--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Robin H. Johnson" <robbat2@gentoo.org>
+Date: Fri, 13 Jul 2018 20:50:47 +0000
+Subject: ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems
+
+From: "Robin H. Johnson" <robbat2@gentoo.org>
+
+[ Upstream commit 2c4d6baf1bc4f7729773ffcee9ba2a9781578633 ]
+
+The ec_no_wakeup matcher added for Thinkpad X1 Carbon 6th gen systems
+beyond matched only a single DMI model (20KGS3JF01), that didn't cover
+my laptop (20KH002JUS). Change to match based on DMI product family to
+cover all X1 6th gen systems.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/ec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -2036,7 +2036,7 @@ static const struct dmi_system_id acpi_e
+ .ident = "Thinkpad X1 Carbon 6th",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
+ },
+ },
+ { },
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 18 Jun 2018 14:17:16 +0300
+Subject: ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 8195a655e5ce09550aff81b2573d9b015d520cb9 ]
+
+On this system EC interrupt triggers constantly kicking devices out of
+low power states and thus blocking power management. The system also has
+a PCIe root port hosting Alpine Ridge Thunderbolt controller and it
+never gets a chance to go to D3cold because of this.
+
+Since the power button works the same regardless if EC interrupt is
+enabled or not during s2idle, add a quirk for this machine that sets
+ec_no_wakeup=true preventing spurious wakeups.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/ec.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -2031,6 +2031,17 @@ static inline void acpi_ec_query_exit(vo
+ }
+ }
+
++static const struct dmi_system_id acpi_ec_no_wakeup[] = {
++ {
++ .ident = "Thinkpad X1 Carbon 6th",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
++ },
++ },
++ { },
++};
++
+ int __init acpi_ec_init(void)
+ {
+ int result;
+@@ -2041,6 +2052,15 @@ int __init acpi_ec_init(void)
+ if (result)
+ return result;
+
++ /*
++ * Disable EC wakeup on following systems to prevent periodic
++ * wakeup from EC GPE.
++ */
++ if (dmi_check_system(acpi_ec_no_wakeup)) {
++ ec_no_wakeup = true;
++ pr_debug("Disabling EC wakeup on suspend-to-idle\n");
++ }
++
+ /* Drivers must be started after acpi_ec_query_init() */
+ dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Thu, 28 Jun 2018 09:56:55 -0700
+Subject: acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit c1985cefd844e26bd19673a6df8d8f0b1918c2db ]
+
+cmd_rc is passed in by reference to the acpi_nfit_ctl() function and the
+caller expects a value returned. However, when the package is pass through
+via the ND_CMD_CALL command, cmd_rc is not touched. Make sure cmd_rc is
+always set.
+
+Fixes: aef253382266 ("libnvdimm, nfit: centralize command status translation")
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -408,6 +408,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ const guid_t *guid;
+ int rc, i;
+
++ *cmd_rc = -EINVAL;
+ func = cmd;
+ if (cmd == ND_CMD_CALL) {
+ call_pkg = buf;
+@@ -518,6 +519,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ * If we return an error (like elsewhere) then caller wouldn't
+ * be able to rely upon data returned to make calculation.
+ */
++ *cmd_rc = 0;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 25 Jun 2018 11:13:59 +0200
+Subject: ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit c9a4c63888dbb79ce4d068ca1dd8b05bc3f156b1 ]
+
+The kernel may spew a WARNING with UBSAN undefined behavior at
+handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT:
+
+UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14
+signed integer overflow:
+2147483647 + 1 cannot be represented in type 'int'
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x122/0x1c8 lib/dump_stack.c:113
+ ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
+ handle_overflow+0x1c2/0x21f lib/ubsan.c:190
+ __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
+ snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007
+ snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144
+ ....
+
+It happens only when INT_MAX is passed there, as we're incrementing it
+unconditionally. So the fix is trivial, check the value with
+INT_MAX. Although the bug itself is fairly harmless, it's better to
+fix it so that fuzzers won't hit this again later.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2004,7 +2004,8 @@ static int snd_seq_ioctl_query_next_clie
+ struct snd_seq_client *cptr = NULL;
+
+ /* search for next client */
+- info->client++;
++ if (info->client < INT_MAX)
++ info->client++;
+ if (info->client < 0)
+ info->client = 0;
+ for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: David Francis <David.Francis@amd.com>
+Date: Thu, 12 Jul 2018 10:07:49 -0400
+Subject: amd/dc/dce100: On dce100, set clocks to 0 on suspend
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 8d4235f71513cdccd9dc52b674323c3591552bc1 ]
+
+[Why]
+When a dce100 asic was suspended, the clocks were not set to 0.
