and xmon=off to disable xmon. This value will override that in step 1.
+3) by a debugfs interface, as proposed in this patchset.
+And this value can override those in step 1 and 2.
+
+Signed-off-by: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/xmon/xmon.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -74,6 +74,7 @@ static int xmon_gate;
+ #endif /* CONFIG_SMP */
+
+ static unsigned long in_xmon __read_mostly = 0;
++static int xmon_on = IS_ENABLED(CONFIG_XMON_DEFAULT);
+
+ static unsigned long adrs;
+ static int size = 1;
+@@ -3244,6 +3245,8 @@ static void sysrq_handle_xmon(int key)
+ /* ensure xmon is enabled */
+ xmon_init(1);
+ debugger(get_irq_regs());
++ if (!xmon_on)
++ xmon_init(0);
+ }
+
+ static struct sysrq_key_op sysrq_xmon_op = {
+@@ -3260,7 +3263,7 @@ static int __init setup_xmon_sysrq(void)
+ __initcall(setup_xmon_sysrq);
+ #endif /* CONFIG_MAGIC_SYSRQ */
+
+-static int __initdata xmon_early, xmon_off;
++static int __initdata xmon_early;
+
+ static int __init early_parse_xmon(char *p)
+ {
+@@ -3268,10 +3271,12 @@ static int __init early_parse_xmon(char
+ /* just "xmon" is equivalent to "xmon=early" */
+ xmon_init(1);
+ xmon_early = 1;
+- } else if (strncmp(p, "on", 2) == 0)
++ xmon_on = 1;
++ } else if (strncmp(p, "on", 2) == 0) {
+ xmon_init(1);
+- else if (strncmp(p, "off", 3) == 0)
+- xmon_off = 1;
++ xmon_on = 1;
++ } else if (strncmp(p, "off", 3) == 0)
++ xmon_on = 0;
+ else if (strncmp(p, "nobt", 4) == 0)
+ xmon_no_auto_backtrace = 1;
+ else
+@@ -3283,10 +3288,8 @@ early_param("xmon", early_parse_xmon);
+
+ void __init xmon_setup(void)
+ {
+-#ifdef CONFIG_XMON_DEFAULT
+- if (!xmon_off)
++ if (xmon_on)
+ xmon_init(1);
+-#endif
+ if (xmon_early)
+ debugger(NULL);
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Petr Mladek <pmladek@suse.com>
+Date: Fri, 24 Mar 2017 17:14:05 +0100
+Subject: printk: Correctly handle preemption in console_unlock()
+
+From: Petr Mladek <pmladek@suse.com>
+
+
+[ Upstream commit 257ab443118bffc7fdcef38f49cf59be68a3e362 ]
+
+Some console drivers code calls console_conditional_schedule()
+that looks at @console_may_schedule. The value must be cleared
+when the drivers are called from console_unlock() with
+interrupts disabled. But rescheduling is fine when the same
+code is called, for example, from tty operations where the
+console semaphore is taken via console_lock().
+
+This is why @console_may_schedule is cleared before calling console
+drivers. The original value is stored to decide if we could sleep
+between lines.
+
+Now, @console_may_schedule is not cleared when we call
+console_trylock() and jump back to the "again" goto label.
+This has become a problem, since the commit 6b97a20d3a7909daa066
+("printk: set may_schedule for some of console_trylock() callers").
+@console_may_schedule might get enabled now.
+
+There is also the opposite problem. console_lock() can be called
+only from preemptive context. It can always enable scheduling in
+the console code. But console_trylock() is not able to detect it
+when CONFIG_PREEMPT_COUNT is disabled. Therefore we should use the
+original @console_may_schedule value after re-acquiring
+the console semaphore in console_unlock().
+
+This patch solves both problems by moving the "again" goto label.
+
+Alternative solution was to clear and restore the value around
+call_console_drivers(). Then console_conditional_schedule() could
+be used also inside console_unlock(). But there was a potential race
+with console_flush_on_panic() as reported by Sergey Senozhatsky.
+That function should be called only where there is only one CPU
+and with interrupts disabled. But better be on the safe side
+because stopping CPUs might fail.
+
+Fixes: 6b97a20d3a7909 ("printk: set may_schedule for some of console_trylock() callers")
+Link: http://lkml.kernel.org/r/1490372045-22288-1-git-send-email-pmladek@suse.com
+Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: linux-fbdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/printk/printk.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2342,7 +2342,7 @@ void console_unlock(void)
+ }
+
+ /*
+- * Console drivers are called under logbuf_lock, so
++ * Console drivers are called with interrupts disabled, so
+ * @console_may_schedule should be cleared before; however, we may
+ * end up dumping a lot of lines, for example, if called from
+ * console registration path, and should invoke cond_resched()
+@@ -2350,11 +2350,15 @@ void console_unlock(void)
+ * scheduling stall on a slow console leading to RCU stall and
+ * softlockup warnings which exacerbate the issue with more
+ * messages practically incapacitating the system.
++ *
++ * console_trylock() is not able to detect the preemptive
++ * context reliably. Therefore the value must be stored before
++ * and cleared after the the "again" goto label.
+ */
+ do_cond_resched = console_may_schedule;
++again:
+ console_may_schedule = 0;
+
+-again:
+ /*
+ * We released the console_sem lock, so we need to recheck if
+ * cpu is online and (if not) is there at least one CON_ANYTIME
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Axel Lin <axel.lin@ingics.com>
+Date: Tue, 7 Nov 2017 13:18:53 +0800
+Subject: pwm: stmpe: Fix wrong register offset for hwpwm=2 case
+
+From: Axel Lin <axel.lin@ingics.com>
+
+
+[ Upstream commit 8472b529e113e0863ea064fdee51bf73c3f86fd6 ]
+
+Fix trivial copy/paste bug.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Fixes: ef1f09eca74a ("pwm: Add a driver for the STMPE PWM")
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-stmpe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pwm/pwm-stmpe.c
++++ b/drivers/pwm/pwm-stmpe.c
+@@ -145,7 +145,7 @@ static int stmpe_24xx_pwm_config(struct
+ break;
+
+ case 2:
+- offset = STMPE24XX_PWMIC1;
++ offset = STMPE24XX_PWMIC2;
+ break;
+
+ default:
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Laxman Dewangan <ldewangan@nvidia.com>
+Date: Fri, 7 Apr 2017 15:04:00 +0530
+Subject: pwm: tegra: Increase precision in PWM rate calculation
+
+From: Laxman Dewangan <ldewangan@nvidia.com>
+
+
+[ Upstream commit 250b76f43f57d578ebff5e7211eb2c73aa5cd6ca ]
+
+The rate of the PWM calculated as follows:
+
+ hz = NSEC_PER_SEC / period_ns;
+ rate = (rate + (hz / 2)) / hz;
+
+This has the precision loss in lower PWM rate.
+
+Change this to have more precision as:
+
+ hz = DIV_ROUND_CLOSEST_ULL(NSEC_PER_SEC * 100, period_ns);
+ rate = DIV_ROUND_CLOSEST(rate * 100, hz)
+
+Example:
+
+1. period_ns = 16672000, PWM clock rate is 200 KHz.
+
+ Based on old formula
+ hz = NSEC_PER_SEC / period_ns
+ = 1000000000ul/16672000
+ = 59 (59.98)
+ rate = (200K + 59/2)/59 = 3390
+
+ Based on new method:
+ hz = 5998
+ rate = DIV_ROUND_CLOSE(200000*100, 5998) = 3334
+
+ If we measure the PWM signal rate, we will get more accurate
+ period with rate value of 3334 instead of 3390.
+
+2. period_ns = 16803898, PWM clock rate is 200 KHz.
+
+ Based on old formula:
+ hz = 59, rate = 3390
+
+ Based on new formula:
+ hz = 5951, rate = 3360
+
+ The PWM signal rate of 3360 is more near to requested period
+ than 3333.
+
+Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-tegra.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/pwm/pwm-tegra.c
++++ b/drivers/pwm/pwm-tegra.c
+@@ -76,6 +76,7 @@ static int tegra_pwm_config(struct pwm_c
+ struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip);
+ unsigned long long c = duty_ns;
+ unsigned long rate, hz;
++ unsigned long long ns100 = NSEC_PER_SEC;
+ u32 val = 0;
+ int err;
+
+@@ -95,9 +96,11 @@ static int tegra_pwm_config(struct pwm_c
+ * cycles at the PWM clock rate will take period_ns nanoseconds.
+ */
+ rate = clk_get_rate(pc->clk) >> PWM_DUTY_WIDTH;
+- hz = NSEC_PER_SEC / period_ns;
+
+- rate = (rate + (hz / 2)) / hz;
++ /* Consider precision in PWM_SCALE_WIDTH rate calculation */
++ ns100 *= 100;
++ hz = DIV_ROUND_CLOSEST_ULL(ns100, period_ns);
++ rate = DIV_ROUND_CLOSEST(rate * 100, hz);
+
+ /*
+ * Since the actual PWM divider is the register's frequency divider
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+Date: Sun, 19 Mar 2017 13:08:20 +0200
+Subject: qed: Always publish VF link from leading hwfn
+
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+
+
+[ Upstream commit e50728effe1126eae39445ba144078b1305b7047 ]
+
+The link information exists only on the leading hwfn,
+but some of its derivatives [e.g., min/max rate] need to
+be configured for each hwfn.
+When re-basing the VF link view, use the leading hwfn
+information as basis for all existing hwfns to allow
+said configurations to stick.
+
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -3573,6 +3573,7 @@ static int qed_get_vf_config(struct qed_
+
+ void qed_inform_vf_link_state(struct qed_hwfn *hwfn)
+ {
++ struct qed_hwfn *lead_hwfn = QED_LEADING_HWFN(hwfn->cdev);
+ struct qed_mcp_link_capabilities caps;
+ struct qed_mcp_link_params params;
+ struct qed_mcp_link_state link;
+@@ -3589,9 +3590,15 @@ void qed_inform_vf_link_state(struct qed
+ if (!vf_info)
+ continue;
+
+- memcpy(¶ms, qed_mcp_get_link_params(hwfn), sizeof(params));
+- memcpy(&link, qed_mcp_get_link_state(hwfn), sizeof(link));
+- memcpy(&caps, qed_mcp_get_link_capabilities(hwfn),
++ /* Only hwfn0 is actually interested in the link speed.
++ * But since only it would receive an MFW indication of link,
++ * need to take configuration from it - otherwise things like
++ * rate limiting for hwfn1 VF would not work.
++ */
++ memcpy(¶ms, qed_mcp_get_link_params(lead_hwfn),
++ sizeof(params));
++ memcpy(&link, qed_mcp_get_link_state(lead_hwfn), sizeof(link));
++ memcpy(&caps, qed_mcp_get_link_capabilities(lead_hwfn),
+ sizeof(caps));
+
+ /* Modify link according to the VF's configured link state */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+Date: Wed, 5 Apr 2017 21:20:11 +0300
+Subject: qed: Correct MSI-x for storage
+
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+
+
+[ Upstream commit 2f78227874754b1e10cd348fd6e7693b0dabb3f6 ]
+
+When qedr is enabled, qed would try dividing the msi-x vectors between
+L2 and RoCE, starting with L2 and providing it with sufficient vectors
+for its queues.
+
+Problem is qed would also do that for storage partitions, and as those
+don't need queues it would lead qed to award those partitions with 0
+msi-x vectors, causing them to believe theye're using INTa and
+preventing them from operating.
+
+Fixes: 51ff17251c9c ("qed: Add support for RoCE hw init")
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -711,7 +711,8 @@ static int qed_slowpath_setup_int(struct
+ cdev->int_params.fp_msix_cnt = cdev->int_params.out.num_vectors -
+ cdev->num_hwfns;
+
+- if (!IS_ENABLED(CONFIG_QED_RDMA))
++ if (!IS_ENABLED(CONFIG_QED_RDMA) ||
++ QED_LEADING_HWFN(cdev)->hw_info.personality != QED_PCI_ETH_ROCE)
+ return 0;
+
+ for_each_hwfn(cdev, i)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Michal Kalderon <Michal.Kalderon@cavium.com>
+Date: Mon, 3 Apr 2017 12:21:10 +0300
+Subject: qed: Fix TM block ILT allocation
+
+From: Michal Kalderon <Michal.Kalderon@cavium.com>
+
+
+[ Upstream commit 44531ba45dbf3c23cc7ae0934ec9b33ef340ac56 ]
+
+When configuring the HW timers block we should set the number of CIDs
+up until the last CID that require timers, instead of only those CIDs
+whose protocol needs timers support.
+
+Today, the protocols that require HW timers' support have their CIDs
+before any other protocol, but that would change in future [when we
+add iWARP support].
+
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_cxt.c | 32 +++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -271,16 +271,34 @@ struct qed_tm_iids {
+ u32 per_vf_tids;
+ };
+
+-static void qed_cxt_tm_iids(struct qed_cxt_mngr *p_mngr,
++static void qed_cxt_tm_iids(struct qed_hwfn *p_hwfn,
++ struct qed_cxt_mngr *p_mngr,
+ struct qed_tm_iids *iids)
+ {
+- u32 i, j;
+-
+- for (i = 0; i < MAX_CONN_TYPES; i++) {
++ bool tm_vf_required = false;
++ bool tm_required = false;
++ int i, j;
++
++ /* Timers is a special case -> we don't count how many cids require
++ * timers but what's the max cid that will be used by the timer block.
++ * therefore we traverse in reverse order, and once we hit a protocol
++ * that requires the timers memory, we'll sum all the protocols up
++ * to that one.
++ */
++ for (i = MAX_CONN_TYPES - 1; i >= 0; i--) {
+ struct qed_conn_type_cfg *p_cfg = &p_mngr->conn_cfg[i];
+
+- if (tm_cid_proto(i)) {
++ if (tm_cid_proto(i) || tm_required) {
++ if (p_cfg->cid_count)
++ tm_required = true;
++
+ iids->pf_cids += p_cfg->cid_count;
++ }
++
++ if (tm_cid_proto(i) || tm_vf_required) {
++ if (p_cfg->cids_per_vf)
++ tm_vf_required = true;
++
+ iids->per_vf_cids += p_cfg->cids_per_vf;
+ }
+ }
+@@ -696,7 +714,7 @@ int qed_cxt_cfg_ilt_compute(struct qed_h
+
+ /* TM PF */
+ p_cli = &p_mngr->clients[ILT_CLI_TM];
+- qed_cxt_tm_iids(p_mngr, &tm_iids);
++ qed_cxt_tm_iids(p_hwfn, p_mngr, &tm_iids);
+ total = tm_iids.pf_cids + tm_iids.pf_tids_total;
+ if (total) {
+ p_blk = &p_cli->pf_blks[0];
+@@ -1591,7 +1609,7 @@ static void qed_tm_init_pf(struct qed_hw
+ u8 i;
+
+ memset(&tm_iids, 0, sizeof(tm_iids));
+- qed_cxt_tm_iids(p_mngr, &tm_iids);
++ qed_cxt_tm_iids(p_hwfn, p_mngr, &tm_iids);
+
+ /* @@@TBD No pre-scan for now */
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: SeongJae Park <sj38.park@gmail.com>
+Date: Fri, 3 Nov 2017 19:17:20 +0900
+Subject: rcutorture/configinit: Fix build directory error message
+
+From: SeongJae Park <sj38.park@gmail.com>
+
+
+[ Upstream commit 2adfa4210f8f35cdfb4e08318cc06b99752964c2 ]
+
+The 'configinit.sh' script checks the format of optional argument for the
+build directory, printing an error message if the format is not valid.
+However, the error message uses the wrong variable, indicating an empty
+string even though the user entered a non-empty (but erroneous) string.
+This commit fixes the script to use the correct variable.
+
+Fixes: c87b9c601ac8 ("rcutorture: Add KVM-based test framework")
+
+Signed-off-by: SeongJae Park <sj38.park@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/rcutorture/bin/configinit.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/rcutorture/bin/configinit.sh
++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh
+@@ -51,7 +51,7 @@ then
+ mkdir $builddir
+ fi
+ else
+- echo Bad build directory: \"$builddir\"
++ echo Bad build directory: \"$buildloc\"
+ exit 2
+ fi
+ fi
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Matthias Kaehlcke <mka@chromium.org>
+Date: Mon, 27 Mar 2017 16:54:12 -0700
+Subject: regulator: core: Limit propagation of parent voltage count and list
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+
+[ Upstream commit fd086045559d90cd7854818b4c60a7119eda6231 ]
+
+Commit 26988efe11b1 ("regulator: core: Allow to get voltage count and
+list from parent") introduces the propagation of the parent voltage
+count and list for regulators that don't provide this information
+themselves. The goal is to support simple switch regulators, however as
+a side effect normal continuous regulators can leak details of their
+supplies and provide consumers with inconsistent information.
+
+Limit the propagation of the voltage count and list to switch
+regulators.
