--- /dev/null
+From 339f237e64742ccd20b70a19f254745033ba74e4 Mon Sep 17 00:00:00 2001
+From: Talons Lee <xin.li@citrix.com>
+Date: Mon, 10 Dec 2018 18:03:00 +0800
+Subject: always clear the X2APIC_ENABLE bit for PV guest
+
+[ Upstream commit 5268c8f39e0efef81af2aaed160272d9eb507beb ]
+
+Commit e657fcc clears cpu capability bit instead of using fake cpuid
+value, the EXTD should always be off for PV guest without depending
+on cpuid value. So remove the cpuid check in xen_read_msr_safe() to
+always clear the X2APIC_ENABLE bit.
+
+Signed-off-by: Talons Lee <xin.li@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/enlighten_pv.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index fd173e6425ccf..481d7920ea244 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -900,10 +900,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ val = native_read_msr_safe(msr, err);
+ switch (msr) {
+ case MSR_IA32_APICBASE:
+-#ifdef CONFIG_X86_X2APIC
+- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+-#endif
+- val &= ~X2APIC_ENABLE;
++ val &= ~X2APIC_ENABLE;
+ break;
+ }
+ return val;
+--
+2.19.1
+
--- /dev/null
+From c56a31f5b4408afafde523fc7971da39f6df1d12 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 15 Jan 2019 18:03:38 +0000
+Subject: atm: he: fix sign-extension overflow on large shift
+
+[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
+
+Shifting the 1 by exp by an int can lead to sign-extension overlow when
+exp is 31 since 1 is an signed int and sign-extending this result to an
+unsigned long long will set the upper 32 bits. Fix this by shifting an
+unsigned long.
+
+Detected by cppcheck:
+(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/he.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index e58538c293777..7ba243691004e 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
+ instead of '/ 512', use '>> 9' to prevent a call
+ to divdu3 on x86 platforms
+ */
+- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
+
+ if (rate_cps < 10)
+ rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
+--
+2.19.1
+
--- /dev/null
+From b24a58eeebf7fb83f491ab31622bf27c2567e349 Mon Sep 17 00:00:00 2001
+From: Peter Oskolkov <posk@google.com>
+Date: Wed, 16 Jan 2019 08:47:54 -0800
+Subject: bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit f4924f24da8c7ef64195096817f3cde324091d97 ]
+
+In sock_setsockopt() (net/core/sock.h), when SO_MARK option is used
+to change sk_mark, sk_dst_reset(sk) is called. The same should be
+done in bpf_setsockopt().
+
+Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf")
+Reported-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Peter Oskolkov <posk@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Reviewed-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index a8a9ff0568b91..41ede90fc28f5 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3102,7 +3102,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ sk->sk_rcvlowat = val ? : 1;
+ break;
+ case SO_MARK:
+- sk->sk_mark = val;
++ if (sk->sk_mark != val) {
++ sk->sk_mark = val;
++ sk_dst_reset(sk);
++ }
+ break;
+ default:
+ ret = -EINVAL;
+--
+2.19.1
+
--- /dev/null
+From ca043f1f0e95c8f804286a4de3889b039f03637c Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Tue, 8 Jan 2019 18:12:24 -0800
+Subject: bpf: correctly set initial window on active Fast Open sender
+
+[ Upstream commit 31aa6503a15ba00182ea6dbbf51afb63bf9e851d ]
+
+The existing BPF TCP initial congestion window (TCP_BPF_IW) does not
+to work on (active) Fast Open sender. This is because it changes the
+(initial) window only if data_segs_out is zero -- but data_segs_out
+is also incremented on SYN-data. This patch fixes the issue by
+proerly accounting for SYN-data additionally.
+
+Fixes: fc7478103c84 ("bpf: Adds support for setting initial cwnd")
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 542fd04bc44da..a8a9ff0568b91 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3128,7 +3128,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ /* Only some options are supported */
+ switch (optname) {
+ case TCP_BPF_IW:
+- if (val <= 0 || tp->data_segs_out > 0)
++ if (val <= 0 || tp->data_segs_out > tp->syn_data)
+ ret = -EINVAL;
+ else
+ tp->snd_cwnd = val;
+--
+2.19.1
+
--- /dev/null
+From f5a8c6b8b91ce8ff07f8936669514bbd001e09c8 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 10:44:51 +0100
+Subject: drm/meson: add missing of_node_put
+
+[ Upstream commit f672b93e4a0a4947d2e1103ed8780e01e13eadb6 ]
+
+Add an of_node_put when the result of of_graph_get_remote_port_parent is
+not available.
+
+An of_node_put is also needed when meson_probe_remote completes. This was
+present at the recursive call, but not in the call from meson_drv_probe.