+Upon resume, the new clock was compared to the existing clock,
+they were found to be the same, and so the clock was not set.
+This resulted in a pernicious blackscreen.
+
+[How]
+In atomic commit, check to see if there are any active pipes.
+If no, set clocks to 0
+
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c | 19 +++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -678,9 +678,22 @@ bool dce100_validate_bandwidth(
+ struct dc *dc,
+ struct dc_state *context)
+ {
+- /* TODO implement when needed but for now hardcode max value*/
+- context->bw.dce.dispclk_khz = 681000;
+- context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
++ int i;
++ bool at_least_one_pipe = false;
++
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ if (context->res_ctx.pipe_ctx[i].stream)
++ at_least_one_pipe = true;
++ }
++
++ if (at_least_one_pipe) {
++ /* TODO implement when needed but for now hardcode max value*/
++ context->bw.dce.dispclk_khz = 681000;
++ context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
++ } else {
++ context->bw.dce.dispclk_khz = 0;
++ context->bw.dce.yclk_khz = 0;
++ }
+
+ return true;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+Date: Fri, 6 Jul 2018 11:32:37 +0100
+Subject: ARC: [plat-hsdk]: Configure APB GPIO controller on ARC HSDK platform
+
+From: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+
+[ Upstream commit ec58ba16e174d7ca24c8955a21cd0a53e0c32fdf ]
+
+In case of HSDK we have intermediate INTC in for of DW APB GPIO controller
+which is used as a de-bounce logic for interrupt wires that come from
+outside the board.
+
+We cannot use existing "irq-dw-apb-ictl" driver here because all input
+lines are routed to corresponding output lines but not muxed into one
+line (this is configured in RTL and we cannot change this in software).
+
+But even if we add such a feature to "irq-dw-apb-ictl" driver that won't
+benefit us as higher-level INTC (in case of HSDK it is IDU) anyways has
+per-input control so adding fully-controller intermediate INTC will only
+bring some overhead on interrupt processing but no other benefits.
+
+Thus we just do one-time configuration of DW APB GPIO controller and
+forget about it.
+
+Based on implementation available on arch/arc/plat-axs10x/axs10x.c file.
+
+Acked-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/plat-hsdk/platform.c | 62 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+
+--- a/arch/arc/plat-hsdk/platform.c
++++ b/arch/arc/plat-hsdk/platform.c
+@@ -42,6 +42,66 @@ static void __init hsdk_init_per_cpu(uns
+ #define SDIO_UHS_REG_EXT (SDIO_BASE + 0x108)
+ #define SDIO_UHS_REG_EXT_DIV_2 (2 << 30)
+
++#define HSDK_GPIO_INTC (ARC_PERIPHERAL_BASE + 0x3000)
++
++static void __init hsdk_enable_gpio_intc_wire(void)
++{
++ /*
++ * Peripherals on CPU Card are wired to cpu intc via intermediate
++ * DW APB GPIO blocks (mainly for debouncing)
++ *
++ * ---------------------
++ * | snps,archs-intc |
++ * ---------------------
++ * |
++ * ----------------------
++ * | snps,archs-idu-intc |
++ * ----------------------
++ * | | | | |
++ * | [eth] [USB] [... other peripherals]
++ * |
++ * -------------------
++ * | snps,dw-apb-intc |
++ * -------------------
++ * | | | |
++ * [Bt] [HAPS] [... other peripherals]
++ *
++ * Current implementation of "irq-dw-apb-ictl" driver doesn't work well
++ * with stacked INTCs. In particular problem happens if its master INTC
++ * not yet instantiated. See discussion here -
++ * https://lkml.org/lkml/2015/3/4/755
++ *
++ * So setup the first gpio block as a passive pass thru and hide it from
++ * DT hardware topology - connect intc directly to cpu intc
++ * The GPIO "wire" needs to be init nevertheless (here)
++ *
++ * One side adv is that peripheral interrupt handling avoids one nested
++ * intc ISR hop
++ *
++ * According to HSDK User's Manual [1], "Table 2 Interrupt Mapping"
++ * we have the following GPIO input lines used as sources of interrupt:
++ * - GPIO[0] - Bluetooth interrupt of RS9113 module
++ * - GPIO[2] - HAPS interrupt (on HapsTrak 3 connector)
++ * - GPIO[3] - Audio codec (MAX9880A) interrupt
++ * - GPIO[8-23] - Available on Arduino and PMOD_x headers
++ * For now there's no use of Arduino and PMOD_x headers in Linux
++ * use-case so we only enable lines 0, 2 and 3.