+
+Fixes: 26988efe11b1 ("regulator: core: Allow to get voltage count and
+ list from parent")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Tested-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/core.c | 9 +++++++--
+ include/linux/regulator/driver.h | 2 ++
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2465,7 +2465,7 @@ static int _regulator_list_voltage(struc
+ ret = ops->list_voltage(rdev, selector);
+ if (lock)
+ mutex_unlock(&rdev->mutex);
+- } else if (rdev->supply) {
++ } else if (rdev->is_switch && rdev->supply) {
+ ret = _regulator_list_voltage(rdev->supply, selector, lock);
+ } else {
+ return -EINVAL;
+@@ -2523,7 +2523,7 @@ int regulator_count_voltages(struct regu
+ if (rdev->desc->n_voltages)
+ return rdev->desc->n_voltages;
+
+- if (!rdev->supply)
++ if (!rdev->is_switch || !rdev->supply)
+ return -EINVAL;
+
+ return regulator_count_voltages(rdev->supply);
+@@ -4049,6 +4049,11 @@ regulator_register(const struct regulato
+ mutex_unlock(®ulator_list_mutex);
+ }
+
++ if (!rdev->desc->ops->get_voltage &&
++ !rdev->desc->ops->list_voltage &&
++ !rdev->desc->fixed_uV)
++ rdev->is_switch = true;
++
+ ret = device_register(&rdev->dev);
+ if (ret != 0) {
+ put_device(&rdev->dev);
+--- a/include/linux/regulator/driver.h
++++ b/include/linux/regulator/driver.h
+@@ -425,6 +425,8 @@ struct regulator_dev {
+ struct regulator_enable_gpio *ena_pin;
+ unsigned int ena_gpio_state:1;
+
++ unsigned int is_switch:1;
++
+ /* time when this regulator was disabled last time */
+ unsigned long last_off_jiffy;
+ };
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Vincent Stehlé" <vincent.stehle@laposte.net>
+Date: Sun, 9 Apr 2017 22:05:05 +0200
+Subject: regulator: isl9305: fix array size
+
+From: "Vincent Stehlé" <vincent.stehle@laposte.net>
+
+
+[ Upstream commit 0c08aaf873174c95e674cf21ffcd041c589d2e5b ]
+
+ISL9305_MAX_REGULATOR is the last index used to access the init_data[]
+array, so we need to add one to this last index to obtain the necessary
+array size.
+
+This fixes the following smatch error:
+
+ drivers/regulator/isl9305.c:160 isl9305_i2c_probe() error: buffer overflow 'pdata->init_data' 3 <= 3
+
+Fixes: dec38b5ce6a9edb4 ("regulator: isl9305: Add Intersil ISL9305/H driver")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Cc: Mark Brown <broonie@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/platform_data/isl9305.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/platform_data/isl9305.h
++++ b/include/linux/platform_data/isl9305.h
+@@ -24,7 +24,7 @@
+ struct regulator_init_data;
+
+ struct isl9305_pdata {
+- struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR];
++ struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR + 1];
+ };
+
+ #endif
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 5 Apr 2017 14:09:48 +0200
+Subject: reiserfs: Make cancel_old_flush() reliable
+
+From: Jan Kara <jack@suse.cz>
+
+
+[ Upstream commit 71b0576bdb862e964a82c73327cdd1a249c53e67 ]
+
+Currently canceling of delayed work that flushes old data using
+cancel_old_flush() does not prevent work from being requeued. Thus
+in theory new work can be queued after cancel_old_flush() from
+reiserfs_freeze() has run. This will become larger problem once
+flush_old_commits() can requeue the work itself.
+
+Fix the problem by recording in sbi->work_queue that flushing work is
+canceled and should not be requeued.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/reiserfs/journal.c | 2 +-
+ fs/reiserfs/reiserfs.h | 1 +
+ fs/reiserfs/super.c | 21 +++++++++++++++------
+ 3 files changed, 17 insertions(+), 7 deletions(-)
+
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -1959,7 +1959,7 @@ static int do_journal_release(struct rei
+ * will be requeued because superblock is being shutdown and doesn't
+ * have MS_ACTIVE set.
+ */
+- cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work);
++ reiserfs_cancel_old_flush(sb);
+ /* wait for all commits to finish */
+ cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work);
+
+--- a/fs/reiserfs/reiserfs.h
++++ b/fs/reiserfs/reiserfs.h
+@@ -2948,6 +2948,7 @@ int reiserfs_allocate_list_bitmaps(struc
+ struct reiserfs_list_bitmap *, unsigned int);
+
+ void reiserfs_schedule_old_flush(struct super_block *s);
++void reiserfs_cancel_old_flush(struct super_block *s);
+ void add_save_link(struct reiserfs_transaction_handle *th,
+ struct inode *inode, int truncate);
+ int remove_save_link(struct inode *inode, int truncate);
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -90,7 +90,9 @@ static void flush_old_commits(struct wor
+ s = sbi->s_journal->j_work_sb;
+
+ spin_lock(&sbi->old_work_lock);
+- sbi->work_queued = 0;
++ /* Avoid clobbering the cancel state... */
++ if (sbi->work_queued == 1)
++ sbi->work_queued = 0;
+ spin_unlock(&sbi->old_work_lock);
+
+ reiserfs_sync_fs(s, 1);
+@@ -117,21 +119,22 @@ void reiserfs_schedule_old_flush(struct
+ spin_unlock(&sbi->old_work_lock);
+ }
+
+-static void cancel_old_flush(struct super_block *s)
++void reiserfs_cancel_old_flush(struct super_block *s)
+ {
+ struct reiserfs_sb_info *sbi = REISERFS_SB(s);
+
+- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work);
+ spin_lock(&sbi->old_work_lock);
+- sbi->work_queued = 0;
++ /* Make sure no new flushes will be queued */
++ sbi->work_queued = 2;
+ spin_unlock(&sbi->old_work_lock);
++ cancel_delayed_work_sync(&REISERFS_SB(s)->old_work);
+ }
+
+ static int reiserfs_freeze(struct super_block *s)
+ {
+ struct reiserfs_transaction_handle th;
+
+- cancel_old_flush(s);
++ reiserfs_cancel_old_flush(s);
+
+ reiserfs_write_lock(s);
+ if (!(s->s_flags & MS_RDONLY)) {
+@@ -152,7 +155,13 @@ static int reiserfs_freeze(struct super_
+
+ static int reiserfs_unfreeze(struct super_block *s)
+ {
++ struct reiserfs_sb_info *sbi = REISERFS_SB(s);
++
+ reiserfs_allow_writes(s);
++ spin_lock(&sbi->old_work_lock);
++ /* Allow old_work to run again */
++ sbi->work_queued = 0;
++ spin_unlock(&sbi->old_work_lock);
+ return 0;
+ }
+
+@@ -2194,7 +2203,7 @@ error_unlocked:
+ if (sbi->commit_wq)
+ destroy_workqueue(sbi->commit_wq);
+
+- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work);
++ reiserfs_cancel_old_flush(s);
+
+ reiserfs_free_bitmap_cache(s);
+ if (SB_BUFFER_WITH_SB(s))
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 23 Mar 2017 15:56:13 +0100
+Subject: rtmutex: Fix PI chain order integrity
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit e0aad5b44ff5d28ac1d6ae70cdf84ca228e889dc ]
+
+rt_mutex_waiter::prio is a copy of task_struct::prio which is updated
+during the PI chain walk, such that the PI chain order isn't messed up
+by (asynchronous) task state updates.
+
+Currently rt_mutex_waiter_less() uses task state for deadline tasks;
+this is broken, since the task state can, as said above, change
+asynchronously, causing the RB tree order to change without actual
+tree update -> FAIL.
+
+Fix this by also copying the deadline into the rt_mutex_waiter state
+and updating it along with its prio field.
+
+Ideally we would also force PI chain updates whenever DL tasks update
+their deadline parameter, but for first approximation this is less
+broken than it was.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: juri.lelli@arm.com
+Cc: bigeasy@linutronix.de
+Cc: xlpang@redhat.com
+Cc: rostedt@goodmis.org
+Cc: mathieu.desnoyers@efficios.com
+Cc: jdesfossez@efficios.com
+Cc: bristot@redhat.com
+Link: http://lkml.kernel.org/r/20170323150216.403992539@infradead.org
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/rtmutex.c | 29 +++++++++++++++++++++++++++--
+ kernel/locking/rtmutex_common.h | 1 +
+ 2 files changed, 28 insertions(+), 2 deletions(-)
+
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -236,8 +236,7 @@ rt_mutex_waiter_less(struct rt_mutex_wai
+ * then right waiter has a dl_prio() too.
+ */
+ if (dl_prio(left->prio))
+- return dl_time_before(left->task->dl.deadline,
+- right->task->dl.deadline);
++ return dl_time_before(left->deadline, right->deadline);
+
+ return 0;
+ }
+@@ -704,7 +703,26 @@ static int rt_mutex_adjust_prio_chain(st
+
+ /* [7] Requeue the waiter in the lock waiter tree. */
+ rt_mutex_dequeue(lock, waiter);
++
++ /*
++ * Update the waiter prio fields now that we're dequeued.
++ *
++ * These values can have changed through either:
++ *
++ * sys_sched_set_scheduler() / sys_sched_setattr()
++ *
++ * or
++ *
++ * DL CBS enforcement advancing the effective deadline.
++ *
++ * Even though pi_waiters also uses these fields, and that tree is only
++ * updated in [11], we can do this here, since we hold [L], which
++ * serializes all pi_waiters access and rb_erase() does not care about
++ * the values of the node being removed.
++ */
+ waiter->prio = task->prio;
++ waiter->deadline = task->dl.deadline;
++
+ rt_mutex_enqueue(lock, waiter);
+
+ /* [8] Release the task */
+@@ -831,6 +849,8 @@ static int rt_mutex_adjust_prio_chain(st
+ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
+ struct rt_mutex_waiter *waiter)
+ {
++ lockdep_assert_held(&lock->wait_lock);
++
+ /*
+ * Before testing whether we can acquire @lock, we set the
+ * RT_MUTEX_HAS_WAITERS bit in @lock->owner. This forces all
+@@ -958,6 +978,8 @@ static int task_blocks_on_rt_mutex(struc
+ struct rt_mutex *next_lock;
+ int chain_walk = 0, res;
+
++ lockdep_assert_held(&lock->wait_lock);
++
+ /*
+ * Early deadlock detection. We really don't want the task to
+ * enqueue on itself just to untangle the mess later. It's not
+@@ -975,6 +997,7 @@ static int task_blocks_on_rt_mutex(struc
+ waiter->task = task;
+ waiter->lock = lock;
+ waiter->prio = task->prio;
++ waiter->deadline = task->dl.deadline;
+
+ /* Get the top priority waiter on the lock */
+ if (rt_mutex_has_waiters(lock))
+@@ -1080,6 +1103,8 @@ static void remove_waiter(struct rt_mute
+ struct task_struct *owner = rt_mutex_owner(lock);
+ struct rt_mutex *next_lock;
+
++ lockdep_assert_held(&lock->wait_lock);
++
+ raw_spin_lock(¤t->pi_lock);
+ rt_mutex_dequeue(lock, waiter);
+ current->pi_blocked_on = NULL;
+--- a/kernel/locking/rtmutex_common.h
++++ b/kernel/locking/rtmutex_common.h
+@@ -33,6 +33,7 @@ struct rt_mutex_waiter {
+ struct rt_mutex *deadlock_lock;
+ #endif
+ int prio;
++ u64 deadline;
+ };
+
+ /*
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 13 Mar 2017 13:36:10 +0100
+Subject: s390/topology: fix typo in early topology code
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+
+[ Upstream commit 4fd4dd8bffb112d1e6549e0ff09e9fa3c8cc2b96 ]
+
+Use MACHINE_FLAG_TOPOLOGY instead of MACHINE_HAS_TOPOLOGY when
+clearing the bit that indicates if the machine provides topology
+information (and if it should be used). Currently works anyway.
+
+Fixes: 68cc795d1933 ("s390/topology: make "topology=off" parameter work")
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/early.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -372,7 +372,7 @@ static int __init topology_setup(char *s
+
+ rc = kstrtobool(str, &enabled);
+ if (!rc && !enabled)
+- S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY;
++ S390_lowcore.machine_flags &= ~MACHINE_FLAG_TOPOLOGY;
+ return rc;
+ }
+ early_param("topology", topology_setup);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Thu, 23 Mar 2017 10:39:40 +0100
+Subject: sched: act_csum: don't mangle TCP and UDP GSO packets
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+
+[ Upstream commit add641e7dee31b36aee83412c29e39dd1f5e0c9c ]
+
+after act_csum computes the checksum on skbs carrying GSO TCP/UDP packets,
+subsequent segmentation fails because skb_needs_check(skb, true) returns
+true. Because of that, skb_warn_bad_offload() is invoked and the following
+message is displayed:
+
+WARNING: CPU: 3 PID: 28 at net/core/dev.c:2553 skb_warn_bad_offload+0xf0/0xfd
+<...>
+
+ [<ffffffff8171f486>] skb_warn_bad_offload+0xf0/0xfd
+ [<ffffffff8161304c>] __skb_gso_segment+0xec/0x110
+ [<ffffffff8161340d>] validate_xmit_skb+0x12d/0x2b0
+ [<ffffffff816135d2>] validate_xmit_skb_list+0x42/0x70
+ [<ffffffff8163c560>] sch_direct_xmit+0xd0/0x1b0
+ [<ffffffff8163c760>] __qdisc_run+0x120/0x270
+ [<ffffffff81613b3d>] __dev_queue_xmit+0x23d/0x690
+ [<ffffffff81613fa0>] dev_queue_xmit+0x10/0x20
+
+Since GSO is able to compute checksum on individual segments of such skbs,
+we can simply skip mangling the packet.
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/act_csum.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -180,6 +180,9 @@ static int tcf_csum_ipv4_tcp(struct sk_b
+ struct tcphdr *tcph;
+ const struct iphdr *iph;
+
++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
++ return 1;
++
+ tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph));
+ if (tcph == NULL)
+ return 0;
+@@ -201,6 +204,9 @@ static int tcf_csum_ipv6_tcp(struct sk_b
+ struct tcphdr *tcph;
+ const struct ipv6hdr *ip6h;
+
++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
++ return 1;
++
+ tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph));
+ if (tcph == NULL)
+ return 0;
+@@ -224,6 +230,9 @@ static int tcf_csum_ipv4_udp(struct sk_b
+ const struct iphdr *iph;
+ u16 ul;
+
++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
++ return 1;
++
+ /*
+ * Support both UDP and UDPLITE checksum algorithms, Don't use
+ * udph->len to get the real length without any protocol check,
+@@ -277,6 +286,9 @@ static int tcf_csum_ipv6_udp(struct sk_b
+ const struct ipv6hdr *ip6h;
+ u16 ul;
+
++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
++ return 1;
++
+ /*
+ * Support both UDP and UDPLITE checksum algorithms, Don't use
+ * udph->len to get the real length without any protocol check,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 13 Oct 2017 16:24:28 -0700
+Subject: sched: Stop resched_cpu() from sending IPIs to offline CPUs
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+
+[ Upstream commit a0982dfa03efca6c239c52cabebcea4afb93ea6b ]
+
+The rcutorture test suite occasionally provokes a splat due to invoking
+resched_cpu() on an offline CPU:
+
+WARNING: CPU: 2 PID: 8 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
+Modules linked in:
+CPU: 2 PID: 8 Comm: rcu_preempt Not tainted 4.14.0-rc4+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+task: ffff902ede9daf00 task.stack: ffff96c50010c000
+RIP: 0010:native_smp_send_reschedule+0x37/0x40
+RSP: 0018:ffff96c50010fdb8 EFLAGS: 00010096
+RAX: 000000000000002e RBX: ffff902edaab4680 RCX: 0000000000000003
+RDX: 0000000080000003 RSI: 0000000000000000 RDI: 00000000ffffffff
+RBP: ffff96c50010fdb8 R08: 0000000000000000 R09: 0000000000000001
+R10: 0000000000000000 R11: 00000000299f36ae R12: 0000000000000001
+R13: ffffffff9de64240 R14: 0000000000000001 R15: ffffffff9de64240
+FS: 0000000000000000(0000) GS:ffff902edfc80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000f7d4c642 CR3: 000000001e0e2000 CR4: 00000000000006e0
+Call Trace:
+ resched_curr+0x8f/0x1c0
+ resched_cpu+0x2c/0x40
+ rcu_implicit_dynticks_qs+0x152/0x220
+ force_qs_rnp+0x147/0x1d0
+ ? sync_rcu_exp_select_cpus+0x450/0x450
+ rcu_gp_kthread+0x5a9/0x950
+ kthread+0x142/0x180
+ ? force_qs_rnp+0x1d0/0x1d0
+ ? kthread_create_on_node+0x40/0x40
+ ret_from_fork+0x27/0x40
+Code: 14 01 0f 92 c0 84 c0 74 14 48 8b 05 14 4f f4 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 38 89 ca 9d e8 e5 56 08 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 52 9e 37 02 85 c0 75 38 55 48
+---[ end trace 26df9e5df4bba4ac ]---
+
+This splat cannot be generated by expedited grace periods because they
+always invoke resched_cpu() on the current CPU, which is good because
+expedited grace periods require that resched_cpu() unconditionally
+succeed. However, other parts of RCU can tolerate resched_cpu() acting
+as a no-op, at least as long as it doesn't happen too often.