+
+The semantic match that finds this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@r exists@
+local idexpression e;
+expression x;
+@@
+e = of_graph_get_remote_port_parent(...);
+... when != x = e
+ when != true e == NULL
+ when != of_node_put(e)
+ when != of_fwnode_handle(e)
+(
+return e;
+|
+*return ...;
+)
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1547372691-28324-4-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 4ad8223c60eae..5deb44ac67915 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -345,8 +345,10 @@ static int meson_probe_remote(struct platform_device *pdev,
+ remote_node = of_graph_get_remote_port_parent(ep);
+ if (!remote_node ||
+ remote_node == parent || /* Ignore parent endpoint */
+- !of_device_is_available(remote_node))
++ !of_device_is_available(remote_node)) {
++ of_node_put(remote_node);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, match, remote, remote_node);
+
+@@ -365,10 +367,13 @@ static int meson_drv_probe(struct platform_device *pdev)
+
+ for_each_endpoint_of_node(np, ep) {
+ remote = of_graph_get_remote_port_parent(ep);
+- if (!remote || !of_device_is_available(remote))
++ if (!remote || !of_device_is_available(remote)) {
++ of_node_put(remote);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, &match, np, remote);
++ of_node_put(remote);
+ }
+
+ if (count && !match)
+--
+2.19.1
+
--- /dev/null
+From 26a0a994b2edd240d31a98c8413f9d0adbbc6a68 Mon Sep 17 00:00:00 2001
+From: Cheng-Min Ao <tony_ao@wiwynn.com>
+Date: Mon, 7 Jan 2019 14:29:32 +0800
+Subject: hwmon: (tmp421) Correct the misspelling of the tmp442 compatible
+ attribute in OF device ID table
+
+[ Upstream commit f422449b58548a41e98fc97b259a283718e527db ]
+
+Correct a typo in OF device ID table
+The last one should be 'ti,tmp442'
+
+Signed-off-by: Cheng-Min Ao <tony_ao@wiwynn.com>
+Signed-off-by: Yu-Hsiang Chen <matt_chen@wiwynn.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp421.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index e36399213324d..ceb3db6f3fdda 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
+ .data = (void *)2
+ },
+ {
+- .compatible = "ti,tmp422",
++ .compatible = "ti,tmp442",
+ .data = (void *)3
+ },
+ { },
+--
+2.19.1
+
--- /dev/null
+From 1c5dac3537e2610604c39c55f3d00ebe5bbcaaee Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 9 Jan 2019 22:41:08 -0700
+Subject: isdn: avm: Fix string plus integer warning from Clang
+
+[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
+
+A recent commit in Clang expanded the -Wstring-plus-int warning, showing
+some odd behavior in this file.
+
+drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
+ cinfo->version[j] = "\0\0" + 1;
+ ~~~~~~~^~~
+drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
+ cinfo->version[j] = "\0\0" + 1;
+ ^
+ & [ ]
+1 warning generated.
+
+This is equivalent to just "\0". Nick pointed out that it is smarter to
+use "" instead of "\0" because "" is used elsewhere in the kernel and
+can be deduplicated at the linking stage.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/309
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/avm/b1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index b1833d08a5fea..40a099f33bfc4 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
+ int i, j;
+
+ for (j = 0; j < AVM_MAXVERSION; j++)
+- cinfo->version[j] = "\0\0" + 1;
++ cinfo->version[j] = "";
+ for (i = 0, j = 0;
+ j < AVM_MAXVERSION && i < cinfo->versionlen;
+ j++, i += cinfo->versionbuf[i] + 1)
+--
+2.19.1
+
--- /dev/null
+From b3e583ebf26a30a607ed6dbbca9e4a815fb4d093 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 8 Jan 2019 21:04:48 +0800
+Subject: isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
+
+[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
+
+The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
+concurrently executed.
+
+isdn_tty_tiocmset
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+isdn_tty_set_termios
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+Thus, some concurrency double-free bugs may occur.
+
+These possible bugs are found by a static tool written by myself and
+my manual code review.
+
+To fix these possible bugs, the mutex lock "modem_info_mutex" used in
+isdn_tty_tiocmset() is added in isdn_tty_set_termios().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/i4l/isdn_tty.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
+index d30130c8d0f3d..b107452e16df7 100644
+--- a/drivers/isdn/i4l/isdn_tty.c
++++ b/drivers/isdn/i4l/isdn_tty.c
+@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ {
+ modem_info *info = (modem_info *) tty->driver_data;
+
++ mutex_lock(&modem_info_mutex);
+ if (!old_termios)
+ isdn_tty_change_speed(info);
+ else {
+ if (tty->termios.c_cflag == old_termios->c_cflag &&
+ tty->termios.c_ispeed == old_termios->c_ispeed &&
+- tty->termios.c_ospeed == old_termios->c_ospeed)
++ tty->termios.c_ospeed == old_termios->c_ospeed) {
++ mutex_unlock(&modem_info_mutex);
+ return;
++ }
+ isdn_tty_change_speed(info);
+ }
++ mutex_unlock(&modem_info_mutex);
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From 076541c9041b1838f4fdc8fe02b0fa1208db244b Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Tue, 25 Dec 2018 22:18:23 -0600
+Subject: leds: lp5523: fix a missing check of return value of lp55xx_read
+
+[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
+
+When lp55xx_read() fails, "status" is an uninitialized variable and thus
+may contain random value; using it leads to undefined behaviors.
+
+The fix inserts a check for the return value of lp55xx_read: if it
+fails, returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp5523.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index 924e50aefb003..13838d72e2971 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+
+ /* Let the programs run for couple of ms and check the engine status */
+ usleep_range(3000, 6000);
+- lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ if (ret)
++ return ret;
+ status &= LP5523_ENG_STATUS_MASK;
+
+ if (status != LP5523_ENG_STATUS_MASK) {
+--
+2.19.1
+
--- /dev/null
+From 29b5becc54372f38868b89240214c30ee19dc973 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 25 Oct 2018 15:43:44 +0300
+Subject: mfd: ab8500-core: Return zero in get_register_interruptible()
+
+[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
+
+This function is supposed to return zero on success or negative error
+codes on error. Unfortunately, there is a bug so it sometimes returns
+non-zero, positive numbers on success.