++ *
++ * [1] https://github.com/foss-for-synopsys-dwc-arc-processors/ARC-Development-Systems-Forum/wiki/docs/ARC_HSDK_User_Guide.pdf
++ */
++#define GPIO_INTEN (HSDK_GPIO_INTC + 0x30)
++#define GPIO_INTMASK (HSDK_GPIO_INTC + 0x34)
++#define GPIO_INTTYPE_LEVEL (HSDK_GPIO_INTC + 0x38)
++#define GPIO_INT_POLARITY (HSDK_GPIO_INTC + 0x3c)
++#define GPIO_INT_CONNECTED_MASK 0x0d
++
++ iowrite32(0xffffffff, (void __iomem *) GPIO_INTMASK);
++ iowrite32(~GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTMASK);
++ iowrite32(0x00000000, (void __iomem *) GPIO_INTTYPE_LEVEL);
++ iowrite32(0xffffffff, (void __iomem *) GPIO_INT_POLARITY);
++ iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN);
++}
++
+ static void __init hsdk_init_early(void)
+ {
+ /*
+@@ -62,6 +122,8 @@ static void __init hsdk_init_early(void)
+ * minimum possible div-by-2.
+ */
+ iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT);
++
++ hsdk_enable_gpio_intc_wire();
+ }
+
+ static const char *hsdk_compat[] __initconst = {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
+Date: Wed, 29 Nov 2017 11:21:45 +0300
+Subject: ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
+
+From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
+
+[ Upstream commit 2f24ef7413a4d91657ef04e77c27ce0b313e6c95 ]
+
+machine_desc->init_per_cpu() hook is supposed to be per cpu
+initialization and would seem to apply equally to UP and/or SMP.
+Infact the comment in header file seems to suggest it works for
+UP too, which was not the case and this patch.
+
+This enables !CONFIG_SMP build for platforms such as hsdk.
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+[vgupta: trimmeed changelog]
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/include/asm/mach_desc.h | 2 --
+ arch/arc/kernel/irq.c | 2 +-
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/arc/include/asm/mach_desc.h
++++ b/arch/arc/include/asm/mach_desc.h
+@@ -34,9 +34,7 @@ struct machine_desc {
+ const char *name;
+ const char **dt_compat;
+ void (*init_early)(void);
+-#ifdef CONFIG_SMP
+ void (*init_per_cpu)(unsigned int);
+-#endif
+ void (*init_machine)(void);
+ void (*init_late)(void);
+
+--- a/arch/arc/kernel/irq.c
++++ b/arch/arc/kernel/irq.c
+@@ -31,10 +31,10 @@ void __init init_IRQ(void)
+ /* a SMP H/w block could do IPI IRQ request here */
+ if (plat_smp_ops.init_per_cpu)
+ plat_smp_ops.init_per_cpu(smp_processor_id());
++#endif
+
+ if (machine_desc->init_per_cpu)
+ machine_desc->init_per_cpu(smp_processor_id());
+-#endif
+ }
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Alexey Brodkin <abrodkin@synopsys.com>
+Date: Fri, 1 Jun 2018 14:34:33 +0300
+Subject: ARC: Explicitly add -mmedium-calls to CFLAGS
+
+From: Alexey Brodkin <abrodkin@synopsys.com>
+
+[ Upstream commit 74c11e300c103af47db5b658fdcf28002421e250 ]
+
+GCC built for arc*-*-linux has "-mmedium-calls" implicitly enabled by default
+thus we don't see any problems during Linux kernel compilation.