+
+This commit therefore makes resched_cpu() invoke resched_curr() only if
+the CPU is either online or is the current CPU.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -508,7 +508,8 @@ void resched_cpu(int cpu)
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&rq->lock, flags);
+- resched_curr(rq);
++ if (cpu_online(cpu) || cpu == smp_processor_id())
++ resched_curr(rq);
+ raw_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 13 Oct 2017 17:00:18 -0700
+Subject: sched: Stop switched_to_rt() from sending IPIs to offline CPUs
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+
+[ Upstream commit 2fe2582649aa2355f79acddb86bd4d6c5363eb63 ]
+
+The rcutorture test suite occasionally provokes a splat due to invoking
+rt_mutex_lock() which needs to boost the priority of a task currently
+sitting on a runqueue that belongs to an offline CPU:
+
+WARNING: CPU: 0 PID: 12 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
+Modules linked in:
+CPU: 0 PID: 12 Comm: rcub/7 Not tainted 4.14.0-rc4+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+task: ffff9ed3de5f8cc0 task.stack: ffffbbf80012c000
+RIP: 0010:native_smp_send_reschedule+0x37/0x40
+RSP: 0018:ffffbbf80012fd10 EFLAGS: 00010082
+RAX: 000000000000002f RBX: ffff9ed3dd9cb300 RCX: 0000000000000004
+RDX: 0000000080000004 RSI: 0000000000000086 RDI: 00000000ffffffff
+RBP: ffffbbf80012fd10 R08: 000000000009da7a R09: 0000000000007b9d
+R10: 0000000000000001 R11: ffffffffbb57c2cd R12: 000000000000000d
+R13: ffff9ed3de5f8cc0 R14: 0000000000000061 R15: ffff9ed3ded59200
+FS: 0000000000000000(0000) GS:ffff9ed3dea00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000080686f0 CR3: 000000001b9e0000 CR4: 00000000000006f0
+Call Trace:
+ resched_curr+0x61/0xd0
+ switched_to_rt+0x8f/0xa0
+ rt_mutex_setprio+0x25c/0x410
+ task_blocks_on_rt_mutex+0x1b3/0x1f0
+ rt_mutex_slowlock+0xa9/0x1e0
+ rt_mutex_lock+0x29/0x30
+ rcu_boost_kthread+0x127/0x3c0
+ kthread+0x104/0x140
+ ? rcu_report_unblock_qs_rnp+0x90/0x90
+ ? kthread_create_on_node+0x40/0x40
+ ret_from_fork+0x22/0x30
+Code: f0 00 0f 92 c0 84 c0 74 14 48 8b 05 34 74 c5 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 a0 c6 fc b9 e8 d5 b5 06 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 a2 d1 13 02 85 c0 75 38 55 48
+
+But the target task's priority has already been adjusted, so the only
+purpose of switched_to_rt() invoking resched_curr() is to wake up the
+CPU running some task that needs to be preempted by the boosted task.
+But the CPU is offline, which presumably means that the task must be
+migrated to some other CPU, and that this other CPU will undertake any
+needed preemption at the time of migration. Because the runqueue lock
+is held when resched_curr() is invoked, we know that the boosted task
+cannot go anywhere, so it is not necessary to invoke resched_curr()
+in this particular case.
+
+This commit therefore makes switched_to_rt() refrain from invoking
+resched_curr() when the target CPU is offline.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/rt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2206,7 +2206,7 @@ static void switched_to_rt(struct rq *rq
+ if (tsk_nr_cpus_allowed(p) > 1 && rq->rt.overloaded)
+ queue_push_tasks(rq);
+ #endif /* CONFIG_SMP */
+- if (p->prio < rq->curr->prio)
++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq)))
+ resched_curr(rq);
+ }
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Date: Fri, 24 Mar 2017 14:11:40 +0530
+Subject: scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait
+
+From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+
+
+[ Upstream commit eb419229be58dc6d4a3a814116a265908e088c39 ]
+
+scsi host12: BS_1377 : mgmt_invalidate_connection Failed for cid=256
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+IP: [<ffffffff81332ebf>] __list_add+0xf/0xc0
+PGD 0
+Oops: 0000 [#1] SMP
+Modules linked in:
+...
+CPU: 9 PID: 1542 Comm: iscsid Tainted: G ------------ T 3.10.0-514.el7.x86_64 #1
+Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 09/12/2016
+task: ffff88076f310fb0 ti: ffff88076bba8000 task.ti: ffff88076bba8000
+RIP: 0010:[<ffffffff81332ebf>] [<ffffffff81332ebf>] __list_add+0xf/0xc0
+RSP: 0018:ffff88076bbab8e8 EFLAGS: 00010046
+RAX: 0000000000000246 RBX: ffff88076bbab990 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff880468badf58 RDI: ffff88076bbab990
+RBP: ffff88076bbab900 R08: 0000000000000246 R09: 00000000000020de
+R10: 0000000000000000 R11: ffff88076bbab5be R12: 0000000000000000
+R13: ffff880468badf58 R14: 000000000001adb0 R15: ffff88076f310fb0
+FS: 00007f377124a880(0000) GS:ffff88046fa40000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000008 CR3: 0000000771318000 CR4: 00000000001407e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Stack:
+ffff88076bbab990 ffff880468badf50 0000000000000001 ffff88076bbab938
+ffffffff810b128b 0000000000000246 00000000cf9b7040 ffff880468bac7a0
+0000000000000000 ffff880468bac7a0 ffff88076bbab9d0 ffffffffa05a6ea3
+
+Call Trace:
+[<ffffffff810b128b>] prepare_to_wait+0x7b/0x90
+[<ffffffffa05a6ea3>] beiscsi_mccq_compl_wait+0x153/0x330 [be2iscsi]
+[<ffffffff810b1600>] ? wake_up_atomic_t+0x30/0x30
+[<ffffffffa05981b1>] beiscsi_ep_disconnect+0x91/0x2d0 [be2iscsi]
+[<ffffffffa0202ffa>] iscsi_if_ep_disconnect.isra.14+0x5a/0x70 [scsi_transport_iscsi]
+[<ffffffffa02042fb>] iscsi_if_recv_msg+0x113b/0x14a0 [scsi_transport_iscsi]
+[<ffffffff811dffd8>] ? __kmalloc_node_track_caller+0x58/0x290
+[<ffffffffa02046ee>] iscsi_if_rx+0x8e/0x1f0 [scsi_transport_iscsi]
+[<ffffffff815a351d>] netlink_unicast+0xed/0x1b0
+[<ffffffff815a38fe>] netlink_sendmsg+0x31e/0x690
+[<ffffffff815a03e4>] ? netlink_rcv_wake+0x44/0x60
+[<ffffffff815a19e3>] ? netlink_recvmsg+0x1e3/0x450
+
+beiscsi_mccq_compl_wait gets called even when MCC tag allocation failed
+for mgmt_invalidate_connection. mcc_wait is not initialized for tag 0
+so causes crash in prepare_to_wait.
+
+Signed-off-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/be2iscsi/be_cmds.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/scsi/be2iscsi/be_cmds.c
++++ b/drivers/scsi/be2iscsi/be_cmds.c
+@@ -246,6 +246,12 @@ int beiscsi_mccq_compl_wait(struct beisc
+ {
+ int rc = 0;
+
++ if (!tag || tag > MAX_MCC_CMD) {
++ __beiscsi_log(phba, KERN_ERR,
++ "BC_%d : invalid tag %u\n", tag);
++ return -EINVAL;
++ }
++
+ if (beiscsi_hba_in_error(phba)) {
+ clear_bit(MCC_TAG_STATE_RUNNING,
+ &phba->ctrl.ptag_state[tag].tag_state);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 4 Dec 2017 10:36:31 -0800
+Subject: scsi: core: scsi_get_device_flags_keyed(): Always return device flags
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+
+[ Upstream commit a44c9d36509c83cf64f33b93f6ab2e63822c01eb ]
+
+Since scsi_get_device_flags_keyed() callers do not check whether or not
+the returned value is an error code, change that function such that it
+returns a flags value even if the 'key' argument is invalid. Note:
+since commit 28a0bc4120d3 ("scsi: sd: Implement blacklist option for
+WRITE SAME w/ UNMAP") bit 31 is a valid device information flag so
+checking whether bit 31 is set in the return value is not sufficient to
+tell the difference between an error code and a flags value.
+
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_devinfo.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -596,17 +596,12 @@ int scsi_get_device_flags_keyed(struct s
+ int key)
+ {
+ struct scsi_dev_info_list *devinfo;
+- int err;
+
+ devinfo = scsi_dev_info_list_find(vendor, model, key);
+ if (!IS_ERR(devinfo))
+ return devinfo->flags;
+
+- err = PTR_ERR(devinfo);
+- if (err != -ENOENT)
+- return err;
+-
+- /* nothing found, return nothing */
++ /* key or device not found: return nothing */
+ if (key != SCSI_DEVINFO_GLOBAL)
+ return 0;
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Date: Fri, 17 Nov 2017 21:31:36 +0100
+Subject: scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
+
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+
+
+[ Upstream commit b369a0471503130cfc74f9f62071db97f48948c3 ]
+
+Commit 56f3d383f37b ("scsi: scsi_devinfo: Add TRY_VPD_PAGES to HITACHI
+OPEN-V blacklist entry") modified some Hitachi entries:
+
+ HITACHI is always supporting VPD pages, even though it's claiming to
+ support SCSI Revision 3 only.
+
+The same should have been done also for HP-rebranded.
+
+[mkp: checkpatch and tweaked commit message]
+
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Takahiro Yasui <takahiro.yasui@hds.com>
+Cc: Matthias Rudolph <Matthias.Rudolph@hitachivantara.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
+Cc: SCSI ML <linux-scsi@vger.kernel.org>
+Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_devinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -180,7 +180,7 @@ static struct {
+ {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */
+- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */
++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */
+ {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN},
+ {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
+ {"HP", "C1557A", NULL, BLIST_FORCELUN},
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Date: Fri, 17 Nov 2017 22:05:13 +0100
+Subject: scsi: dh: add new rdac devices
+
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+
+
+[ Upstream commit 4b3aec2bbbce1c35f50e7475a9fd78d24b9ea4ea ]
+
+Add IBM 3542 and 3552, arrays: FAStT200 and FAStT500.
+
+Add full STK OPENstorage family, arrays: 9176, D173, D178, D210, D220,
+D240 and D280.
+
+Add STK BladeCtlr family, arrays: B210, B220, B240 and B280.
+
+These changes were done in multipath-tools time ago.
+
+Cc: NetApp RDAC team <ng-eseries-upstream-maintainers@netapp.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christophe Varoqui <christophe.varoqui@opensvc.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
+Cc: SCSI ML <linux-scsi@vger.kernel.org>
+Cc: device-mapper development <dm-devel@redhat.com>
+Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_dh.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_d
+ {"IBM", "1815", "rdac", },
+ {"IBM", "1818", "rdac", },
+ {"IBM", "3526", "rdac", },
++ {"IBM", "3542", "rdac", },
++ {"IBM", "3552", "rdac", },
+ {"SGI", "TP9", "rdac", },
+ {"SGI", "IS", "rdac", },
+- {"STK", "OPENstorage D280", "rdac", },
++ {"STK", "OPENstorage", "rdac", },
+ {"STK", "FLEXLINE 380", "rdac", },
++ {"STK", "BladeCtlr", "rdac", },
+ {"SUN", "CSM", "rdac", },
+ {"SUN", "LCSM100", "rdac", },
+ {"SUN", "STK6580_6780", "rdac", },
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Satish Kharat <satishkh@cisco.com>
+Date: Tue, 28 Feb 2017 16:14:56 -0800
+Subject: scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative
+
+From: Satish Kharat <satishkh@cisco.com>
+
+
+[ Upstream commit 7ef539c88d7d394410d547c9f082d477093a2a22 ]
+
+Fixing the IO stats update (Active IOs and IO completion) to prevent
+"Number of Active IOs" from becoming negative in the fnistats output.
+
+Signed-off-by: Satish Kharat <satishkh@cisco.com>
+Signed-off-by: Sesidhar Baddela <sebaddel@cisco.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/fnic/fnic_scsi.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -1127,12 +1127,6 @@ static void fnic_fcpio_itmf_cmpl_handler
+ else
+ CMD_ABTS_STATUS(sc) = hdr_status;
+
+- atomic64_dec(&fnic_stats->io_stats.active_ios);
+- if (atomic64_read(&fnic->io_cmpl_skip))
+- atomic64_dec(&fnic->io_cmpl_skip);
+- else
+- atomic64_inc(&fnic_stats->io_stats.io_completions);
+-
+ if (!(CMD_FLAGS(sc) & (FNIC_IO_ABORTED | FNIC_IO_DONE)))
+ atomic64_inc(&misc_stats->no_icmnd_itmf_cmpls);
+
+@@ -1173,6 +1167,11 @@ static void fnic_fcpio_itmf_cmpl_handler
+ (((u64)CMD_FLAGS(sc) << 32) |
+ CMD_STATE(sc)));
+ sc->scsi_done(sc);
++ atomic64_dec(&fnic_stats->io_stats.active_ios);
++ if (atomic64_read(&fnic->io_cmpl_skip))
++ atomic64_dec(&fnic->io_cmpl_skip);
++ else
++ atomic64_inc(&fnic_stats->io_stats.io_completions);
+ }
+ }
+
+@@ -1962,6 +1961,11 @@ int fnic_abort_cmd(struct scsi_cmnd *sc)
+ /* Call SCSI completion function to complete the IO */
+ sc->result = (DID_ABORT << 16);
+ sc->scsi_done(sc);
++ atomic64_dec(&fnic_stats->io_stats.active_ios);
++ if (atomic64_read(&fnic->io_cmpl_skip))
++ atomic64_dec(&fnic->io_cmpl_skip);
++ else
++ atomic64_inc(&fnic_stats->io_stats.io_completions);
+ }
+
+ fnic_abort_cmd_end:
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Wed, 15 Mar 2017 16:58:36 -0500
+Subject: scsi: ipr: Fix missed EH wakeup
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+
+[ Upstream commit 66a0d59cdd12546ddf01d229de28b07ccf6d637f ]
+
+Following a command abort or device reset, ipr's EH handlers wait for
+the commands getting aborted to get sent back from the adapter prior to
+returning from the EH handler. This fixes up some cases where the
+completion handler was not getting called, which would have resulted in
+the EH thread waiting until it timed out, greatly extending EH time.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Reviewed-by: Wendy Xiong <wenxiong@linux.vnet.ibm.com>
+Tested-by: Wendy Xiong <wenxiong@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ipr.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -836,8 +836,10 @@ static void ipr_sata_eh_done(struct ipr_
+
+ qc->err_mask |= AC_ERR_OTHER;
+ sata_port->ioasa.status |= ATA_BUSY;
+- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ ata_qc_complete(qc);
++ if (ipr_cmd->eh_comp)
++ complete(ipr_cmd->eh_comp);
++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ }
+
+ /**
+@@ -5947,8 +5949,10 @@ static void ipr_erp_done(struct ipr_cmnd
+ res->in_erp = 0;
+ }
+ scsi_dma_unmap(ipr_cmd->scsi_cmd);
+- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ scsi_cmd->scsi_done(scsi_cmd);
++ if (ipr_cmd->eh_comp)
++ complete(ipr_cmd->eh_comp);
++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ }
+
+ /**
+@@ -6338,8 +6342,10 @@ static void ipr_erp_start(struct ipr_ioa
+ }
+
+ scsi_dma_unmap(ipr_cmd->scsi_cmd);
+- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ scsi_cmd->scsi_done(scsi_cmd);
++ if (ipr_cmd->eh_comp)
++ complete(ipr_cmd->eh_comp);
++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ }
+
+ /**
+@@ -6365,8 +6371,10 @@ static void ipr_scsi_done(struct ipr_cmn
+ scsi_dma_unmap(scsi_cmd);
+
+ spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags);
+- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ scsi_cmd->scsi_done(scsi_cmd);
++ if (ipr_cmd->eh_comp)
++ complete(ipr_cmd->eh_comp);
++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
+ spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags);
+ } else {
+ spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Li Dongyang <dongyang.li@anu.edu.au>
+Date: Tue, 14 Nov 2017 10:48:04 +1100
+Subject: scsi: ses: don't ask for diagnostic pages repeatedly during probe
+
+From: Li Dongyang <dongyang.li@anu.edu.au>
+
+
+[ Upstream commit 9c0a50022b8ac7e863e6ec8342fa476fe5d1d75c ]
+
+We are testing if there is a match with the ses device in a loop by
+calling ses_match_to_enclosure(), which will issue scsi receive
+diagnostics commands to the ses device for every device on the same
+host. On one of our boxes with 840 disks, it takes a long time to load
+the driver:
+
+[root@g1b-oss06 ~]# time modprobe ses
+
+real 40m48.247s
+user 0m0.001s
+sys 0m0.196s
+
+With the patch:
+
+[root@g1b-oss06 ~]# time modprobe ses
+
+real 0m17.915s
+user 0m0.008s
+sys 0m0.053s
+
+Note that we still need to refresh page 10 when we see a new disk to
+create the link.