+
+I noticed this bug during review and I can't test it. It does appear
+that the return is sometimes propogated back to _regmap_read() where all
+non-zero returns are treated as failure so this may affect run time.
+
+Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ab8500-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 30d09d1771717..11ab17f64c649 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
+ mutex_unlock(&ab8500->lock);
+ dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
+
+- return ret;
++ return (ret < 0) ? ret : 0;
+ }
+
+ static int ab8500_get_register(struct device *dev, u8 bank,
+--
+2.19.1
+
--- /dev/null
+From 2e9854606262abffbdb3c71117bbdaf2bfeb7fa3 Mon Sep 17 00:00:00 2001
+From: Dien Pham <dien.pham.ry@renesas.com>
+Date: Wed, 3 Oct 2018 15:58:41 +0200
+Subject: mfd: bd9571mwv: Add volatile register to make DVFS work
+
+[ Upstream commit b0aff01e7aa6ad2d6998ef1323843212d1db8b04 ]
+
+Because BD9571MWV_DVFS_MONIVDAC is not defined in the volatile table,
+the physical register value is not updated by regmap and DVFS doesn't
+work as expected. Fix it!
+
+Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver")
+Signed-off-by: Dien Pham <dien.pham.ry@renesas.com>
+[wsa: rebase, add 'Fixes', reword commit message]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/bd9571mwv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index 64e088dfe7b05..98192d4863e4c 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -57,6 +57,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
+ };
+
+ static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
+ regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
+ regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
+ regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
+--
+2.19.1
+
--- /dev/null
+From e4952c642ba2fe79a771685185d15bb27d6a5da7 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 17:56:28 -0700
+Subject: mfd: db8500-prcmu: Fix some section annotations
+
+[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
+
+When building the kernel with Clang, the following section mismatch
+warnings appear:
+
+WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:init_prcm_registers()
+The function db8500_prcmu_probe() references
+the function __init init_prcm_registers().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of init_prcm_registers is wrong.
+
+WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:fw_project_name()
+The function db8500_prcmu_probe() references
+the function __init fw_project_name().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of fw_project_name is wrong.
+
+db8500_prcmu_probe should not be marked as __init so remove the __init
+annotation from fw_project_name and init_prcm_registers.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/db8500-prcmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index 5970b8def5487..aec20e1c7d3d5 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
+ .irq_unmask = prcmu_irq_unmask,
+ };
+
+-static __init char *fw_project_name(u32 project)
++static char *fw_project_name(u32 project)
+ {
+ switch (project) {
+ case PRCMU_FW_PROJECT_U8500:
+@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
+ INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
+ }
+
+-static void __init init_prcm_registers(void)
++static void init_prcm_registers(void)
+ {
+ u32 val;
+
+--
+2.19.1
+
--- /dev/null
+From 43021404a6e389a7df9966815a735c6c3d69d459 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Thu, 20 Dec 2018 15:12:11 -0600
+Subject: mfd: mc13xxx: Fix a missing check of a register-read failure
+
+[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
+
+When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will
+contain random value. Further execution uses "old_adc0" even when
+mc13xxx_reg_read() fails.
+The fix checks the return value of mc13xxx_reg_read(), and exits
+the execution when it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index d7f54e492aa61..6c16f170529f5 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+
+ mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
+
+- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ if (ret)
++ goto out;
+
+ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
+ adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+--
+2.19.1
+
--- /dev/null
+From 78492a8de84b5ed69e6f1f37dd75837347dff2da Mon Sep 17 00:00:00 2001
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Mon, 22 Oct 2018 10:55:06 +0800
+Subject: mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
+
+[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ]
+
+If the PMIC ID is unknown, the current code would call
+irq_domain_remove and panic, as pmic->irq_domain is only
+initialized by mt6397_irq_init.
+
+Return immediately with an error, if the chip ID is unsupported.
+
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mt6397-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
+index 04a601f6aebe5..0afadea996bbd 100644
+--- a/drivers/mfd/mt6397-core.c
++++ b/drivers/mfd/mt6397-core.c
+@@ -309,8 +309,7 @@ static int mt6397_probe(struct platform_device *pdev)
+
+ default:
+ dev_err(&pdev->dev, "unsupported chip: %d\n", id);
+- ret = -ENODEV;
+- break;
++ return -ENODEV;
+ }
+
+ if (ret) {
+--
+2.19.1
+
--- /dev/null
+From 44c1c4e176344333161a3f7cd276512c9e2020d0 Mon Sep 17 00:00:00 2001
+From: Jonathan Marek <jonathan@marek.ca>
+Date: Mon, 19 Nov 2018 14:53:17 -0500
+Subject: mfd: qcom_rpm: write fw_version to CTRL_REG
+
+[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ]
+
+This is required as part of the initialization sequence on certain SoCs.
+
+If these registers are not initialized, the hardware can be unresponsive.
+This fixes the driver on apq8060 (HP TouchPad device).