+----------------------------->8------------------------
+arc-linux-gcc -mcpu=arc700 -Q --help=target | grep calls
+ -mlong-calls [disabled]
+ -mmedium-calls [enabled]
+----------------------------->8------------------------
+
+But if we try to use so-called Elf32 toolchain with GCC configured for
+arc*-*-elf* then we'd see the following failure:
+----------------------------->8------------------------
+init/do_mounts.o: In function 'init_rootfs':
+do_mounts.c:(.init.text+0x108): relocation truncated to fit: R_ARC_S21W_PCREL
+against symbol 'unregister_filesystem' defined in .text section in fs/filesystems.o
+
+arc-elf32-ld: final link failed: Symbol needs debug section which does not exist
+make: *** [vmlinux] Error 1
+----------------------------->8------------------------
+
+That happens because neither "-mmedium-calls" nor "-mlong-calls" are enabled in
+Elf32 GCC:
+----------------------------->8------------------------
+arc-elf32-gcc -mcpu=arc700 -Q --help=target | grep calls
+ -mlong-calls [disabled]
+ -mmedium-calls [disabled]
+----------------------------->8------------------------
+
+Now to make it possible to use Elf32 toolchain for building Linux kernel
+we're explicitly add "-mmedium-calls" to CFLAGS.
+
+And since we add "-mmedium-calls" to the global CFLAGS there's no point in
+having per-file copies thus removing them.
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/Makefile | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -16,7 +16,7 @@ endif
+
+ KBUILD_DEFCONFIG := nsim_700_defconfig
+
+-cflags-y += -fno-common -pipe -fno-builtin -D__linux__
++cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7
+ cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs
+
+@@ -140,16 +140,3 @@ dtbs: scripts
+
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+-
+-# Hacks to enable final link due to absence of link-time branch relexation
+-# and gcc choosing optimal(shorter) branches at -O3
+-#
+-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
+-# However lib/decompress_inflate.o (.init.text) calls
+-# zlib_inflate_workspacesize (.text) causing relocation errors.
+-# Thus forcing all exten calls in this file to be long calls
+-export CFLAGS_decompress_inflate.o = -mmedium-calls
+-export CFLAGS_initramfs.o = -mmedium-calls
+-ifdef CONFIG_SMP
+-export CFLAGS_core.o = -mmedium-calls
+-endif
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 19 Jun 2018 17:22:05 +0300
+Subject: ARC: Improve cmpxchg syscall implementation
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit e8708786d4fe21c043d38d760f768949a3d71185 ]
+
+This is used in configs lacking hardware atomics to emulate atomic r-m-w
+for user space, implemented by disabling preemption in kernel.
+
+However there are issues in current implementation:
+
+1. Process not terminated if invalid user pointer passed:
+ i.e. __get_user() failed.
+
+2. The reason for this patch was __put_user() failure not being handled
+ either, specifically for the COW break scenario.
+ The zero page is initially wired up and read from __get_user()
+ succeeds. A subsequent write by __put_user() induces a
+ Protection Violation, but COW can't finish as Linux page fault
+ handler is disabled due to preempt disable.
+ And what's worse is we silently return the stale value to user space.
+ Fix this specific case by re-enabling preemption and explicitly
+ fixing up the fault and retrying the whole sequence over.
+
+Cc: Max Filippov <jcmvbkbc@gmail.com>
+Cc: linux-arch@vger.kernel.org
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+[vgupta: rewrote the changelog]
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/kernel/process.c | 47 +++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 36 insertions(+), 11 deletions(-)
+
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls)
+ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+ {
+ struct pt_regs *regs = current_pt_regs();
+- int uval = -EFAULT;
++ u32 uval;
++ int ret;
+
+ /*
+ * This is only for old cores lacking LLOCK/SCOND, which by defintion
+@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *,
+ /* Z indicates to userspace if operation succeded */
+ regs->status32 &= ~STATUS_Z_MASK;
+
+- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+- return -EFAULT;
++ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
++ if (!ret)
++ goto fail;
+
++again:
+ preempt_disable();
+
+- if (__get_user(uval, uaddr))
+- goto done;
++ ret = __get_user(uval, uaddr);
++ if (ret)
++ goto fault;
+
+- if (uval == expected) {
+- if (!__put_user(new, uaddr))
+- regs->status32 |= STATUS_Z_MASK;
+- }
++ if (uval != expected)
++ goto out;
+
+-done:
+- preempt_enable();
++ ret = __put_user(new, uaddr);
++ if (ret)
++ goto fault;
++
++ regs->status32 |= STATUS_Z_MASK;
+
++out:
++ preempt_enable();
+ return uval;
++
++fault:
++ preempt_enable();
++
++ if (unlikely(ret != -EFAULT))
++ goto fail;
++
++ down_read(¤t->mm->mmap_sem);
++ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
++ FAULT_FLAG_WRITE, NULL);
++ up_read(¤t->mm->mmap_sem);
++
++ if (likely(!ret))
++ goto again;
++
++fail:
++ force_sig(SIGSEGV, current);
++ return ret;
+ }
+
+ #ifdef CONFIG_ISA_ARCV2
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Tue, 10 Jul 2018 08:22:40 +0100
+Subject: ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
+
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+
+[ Upstream commit b4c7e2bd2eb4764afe3af9409ff3b1b87116fa30 ]
+
+Dynamic ftrace requires modifying the code segments that are usually
+set to read-only. To do this, a per arch function is called both before
+and after the ftrace modifications are performed. The "before" function
+will set kernel code text to read-write to allow for ftrace to make the
+modifications, and the "after" function will set the kernel code text
+back to "read-only" to keep the kernel code text protected.