+
+Signed-off-by: Li Dongyang <dongyang.li@anu.edu.au>
+Tested-by: Jason Ozolins <jason.ozolins@hpe.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ses.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -578,13 +578,16 @@ static void ses_enclosure_data_process(s
+ }
+
+ static void ses_match_to_enclosure(struct enclosure_device *edev,
+- struct scsi_device *sdev)
++ struct scsi_device *sdev,
++ int refresh)
+ {
++ struct scsi_device *edev_sdev = to_scsi_device(edev->edev.parent);
+ struct efd efd = {
+ .addr = 0,
+ };
+
+- ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
++ if (refresh)
++ ses_enclosure_data_process(edev, edev_sdev, 0);
+
+ if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent))
+ efd.addr = sas_get_address(sdev);
+@@ -615,7 +618,7 @@ static int ses_intf_add(struct device *c
+ struct enclosure_device *prev = NULL;
+
+ while ((edev = enclosure_find(&sdev->host->shost_gendev, prev)) != NULL) {
+- ses_match_to_enclosure(edev, sdev);
++ ses_match_to_enclosure(edev, sdev, 1);
+ prev = edev;
+ }
+ return -ENODEV;
+@@ -727,7 +730,7 @@ static int ses_intf_add(struct device *c
+ shost_for_each_device(tmp_sdev, sdev->host) {
+ if (tmp_sdev->lun != 0 || scsi_device_enclosure(tmp_sdev))
+ continue;
+- ses_match_to_enclosure(edev, tmp_sdev);
++ ses_match_to_enclosure(edev, tmp_sdev, 0);
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
+Date: Wed, 5 Apr 2017 12:18:19 -0300
+Subject: scsi: ses: don't get power status of SES device slot on probe
+
+From: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
+
+
+[ Upstream commit 75106523f39751390b5789b36ee1d213b3af1945 ]
+
+The commit 08024885a2a3 ("ses: Add power_status to SES device slot")
+introduced the 'power_status' attribute to enclosure components and
+the associated callbacks.
+
+There are 2 callbacks available to get the power status of a device:
+1) ses_get_power_status() for 'struct enclosure_component_callbacks'
+2) get_component_power_status() for the sysfs device attribute
+(these are available for kernel-space and user-space, respectively.)
+
+However, despite both methods being available to get power status
+on demand, that commit also introduced a call to get power status
+in ses_enclosure_data_process().
+
+This dramatically increased the total probe time for SCSI devices
+on larger configurations, because ses_enclosure_data_process() is
+called several times during the SCSI devices probe and loops over
+the component devices (but that is another problem, another patch).
+
+That results in a tremendous continuous hammering of SCSI Receive
+Diagnostics commands to the enclosure-services device, which does
+delay the total probe time for the SCSI devices __significantly__:
+
+ Originally, ~34 minutes on a system attached to ~170 disks:
+
+ [ 9214.490703] mpt3sas version 13.100.00.00 loaded
+ ...
+ [11256.580231] scsi 17:0:177:0: qdepth(16), tagged(1), simple(0),
+ ordered(0), scsi_level(6), cmd_que(1)
+
+ With this patch, it decreased to ~2.5 minutes -- a 13.6x faster
+
+ [ 1002.992533] mpt3sas version 13.100.00.00 loaded
+ ...
+ [ 1151.978831] scsi 11:0:177:0: qdepth(16), tagged(1), simple(0),
+ ordered(0), scsi_level(6), cmd_que(1)
+
+Back to the commit discussion.. on the ses_get_power_status() call
+introduced in ses_enclosure_data_process(): impact of removing it.
+
+That may possibly be in place to initialize the power status value
+on device probe. However, those 2 functions available to retrieve
+that value _do_ automatically refresh/update it. So the potential
+benefit would be a direct access of the 'power_status' field which
+does not use the callbacks...
+
+But the only reader of 'struct enclosure_component::power_status'
+is the get_component_power_status() callback for sysfs attribute,
+and it _does_ check for and call the .get_power_status callback,
+(which indeed is defined and implemented by that commit), so the
+power status value is, again, automatically updated.
+
+So, the remaining potential for a direct/non-callback access to
+the power_status attribute would be out-of-tree modules -- well,
+for those, if they are for whatever reason interested in values
+that are set during device probe and not up-to-date by the time
+they need it.. well, that would be curious.
+
+Well, to handle that more properly, set the initial power state
+value to '-1' (i.e., uninitialized) instead of '1' (power 'on'),
+and check for it in that callback which may do an direct access
+to the field value _if_ a callback function is not defined.
+
+Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
+Fixes: 08024885a2a3 ("ses: Add power_status to SES device slot")
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/enclosure.c | 7 ++++++-
+ drivers/scsi/ses.c | 1 -
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/enclosure.c
++++ b/drivers/misc/enclosure.c
+@@ -148,7 +148,7 @@ enclosure_register(struct device *dev, c
+ for (i = 0; i < components; i++) {
+ edev->component[i].number = -1;
+ edev->component[i].slot = -1;
+- edev->component[i].power_status = 1;
++ edev->component[i].power_status = -1;
+ }
+
+ mutex_lock(&container_list_lock);
+@@ -600,6 +600,11 @@ static ssize_t get_component_power_statu
+
+ if (edev->cb->get_power_status)
+ edev->cb->get_power_status(edev, ecomp);
++
++ /* If still uninitialized, the callback failed or does not exist. */
++ if (ecomp->power_status == -1)
++ return (edev->cb->get_power_status) ? -EIO : -ENOTTY;
++
+ return snprintf(buf, 40, "%s\n", ecomp->power_status ? "on" : "off");
+ }
+
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -548,7 +548,6 @@ static void ses_enclosure_data_process(s
+ ecomp = &edev->component[components++];
+
+ if (!IS_ERR(ecomp)) {
+- ses_get_power_status(edev, ecomp);
+ if (addl_desc_ptr)
+ ses_process_descriptor(
+ ecomp,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Fri, 7 Apr 2017 09:34:15 +0200
+Subject: scsi: sg: check for valid direction before starting the request
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+
+[ Upstream commit 28676d869bbb5257b5f14c0c95ad3af3a7019dd5 ]
+
+Check for a valid direction before starting the request, otherwise we
+risk running into an assertion in the scsi midlayer checking for valid
+requests.
+
+[mkp: fixed typo]
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Link: http://www.spinics.net/lists/linux-scsi/msg104400.html
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Tested-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sg.c | 46 ++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 34 insertions(+), 12 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -663,18 +663,14 @@ sg_write(struct file *filp, const char _
+ * is a non-zero input_size, so emit a warning.
+ */
+ if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
+- static char cmd[TASK_COMM_LEN];
+- if (strcmp(current->comm, cmd)) {
+- printk_ratelimited(KERN_WARNING
+- "sg_write: data in/out %d/%d bytes "
+- "for SCSI command 0x%x-- guessing "
+- "data in;\n program %s not setting "
+- "count and/or reply_len properly\n",
+- old_hdr.reply_len - (int)SZ_SG_HEADER,
+- input_size, (unsigned int) cmnd[0],
+- current->comm);
+- strcpy(cmd, current->comm);
+- }
++ printk_ratelimited(KERN_WARNING
++ "sg_write: data in/out %d/%d bytes "
++ "for SCSI command 0x%x-- guessing "
++ "data in;\n program %s not setting "
++ "count and/or reply_len properly\n",
++ old_hdr.reply_len - (int)SZ_SG_HEADER,
++ input_size, (unsigned int) cmnd[0],
++ current->comm);
+ }
+ k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
+ return (k < 0) ? k : count;
+@@ -753,6 +749,29 @@ sg_new_write(Sg_fd *sfp, struct file *fi
+ return count;
+ }
+
++static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
++{
++ switch (hp->dxfer_direction) {
++ case SG_DXFER_NONE:
++ if (hp->dxferp || hp->dxfer_len > 0)
++ return false;
++ return true;
++ case SG_DXFER_TO_DEV:
++ case SG_DXFER_FROM_DEV:
++ case SG_DXFER_TO_FROM_DEV:
++ if (!hp->dxferp || hp->dxfer_len == 0)
++ return false;
++ return true;
++ case SG_DXFER_UNKNOWN:
++ if ((!hp->dxferp && hp->dxfer_len) ||
++ (hp->dxferp && hp->dxfer_len == 0))
++ return false;
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int
+ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ unsigned char *cmnd, int timeout, int blocking)
+@@ -773,6 +792,9 @@ sg_common_write(Sg_fd * sfp, Sg_request
+ "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
+ (int) cmnd[0], (int) hp->cmd_len));
+
++ if (!sg_is_valid_dxfer(hp))
++ return -EINVAL;
++
+ k = sg_start_req(srp, cmnd);
+ if (k) {
+ SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Hannes Reinecke <hare@suse.de>
+Date: Fri, 7 Apr 2017 09:34:17 +0200
+Subject: scsi: sg: close race condition in sg_remove_sfp_usercontext()
+
+From: Hannes Reinecke <hare@suse.de>
+
+
+[ Upstream commit 97d27b0dd015e980ade63fda111fd1353276e28b ]
+
+sg_remove_sfp_usercontext() is clearing any sg requests, but needs to
+take 'rq_list_lock' when modifying the list.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Tested-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sg.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -524,6 +524,7 @@ sg_read(struct file *filp, char __user *
+ } else
+ count = (old_hdr->result == 0) ? 0 : -EIO;
+ sg_finish_rem_req(srp);
++ sg_remove_request(sfp, srp);
+ retval = count;
+ free_old_hdr:
+ kfree(old_hdr);
+@@ -564,6 +565,7 @@ sg_new_read(Sg_fd * sfp, char __user *bu
+ }
+ err_out:
+ err2 = sg_finish_rem_req(srp);
++ sg_remove_request(sfp, srp);
+ return err ? : err2 ? : count;
+ }
+
+@@ -800,6 +802,7 @@ sg_common_write(Sg_fd * sfp, Sg_request
+ SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
+ "sg_common_write: start_req err=%d\n", k));
+ sg_finish_rem_req(srp);
++ sg_remove_request(sfp, srp);
+ return k; /* probably out of space --> ENOMEM */
+ }
+ if (atomic_read(&sdp->detaching)) {
+@@ -812,6 +815,7 @@ sg_common_write(Sg_fd * sfp, Sg_request
+ }
+
+ sg_finish_rem_req(srp);
++ sg_remove_request(sfp, srp);
+ return -ENODEV;
+ }
+
+@@ -1302,6 +1306,7 @@ sg_rq_end_io_usercontext(struct work_str
+ struct sg_fd *sfp = srp->parentfp;
+
+ sg_finish_rem_req(srp);
++ sg_remove_request(sfp, srp);
+ kref_put(&sfp->f_ref, sg_remove_sfp);
+ }
+
+@@ -1846,8 +1851,6 @@ sg_finish_rem_req(Sg_request *srp)
+ else
+ sg_remove_scat(sfp, req_schp);
+
+- sg_remove_request(sfp, srp);
+-
+ return ret;
+ }
+
+@@ -2194,12 +2197,17 @@ sg_remove_sfp_usercontext(struct work_st
+ struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
+ struct sg_device *sdp = sfp->parentdp;
+ Sg_request *srp;
++ unsigned long iflags;
+
+ /* Cleanup any responses which were never read(). */
++ write_lock_irqsave(&sfp->rq_list_lock, iflags);
+ while (!list_empty(&sfp->rq_list)) {
+ srp = list_first_entry(&sfp->rq_list, Sg_request, entry);
+ sg_finish_rem_req(srp);
++ list_del(&srp->entry);
++ srp->parentfp = NULL;
+ }
++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+
+ if (sfp->reserve.bufflen > 0) {
+ SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Alexander Potapenko <glider@google.com>
+Date: Mon, 6 Mar 2017 19:46:14 +0100
+Subject: selinux: check for address length in selinux_socket_bind()
+
+From: Alexander Potapenko <glider@google.com>
+
+
+[ Upstream commit e2f586bd83177d22072b275edd4b8b872daba924 ]
+
+KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of
+uninitialized memory in selinux_socket_bind():
+
+==================================================================
+BUG: KMSAN: use of unitialized memory
+inter: 0
+CPU: 3 PID: 1074 Comm: packet2 Tainted: G B 4.8.0-rc6+ #1916
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+ 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48
+ ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550
+ 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002
+Call Trace:
+ [< inline >] __dump_stack lib/dump_stack.c:15
+ [<ffffffff825759c8>] dump_stack+0x238/0x290 lib/dump_stack.c:51
+ [<ffffffff818bdee6>] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008
+ [<ffffffff818bf0fb>] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424
+ [<ffffffff822dae71>] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288
+ [<ffffffff8229357c>] security_socket_bind+0x1ec/0x240 security/security.c:1240
+ [<ffffffff84265d98>] SYSC_bind+0x358/0x5f0 net/socket.c:1366
+ [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356
+ [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292
+ [<ffffffff8518217c>] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:?
+chained origin: 00000000ba6009bb
+ [<ffffffff810bb7a7>] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67
+ [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322
+ [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337
+ [<ffffffff818bd2b8>] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530
+ [<ffffffff818bf033>] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380
+ [<ffffffff84265b69>] SYSC_bind+0x129/0x5f0 net/socket.c:1356
+ [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356
+ [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292
+ [<ffffffff8518217c>] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:?
+origin description: ----address@SYSC_bind (origin=00000000b8c00900)
+==================================================================
+
+(the line numbers are relative to 4.8-rc6, but the bug persists upstream)
+
+, when I run the following program as root:
+
+=======================================================
+ #include <string.h>
+ #include <sys/socket.h>
+ #include <netinet/in.h>
+
+ int main(int argc, char *argv[]) {
+ struct sockaddr addr;
+ int size = 0;
+ if (argc > 1) {
+ size = atoi(argv[1]);
+ }
+ memset(&addr, 0, sizeof(addr));
+ int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
+ bind(fd, &addr, size);
+ return 0;
+ }
+=======================================================
+
+(for different values of |size| other error reports are printed).
+
+This happens because bind() unconditionally copies |size| bytes of
+|addr| to the kernel, leaving the rest uninitialized. Then
+security_socket_bind() reads the IP address bytes, including the
+uninitialized ones, to determine the port, or e.g. pass them further to
+sel_netnode_find(), which uses them to calculate a hash.
+
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+[PM: fixed some whitespace damage]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4328,10 +4328,18 @@ static int selinux_socket_bind(struct so
+ u32 sid, node_perm;
+
+ if (family == PF_INET) {
++ if (addrlen < sizeof(struct sockaddr_in)) {
++ err = -EINVAL;
++ goto out;
++ }
+ addr4 = (struct sockaddr_in *)address;
+ snum = ntohs(addr4->sin_port);
+ addrp = (char *)&addr4->sin_addr.s_addr;
+ } else {
++ if (addrlen < SIN6_LEN_RFC2133) {
++ err = -EINVAL;
++ goto out;
++ }
+ addr6 = (struct sockaddr_in6 *)address;
+ snum = ntohs(addr6->sin6_port);
+ addrp = (char *)&addr6->sin6_addr.s6_addr;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+Date: Tue, 4 Apr 2017 11:18:51 +0200
+Subject: serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off
+
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+
+
+[ Upstream commit e61c38d85b7392e033ee03bca46f1d6006156175 ]
+
+If the UART is operated in DTE mode and UCR3_DCD or UCR3_RI are 1 (which
+is the reset default) and the opposite side pulls the respective line to
+its active level the irq triggers after it is requested in .probe.
+
+These irqs were already disabled in .startup but this might be too late.
+
+Also setup of the UFCR_DCEDTE bit (currently done in .set_termios) is
+done very late which is critical as it also controls direction of some
+pins.
+
+So setup UFCR_DCEDTE earlier (in .probe) and also disable the broken
+irqs in DTE mode there before requesting irqs.
+
+Acked-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/imx.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1316,19 +1316,10 @@ static int imx_startup(struct uart_port
+ if (!is_imx1_uart(sport)) {
+ temp = readl(sport->port.membase + UCR3);
+
+- /*
+- * The effect of RI and DCD differs depending on the UFCR_DCEDTE
+- * bit. In DCE mode they control the outputs, in DTE mode they
+- * enable the respective irqs. At least the DCD irq cannot be
+- * cleared on i.MX25 at least, so it's not usable and must be
+- * disabled. I don't have test hardware to check if RI has the
+- * same problem but I consider this likely so it's disabled for
+- * now, too.
+- */
+- temp |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP |
+- UCR3_DTRDEN | UCR3_RI | UCR3_DCD;
++ temp |= UCR3_DTRDEN | UCR3_RI | UCR3_DCD;
+
+ if (sport->dte_mode)
++ /* disable broken interrupts */
+ temp &= ~(UCR3_RI | UCR3_DCD);
+
+ writel(temp, sport->port.membase + UCR3);
+@@ -1583,8 +1574,6 @@ imx_set_termios(struct uart_port *port,
+
+ ufcr = readl(sport->port.membase + UFCR);
+ ufcr = (ufcr & (~UFCR_RFDIV)) | UFCR_RFDIV_REG(div);
+- if (sport->dte_mode)
+- ufcr |= UFCR_DCEDTE;
+ writel(ufcr, sport->port.membase + UFCR);
+
+ writel(num, sport->port.membase + UBIR);
+@@ -2149,6 +2138,27 @@ static int serial_imx_probe(struct platf
+ UCR1_TXMPTYEN | UCR1_RTSDEN);
+ writel_relaxed(reg, sport->port.membase + UCR1);
+
++ if (!is_imx1_uart(sport) && sport->dte_mode) {
++ /*
++ * The DCEDTE bit changes the direction of DSR, DCD, DTR and RI
++ * and influences if UCR3_RI and UCR3_DCD changes the level of RI
++ * and DCD (when they are outputs) or enables the respective
++ * irqs. So set this bit early, i.e. before requesting irqs.
++ */
++ writel(UFCR_DCEDTE, sport->port.membase + UFCR);
++
++ /*
++ * Disable UCR3_RI and UCR3_DCD irqs. They are also not
++ * enabled later because they cannot be cleared
++ * (confirmed on i.MX25) which makes them unusable.