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/qcom_rpm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
+index 52fafea06067e..8d420c37b2a61 100644
+--- a/drivers/mfd/qcom_rpm.c
++++ b/drivers/mfd/qcom_rpm.c
+@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
+ return -EFAULT;
+ }
+
++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
++
+ dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
+ fw_version[1],
+ fw_version[2]);
+--
+2.19.1
+
--- /dev/null
+From d1a9f9193a5a3b83d447c4fb64ecd72d615c751c Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Mon, 3 Dec 2018 13:31:17 +0530
+Subject: mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd
+ cells
+
+[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ]
+
+Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that
+different instances are uniquely identified. This is required in order
+to support registering of multiple instances of same ti_am335x_tscadc IP.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ti_am335x_tscadc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index 7dc1cbcd2fb89..5894d6c16fab8 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -265,8 +265,9 @@ static int ti_tscadc_probe(struct platform_device *pdev)
+ cell->pdata_size = sizeof(tscadc);
+ }
+
+- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+- tscadc->used_cells, NULL, 0, NULL);
++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
++ tscadc->cells, tscadc->used_cells, NULL,
++ 0, NULL);
+ if (err < 0)
+ goto err_disable_clk;
+
+--
+2.19.1
+
--- /dev/null
+From a49f2d56116c1f773a3a4ac596558ef2b8346cbe Mon Sep 17 00:00:00 2001
+From: Keerthy <j-keerthy@ti.com>
+Date: Sun, 9 Dec 2018 19:29:31 +0530
+Subject: mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path
+ in probe()
+
+[ Upstream commit 75d4c5e03c2ae9902ab521024b10291f6fc9515b ]
+
+Use devm_regmap_add_irq_chip and clean up error path in probe
+and also the remove function.
+
+Reported-by: Christian Hohnstaedt <Christian.Hohnstaedt@wago.com>
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tps65218.c | 24 +++---------------------
+ 1 file changed, 3 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 13834a0d28172..612f5ecda78fa 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -243,9 +243,9 @@ static int tps65218_probe(struct i2c_client *client,
+
+ mutex_init(&tps->tps_lock);
+
+- ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+- IRQF_ONESHOT, 0, &tps65218_irq_chip,
+- &tps->irq_data);
++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
++ IRQF_ONESHOT, 0, &tps65218_irq_chip,
++ &tps->irq_data);
+ if (ret < 0)
+ return ret;
+
+@@ -261,26 +261,9 @@ static int tps65218_probe(struct i2c_client *client,
+ ARRAY_SIZE(tps65218_cells), NULL, 0,
+ regmap_irq_get_domain(tps->irq_data));
+
+- if (ret < 0)
+- goto err_irq;
+-
+- return 0;
+-
+-err_irq:
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+ return ret;
+ }
+
+-static int tps65218_remove(struct i2c_client *client)
+-{
+- struct tps65218 *tps = i2c_get_clientdata(client);
+-
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id tps65218_id_table[] = {
+ { "tps65218", TPS65218 },
+ { },
+@@ -293,7 +276,6 @@ static struct i2c_driver tps65218_driver = {
+ .of_match_table = of_tps65218_match_table,
+ },
+ .probe = tps65218_probe,
+- .remove = tps65218_remove,
+ .id_table = tps65218_id_table,
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 6a6f110b8c5e6f7801bc5c5431be4bef610b9376 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 10:13:23 -0700
+Subject: mfd: twl-core: Fix section annotations on {,un}protect_pm_master
+
+[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
+
+When building the kernel with Clang, the following section mismatch
+warning appears:
+
+WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from
+the function twl_probe() to the function
+.init.text:unprotect_pm_master()
+The function twl_probe() references
+the function __init unprotect_pm_master().
+This is often because twl_probe lacks a __init
+annotation or the annotation of unprotect_pm_master is wrong.
+
+Remove the __init annotation on the *protect_pm_master functions so
+there is no more mismatch.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/twl-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index d3133a371e277..8f993272901d5 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
+ * letting it generate the right frequencies for USB, MADC, and
+ * other purposes.
+ */
+-static inline int __init protect_pm_master(void)
++static inline int protect_pm_master(void)
+ {
+ int e = 0;
+
+@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
+ return e;
+ }
+
+-static inline int __init unprotect_pm_master(void)
++static inline int unprotect_pm_master(void)
+ {
+ int e = 0;
+
+--
+2.19.1
+
--- /dev/null
+From 68b34e775f4105959a874964c3e517d486a6fcd1 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Wed, 28 Nov 2018 10:04:22 +0000
+Subject: mfd: wm5110: Add missing ASRC rate register
+
+[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wm5110-tables.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 1ee68bd440fbc..16c6e2accfaa5 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
+ { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */
+ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */
+ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */
++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */
+ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */
+ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */
+ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
+@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
+ case ARIZONA_ASRC_ENABLE:
+ case ARIZONA_ASRC_STATUS:
+ case ARIZONA_ASRC_RATE1:
++ case ARIZONA_ASRC_RATE2:
+ case ARIZONA_ISRC_1_CTRL_1:
+ case ARIZONA_ISRC_1_CTRL_2:
+ case ARIZONA_ISRC_1_CTRL_3:
+--
+2.19.1
+
--- /dev/null
+From d3b936690dc9f58f1a9521b6329532324d64994a Mon Sep 17 00:00:00 2001
+From: Alban Bedel <albeu@free.fr>
+Date: Mon, 7 Jan 2019 20:45:15 +0100
+Subject: MIPS: ath79: Enable OF serial ports in the default config
+
+[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
+
+CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF
+boards, enable it in the default config to get a working setup out of
+the box.