+
+The issue happens when dynamic ftrace is tested at boot up. The test is
+done before the kernel code text has been set to read-only. But the
+"before" and "after" calls are still performed. The "after" call will
+change the kernel code text to read-only prematurely, and other boot
+code that expects this code to be read-write will fail.
+
+The solution is to add a variable that is set when the kernel code text
+is expected to be converted to read-only, and make the ftrace "before"
+and "after" calls do nothing if that variable is not yet set. This is
+similar to the x86 solution from commit 162396309745 ("ftrace, x86:
+make kernel text writable only for conversions").
+
+Link: http://lkml.kernel.org/r/20180620212906.24b7b66e@vmware.local.home
+
+Reported-by: Stefan Agner <stefan@agner.ch>
+Tested-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mm/init.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -736,20 +736,29 @@ static int __mark_rodata_ro(void *unused
+ return 0;
+ }
+
++static int kernel_set_to_readonly __read_mostly;
++
+ void mark_rodata_ro(void)
+ {
++ kernel_set_to_readonly = 1;
+ stop_machine(__mark_rodata_ro, NULL, NULL);
+ debug_checkwx();
+ }
+
+ void set_kernel_text_rw(void)
+ {
++ if (!kernel_set_to_readonly)
++ return;
++
+ set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
+ current->active_mm);
+ }
+
+ void set_kernel_text_ro(void)
+ {
++ if (!kernel_set_to_readonly)
++ return;
++
+ set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
+ current->active_mm);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Thu, 17 May 2018 20:20:52 -0500
+Subject: ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 1b6fe9798af8cb7d80fad5dd30ee1bcd1e0f51eb ]
+
+When booting from MMC/SD in rw mode on DA850 EVM, the system
+crashes because the write protect pin should be active high
+and not active low. This patch fixes the polarity of the WP pin.
+
+Fixes: bdf0e8364fd3 ("ARM: davinci: da850-evm: use gpio descriptor for mmc pins")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-davinci/board-da850-evm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -773,7 +773,7 @@ static struct gpiod_lookup_table mmc_gpi
+ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
+ GPIO_ACTIVE_LOW),
+ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
+- GPIO_ACTIVE_LOW),
++ GPIO_ACTIVE_HIGH),
+ },
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Nishanth Menon <nm@ti.com>
+Date: Tue, 10 Jul 2018 14:47:25 -0500
+Subject: ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 2f8b5b21830aea95989a6e67d8a971297272a086 ]
+
+Call secure services to enable ACTLR[0] (Enable invalidates of BTB with
+ICIALLU) when branch hardening is enabled for kernel.
+
+On GP devices OMAP5/DRA7, there is no possibility to update secure
+side since "secure world" is ROM and there are no override mechanisms
+possible. On HS devices, appropriate PPA should do the workarounds as
+well.
+
+However, the configuration is only done for secondary core, since it is
+expected that firmware/bootloader will have enabled the required
+configuration for the primary boot core (note: bootloaders typically
+will NOT enable secondary processors, since it has no need to do so).
+
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap-smp.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(voi
+ static inline void omap5_erratum_workaround_801819(void) { }
+ #endif
+
++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
++/*
++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
++ * ICIALLU) to activate the workaround for secondary Core.
++ * NOTE: it is assumed that the primary core's configuration is done
++ * by the boot loader (kernel will detect a misconfiguration and complain
++ * if this is not done).
++ *
++ * In General Purpose(GP) devices, ACR bit settings can only be done
++ * by ROM code in "secure world" using the smc call and there is no
++ * option to update the "firmware" on such devices. This also works for
++ * High security(HS) devices, as a backup option in case the
++ * "update" is not done in the "security firmware".