++ */
++ writel(IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP | UCR3_DSR,
++ sport->port.membase + UCR3);
++
++ } else {
++ writel(0, sport->port.membase + UFCR);
++ }
++
+ clk_disable_unprepare(sport->clk_ipg);
+
+ /*
blkcg-fix-double-free-of-new_blkg-in-blkcg_init_queue.patch
+input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch
+perf-stat-issue-a-hw-watchdog-disable-hint.patch
+staging-speakup-replace-bug_on-with-warn_on.patch
+staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch
+hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch
+drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch
+arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch
+arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch
+arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch
+arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch
+arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch
+drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch
+drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch
+ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch
+drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch
+net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch
+pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch
+selinux-check-for-address-length-in-selinux_socket_bind.patch
+x86-mm-make-mmap-map_32bit-work-correctly.patch
+perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch
+x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch
+eventpoll.h-fix-epoll-event-masks.patch
+i40e-acquire-nvm-lock-before-reads-on-all-devices.patch
+i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch
+perf-tools-make-perf_event__synthesize_mmap_events-scale.patch
+arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch
+drivers-net-xgene-fix-hardware-checksum-setting.patch
+drivers-net-phy-xgene-fix-mdio-write.patch
+drivers-net-xgene-fix-wrong-logical-operation.patch
+drivers-net-xgene-fix-rx-checksum-validation-logic.patch
+drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch
+ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch
+ath10k-fix-fetching-channel-during-potential-radar-detection.patch
+usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch
+arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch
+net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch
+netem-apply-correct-delay-when-rate-throttling.patch
+x86-mce-init-some-cpu-features-early.patch
+omapfb-dss-handle-return-errors-in-dss_init_ports.patch
+perf-probe-fix-concat_probe_trace_events.patch
+perf-probe-return-errno-when-not-hitting-any-event.patch
+hid-clamp-input-to-logical-range-if-no-null-state.patch
+net-8021q-create-device-with-all-possible-features-in-wanted_features.patch
+arm-dts-adjust-moxart-irq-controller-and-flags.patch
+qed-always-publish-vf-link-from-leading-hwfn.patch
+s390-topology-fix-typo-in-early-topology-code.patch
+zd1211rw-fix-null-deref-at-probe.patch
+batman-adv-handle-race-condition-for-claims-between-gateways.patch
+of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch
+solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch
+x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch
+scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch
+scsi-ipr-fix-missed-eh-wakeup.patch
+media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch
+timers-sched_clock-update-timeout-for-clock-wrap.patch
+sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch
+input-qt1070-add-of-device-id-table.patch
+sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch
+pci-hv-properly-handle-pci-bus-remove.patch
+pci-hv-lock-pci-bus-on-device-eject.patch
+asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch
+spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch
+tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch
+dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch
+usb-dwc3-make-sure-ux_exit_px-is-cleared.patch
+arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch
+perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch
+perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch
+i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch
+powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch
+scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch
+driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch
+bonding-make-speed-duplex-setting-consistent-with-link-state.patch
+mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch
+alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch
+arm-dts-r8a7794-correct-clock-of-du1.patch
+arm-dts-silk-correct-clock-of-du1.patch
+blk-throttle-make-sure-expire-time-isn-t-too-big.patch
+arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch
+regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch
+perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch
+f2fs-relax-node-version-check-for-victim-data-in-gc.patch
+drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch
+bonding-refine-bond_fold_stats-wrap-detection.patch
+pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch
+powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch
+braille-console-fix-value-returned-by-_braille_console_setup.patch
+drm-vmwgfx-fixes-to-vmwgfx_fb.patch
+vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch
+nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch
+nfc-nfcmrvl-double-free-on-error-path.patch
+nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch
+arm-dts-r7s72100-fix-ethernet-clock-parent.patch
+arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch
+arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch
+arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch
+powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch
+net-hns-correct-hns-rss-key-set-function.patch
+net-faraday-add-missing-include-of-of.h.patch
+qed-fix-tm-block-ilt-allocation.patch
+rtmutex-fix-pi-chain-order-integrity.patch
+printk-correctly-handle-preemption-in-console_unlock.patch
+soc-tegra-fix-link-errors-with-pmc-disabled.patch
+drm-rcar-du-handle-event-when-disabling-crtcs.patch
+arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch
+clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch
+reiserfs-make-cancel_old_flush-reliable.patch
+asoc-rt5677-add-of-device-id-table.patch
+ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch
+alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch
+alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch
+fm10k-correctly-check-if-interface-is-removed.patch
+edac-altera-fix-peripheral-warnings-for-cyclone5.patch
+scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch
+qed-correct-msi-x-for-storage.patch
+apparmor-make-path_max-parameter-readonly.patch
+iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch
+kvm-svm-setup-mcg_cap-on-amd-properly.patch
+kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch
+video-arm-clcd-fix-dma-allocation-size.patch
+drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch
+drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch
+drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch
+i40e-only-register-client-on-iwarp-capable-devices.patch
+coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch
+lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch
+tty-amba-pl011-fix-spurious-tx-interrupts.patch
+serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch
+mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch
+mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch
+mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch
+mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch
+v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch
+v4l-vsp1-register-pipe-with-output-wpf.patch
+regulator-isl9305-fix-array-size.patch
+md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch
+md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch
+powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch
+usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch
+usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch
+perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch
+iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch
+drivers-perf-arm_pmu-handle-no-platform_device.patch
+perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch
+net-fec-add-phy-reset-gpios-probe_defer-check.patch
+perf-session-don-t-rely-on-evlist-in-pipe-mode.patch
+vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch
+vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch
+scsi-sg-check-for-valid-direction-before-starting-the-request.patch
+scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch
+alsa-hda-add-geminilake-id-to-skl_plus.patch
+kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch
+kprobes-x86-set-kprobes-pages-read-only.patch
+pwm-tegra-increase-precision-in-pwm-rate-calculation.patch
+clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch
+bluetooth-avoid-bt_accept_unlink-double-unlinking.patch
+bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch
+mac80211_hwsim-use-per-interface-power-level.patch
+ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch
+wil6210-fix-protection-against-connections-during-reset.patch
+wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch
+perf-stat-fix-bug-in-handling-events-in-error-state.patch
+mwifiex-fix-invalid-port-issue.patch
+drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch
+video-hdmi-allow-empty-hdmi-infoframes.patch
+hid-elo-clear-btn_left-mapping.patch
+iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch
+clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch
+arm-dts-exynos-correct-trats2-panel-reset-line.patch
+sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch
+sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch
+test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch
+net-ieee802154-adf7242-fix-bug-if-defined-debug.patch
+net-xfrm-allow-clearing-socket-xfrm-policies.patch
+mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch
+net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch
+arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch
+arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch
+mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch
+userns-don-t-fail-follow_automount-based-on-s_user_ns.patch
+leds-pm8058-silence-pointer-to-integer-size-warning.patch
+power-supply-ab8500_charger-fix-an-error-handling-path.patch
+power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch
+ath10k-update-tdls-teardown-state-to-target.patch
+dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch
+scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch
+pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch
+clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch
+mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch
+ath10k-fix-invalid-sts_cap_offset_mask.patch
+tools-usbip-fixes-build-with-musl-libc-toolchain.patch
+spi-sun6i-disable-unprepare-clocks-on-remove.patch
+bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch
+scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch
+scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch
+scsi-dh-add-new-rdac-devices.patch
+media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch
+media-cpia2-fix-a-couple-off-by-one-bugs.patch
+veth-set-peer-gso-values.patch
+drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch
+powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch
+agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch
+mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch
+mac80211-remove-bug-when-interface-type-is-invalid.patch
+asoc-nuc900-fix-a-loop-timeout-test.patch
+ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch
+rcutorture-configinit-fix-build-directory-error-message.patch
+locking-locktorture-fix-num-reader-writer-corner-cases.patch
+ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 20 Mar 2017 10:13:06 +0100
+Subject: soc/tegra: Fix link errors with PMC disabled
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit bd737038d555468198495230f4233b9ba92e774c ]
+
+With the new Tegra186 PMC driver merged, anything that relies on the previous
+PMC driver fails to link when that is disabled:
+
+arch/arm/mach-tegra/pm.o: In function `tegra_pm_set':
+pm.c:(.text.tegra_pm_set+0x3c): undefined reference to `tegra_pmc_enter_suspend_mode'
+arch/arm/mach-tegra/pm.o: In function `tegra_suspend_enter':
+pm.c:(.text.tegra_suspend_enter+0x4): undefined reference to `tegra_pmc_get_suspend_mode'
+arch/arm/mach-tegra/pm.o: In function `tegra_init_suspend':
+pm.c:(.init.text+0x1c): undefined reference to `tegra_pmc_get_suspend_mode'
+pm.c:(.init.text+0x74): undefined reference to `tegra_pmc_set_suspend_mode'
+
+ERROR: tegra_powergate_sequence_power_up [drivers/ata/ahci_tegra.ko] undefined!
+ERROR: tegra_powergate_power_off [drivers/ata/ahci_tegra.ko] undefined!
+
+Making the definition depend on the presence of the driver makes it build
+again, though that might not be the correct fix.
+
+Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 854014236290 ("soc/tegra: Implement Tegra186 PMC support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/soc/tegra/pmc.h | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+--- a/include/soc/tegra/pmc.h
++++ b/include/soc/tegra/pmc.h
+@@ -26,12 +26,6 @@
+ struct clk;
+ struct reset_control;
+
+-#ifdef CONFIG_PM_SLEEP
+-enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void);
+-void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode);
+-void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode);
+-#endif /* CONFIG_PM_SLEEP */
+-
+ #ifdef CONFIG_SMP
+ bool tegra_pmc_cpu_is_powered(unsigned int cpuid);
+ int tegra_pmc_cpu_power_on(unsigned int cpuid);
+@@ -108,7 +102,7 @@ int tegra_pmc_cpu_remove_clamping(unsign
+ #define TEGRA_IO_RAIL_LVDS 57
+ #define TEGRA_IO_RAIL_SYS_DDC 58
+
+-#ifdef CONFIG_ARCH_TEGRA
++#ifdef CONFIG_SOC_TEGRA_PMC
+ int tegra_powergate_is_powered(unsigned int id);
+ int tegra_powergate_power_on(unsigned int id);
+ int tegra_powergate_power_off(unsigned int id);
+@@ -120,6 +114,11 @@ int tegra_powergate_sequence_power_up(un
+
+ int tegra_io_rail_power_on(unsigned int id);
+ int tegra_io_rail_power_off(unsigned int id);
++
++enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void);
++void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode);
++void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode);
++
+ #else
+ static inline int tegra_powergate_is_powered(unsigned int id)
+ {
+@@ -157,6 +156,20 @@ static inline int tegra_io_rail_power_of
+ {
+ return -ENOSYS;
+ }
+-#endif /* CONFIG_ARCH_TEGRA */
++
++static inline enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void)
++{
++ return TEGRA_SUSPEND_NONE;
++}
++
++static inline void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode)
++{
++}
++
++static inline void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode)
++{
++}
++
++#endif /* CONFIG_SOC_TEGRA_PMC */
+
+ #endif /* __SOC_TEGRA_PMC_H__ */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Anton Sviridenko <anton@corp.bluecherry.net>
+Date: Thu, 9 Mar 2017 10:46:18 -0300
+Subject: [media] solo6x10: release vb2 buffers in solo_stop_streaming()
+
+From: Anton Sviridenko <anton@corp.bluecherry.net>
+
+
+[ Upstream commit 6e4c8480bd2eb95309ad3c875e11d2cad98f9188 ]
+
+Fixes warning that appears in dmesg after closing V4L2 userspace
+application that plays video from the display device
+(first device from V4L2 device nodes provided by solo, usually /dev/video0
+when no other V4L2 devices are present). Encoder device nodes are not
+affected. Can be reproduced by starting and closing
+
+ffplay -f video4linux2 /dev/video0
+
+[ 8130.281251] ------------[ cut here ]------------
+[ 8130.281256] WARNING: CPU: 1 PID: 20414 at drivers/media/v4l2-core/videobuf2-core.c:1651 __vb2_queue_cancel+0x14b/0x230
+[ 8130.281257] Modules linked in: ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat solo6x10 x86_pkg_temp_thermal vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O)
+[ 8130.281264] CPU: 1 PID: 20414 Comm: ffplay Tainted: G O 4.10.0-gentoo #1
+[ 8130.281264] Hardware name: ASUS All Series/B85M-E, BIOS 2301 03/30/2015
+[ 8130.281265] Call Trace:
+[ 8130.281267] dump_stack+0x4f/0x72
+[ 8130.281270] __warn+0xc7/0xf0
+[ 8130.281271] warn_slowpath_null+0x18/0x20
+[ 8130.281272] __vb2_queue_cancel+0x14b/0x230
+[ 8130.281273] vb2_core_streamoff+0x23/0x90
+[ 8130.281275] vb2_streamoff+0x24/0x50
+[ 8130.281276] vb2_ioctl_streamoff+0x3d/0x50
+[ 8130.281278] v4l_streamoff+0x15/0x20
+[ 8130.281279] __video_do_ioctl+0x25e/0x2f0
+[ 8130.281280] video_usercopy+0x279/0x520
+[ 8130.281282] ? v4l_enum_fmt+0x1330/0x1330
+[ 8130.281285] ? unmap_region+0xdf/0x110
+[ 8130.281285] video_ioctl2+0x10/0x20
+[ 8130.281286] v4l2_ioctl+0xce/0xe0
+[ 8130.281289] do_vfs_ioctl+0x8b/0x5b0
+[ 8130.281290] ? __fget+0x72/0xa0
+[ 8130.281291] SyS_ioctl+0x74/0x80
+[ 8130.281294] entry_SYSCALL_64_fastpath+0x13/0x94
+[ 8130.281295] RIP: 0033:0x7ff86fee6b27
+[ 8130.281296] RSP: 002b:00007ffe467f6a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[ 8130.281297] RAX: ffffffffffffffda RBX: 00000000d1a4d788 RCX: 00007ff86fee6b27
+[ 8130.281297] RDX: 00007ffe467f6a14 RSI: 0000000040045613 RDI: 0000000000000006
+[ 8130.281298] RBP: 000000000373f8d0 R08: 00000000ffffffff R09: 00007ff860001140
+[ 8130.281298] R10: 0000000000000243 R11: 0000000000000246 R12: 0000000000000000
+[ 8130.281299] R13: 00000000000000a0 R14: 00007ffe467f6530 R15: 0000000001f32228
+[ 8130.281300] ---[ end trace 00695dc96be646e7 ]---
+
+Signed-off-by: Anton Sviridenko <anton@corp.bluecherry.net>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-v4l2.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/media/pci/solo6x10/solo6x10-v4l2.c
++++ b/drivers/media/pci/solo6x10/solo6x10-v4l2.c
+@@ -341,6 +341,17 @@ static void solo_stop_streaming(struct v
+ struct solo_dev *solo_dev = vb2_get_drv_priv(q);
+
+ solo_stop_thread(solo_dev);
++
++ spin_lock(&solo_dev->slock);
++ while (!list_empty(&solo_dev->vidq_active)) {
++ struct solo_vb2_buf *buf = list_entry(
++ solo_dev->vidq_active.next,
++ struct solo_vb2_buf, list);
++
++ list_del(&buf->list);
++ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++ }
++ spin_unlock(&solo_dev->slock);
+ INIT_LIST_HEAD(&solo_dev->vidq_active);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Wed, 22 Mar 2017 09:18:26 +0900
+Subject: spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+
+[ Upstream commit 812613591cb652344186c4cd912304ed02138566 ]
+
+When running the spi-loopback-test with slower clock rate like 10 KHz,
+the test for 251 bytes transfer was failed. This failure triggered an
+spi-omap2-mcspi's error message "DMA RX last word empty".
+
+This message means that PIO for reading the remaining bytes due to the
+DMA transfer length reduction is failed. This problem can be fixed by
+polling OMAP2_MCSPI_CHSTAT_RXS bit in channel status register to wait
+until the receive buffer register is filled.
+
+Cc: Mark Brown <broonie@kernel.org>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -454,6 +454,8 @@ omap2_mcspi_rx_dma(struct spi_device *sp
+ int elements = 0;
+ int word_len, element_count;
+ struct omap2_mcspi_cs *cs = spi->controller_state;
++ void __iomem *chstat_reg = cs->base + OMAP2_MCSPI_CHSTAT0;
++
+ mcspi = spi_master_get_devdata(spi->master);
+ mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+ count = xfer->len;
+@@ -549,8 +551,8 @@ omap2_mcspi_rx_dma(struct spi_device *sp
+ if (l & OMAP2_MCSPI_CHCONF_TURBO) {
+ elements--;
+
+- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0)
+- & OMAP2_MCSPI_CHSTAT_RXS)) {
++ if (!mcspi_wait_for_reg_bit(chstat_reg,
++ OMAP2_MCSPI_CHSTAT_RXS)) {
+ u32 w;
+
+ w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0);
+@@ -568,8 +570,7 @@ omap2_mcspi_rx_dma(struct spi_device *sp
+ return count;
+ }
+ }
+- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0)
+- & OMAP2_MCSPI_CHSTAT_RXS)) {
++ if (!mcspi_wait_for_reg_bit(chstat_reg, OMAP2_MCSPI_CHSTAT_RXS)) {
+ u32 w;
+
+ w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Date: Thu, 7 Dec 2017 15:04:53 +0100
+Subject: spi: sun6i: disable/unprepare clocks on remove
+
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+
+
+[ Upstream commit 2d9bbd02c54094ceffa555143b0d68cd06504d63 ]
+
+sun6i_spi_probe() uses sun6i_spi_runtime_resume() to prepare/enable
+clocks, so sun6i_spi_remove() should use sun6i_spi_runtime_suspend() to
+disable/unprepare them if we're not suspended.