+
+Signed-off-by: Alban Bedel <albeu@free.fr>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/configs/ath79_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
+index 25ed914933e5c..8a22978be1e6d 100644
+--- a/arch/mips/configs/ath79_defconfig
++++ b/arch/mips/configs/ath79_defconfig
+@@ -72,6 +72,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
+ # CONFIG_SERIAL_8250_PCI is not set
+ CONFIG_SERIAL_8250_NR_UARTS=1
+ CONFIG_SERIAL_8250_RUNTIME_UARTS=1
++CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_SERIAL_AR933X=y
+ CONFIG_SERIAL_AR933X_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
+--
+2.19.1
+
--- /dev/null
+From c0c52aaacd4c84f17c037fb34d6276e26a097e3b Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Wed, 9 Jan 2019 18:12:16 +0100
+Subject: MIPS: jazz: fix 64bit build
+
+[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
+
+64bit JAZZ builds failed with
+
+ linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`:
+ /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
+ of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
+ [-Werror=implicit-function-declaration]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^~~~~~~~~
+ CKSEG1ADDR
+ /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
+ integer of different size [-Werror=int-to-pointer-cast]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^
+ In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
+ from /linux-next/include/linux/compiler.h:248,
+ from /linux-next/include/linux/kernel.h:10,
+ from /linux-next/arch/mips/jazz/jazzdma.c:11:
+ /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
+ pointer to integer of different size [-Werror=pointer-to-int-cast]
+ #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
+ ^
+ /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
+ expansion of macro `_ACAST32_`
+ #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
+ ^~~~~~~~~
+ /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
+ macro `CPHYSADDR`
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+
+Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup
+fixes this.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/jazz/jazzdma.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
+index d626a9a391cc9..e3c3d9483e140 100644
+--- a/arch/mips/jazz/jazzdma.c
++++ b/arch/mips/jazz/jazzdma.c
+@@ -72,14 +72,15 @@ static int __init vdma_init(void)
+ get_order(VDMA_PGTBL_SIZE));
+ BUG_ON(!pgtbl);
+ dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+
+ /*
+ * Clear the R4030 translation table
+ */
+ vdma_pgtbl_init();
+
+- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
++ CPHYSADDR((unsigned long)pgtbl));
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+--
+2.19.1
+
--- /dev/null
+From 745fa1ead038336273bb7e3bfe465ca93803a0e8 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:01 +0000
+Subject: mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
+
+[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ]
+
+The driver currently treats static FDB entries as both static and
+sticky. This is incorrect and prevents such entries from being roamed to
+a different port via learning.
+
+Fix this by configuring static entries with ageing disabled and roaming
+enabled.
+
+In net-next we can add proper support for the newly introduced 'sticky'
+flag.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index f33fb95c41895..3ba9f2c079b2a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1086,7 +1086,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
+ static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
+ {
+ return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
+- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
+ }
+
+ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+@@ -1098,7 +1098,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ const char *mac, u16 fid, bool adding,
+ enum mlxsw_reg_sfd_rec_action action,
+- bool dynamic)
++ enum mlxsw_reg_sfd_rec_policy policy)
+ {
+ char *sfd_pl;
+ u8 num_rec;
+@@ -1109,8 +1109,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ return -ENOMEM;
+
+ mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
+- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+- mac, fid, action, local_port);
++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
+ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
+ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+ if (err)
+@@ -1129,7 +1128,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ bool dynamic)
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
+- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
++ MLXSW_REG_SFD_REC_ACTION_NOP,
++ mlxsw_sp_sfd_rec_policy(dynamic));
+ }
+
+ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+@@ -1137,7 +1137,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
+ MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
+- false);
++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
+ }
+
+ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
+--
+2.19.1
+
--- /dev/null
+From 54c4fba6d8c029c64db843125ca59337a5e2bc56 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Fri, 4 Jan 2019 20:18:11 +0800
+Subject: net: hns: Fix use after free identified by SLUB debug
+
+[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
+
+When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will
+identify a use after free bug:
+
+[134.189505] Unable to handle kernel paging request at virtual address
+ 006b6b6b6b6b6b6b
+[134.197553] Mem abort info:
+[134.200381] ESR = 0x96000004
+[134.203487] Exception class = DABT (current EL), IL = 32 bits
+[134.209497] SET = 0, FnV = 0
+[134.212596] EA = 0, S1PTW = 0
+[134.215777] Data abort info:
+[134.218701] ISV = 0, ISS = 0x00000004
+[134.222596] CM = 0, WnR = 0
+[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges
+[134.232851] Internal error: Oops: 96000004 [#1] SMP
+[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G
+ OE 4.19.5-1.2.34.aarch64 #1
+[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018
+[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO)
+[134.260044] pc : hns_ae_put_handle+0x38/0x60
+[134.264372] lr : hns_ae_put_handle+0x24/0x60
+[134.268700] sp : ffff00001be93c50
+[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040
+[134.277442] x27: 0000000000000000 x26: 0000000000000000
+[134.282830] x25: 0000000056000000 x24: 0000000000000015
+[134.288284] x23: ffff0000096fe098 x22: ffff000001050070
+[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098
+[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000
+[134.312945] x17: 0000000000000000 x16: 0000000000000000
+[134.322517] x15: 0000000000000002 x14: 0000000000000000
+[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988
+[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000
+[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000
+[134.360569] x7 : dead000000000100 x6 : ffff000009579748
+[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000
+[134.379550] x3 : 0000000000000001 x2 : 0000000000000000
+[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000
+[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd)
+[134.408498] Call trace:
+[134.414611] hns_ae_put_handle+0x38/0x60
+[134.422208] hnae_put_handle+0xd4/0x108
+[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv]
+[134.438342] platform_drv_remove+0x2c/0x70
+[134.445958] device_release_driver_internal+0x174/0x208
+[134.454810] driver_detach+0x70/0xd8
+[134.461913] bus_remove_driver+0x64/0xe8
+[134.469396] driver_unregister+0x34/0x60
+[134.476822] platform_driver_unregister+0x20/0x30
+[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv]
+[134.494634] __arm64_sys_delete_module+0x238/0x290
+
+struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is
+freed, than use hnae_handle will cause use after free panic.