++ */
++static void omap5_secondary_harden_predictor(void)
++{
++ u32 acr, acr_mask;
++
++ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
++
++ /*
++ * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
++ */
++ acr_mask = BIT(0);
++
++ /* Do we already have it done.. if yes, skip expensive smc */
++ if ((acr & acr_mask) == acr_mask)
++ return;
++
++ acr |= acr_mask;
++ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
++
++ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
++ __func__, smp_processor_id());
++}
++#else
++static inline void omap5_secondary_harden_predictor(void) { }
++#endif
++
+ static void omap4_secondary_init(unsigned int cpu)
+ {
+ /*
+@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigne
+ set_cntfreq();
+ /* Configure ACR to disable streaming WA for 801819 */
+ omap5_erratum_workaround_801819();
++ /* Enable ACR to allow for ICUALLU workaround */
++ omap5_secondary_harden_predictor();
+ }
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Wed, 11 Jul 2018 12:54:54 -0500
+Subject: ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ]
+
+The AM3517 has a different OTG controller location than the OMAP3,
+which is included from omap3.dtsi. This results in a hwmod error.
+Since the AM3517 has a different OTG controller address, this patch
+disabes one that is isn't available.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am3517.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm/boot/dts/am3517.dtsi
++++ b/arch/arm/boot/dts/am3517.dtsi
+@@ -91,6 +91,11 @@
+ };
+ };
+
++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
++&usb_otg_hs {
++ status = "disabled";
++};
++
+ &iva {
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Daniel Mack <daniel@zonque.org>
+Date: Sun, 17 Jun 2018 13:53:09 +0200
+Subject: ARM: dts: am437x: make edt-ft5x06 a wakeup source
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ]
+
+The touchscreen driver no longer configures the device as wakeup source by
+default. A "wakeup-source" property is needed.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/am437x-sk-evm.dts
++++ b/arch/arm/boot/dts/am437x-sk-evm.dts
+@@ -537,6 +537,8 @@
+
+ touchscreen-size-x = <480>;
+ touchscreen-size-y = <272>;
++
++ wakeup-source;
+ };
+
+ tlv320aic3106: tlv320aic3106@1b {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Fri, 25 May 2018 16:01:47 +0530
+Subject: arm: dts: armada: Fix "#cooling-cells" property's name
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit ac62cc9d9cd6fa4c79e171c13dc8d58c3862b678 ]
+
+It should be "#cooling-cells" instead of "cooling-cells". Fix it.
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/armada-385-synology-ds116.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts
++++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts
+@@ -139,7 +139,7 @@
+ 3700 5
+ 3900 6
+ 4000 7>;
+- cooling-cells = <2>;
++ #cooling-cells = <2>;
+ };
+
+ gpio-leds {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 11 Jun 2018 15:53:40 -0700
+Subject: ARM: dts: BCM5301x: Fix i2c controller interrupt type
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit a0a8338e905734518ab9b10b06e7fd0201228f8b ]
+
+The i2c controller should be using IRQ_TYPE_LEVEL_HIGH, fix that.
+
+Fixes: bb097e3e0045 ("ARM: dts: BCM5301X: Add I2C support to the DT")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -365,7 +365,7 @@
+ i2c0: i2c@18009000 {
+ compatible = "brcm,iproc-i2c";
+ reg = <0x18009000 0x50>;
+- interrupts = <GIC_SPI 121 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ clock-frequency = <100000>;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Tue, 12 Jun 2018 13:21:27 -0700
+Subject: ARM: dts: Cygnus: Fix I2C controller interrupt type
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+[ Upstream commit 71ca3409703b62b6a092d0d9d13f366c121bc5d3 ]
+
+Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
+Cygnus SoC.