+Replacing pm_runtime_disable() by pm_runtime_force_suspend() will ensure
+that sun6i_spi_runtime_suspend() is called if needed.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver)
+Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-sun6i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -464,7 +464,7 @@ err_free_master:
+
+ static int sun6i_spi_remove(struct platform_device *pdev)
+ {
+- pm_runtime_disable(&pdev->dev);
++ pm_runtime_force_suspend(&pdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Varsha Rao <rvarsha016@gmail.com>
+Date: Sat, 25 Feb 2017 17:53:58 +0530
+Subject: staging: speakup: Replace BUG_ON() with WARN_ON().
+
+From: Varsha Rao <rvarsha016@gmail.com>
+
+
+[ Upstream commit d351c2db5420bb17dcd2d9aac7ddb5f64c6d04b3 ]
+
+BUG_ON() is replaced with WARN_ON() and EINVAL is returned, when
+WARN_ON() is true. This fixes the following checkpatch issue:
+
+Avoid crashing the kernel - try using WARN_ON & recovery code rather
+than BUG() or BUG_ON().
+
+Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/speakup/kobjects.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/speakup/kobjects.c
++++ b/drivers/staging/speakup/kobjects.c
+@@ -834,7 +834,9 @@ static ssize_t message_show(struct kobje
+ struct msg_group_t *group = spk_find_msg_group(attr->attr.name);
+ unsigned long flags;
+
+- BUG_ON(!group);
++ if (WARN_ON(!group))
++ return -EINVAL;
++
+ spin_lock_irqsave(&speakup_info.spinlock, flags);
+ retval = message_show_helper(buf, group->start, group->end);
+ spin_unlock_irqrestore(&speakup_info.spinlock, flags);
+@@ -846,7 +848,9 @@ static ssize_t message_store(struct kobj
+ {
+ struct msg_group_t *group = spk_find_msg_group(attr->attr.name);
+
+- BUG_ON(!group);
++ if (WARN_ON(!group))
++ return -EINVAL;
++
+ return message_store_helper(buf, count, group);
+ }
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 28 Feb 2017 11:47:33 +0000
+Subject: staging: wilc1000: add check for kmalloc allocation failure.
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 6cc0c259d034c6ab48f4e12f505213988e73d380 ]
+
+Add a sanity check that wid.val has been allocated, fixes a null
+pointer deference on stamac when calling ether_add_copy.
+
+Detected by CoverityScan, CID#1369537 ("Dereference null return value")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/wilc1000/host_interface.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/wilc1000/host_interface.c
++++ b/drivers/staging/wilc1000/host_interface.c
+@@ -1930,6 +1930,8 @@ static s32 Handle_Get_InActiveTime(struc
+ wid.type = WID_STR;
+ wid.size = ETH_ALEN;
+ wid.val = kmalloc(wid.size, GFP_KERNEL);
++ if (!wid.val)
++ return -ENOMEM;
+
+ stamac = wid.val;
+ memcpy(stamac, strHostIfStaInactiveT->mac, ETH_ALEN);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Tom Hromatka <tom.hromatka@oracle.com>
+Date: Wed, 4 Jan 2017 15:28:04 -0700
+Subject: sysrq: Reset the watchdog timers while displaying high-resolution timers
+
+From: Tom Hromatka <tom.hromatka@oracle.com>
+
+
+[ Upstream commit 0107042768658fea9f5f5a9c00b1c90f5dab6a06 ]
+
+On systems with a large number of CPUs, running sysrq-<q> can cause
+watchdog timeouts. There are two slow sections of code in the sysrq-<q>
+path in timer_list.c.
+
+1. print_active_timers() - This function is called by print_cpu() and
+ contains a slow goto loop. On a machine with hundreds of CPUs, this
+ loop took approximately 100ms for the first CPU in a NUMA node.
+ (Subsequent CPUs in the same node ran much quicker.) The total time
+ to print all of the CPUs is ultimately long enough to trigger the
+ soft lockup watchdog.
+
+2. print_tickdevice() - This function outputs a large amount of textual
+ information. This function also took approximately 100ms per CPU.
+
+Since sysrq-<q> is not a performance critical path, there should be no
+harm in touching the nmi watchdog in both slow sections above. Touching
+it in just one location was insufficient on systems with hundreds of
+CPUs as occasional timeouts were still observed during testing.
+
+This issue was observed on an Oracle T7 machine with 128 CPUs, but I
+anticipate it may affect other systems with similarly large numbers of
+CPUs.
+
+Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
+Reviewed-by: Rob Gardner <rob.gardner@oracle.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/timer_list.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -16,6 +16,7 @@
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <linux/kallsyms.h>
++#include <linux/nmi.h>
+
+ #include <asm/uaccess.h>
+
+@@ -96,6 +97,9 @@ print_active_timers(struct seq_file *m,
+
+ next_one:
+ i = 0;
++
++ touch_nmi_watchdog();
++
+ raw_spin_lock_irqsave(&base->cpu_base->lock, flags);
+
+ curr = timerqueue_getnext(&base->active);
+@@ -207,6 +211,8 @@ print_tickdevice(struct seq_file *m, str
+ {
+ struct clock_event_device *dev = td->evtdev;
+
++ touch_nmi_watchdog();
++
+ SEQ_printf(m, "Tick Device: mode: %d\n", td->mode);
+ if (cpu < 0)
+ SEQ_printf(m, "Broadcast device\n");
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Gao Feng <fgao@ikuai8.com>
+Date: Fri, 24 Mar 2017 07:05:12 +0800
+Subject: tcp: sysctl: Fix a race to avoid unexpected 0 window from space
+
+From: Gao Feng <fgao@ikuai8.com>
+
+
+[ Upstream commit c48367427a39ea0b85c7cf018fe4256627abfd9e ]
+
+Because sysctl_tcp_adv_win_scale could be changed any time, so there
+is one race in tcp_win_from_space.
+For example,
+1.sysctl_tcp_adv_win_scale<=0 (sysctl_tcp_adv_win_scale is negative now)
+2.space>>(-sysctl_tcp_adv_win_scale) (sysctl_tcp_adv_win_scale is postive now)
+
+As a result, tcp_win_from_space returns 0. It is unexpected.
+
+Certainly if the compiler put the sysctl_tcp_adv_win_scale into one
+register firstly, then use the register directly, it would be ok.
+But we could not depend on the compiler behavior.
+
+Signed-off-by: Gao Feng <fgao@ikuai8.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/tcp.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1265,9 +1265,11 @@ void tcp_select_initial_window(int __spa
+
+ static inline int tcp_win_from_space(int space)
+ {
+- return sysctl_tcp_adv_win_scale<=0 ?
+- (space>>(-sysctl_tcp_adv_win_scale)) :
+- space - (space>>sysctl_tcp_adv_win_scale);
++ int tcp_adv_win_scale = sysctl_tcp_adv_win_scale;
++
++ return tcp_adv_win_scale <= 0 ?
++ (space>>(-tcp_adv_win_scale)) :
++ space - (space>>tcp_adv_win_scale);
+ }
+
+ /* Note: caller must be prepared to deal with negative returns */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Mon, 20 Nov 2017 09:45:35 -0800
+Subject: test_firmware: fix setting old custom fw path back on exit
+
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+
+
+[ Upstream commit 65c79230576873b312c3599479c1e42355c9f349 ]
+
+The file /sys/module/firmware_class/parameters/path can be used
+to set a custom firmware path. The fw_filesystem.sh script creates
+a temporary directory to add a test firmware file to be used during
+testing, in order for this to work it uses the custom path syfs file
+and it was supposed to reset back the file on execution exit. The
+script failed to do this due to a typo, it was using OLD_PATH instead
+of OLD_FWPATH, since its inception since v3.17.
+
+Its not as easy to just keep the old setting, it turns out that
+resetting an empty setting won't actually do what we want, we need
+to check if it was empty and set an empty space.
+
+Without this we end up having the temporary path always set after
+we run these tests.
+
+Fixes: 0a8adf58475 ("test: add firmware_class loader test")
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/firmware/fw_filesystem.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/firmware/fw_filesystem.sh
++++ b/tools/testing/selftests/firmware/fw_filesystem.sh
+@@ -28,7 +28,10 @@ test_finish()
+ if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+ echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
+ fi
+- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path
++ if [ "$OLD_FWPATH" = "" ]; then
++ OLD_FWPATH=" "
++ fi
++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+ rm -f "$FW"
+ rmdir "$FWPATH"
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: David Engraf <david.engraf@sysgo.com>
+Date: Fri, 17 Feb 2017 08:51:03 +0100
+Subject: timers, sched_clock: Update timeout for clock wrap
+
+From: David Engraf <david.engraf@sysgo.com>
+
+
+[ Upstream commit 1b8955bc5ac575009835e371ae55e7f3af2197a9 ]
+
+The scheduler clock framework may not use the correct timeout for the clock
+wrap. This happens when a new clock driver calls sched_clock_register()
+after the kernel called sched_clock_postinit(). In this case the clock wrap
+timeout is too long thus sched_clock_poll() is called too late and the clock
+already wrapped.
+
+On my ARM system the scheduler was no longer scheduling any other task than
+the idle task because the sched_clock() wrapped.
+
+Signed-off-by: David Engraf <david.engraf@sysgo.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/sched_clock.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/time/sched_clock.c
++++ b/kernel/time/sched_clock.c
+@@ -205,6 +205,11 @@ sched_clock_register(u64 (*read)(void),
+
+ update_clock_read_data(&rd);
+
++ if (sched_clock_timer.function != NULL) {
++ /* update timeout for clock wrap */
++ hrtimer_start(&sched_clock_timer, cd.wrap_kt, HRTIMER_MODE_REL);
++ }
++
+ r = rate;
+ if (r >= 4000000) {
+ r /= 1000000;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+Date: Tue, 5 Dec 2017 18:48:14 +0100
+Subject: tools/usbip: fixes build with musl libc toolchain
+
+From: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+
+
+[ Upstream commit 77be4c878c72e411ad22af96b6f81dd45c26450a ]
+
+Indeed musl doesn't define old SIGCLD signal name but only new one SIGCHLD.
+SIGCHLD is the new POSIX name for that signal so it doesn't change
+anything on other libcs.
+
+This fixes this kind of build error:
+
+usbipd.c: In function ‘set_signal’:
+usbipd.c:459:12: error: 'SIGCLD' undeclared (first use in this function)
+ sigaction(SIGCLD, &act, NULL);
+ ^~~~~~
+usbipd.c:459:12: note: each undeclared identifier is reported only once
+ for each function it appears in
+Makefile:407: recipe for target 'usbipd.o' failed
+make[3]: *** [usbipd.o] Error 1
+
+Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/usb/usbip/src/usbipd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/usb/usbip/src/usbipd.c
++++ b/tools/usb/usbip/src/usbipd.c
+@@ -463,7 +463,7 @@ static void set_signal(void)
+ sigaction(SIGTERM, &act, NULL);
+ sigaction(SIGINT, &act, NULL);
+ act.sa_handler = SIG_IGN;
+- sigaction(SIGCLD, &act, NULL);
++ sigaction(SIGCHLD, &act, NULL);
+ }
+
+ static const char *pid_file;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Jayachandran C <jnair@caviumnetworks.com>
+Date: Sat, 1 Apr 2017 19:42:09 +0000
+Subject: tty: amba-pl011: Fix spurious TX interrupts
+
+From: Jayachandran C <jnair@caviumnetworks.com>
+
+
+[ Upstream commit 7d05587c9e0e4611650bb403812e2d492c178a9f ]
+
+On SMP systems, we see a lot of spurious TX interrupts when a
+program generates a steady stream of output to the pl011 UART.
+
+The problem can be easily seen when one CPU generates the output
+while another CPU handles the pl011 interrupts, and the rate of
+output is low enough not to fill the TX FIFO. The problem seems
+to be:
+
+ -- CPU a -- -- CPU b --
+ (take port lock)
+ pl011_start_tx
+ pl011_start_tx_pio
+ enable TXIM in REG_IMSC -> causes uart tx intr (pl011_int)
+ pl011_tx_chars pl011_int
+ ...tx chars, all done... (wait for port lock)
+ pl011_stop_tx .
+ disable TXIM .
+ (release port lock) -> (take port lock)
+ check for TXIM, not enabled
+ (release port lock)
+ return IRQ_NONE
+
+Enabling the TXIM in pl011_start_tx_pio() causes the interrupt
+to be generated and delivered to CPU b, even though pl011_tx_chars()
+is able to complete the TX and then disable the tx interrupt.
+
+Fix this by enabling TXIM only after pl011_tx_chars, if it is needed.
+pl011_tx_chars will return a boolean indicating whether the TX
+interrupts have to be enabled.
+
+Debugged-by: Vijaya Kumar <Vijaya.Kumar@cavium.com>
+Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1302,14 +1302,15 @@ static void pl011_stop_tx(struct uart_po
+ pl011_dma_tx_stop(uap);
+ }
+
+-static void pl011_tx_chars(struct uart_amba_port *uap, bool from_irq);
++static bool pl011_tx_chars(struct uart_amba_port *uap, bool from_irq);
+
+ /* Start TX with programmed I/O only (no DMA) */
+ static void pl011_start_tx_pio(struct uart_amba_port *uap)
+ {
+- uap->im |= UART011_TXIM;
+- pl011_write(uap->im, uap, REG_IMSC);
+- pl011_tx_chars(uap, false);
++ if (pl011_tx_chars(uap, false)) {
++ uap->im |= UART011_TXIM;
++ pl011_write(uap->im, uap, REG_IMSC);
++ }
+ }
+
+ static void pl011_start_tx(struct uart_port *port)
+@@ -1389,25 +1390,26 @@ static bool pl011_tx_char(struct uart_am
+ return true;
+ }
+
+-static void pl011_tx_chars(struct uart_amba_port *uap, bool from_irq)
++/* Returns true if tx interrupts have to be (kept) enabled */
++static bool pl011_tx_chars(struct uart_amba_port *uap, bool from_irq)
+ {
+ struct circ_buf *xmit = &uap->port.state->xmit;
+ int count = uap->fifosize >> 1;
+
+ if (uap->port.x_char) {
+ if (!pl011_tx_char(uap, uap->port.x_char, from_irq))
+- return;
++ return true;
+ uap->port.x_char = 0;
+ --count;
+ }
+ if (uart_circ_empty(xmit) || uart_tx_stopped(&uap->port)) {
+ pl011_stop_tx(&uap->port);
+- return;
++ return false;
+ }
+
+ /* If we are using DMA mode, try to send some characters. */
+ if (pl011_dma_tx_irq(uap))
+- return;
++ return true;
+
+ do {
+ if (likely(from_irq) && count-- == 0)
+@@ -1422,8 +1424,11 @@ static void pl011_tx_chars(struct uart_a
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(&uap->port);
+
+- if (uart_circ_empty(xmit))
++ if (uart_circ_empty(xmit)) {
+ pl011_stop_tx(&uap->port);
++ return false;
++ }
++ return true;
+ }
+
+ static void pl011_modem_status(struct uart_amba_port *uap)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: John Stultz <john.stultz@linaro.org>
+Date: Mon, 13 Feb 2017 20:08:08 -0800
+Subject: usb: dwc2: Make sure we disconnect the gadget state
+
+From: John Stultz <john.stultz@linaro.org>
+
+
+[ Upstream commit dad3f793f20fbb5c0c342f0f5a0bdf69a4d76089 ]
+
+I had seen some odd behavior with HiKey's usb-gadget interface
+that I finally seemed to have chased down. Basically every other
+time I plugged in the OTG port, the gadget interface would
+properly initialize. The other times, I'd get a big WARN_ON
+in dwc2_hsotg_init_fifo() about the fifo_map not being clear.
+
+Ends up if we don't disconnect the gadget state, the fifo-map
+doesn't get cleared properly, which causes WARN_ON messages and
+also results in the device not properly being setup as a gadget
+every other time the OTG port is connected.
+
+So this patch adds a call to dwc2_hsotg_disconnect() in the
+reset path so the state is properly cleared.
+
+With it, the gadget interface initializes properly on every
+plug in.
+
+Cc: Wei Xu <xuwei5@hisilicon.com>
+Cc: Guodong Xu <guodong.xu@linaro.org>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: John Youn <johnyoun@synopsys.com>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Chen Yu <chenyu56@huawei.com>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: linux-usb@vger.kernel.org
+Acked-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -3220,6 +3220,7 @@ static void dwc2_conn_id_status_change(s
+ dwc2_core_init(hsotg, false);
+ dwc2_enable_global_interrupts(hsotg);
+ spin_lock_irqsave(&hsotg->lock, flags);
++ dwc2_hsotg_disconnect(hsotg);
+ dwc2_hsotg_core_init_disconnected(hsotg, false);
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+ dwc2_hsotg_core_connect(hsotg);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Wed, 3 Aug 2016 14:16:15 +0300
+Subject: usb: dwc3: make sure UX_EXIT_PX is cleared
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+
+[ Upstream commit 1966b8657d058ecb95031809b607bf3fd1e01c10 ]
+
+This bit is only supposed to be used with known
+buggy PHYs, however some platforms might erroneously
+set it. In order to avoid it, let's make sure this
+bit is always cleared. If some PHY needs this, we
+will need to add a quirk flag.