+
+This patch frees vf_cb after hnae_handle used.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index a185a8be79993..53904f257b19d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+ int i;
+
+- vf_cb->mac_cb = NULL;
+-
+- kfree(vf_cb);
+-
+ for (i = 0; i < handle->q_num; i++)
+ hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
++
++ kfree(vf_cb);
+ }
+
+ static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+--
+2.19.1
+
--- /dev/null
+From b5e71549951710ca92b15c662a161c1fa70ad08a Mon Sep 17 00:00:00 2001
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Thu, 8 Nov 2018 12:06:53 +0200
+Subject: net/mlx5e: Fix wrong (zero) TX drop counter indication for
+ representor
+
+[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ]
+
+For representors, the TX dropped counter is not folded from the
+per-ring counters. Fix it.
+
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 281911698f72f..e69674d38f167 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -125,6 +125,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
+
+ s->tx_packets += sq_stats->packets;
+ s->tx_bytes += sq_stats->bytes;
++ s->tx_queue_dropped += sq_stats->dropped;
+ }
+ }
+ }
+--
+2.19.1
+
--- /dev/null
+From d4d4d388f5b6721cb751922ee27b720ed0d925d1 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:56 +0100
+Subject: net: stmmac: Fix PCI module removal leak
+
+[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ]
+
+Since commit b7d0f08e9129, the enable / disable of PCI device is not
+managed which will result in IO regions not being automatically unmapped.
+As regions continue mapped it is currently not possible to remove and
+then probe again the PCI module of stmmac.
+
+Fix this by manually unmapping regions on remove callback.
+
+Changes from v1:
+- Fix build error
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups")
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index c54a50dbd5ac2..d819e8eaba122 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ */
+ static void stmmac_pci_remove(struct pci_dev *pdev)
+ {
++ int i;
++
+ stmmac_dvr_remove(&pdev->dev);
++
++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
++ if (pci_resource_len(pdev, i) == 0)
++ continue;
++ pcim_iounmap_regions(pdev, BIT(i));
++ break;
++ }
++
+ pci_disable_device(pdev);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 574137be4b5bf8b761503f5a9d647a6a54139504 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Fri, 4 Jan 2019 17:56:16 +0900
+Subject: netfilter: nf_tables: fix leaking object reference count
+
+[ Upstream commit b91d9036883793122cf6575ca4dfbfbdd201a83d ]
+
+There is no code that decreases the reference count of stateful objects
+in error path of the nft_add_set_elem(). this causes a leak of reference
+count of stateful objects.
+
+Test commands:
+ $nft add table ip filter
+ $nft add counter ip filter c1
+ $nft add map ip filter m1 { type ipv4_addr : counter \;}
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft delete element ip filter m1 { 1 }
+ $nft delete counter ip filter c1
+
+Result:
+ Error: Could not process rule: Device or resource busy
+ delete counter ip filter c1
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+At the second 'nft add element ip filter m1 { 1 : c1 }', the reference
+count of the 'c1' is increased then it tries to insert into the 'm1'. but
+the 'm1' already has same element so it returns -EEXIST.
+But it doesn't decrease the reference count of the 'c1' in the error path.
+Due to a leak of the reference count of the 'c1', the 'c1' can't be
+removed by 'nft delete counter ip filter c1'.
+
+Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 623ec29ade26b..bf26e27ca456c 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4046,6 +4046,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ err5:
+ kfree(trans);
+ err4:
++ if (obj)
++ obj->use--;
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+--
+2.19.1
+
--- /dev/null
+From 63966d08c03c916e0bc774a3ac577b85e32eb229 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:33 -0800
+Subject: pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
+
+[ Upstream commit e6587cdbd732eacb4c7ce592ed46f7bbcefb655f ]
+
+When a connection is closing we receive on pvcalls_sk_state_change
+notification. Instead of setting the connection as closed immediately
+(-ENOTCONN), let's read one more time from it: pvcalls_conn_back_read
+will set the connection as closed when necessary.
+
+That way, we avoid races between pvcalls_sk_state_change and
+pvcalls_back_ioworker.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 169293c25a915..7185ebb63bd53 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -164,9 +164,10 @@ static void pvcalls_conn_back_read(void *opaque)
+
+ /* write the data, then modify the indexes */
+ virt_wmb();
+- if (ret < 0)
++ if (ret < 0) {
++ atomic_set(&map->read, 0);
+ intf->in_error = ret;
+- else
++ } else
+ intf->in_prod = prod + ret;
+ /* update the indexes, then notify the other end */
+ virt_wmb();
+@@ -296,7 +297,7 @@ static void pvcalls_sk_state_change(struct sock *sock)
+ return;
+
+ intf = map->ring;
+- intf->in_error = -ENOTCONN;
++ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From f5e2144c84b424b0221eba6d373f3b390ddd620f Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:39 +0200
+Subject: qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page
+ count
+
+[ Upstream commit 2d533a9287f2011632977e87ce2783f4c689c984 ]
+
+In PBL chains with non power of 2 page count, the producer is not at the
+beginning of the chain when index is 0 after a wrap. Therefore, after the
+producer index wrap around, page index should be calculated more carefully.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 59ddf9af909e4..2dd0a9ed5b361 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain)
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ u32 prod_idx, void *p_prod_elem)
+ {
++ if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++ u32 cur_prod, page_mask, page_cnt, page_diff;
++
++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++ p_chain->u.chain32.prod_idx;
++
++ /* Assume that number of elements in a page is power of 2 */
++ page_mask = ~p_chain->elem_per_page_mask;
++
++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++ * reaches the first element of next page before the page index
++ * is incremented. See qed_chain_produce().