+
+Fixes: b51c05a331ff ("ARM: dts: add I2C device nodes for Broadcom Cygnus")
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm-cygnus.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -216,7 +216,7 @@
+ reg = <0x18008000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
+@@ -245,7 +245,7 @@
+ reg = <0x1800b000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Tue, 12 Jun 2018 13:21:28 -0700
+Subject: ARM: dts: Cygnus: Fix PCIe controller interrupt type
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+[ Upstream commit 6cb1628ad3506b315cdddd7676db0ff2af378d28 ]
+
+Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
+Cygnus SoC
+
+Fixes: cd590b50a936 ("ARM: dts: enable PCIe support for Cygnus")
+Fixes: f6b889358a82 ("ARM: dts: Enable MSI support for Broadcom Cygnus")
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm-cygnus.dtsi | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -256,7 +256,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <0>;
+
+@@ -278,10 +278,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
+- <GIC_SPI 97 IRQ_TYPE_NONE>,
+- <GIC_SPI 98 IRQ_TYPE_NONE>,
+- <GIC_SPI 99 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
+
+@@ -291,7 +291,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <1>;
+
+@@ -313,10 +313,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
+- <GIC_SPI 103 IRQ_TYPE_NONE>,
+- <GIC_SPI 104 IRQ_TYPE_NONE>,
+- <GIC_SPI 105 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Keerthy <j-keerthy@ti.com>
+Date: Tue, 5 Jun 2018 15:37:51 +0530
+Subject: ARM: dts: da850: Fix interrups property for gpio
+
+From: Keerthy <j-keerthy@ti.com>
+
+[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ]
+
+The intc #interrupt-cells is equal to 1. Currently gpio
+node has 2 cells per IRQ which is wrong. Remove the additional
+cell for each of the interrupts.
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node")
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/da850.dtsi | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/da850.dtsi
++++ b/arch/arm/boot/dts/da850.dtsi
+@@ -539,11 +539,7 @@
+ gpio-controller;
+ #gpio-cells = <2>;
+ reg = <0x226000 0x1000>;
+- interrupts = <42 IRQ_TYPE_EDGE_BOTH
+- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
+- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
+- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
+- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
++ interrupts = <42 43 44 45 46 47 48 49 50>;
+ ti,ngpio = <144>;
+ ti,davinci-gpio-unbanked = <0>;
+ status = "disabled";
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 11 Jun 2018 15:47:14 -0700
+Subject: ARM: dts: HR2: Fix interrupt types for i2c and PCIe
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit dbe4a39331b7aa8bcac8ef2da780724e1af1619a ]
+
+The i2c and PCIe controllers had an incorrect type which should have
+been set to IRQ_TYPE_LEVEL_HIGH, fix that.
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -264,7 +264,7 @@
+ reg = <0x38000 0x50>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 95 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ };
+
+@@ -279,7 +279,7 @@
+ reg = <0x3b000 0x50>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ };
+ };
+@@ -300,7 +300,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <0>;
+
+@@ -322,10 +322,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 182 IRQ_TYPE_NONE>,
+- <GIC_SPI 183 IRQ_TYPE_NONE>,
+- <GIC_SPI 184 IRQ_TYPE_NONE>,
+- <GIC_SPI 185 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>;
+ brcm,pcie-msi-inten;
+ };
+ };
+@@ -336,7 +336,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <1>;
+
+@@ -358,10 +358,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>,
+- <GIC_SPI 189 IRQ_TYPE_NONE>,
+- <GIC_SPI 190 IRQ_TYPE_NONE>,
+- <GIC_SPI 191 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
+ brcm,pcie-msi-inten;
+ };
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+Date: Thu, 19 Jul 2018 21:38:23 +0200
+Subject: ARM: dts: imx6: RDU2: fix irq type for mv88e6xxx switch
+
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit e01a06c8089132bb4da035c6a83df23916ca3ebf ]
+
+The Marvell switches report their interrupts in a level sensitive way.
+When using edge sensitive detection a race condition in the interrupt
+handler of the swich might result in the OS to miss all future events
+which might make the switch non-functional.
+
+The problem is that both mv88e6xxx_g2_irq_thread_fn() and
+mv88e6xxx_g1_irq_thread_work() sample the irq cause register
+(MV88E6XXX_G2_INT_SRC and MV88E6XXX_G1_STS respectively) once and then
+handle the observed sources. If after sampling but before all observed
+irq sources are handled a new irq source gets active this is not noticed
+by the handler which returns unsuspecting, but the interrupt line stays
+active which prevents the edge detector to kick in.
+
+All device trees but imx6qdl-zii-rdu2 get this right (most of them by
+not specifying an interrupt parent). So fix imx6qdl-zii-rdu2
+accordingly.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: f64992d1a916 ("ARM: dts: imx6: RDU2: Add Switch interrupts")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -672,7 +672,7 @@
+ dsa,member = <0 0>;
+ eeprom-length = <512>;
+ interrupt-parent = <&gpio6>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 11 Jun 2018 15:47:12 -0700
+Subject: ARM: dts: NSP: Fix i2c controller interrupt type
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit a3e32e78a40017756c71ef6dad429ffe3301126a ]
+
+The i2c controller should use IRQ_TYPE_LEVEL_HIGH instead of
+IRQ_TYPE_NONE.