+
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 6 ++++++
+ drivers/usb/dwc3/core.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -464,6 +464,12 @@ static int dwc3_phy_setup(struct dwc3 *d
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
+
+ /*
++ * Make sure UX_EXIT_PX is cleared as that causes issues with some
++ * PHYs. Also, this bit is not supposed to be used in normal operation.
++ */
++ reg &= ~DWC3_GUSB3PIPECTL_UX_EXIT_PX;
++
++ /*
+ * Above 1.94a, it is recommended to set DWC3_GUSB3PIPECTL_SUSPHY
+ * to '0' during coreConsultant configuration. So default value
+ * will be '0' when the core is reset. Application needs to set it
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -223,6 +223,7 @@
+ #define DWC3_GUSB3PIPECTL_PHYSOFTRST (1 << 31)
+ #define DWC3_GUSB3PIPECTL_U2SSINP3OK (1 << 29)
+ #define DWC3_GUSB3PIPECTL_DISRXDETINP3 (1 << 28)
++#define DWC3_GUSB3PIPECTL_UX_EXIT_PX (1 << 27)
+ #define DWC3_GUSB3PIPECTL_REQP1P2P3 (1 << 24)
+ #define DWC3_GUSB3PIPECTL_DEP1P2P3(n) ((n) << 19)
+ #define DWC3_GUSB3PIPECTL_DEP1P2P3_MASK DWC3_GUSB3PIPECTL_DEP1P2P3(7)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Yuyang Du <yuyang.du@intel.com>
+Date: Fri, 24 Mar 2017 04:06:11 +0800
+Subject: usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()
+
+From: Yuyang Du <yuyang.du@intel.com>
+
+
+[ Upstream commit 9f20dfb44d03745d0d3cef2ffb3abf8d8024fa61 ]
+
+This fixes the commit: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add
+SuperSpeed support").
+
+In the case of ClearPortFeature and USB_PORT_FEAT_POWER, simply clear
+the right bit regardless of what the wValue is.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Yuyang Du <yuyang.du@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/dummy_hcd.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -2103,16 +2103,13 @@ static int dummy_hub_control(
+ }
+ break;
+ case USB_PORT_FEAT_POWER:
+- if (hcd->speed == HCD_USB3) {
+- if (dum_hcd->port_status & USB_PORT_STAT_POWER)
+- dev_dbg(dummy_dev(dum_hcd),
+- "power-off\n");
+- } else
+- if (dum_hcd->port_status &
+- USB_SS_PORT_STAT_POWER)
+- dev_dbg(dummy_dev(dum_hcd),
+- "power-off\n");
+- /* FALLS THROUGH */
++ dev_dbg(dummy_dev(dum_hcd), "power-off\n");
++ if (hcd->speed == HCD_USB3)
++ dum_hcd->port_status &= ~USB_SS_PORT_STAT_POWER;
++ else
++ dum_hcd->port_status &= ~USB_PORT_STAT_POWER;
++ set_link_state(dum_hcd);
++ break;
+ default:
+ dum_hcd->port_status &= ~(1 << wValue);
+ set_link_state(dum_hcd);
+@@ -2283,14 +2280,13 @@ static int dummy_hub_control(
+ if ((dum_hcd->port_status &
+ USB_SS_PORT_STAT_POWER) != 0) {
+ dum_hcd->port_status |= (1 << wValue);
+- set_link_state(dum_hcd);
+ }
+ } else
+ if ((dum_hcd->port_status &
+ USB_PORT_STAT_POWER) != 0) {
+ dum_hcd->port_status |= (1 << wValue);
+- set_link_state(dum_hcd);
+ }
++ set_link_state(dum_hcd);
+ }
+ break;
+ case GetPortErrorCount:
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Oliver Neukum <oneukum@suse.com>
+Date: Tue, 14 Mar 2017 12:05:07 +0100
+Subject: usb: misc: lvs: fix race condition in disconnect handling
+
+From: Oliver Neukum <oneukum@suse.com>
+
+
+[ Upstream commit c4ba329cabca7c839ab48fb58b5bcc2582951a48 ]
+
+There is a small window during which the an URB may
+remain active after disconnect has returned. If in that case
+already freed memory may be accessed and executed.
+
+The fix is to poison the URB befotre the work is flushed.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/lvstest.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/misc/lvstest.c
++++ b/drivers/usb/misc/lvstest.c
+@@ -433,6 +433,7 @@ static void lvs_rh_disconnect(struct usb
+ struct lvs_rh *lvs = usb_get_intfdata(intf);
+
+ sysfs_remove_group(&intf->dev.kobj, &lvs_attr_group);
++ usb_poison_urb(lvs->urb); /* used in scheduled work */
+ flush_work(&lvs->rh_work);
+ usb_free_urb(lvs->urb);
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 29 Nov 2017 17:29:20 -0600
+Subject: userns: Don't fail follow_automount based on s_user_ns
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+
+[ Upstream commit bbc3e471011417598e598707486f5d8814ec9c01 ]
+
+When vfs_submount was added the test to limit automounts from
+filesystems that with s_user_ns != &init_user_ns accidentially left
+in follow_automount. The test was never about any security concerns
+and was always about how do we implement this for filesystems whose
+s_user_ns != &init_user_ns.
+
+At the moment this check makes no difference as there are no
+filesystems that both set FS_USERNS_MOUNT and implement d_automount.
+
+Remove this check now while I am thinking about it so there will not
+be odd booby traps for someone who does want to make this combination
+work.
+
+vfs_submount still needs improvements to allow this combination to work,
+and vfs_submount contains a check that presents a warning.
+
+The autofs4 filesystem could be modified to set FS_USERNS_MOUNT and it would
+need not work on this code path, as userspace performs the mounts.
+
+Fixes: 93faccbbfa95 ("fs: Better permission checking for submounts")
+Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds")
+Acked-by: Ian Kent <raven@themaw.net>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/namei.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1121,9 +1121,6 @@ static int follow_automount(struct path
+ path->dentry->d_inode)
+ return -EISDIR;
+
+- if (path->dentry->d_sb->s_user_ns != &init_user_ns)
+- return -EACCES;
+-
+ nd->total_link_count++;
+ if (nd->total_link_count >= 40)
+ return -ELOOP;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Date: Fri, 6 Jan 2017 10:15:28 -0200
+Subject: [media] v4l: vsp1: Prevent multiple streamon race commencing pipeline early
+
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+
+
+[ Upstream commit 4461c84b52b4a952c657505ef7e4e06b016783df ]
+
+With multiple inputs through the BRU it is feasible for the streams to
+race each other at stream-on.
+
+Multiple VIDIOC_STREAMON calls racing each other could have process
+N-1 skipping over the pipeline setup section and then start the pipeline
+early, if videobuf2 has already enqueued buffers to the driver for
+process N but not called the .start_streaming() operation yet
+
+In the case of the video pipelines, this
+can present two serious issues.
+
+ 1) A null-dereference if the pipe->dl is committed at the same time as
+ the vsp1_video_setup_pipeline() is processing
+
+ 2) A hardware hang, where a display list is committed without having
+ called vsp1_video_setup_pipeline() first
+
+Repair this issue, by ensuring that only the stream which configures the
+pipeline is able to start it.
+
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vsp1/vsp1_video.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/media/platform/vsp1/vsp1_video.c
++++ b/drivers/media/platform/vsp1/vsp1_video.c
+@@ -792,6 +792,7 @@ static int vsp1_video_start_streaming(st
+ {
+ struct vsp1_video *video = vb2_get_drv_priv(vq);
+ struct vsp1_pipeline *pipe = video->rwpf->pipe;
++ bool start_pipeline = false;
+ unsigned long flags;
+ int ret;
+
+@@ -802,11 +803,23 @@ static int vsp1_video_start_streaming(st
+ mutex_unlock(&pipe->lock);
+ return ret;
+ }
++
++ start_pipeline = true;
+ }
+
+ pipe->stream_count++;
+ mutex_unlock(&pipe->lock);
+
++ /*
++ * vsp1_pipeline_ready() is not sufficient to establish that all streams
++ * are prepared and the pipeline is configured, as multiple streams
++ * can race through streamon with buffers already queued; Therefore we
++ * don't even attempt to start the pipeline until the last stream has
++ * called through here.
++ */
++ if (!start_pipeline)
++ return 0;
++
+ spin_lock_irqsave(&pipe->irqlock, flags);
+ if (vsp1_pipeline_ready(pipe))
+ vsp1_video_pipeline_run(pipe);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Date: Mon, 27 Feb 2017 10:40:34 -0300
+Subject: [media] v4l: vsp1: Register pipe with output WPF
+
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+
+
+[ Upstream commit 1531a208ed861e4bd287444f9466ffcf98383de2 ]
+
+The DRM object does not register the pipe with the WPF object. This is
+used internally throughout the driver as a means of accessing the pipe.
+As such this breaks operations which require access to the pipe from WPF
+interrupts.
+
+Register the pipe inside the WPF object after it has been declared as
+the output.
+
+Fixes: ff7e97c94d9f ("[media] v4l: vsp1: Store pipeline pointer in rwpf")
+
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vsp1/vsp1_drm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -596,6 +596,7 @@ int vsp1_drm_init(struct vsp1_device *vs
+ pipe->bru = &vsp1->bru->entity;
+ pipe->lif = &vsp1->lif->entity;
+ pipe->output = vsp1->wpf[0];
++ pipe->output->pipe = pipe;
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Thu, 7 Dec 2017 15:40:20 -0800
+Subject: veth: set peer GSO values
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+
+[ Upstream commit 72d24955b44a4039db54a1c252b5031969eeaac3 ]
+
+When new veth is created, and GSO values have been configured
+on one device, clone those values to the peer.
+
+For example:
+ # ip link add dev vm1 gso_max_size 65530 type veth peer name vm2
+
+This should create vm1 <--> vm2 with both having GSO maximum
+size set to 65530.
+
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/veth.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -425,6 +425,9 @@ static int veth_newlink(struct net *src_
+ if (ifmp && (dev->ifindex != 0))
+ peer->ifindex = ifmp->ifi_index;
+
++ peer->gso_max_size = dev->gso_max_size;
++ peer->gso_max_segs = dev->gso_max_segs;
++
+ err = register_netdevice(peer);
+ put_net(net);
+ net = NULL;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Fri, 24 Mar 2017 17:44:06 +1100
+Subject: vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+
+[ Upstream commit 1282ba7fc28dbc66c3f0e4aaafaaa228361d1ae5 ]
+
+The existing SPAPR TCE driver advertises both VFIO_SPAPR_TCE_IOMMU and
+VFIO_SPAPR_TCE_v2_IOMMU types to the userspace and the userspace usually
+picks the v2.
+
+Normally the userspace would create a container, attach an IOMMU group
+to it and only then set the IOMMU type (which would normally be v2).
+
+However a specific IOMMU group may not support v2, in other words
+it may not implement set_window/unset_window/take_ownership/
+release_ownership and such a group should not be attached to
+a v2 container.
+
+This adds extra checks that a new group can do what the selected IOMMU
+type suggests. The userspace can then test the return value from
+ioctl(VFIO_SET_IOMMU, VFIO_SPAPR_TCE_v2_IOMMU) and try
+VFIO_SPAPR_TCE_IOMMU.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -1332,8 +1332,16 @@ static int tce_iommu_attach_group(void *
+
+ if (!table_group->ops || !table_group->ops->take_ownership ||
+ !table_group->ops->release_ownership) {
++ if (container->v2) {
++ ret = -EPERM;
++ goto unlock_exit;
++ }
+ ret = tce_iommu_take_ownership(container, table_group);
+ } else {
++ if (!container->v2) {
++ ret = -EPERM;
++ goto unlock_exit;
++ }
+ ret = tce_iommu_take_ownership_ddw(container, table_group);
+ if (!tce_groups_attached(container) && !container->tables[0])
+ container->def_window_pending = true;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Mon, 27 Mar 2017 14:23:40 +1100
+Subject: vfio/spapr_tce: Check kzalloc() return when preregistering memory
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+
+[ Upstream commit 3393af24b665cb0aea7353b05e522b03ab1e7d73 ]
+
+This adds missing checking for kzalloc() return value.
+
+Fixes: 4b6fad7097f8 ("powerpc/mm/iommu, vfio/spapr: Put pages on VFIO container shutdown")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -195,6 +195,11 @@ static long tce_iommu_register_pages(str
+ return ret;
+
+ tcemem = kzalloc(sizeof(*tcemem), GFP_KERNEL);
++ if (!tcemem) {
++ mm_iommu_put(container->mm, mem);
++ return -ENOMEM;
++ }
++
+ tcemem->mem = mem;
+ list_add(&tcemem->next, &container->prereg_list);
+
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Liam Beguin <lbeguin@tycoint.com>
+Date: Fri, 7 Apr 2017 17:03:24 +0200
+Subject: video: ARM CLCD: fix dma allocation size
+
+From: Liam Beguin <lbeguin@tycoint.com>
+
+
+[ Upstream commit 9a1c779e6b06855e41099caa6f15b3b584dfa88c ]
+
+This patch forces the frambuffer size to be aligned on kernel pages.
+
+During the board startup, the splash screed did appear;
+the "ts_test" program or our application were not able to start.
+
+The following error message was reported:
+error: failed to map framebuffer device to memory.
+LinuxFB: driver cannot connect
+
+The issue was discovered, on the LPC32xx platform, during the migration
+of the LCD definition from the board file to the device tree.
+
+Signed-off-by: Liam Beguin <lbeguin@tycoint.com>
+Signed-off-by: Sylvain Lemieux <slemieux@tycoint.com>
+Cc: Vladimir Zapolskiy <vz@mleia.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/amba-clcd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/amba-clcd.c
++++ b/drivers/video/fbdev/amba-clcd.c
+@@ -892,8 +892,8 @@ static int clcdfb_of_dma_setup(struct cl
+ if (err)
+ return err;
+
+- framesize = fb->panel->mode.xres * fb->panel->mode.yres *
+- fb->panel->bpp / 8;
++ framesize = PAGE_ALIGN(fb->panel->mode.xres * fb->panel->mode.yres *
++ fb->panel->bpp / 8);
+ fb->fb.screen_base = dma_alloc_coherent(&fb->dev->dev, framesize,
+ &dma, GFP_KERNEL);
+ if (!fb->fb.screen_base)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+Date: Mon, 13 Nov 2017 19:04:18 +0200
+Subject: video/hdmi: Allow "empty" HDMI infoframes
+
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+
+
+[ Upstream commit 593f4b19a094c4426bd1e1e3cbab87a48bd13c71 ]
+
+HDMI 2.0 Appendix F suggest that we should keep sending the infoframe
+when switching from 3D to 2D mode, even if the infoframe isn't strictly
+necessary (ie. not needed to transmit the VIC or stereo information).
+This is a workaround against some sinks that fail to realize that they
+should switch from 3D to 2D mode when the source stop transmitting
+the infoframe.
+
+v2: Handle unpack() as well
+ Pull the length calculation into a helper
+
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: linux-media@vger.kernel.org
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> #v1
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171113170427.4150-2-ville.syrjala@linux.intel.com
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/hdmi.c | 51 +++++++++++++++++++++++++++++++--------------------
+ 1 file changed, 31 insertions(+), 20 deletions(-)
+
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hd
+ }
+ EXPORT_SYMBOL(hdmi_vendor_infoframe_init);
+
++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame)
++{
++ /* for side by side (half) we also need to provide 3D_Ext_Data */
++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
++ return 6;
++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID)
++ return 5;
++ else
++ return 4;
++}
++
+ /**
+ * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer
+ * @frame: HDMI infoframe
+@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struc
+ u8 *ptr = buffer;
+ size_t length;
+
+- /* empty info frame */
+- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID)
+- return -EINVAL;
+-
+ /* only one of those can be supplied */
+ if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID)
+ return -EINVAL;
+
+- /* for side by side (half) we also need to provide 3D_Ext_Data */
+- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
+- frame->length = 6;
+- else
+- frame->length = 5;
++ frame->length = hdmi_vendor_infoframe_length(frame);
+
+ length = HDMI_INFOFRAME_HEADER_SIZE + frame->length;
+
+@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struc
+ ptr[5] = 0x0c;
+ ptr[6] = 0x00;
+
+- if (frame->vic) {
+- ptr[7] = 0x1 << 5; /* video format */
+- ptr[8] = frame->vic;
+- } else {
++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) {
+ ptr[7] = 0x2 << 5; /* video format */
+ ptr[8] = (frame->s3d_struct & 0xf) << 4;
+ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
+ ptr[9] = (frame->s3d_ext_data & 0xf) << 4;
++ } else if (frame->vic) {
++ ptr[7] = 0x1 << 5; /* video format */
++ ptr[8] = frame->vic;
++ } else {
++ ptr[7] = 0x0 << 5; /* video format */
+ }
+
+ hdmi_infoframe_set_checksum(buffer, length);
+@@ -1161,7 +1166,7 @@ hdmi_vendor_any_infoframe_unpack(union h
+
+ if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR ||
+ ptr[1] != 1 ||
+- (ptr[2] != 5 && ptr[2] != 6))
++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6))
+ return -EINVAL;
+
+ length = ptr[2];
+@@ -1189,16 +1194,22 @@ hdmi_vendor_any_infoframe_unpack(union h
+
+ hvf->length = length;
+
+- if (hdmi_video_format == 0x1) {
+- hvf->vic = ptr[4];
+- } else if (hdmi_video_format == 0x2) {
++ if (hdmi_video_format == 0x2) {
++ if (length != 5 && length != 6)
++ return -EINVAL;
+ hvf->s3d_struct = ptr[4] >> 4;
+ if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) {
+- if (length == 6)
+- hvf->s3d_ext_data = ptr[5] >> 4;
+- else
++ if (length != 6)
+ return -EINVAL;
++ hvf->s3d_ext_data = ptr[5] >> 4;
+ }
++ } else if (hdmi_video_format == 0x1) {
++ if (length != 5)
++ return -EINVAL;
++ hvf->vic = ptr[4];
++ } else {
++ if (length != 4)
++ return -EINVAL;
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Felix Manlunas <felix.manlunas@cavium.com>
+Date: Wed, 29 Mar 2017 17:56:43 -0700
+Subject: vxlan: vxlan dev should inherit lowerdev's gso_max_size
+
+From: Felix Manlunas <felix.manlunas@cavium.com>
+
+
+[ Upstream commit d6acfeb17d030bb3907e77c048b0e7783ad8e5a9 ]
+
+vxlan dev currently ignores lowerdev's gso_max_size, which adversely
+affects TSO performance of liquidio if it's the lowerdev. Egress TCP
+packets' skb->len often exceed liquidio's advertised gso_max_size. This
+may happen on other NIC drivers.