++ * Index wrap around is not a problem because the difference
++ * between current and given producer indices is always
++ * positive and lower than the chain's capacity.
++ */
++ page_diff = (((cur_prod - 1) & page_mask) -
++ ((prod_idx - 1) & page_mask)) /
++ p_chain->elem_per_page;
++
++ page_cnt = qed_chain_get_page_cnt(p_chain);
++ if (is_chain_u16(p_chain))
++ p_chain->pbl.c.u16.prod_page_idx =
++ (p_chain->pbl.c.u16.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ else
++ p_chain->pbl.c.u32.prod_page_idx =
++ (p_chain->pbl.c.u32.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ }
++
+ if (is_chain_u16(p_chain))
+ p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ else
+--
+2.19.1
+
--- /dev/null
+From 5a753f5d4db599506f887bbf9b1539dbf8eba1e5 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:40 +0200
+Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory
+ barrier
+
+[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ]
+
+Make sure chain element is updated before ringing the doorbell.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index b73bcbeb5f279..cef619f0ce10b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1487,6 +1487,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
+ cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++ /* Make sure chain element is updated before ringing the doorbell */
++ dma_wmb();
++
+ DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+
+--
+2.19.1
+
--- /dev/null
+From a2ca5f49892d3d601aa021cfb8d02564550f1fbb Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Tue, 8 Jan 2019 13:50:43 -0700
+Subject: scsi: isci: initialize shost fully before calling scsi_add_host()
+
+[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
+
+scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
+command size to allocate based on the prot_capabilities. In the isci
+driver, scsi_host_set_prot() is called after scsi_add_host() so the command
+size gets calculated to be smaller than it needs to be. Eventually,
+scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
+was sized correctly and a buffer overrun may occur.
+
+However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
+size, the mistake can go unnoticed.
+
+The bug was noticed after the struct request size was reduced by commit
+9d037ad707ed ("block: remove req->timeout_list")
+
+Which likely reduced the allocated space for the request by an entire cache
+line, enough that the overflow could be hit and it caused a panic, on boot,
+at:
+
+ RIP: 0010:t10_pi_complete+0x77/0x1c0
+ Call Trace:
+ <IRQ>
+ sd_done+0xf5/0x340
+ scsi_finish_command+0xc3/0x120
+ blk_done_softirq+0x83/0xb0
+ __do_softirq+0xa1/0x2e6
+ irq_exit+0xbc/0xd0
+ call_function_single_interrupt+0xf/0x20
+ </IRQ>
+
+sd_done() would call scsi_prot_sg_count() which reads the number of
+entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
+the allocated space it reads a garbage number and erroneously calls
+t10_pi_complete().
+
+To prevent this, the calls to scsi_host_set_prot() are moved into
+isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
+move the similar call to scsi_host_set_guard().
+
+Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
+Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/init.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 922e3e56c90d9..c71e0f3b146ab 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -591,6 +591,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
+ shost->max_lun = ~0;
+ shost->max_cmd_len = MAX_COMMAND_SIZE;
+
++ /* turn on DIF support */
++ scsi_host_set_prot(shost,
++ SHOST_DIF_TYPE1_PROTECTION |
++ SHOST_DIF_TYPE2_PROTECTION |
++ SHOST_DIF_TYPE3_PROTECTION);
++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
++
+ err = scsi_add_host(shost, &pdev->dev);
+ if (err)
+ goto err_shost;
+@@ -678,13 +685,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err_host_alloc;
+ }
+ pci_info->hosts[i] = h;
+-
+- /* turn on DIF support */
+- scsi_host_set_prot(to_shost(h),
+- SHOST_DIF_TYPE1_PROTECTION |
+- SHOST_DIF_TYPE2_PROTECTION |
+- SHOST_DIF_TYPE3_PROTECTION);
+- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
+ }
+
+ err = isci_setup_interrupts(pdev);
+--
+2.19.1
+
--- /dev/null
+From 5fa3dcca9f8f4aecf91662ade8a5b3175759863a Mon Sep 17 00:00:00 2001
+From: Manish Rangankar <mrangankar@marvell.com>
+Date: Wed, 9 Jan 2019 01:39:07 -0800
+Subject: scsi: qedi: Add ep_state for login completion on un-reachable targets
+
+[ Upstream commit 34a2ce887668db9dda4b56e6f155c49ac13f3e54 ]
+
+When the driver finds invalid destination MAC for the first un-reachable
+target, and before completes the PATH_REQ operation, set new ep_state to
+OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper
+open-iscsi layer is notified to complete the login process on the first
+un-reachable target and thus proceed login to other reachable targets.
+
+Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_iscsi.c | 3 +++
+ drivers/scsi/qedi/qedi_iscsi.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index a02b34ea5cab1..45f044f35cea8 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -961,6 +961,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+
+ qedi_ep = ep->dd_data;
+ if (qedi_ep->state == EP_STATE_IDLE ||
++ qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ return -1;
+
+@@ -1043,6 +1044,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+
+ switch (qedi_ep->state) {
+ case EP_STATE_OFLDCONN_START:
++ case EP_STATE_OFLDCONN_NONE:
+ goto ep_release_conn;
+ case EP_STATE_OFLDCONN_FAILED:
+ break;
+@@ -1233,6 +1235,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+
+ if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++ qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ ret = -EIO;
+ goto set_path_exit;
+ }
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 3247287cb0e7e..812b4b68e6e48 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ EP_STATE_OFLDCONN_FAILED = 0x2000,
+ EP_STATE_CONNECT_FAILED = 0x4000,
+ EP_STATE_DISCONN_TIMEDOUT = 0x8000,
++ EP_STATE_OFLDCONN_NONE = 0x10000,
+ };
+
+ struct qedi_conn;
+--
+2.19.1
+
--- /dev/null
+From 56cd2f00798a68e7f1a1fe72d00322360c241cfd Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 20 Dec 2018 11:16:07 +0800
+Subject: scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
+
+[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
+
+The return code should be check while qla4xxx_copy_from_fwddb_param fails.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla4xxx/ql4_os.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index a6aa08d9a171c..22dc70a2138e2 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -7241,6 +7241,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
+
+ rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
+ fw_ddb_entry);
++ if (rc)
++ goto free_sess;
+
+ ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
+ __func__, fnode_sess->dev.kobj.name);
+--
+2.19.1
+
--- /dev/null
+From 0238519337b359b5d6a11be23c104b00887e5fe8 Mon Sep 17 00:00:00 2001
+From: Stanley Chu <stanley.chu@mediatek.com>
+Date: Mon, 7 Jan 2019 22:19:34 +0800
+Subject: scsi: ufs: Fix system suspend status
+
+[ Upstream commit ce9e7bce43526626f7cffe2e657953997870197e ]
+
+hba->is_sys_suspended is set after successful system suspend but
+not clear after successful system resume.
+
+According to current behavior, hba->is_sys_suspended will not be set if
+host is runtime-suspended but not system-suspended. Thus we shall aligh the
+same policy: clear this flag even if host remains runtime-suspended after
+ufshcd_system_resume is successfully returned.
+
+Simply fix this flag to correct host status logs.
+
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 21c81c1feac59..66540491839ea 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7520,6 +7520,8 @@ int ufshcd_system_resume(struct ufs_hba *hba)
+ trace_ufshcd_system_resume(dev_name(hba->dev), ret,
+ ktime_to_us(ktime_sub(ktime_get(), start)),
+ hba->curr_dev_pwr_mode, hba->uic_link_state);
++ if (!ret)
++ hba->is_sys_suspended = false;
+ return ret;
+ }
+ EXPORT_SYMBOL(ufshcd_system_resume);
+--
+2.19.1
+
numa-change-get_mempolicy-to-use-nr_node_ids-instead-of-max_numnodes.patch
proc-oom-do-not-report-alien-mms-when-setting-oom_score_adj.patch
keys-allow-reaching-the-keys-quotas-exactly.patch
+mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch
+pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch
+mfd-twl-core-fix-section-annotations-on-un-protect_p.patch
+mfd-db8500-prcmu-fix-some-section-annotations.patch
+mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch
+mfd-ab8500-core-return-zero-in-get_register_interrup.patch
+mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch
+mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch
+mfd-wm5110-add-missing-asrc-rate-register.patch
+mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch
+mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch
+xen-pvcalls-remove-set-but-not-used-variable-intf.patch
+qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch
+qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
+net-hns-fix-use-after-free-identified-by-slub-debug.patch
+mips-ath79-enable-of-serial-ports-in-the-default-con.patch
+netfilter-nf_tables-fix-leaking-object-reference-cou.patch
+scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch
+scsi-isci-initialize-shost-fully-before-calling-scsi.patch
+mips-jazz-fix-64bit-build.patch
+bpf-correctly-set-initial-window-on-active-fast-open.patch
+net-stmmac-fix-pci-module-removal-leak.patch
+isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch
+scsi-ufs-fix-system-suspend-status.patch
+scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch
+always-clear-the-x2apic_enable-bit-for-pv-guest.patch
+drm-meson-add-missing-of_node_put.patch
+atm-he-fix-sign-extension-overflow-on-large-shift.patch
+hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch
+leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch
+bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch
+mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch
+net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch
+isdn-avm-fix-string-plus-integer-warning-from-clang.patch
--- /dev/null
+From 337763470c686cb99e0f453a0846902f35c82664 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 4 Jan 2019 06:03:40 +0000
+Subject: xen/pvcalls: remove set but not used variable 'intf'
+
+[ Upstream commit 1f8ce09b36c41a026a37a24b20efa32000892a64 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/xen/pvcalls-back.c: In function 'pvcalls_sk_state_change':
+drivers/xen/pvcalls-back.c:286:28: warning:
+ variable 'intf' set but not used [-Wunused-but-set-variable]
+
+It not used since e6587cdbd732 ("pvcalls-back: set -ENOTCONN in
+pvcalls_conn_back_read")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 7185ebb63bd53..abd6dbc29ac28 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -291,12 +291,10 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
+ static void pvcalls_sk_state_change(struct sock *sock)
+ {
+ struct sock_mapping *map = sock->sk_user_data;
+- struct pvcalls_data_intf *intf;
+
+ if (map == NULL)
+ return;
+
+- intf = map->ring;
+ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