+
+Fix it by assigning lowerdev's gso_max_size to that of vxlan dev. Might as
+well do likewise for gso_max_segs.
+
+Single flow TSO throughput of liquidio as lowerdev (using iperf3):
+
+ Before the patch: 139 Mbps
+ After the patch : 8.68 Gbps
+ Percent increase: 6,144 %
+
+Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com>
+Signed-off-by: Satanand Burla <satananda.burla@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2912,6 +2912,11 @@ static int vxlan_dev_configure(struct ne
+ return -EINVAL;
+ }
+
++ if (lowerdev) {
++ dev->gso_max_size = lowerdev->gso_max_size;
++ dev->gso_max_segs = lowerdev->gso_max_segs;
++ }
++
+ if (conf->mtu) {
+ err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false);
+ if (err)
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
+Date: Wed, 5 Apr 2017 14:58:11 +0300
+Subject: wil6210: fix memory access violation in wil_memcpy_from/toio_32
+
+From: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
+
+
+[ Upstream commit 0f6edfe2bbbb59d161580cb4870fcc46f5490f85 ]
+
+In case count is not multiple of 4, there is a read access in
+wil_memcpy_toio_32() from outside src buffer boundary.
+In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is
+a write access to outside dst io memory boundary.
+
+Fix these issues with proper handling of the last 1 to 4 copied bytes.
+
+Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
+Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/wil6210/main.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -129,9 +129,15 @@ void wil_memcpy_fromio_32(void *dst, con
+ u32 *d = dst;
+ const volatile u32 __iomem *s = src;
+
+- /* size_t is unsigned, if (count%4 != 0) it will wrap */
+- for (count += 4; count > 4; count -= 4)
++ for (; count >= 4; count -= 4)
+ *d++ = __raw_readl(s++);
++
++ if (unlikely(count)) {
++ /* count can be 1..3 */
++ u32 tmp = __raw_readl(s);
++
++ memcpy(d, &tmp, count);
++ }
+ }
+
+ void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst,
+@@ -148,8 +154,16 @@ void wil_memcpy_toio_32(volatile void __
+ volatile u32 __iomem *d = dst;
+ const u32 *s = src;
+
+- for (count += 4; count > 4; count -= 4)
++ for (; count >= 4; count -= 4)
+ __raw_writel(*s++, d++);
++
++ if (unlikely(count)) {
++ /* count can be 1..3 */
++ u32 tmp = 0;
++
++ memcpy(&tmp, s, count);
++ __raw_writel(tmp, d);
++ }
+ }
+
+ void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil,
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
+Date: Wed, 5 Apr 2017 14:58:08 +0300
+Subject: wil6210: fix protection against connections during reset
+
+From: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
+
+
+[ Upstream commit b819447dfc4bd120c9d6cd8521252d544fce8fe7 ]
+
+Existing code that ignores connection events during
+reset flow will never take effect since it locks the
+same mutex taken by the reset flow.
+
+In addition, in case of unsolicited disconnect events ignore
+those as well since device is about to get reset.
+
+Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
+Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/wil6210/wmi.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -501,16 +501,16 @@ static void wmi_evt_connect(struct wil62
+ assoc_resp_ielen = 0;
+ }
+
+- mutex_lock(&wil->mutex);
+ if (test_bit(wil_status_resetting, wil->status) ||
+ !test_bit(wil_status_fwready, wil->status)) {
+ wil_err(wil, "status_resetting, cancel connect event, CID %d\n",
+ evt->cid);
+- mutex_unlock(&wil->mutex);
+ /* no need for cleanup, wil_reset will do that */
+ return;
+ }
+
++ mutex_lock(&wil->mutex);
++
+ if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
+ (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
+ if (!test_bit(wil_status_fwconnecting, wil->status)) {
+@@ -608,6 +608,13 @@ static void wmi_evt_disconnect(struct wi
+
+ wil->sinfo_gen++;
+
++ if (test_bit(wil_status_resetting, wil->status) ||
++ !test_bit(wil_status_fwready, wil->status)) {
++ wil_err(wil, "status_resetting, cancel disconnect event\n");
++ /* no need for cleanup, wil_reset will do that */
++ return;
++ }
++
+ mutex_lock(&wil->mutex);
+ wil6210_disconnect(wil, evt->bssid, reason_code, true);
+ mutex_unlock(&wil->mutex);
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 22 Mar 2017 14:32:32 -0700
+Subject: x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up
+
+From: Andy Lutomirski <luto@kernel.org>
+
+
+[ Upstream commit 23b2a4ddebdd17fad265b4bb77256c2e4ec37dee ]
+
+The x86 smpboot trampoline expects initial_page_table to have the
+GDT mapped. If the GDT ends up in a virtually mapped per-cpu page,
+then it won't be in the page tables at all until perc-pu areas are
+set up. The result will be a triple fault the first time that the
+CPU attempts to access the GDT after LGDT loads the perc-pu GDT.
+
+This appears to be an old bug, but somehow the GDT fixmap rework
+is triggering it. This seems to have something to do with the
+memory layout.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Garnier <thgarnie@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/a553264a5972c6a86f9b5caac237470a0c74a720.1490218061.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/setup.c | 15 ---------------
+ arch/x86/kernel/setup_percpu.c | 21 +++++++++++++++++++++
+ 2 files changed, 21 insertions(+), 15 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1200,21 +1200,6 @@ void __init setup_arch(char **cmdline_p)
+
+ kasan_init();
+
+-#ifdef CONFIG_X86_32
+- /* sync back kernel address range */
+- clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
+- swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+- KERNEL_PGD_PTRS);
+-
+- /*
+- * sync back low identity map too. It is used for example
+- * in the 32-bit EFI stub.
+- */
+- clone_pgd_range(initial_page_table,
+- swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+- min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+-#endif
+-
+ tboot_probe();
+
+ map_vsyscall();
+--- a/arch/x86/kernel/setup_percpu.c
++++ b/arch/x86/kernel/setup_percpu.c
+@@ -287,4 +287,25 @@ void __init setup_per_cpu_areas(void)
+
+ /* Setup cpu initialized, callin, callout masks */
+ setup_cpu_local_masks();
++
++#ifdef CONFIG_X86_32
++ /*
++ * Sync back kernel address range. We want to make sure that
++ * all kernel mappings, including percpu mappings, are available
++ * in the smpboot asm. We can't reliably pick up percpu
++ * mappings using vmalloc_fault(), because exception dispatch
++ * needs percpu data.
++ */
++ clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
++ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++ KERNEL_PGD_PTRS);
++
++ /*
++ * sync back low identity map too. It is used for example
++ * in the 32-bit EFI stub.
++ */
++ clone_pgd_range(initial_page_table,
++ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++ min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
++#endif
+ }
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Xunlei Pang <xlpang@redhat.com>
+Date: Mon, 13 Mar 2017 10:50:19 +0100
+Subject: x86/mce: Handle broadcasted MCE gracefully with kexec
+
+From: Xunlei Pang <xlpang@redhat.com>
+
+
+[ Upstream commit 5bc329503e8191c91c4c40836f062ef771d8ba83 ]
+
+When we are about to kexec a crash kernel and right then and there a
+broadcasted MCE fires while we're still in the first kernel and while
+the other CPUs remain in a holding pattern, the #MC handler of the
+first kernel will timeout and then panic due to never completing MCE
+synchronization.
+
+Handle this in a similar way as to when the CPUs are offlined when that
+broadcasted MCE happens.
+
+[ Boris: rewrote commit message and comments. ]
+
+Suggested-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Xunlei Pang <xlpang@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Tony Luck <tony.luck@intel.com>
+Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: kexec@lists.infradead.org
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/1487857012-9059-1-git-send-email-xlpang@redhat.com
+Link: http://lkml.kernel.org/r/20170313095019.19351-1-bp@alien8.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/reboot.h | 1 +
+ arch/x86/kernel/cpu/mcheck/mce.c | 18 ++++++++++++++++--
+ arch/x86/kernel/reboot.c | 5 +++--
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/include/asm/reboot.h
++++ b/arch/x86/include/asm/reboot.h
+@@ -15,6 +15,7 @@ struct machine_ops {
+ };
+
+ extern struct machine_ops machine_ops;
++extern int crashing_cpu;
+
+ void native_machine_crash_shutdown(struct pt_regs *regs);
+ void native_machine_shutdown(void);
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -48,6 +48,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
++#include <asm/reboot.h>
+
+ #include "mce-internal.h"
+
+@@ -1081,9 +1082,22 @@ void do_machine_check(struct pt_regs *re
+ * on Intel.
+ */
+ int lmce = 1;
++ int cpu = smp_processor_id();
+
+- /* If this CPU is offline, just bail out. */
+- if (cpu_is_offline(smp_processor_id())) {
++ /*
++ * Cases where we avoid rendezvous handler timeout:
++ * 1) If this CPU is offline.
++ *
++ * 2) If crashing_cpu was set, e.g. we're entering kdump and we need to
++ * skip those CPUs which remain looping in the 1st kernel - see
++ * crash_nmi_callback().
++ *
++ * Note: there still is a small window between kexec-ing and the new,
++ * kdump kernel establishing a new #MC handler where a broadcasted MCE
++ * might not get handled properly.
++ */
++ if (cpu_is_offline(cpu) ||
++ (crashing_cpu != -1 && crashing_cpu != cpu)) {
+ u64 mcgstatus;
+
+ mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -769,10 +769,11 @@ void machine_crash_shutdown(struct pt_re
+ #endif
+
+
++/* This is the CPU performing the emergency shutdown work. */
++int crashing_cpu = -1;
++
+ #if defined(CONFIG_SMP)
+
+-/* This keeps a track of which one is crashing cpu. */
+-static int crashing_cpu;
+ static nmi_shootdown_cb shootdown_callback;
+
+ static atomic_t waiting_for_crash_ipi;
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Date: Wed, 15 Mar 2017 12:30:55 -0500
+Subject: x86/mce: Init some CPU features early
+
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+
+
+[ Upstream commit 5204bf17031b69fa5faa4dc80a9dc1e2446d74f9 ]
+
+When the MCA banks in __mcheck_cpu_init_generic() are polled for leftover
+errors logged during boot or from the previous boot, its required to have
+CPU features detected sufficiently so that the reading out and handling of
+those early errors is done correctly.
+
+If those features are not available, the decoding may miss some information
+and get incomplete errors logged. For example, on SMCA systems the MCA_IPID
+and MCA_SYND registers are not logged and MCA_ADDR is not masked
+appropriately.
+
+To cure that, do a subset of the basic feature detection early while the
+rest happens in its usual place in __mcheck_cpu_init_vendor().
+
+Signed-off-by: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/1489599055-20756-1-git-send-email-Yazen.Ghannam@amd.com
+[ Massage commit message and simplify. ]
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1695,30 +1695,35 @@ static int __mcheck_cpu_ancient_init(str
+ return 0;
+ }
+
+-static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
++/*
++ * Init basic CPU features needed for early decoding of MCEs.
++ */
++static void __mcheck_cpu_init_early(struct cpuinfo_x86 *c)
+ {
+- switch (c->x86_vendor) {
+- case X86_VENDOR_INTEL:
+- mce_intel_feature_init(c);
+- mce_adjust_timer = cmci_intel_adjust_timer;
+- break;
+-
+- case X86_VENDOR_AMD: {
++ if (c->x86_vendor == X86_VENDOR_AMD) {
+ mce_flags.overflow_recov = !!cpu_has(c, X86_FEATURE_OVERFLOW_RECOV);
+ mce_flags.succor = !!cpu_has(c, X86_FEATURE_SUCCOR);
+ mce_flags.smca = !!cpu_has(c, X86_FEATURE_SMCA);
+
+- /*
+- * Install proper ops for Scalable MCA enabled processors
+- */
+ if (mce_flags.smca) {
+ msr_ops.ctl = smca_ctl_reg;
+ msr_ops.status = smca_status_reg;
+ msr_ops.addr = smca_addr_reg;
+ msr_ops.misc = smca_misc_reg;
+ }
+- mce_amd_feature_init(c);
++ }
++}
+
++static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
++{
++ switch (c->x86_vendor) {
++ case X86_VENDOR_INTEL:
++ mce_intel_feature_init(c);
++ mce_adjust_timer = cmci_intel_adjust_timer;
++ break;
++
++ case X86_VENDOR_AMD: {
++ mce_amd_feature_init(c);
+ break;
+ }
+
+@@ -1804,6 +1809,7 @@ void mcheck_cpu_init(struct cpuinfo_x86
+
+ machine_check_vector = do_machine_check;
+
++ __mcheck_cpu_init_early(c);
+ __mcheck_cpu_init_generic();
+ __mcheck_cpu_init_vendor(c);
+ __mcheck_cpu_init_clear_banks();
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Dmitry Safonov <dsafonov@virtuozzo.com>
+Date: Mon, 6 Mar 2017 17:17:20 +0300
+Subject: x86/mm: Make mmap(MAP_32BIT) work correctly
+
+From: Dmitry Safonov <dsafonov@virtuozzo.com>
+
+
+[ Upstream commit 3e6ef9c80946f781fc25e8490c9875b1d2b61158 ]
+
+mmap(MAP_32BIT) is broken due to the dependency on the TIF_ADDR32 thread
+flag.
+
+For 64bit applications MAP_32BIT will force legacy bottom-up allocations and
+the 1GB address space restriction even if the application issued a compat
+syscall, which should not be subject of these restrictions.
+
+For 32bit applications, which issue 64bit syscalls the newly introduced
+mmap base separation into 64-bit and compat bases changed the behaviour
+because now a 64-bit mapping is returned, but due to the TIF_ADDR32
+dependency MAP_32BIT is ignored. Before the separation a 32-bit mapping was
+returned, so the MAP_32BIT handling was irrelevant.
+
+Replace the check for TIF_ADDR32 with a check for the compat syscall. That
+solves both the 64-bit issuing a compat syscall and the 32-bit issuing a
+64-bit syscall problems.
+
+[ tglx: Massaged changelog ]
+
+Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
+Cc: 0x7f454c46@gmail.com
+Cc: linux-mm@kvack.org
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Cyrill Gorcunov <gorcunov@openvz.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Link: http://lkml.kernel.org/r/20170306141721.9188-5-dsafonov@virtuozzo.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/sys_x86_64.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -100,7 +100,7 @@ out:
+ static void find_start_end(unsigned long flags, unsigned long *begin,
+ unsigned long *end)
+ {
+- if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) {
++ if (!in_compat_syscall() && (flags & MAP_32BIT)) {
+ /* This is usually used needed to map code in small
+ model, so it needs to be in the first 31bit. Limit
+ it to that. This means we need to move the
+@@ -175,7 +175,7 @@ arch_get_unmapped_area_topdown(struct fi
+ return addr;
+
+ /* for MAP_32BIT mappings we force the legacy mmap base */
+- if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT))
++ if (!in_compat_syscall() && (flags & MAP_32BIT))
+ goto bottomup;
+
+ /* requesting a specific address */
--- /dev/null
+From foo@baz Sun Mar 18 16:55:33 CET 2018
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Mar 2017 13:44:21 +0100
+Subject: zd1211rw: fix NULL-deref at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+
+[ Upstream commit ca260ece6a57dc7d751e0685f51fa2c55d851873 ]
+
+Make sure to check the number of endpoints to avoid dereferencing a
+NULL-pointer or accessing memory beyond the endpoint array should a
+malicious device lack the expected endpoints.
+
+Fixes: a1030e92c150 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device")
+Cc: Daniel Drake <dsd@gentoo.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
+@@ -1278,6 +1278,9 @@ static int eject_installer(struct usb_in
+ u8 bulk_out_ep;
+ int r;
+
++ if (iface_desc->desc.bNumEndpoints < 2)
++ return -ENODEV;
++
+ /* Find bulk out endpoint */
+ for (r = 1; r >= 0; r--) {
+ endpoint = &iface_desc->endpoint[r].desc;
projects / thirdparty / kernel / stable-queue.git / commitdiff