+
+Fixes: 0f9f27a36d09 ("ARM: dts: NSP: Add I2C support to the DT")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -391,7 +391,7 @@
+ reg = <0x38000 0x50>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ dma-coherent;
+ status = "disabled";
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 11 Jun 2018 15:47:13 -0700
+Subject: ARM: dts: NSP: Fix PCIe controllers interrupt types
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 403fde644855bc71318c8db65646383e22653b13 ]
+
+The interrupts for the PCIe controllers should all be of type
+IRQ_TYPE_LEVEL_HIGH instead of IRQ_TYPE_NONE.
+
+Fixes: d71eb9412088 ("ARM: dts: NSP: Add MSI support on PCI")
+Fixes: 522199029fdc ("ARM: dts: NSP: Fix PCIE DT issue")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/bcm-nsp.dtsi | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -496,7 +496,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <0>;
+
+@@ -519,10 +519,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
+- <GIC_SPI 128 IRQ_TYPE_NONE>,
+- <GIC_SPI 129 IRQ_TYPE_NONE>,
+- <GIC_SPI 130 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
+ brcm,pcie-msi-inten;
+ };
+ };
+@@ -533,7 +533,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <1>;
+
+@@ -556,10 +556,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
+- <GIC_SPI 134 IRQ_TYPE_NONE>,
+- <GIC_SPI 135 IRQ_TYPE_NONE>,
+- <GIC_SPI 136 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+ brcm,pcie-msi-inten;
+ };
+ };
+@@ -570,7 +570,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <2>;
+
+@@ -593,10 +593,10 @@
+ compatible = "brcm,iproc-msi";
+ msi-controller;
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
+- <GIC_SPI 140 IRQ_TYPE_NONE>,
+- <GIC_SPI 141 IRQ_TYPE_NONE>,
+- <GIC_SPI 142 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+ brcm,pcie-msi-inten;
+ };
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Pavel Machek <pavel@ucw.cz>
+Date: Mon, 16 Jul 2018 09:10:48 +0200
+Subject: ARM: dts: omap4-droid4: fix dts w.r.t. pwm
+
+From: Pavel Machek <pavel@ucw.cz>
+
+[ Upstream commit d3f6daede246038cf2ea38b78d732f9dd8feb1d6 ]
+
+pwm node should not be under gpio6 node in the device tree.
+
+This fixes detection of the pwm on Droid 4.
+
+Fixes: 6d7bdd328da4 ("ARM: dts: omap4-droid4: update touchscreen")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+[tony@atomide.com: added fixes tag]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4-droid4-xt894.dts | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+@@ -159,13 +159,7 @@
+
+ dais = <&mcbsp2_port>, <&mcbsp3_port>;
+ };
+-};
+-
+-&dss {
+- status = "okay";
+-};
+
+-&gpio6 {
+ pwm8: dmtimer-pwm-8 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&vibrator_direction_pin>;
+@@ -192,7 +186,10 @@
+ pwm-names = "enable", "direction";
+ direction-duty-cycle-ns = <10000000>;
+ };
++};
+
++&dss {
++ status = "okay";
+ };
+
+ &dsi1 {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Tue, 26 Jun 2018 08:37:09 -0300
+Subject: ARM: imx_v4_v5_defconfig: Select ULPI support
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ]
+
+Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
+USB ULPI can be functional on some boards like that use ULPI
+interface.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/imx_v4_v5_defconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/configs/imx_v4_v5_defconfig
++++ b/arch/arm/configs/imx_v4_v5_defconfig
+@@ -141,9 +141,11 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_NOP_USB_XCEIV=y
+ CONFIG_USB_GADGET=y
+ CONFIG_USB_ETH=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Mon, 25 Jun 2018 09:34:03 -0300
+Subject: ARM: imx_v6_v7_defconfig: Select ULPI support
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 157bcc06094c3c5800d3f4676527047b79b618e7 ]
+
+Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
+USB ULPI can be functional on some boards like imx51-babbge.
+
+This fixes a kernel hang in 4.18-rc1 on i.mx51-babbage, caused by commit
+03e6275ae381 ("usb: chipidea: Fix ULPI on imx51").
+
+Suggested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/imx_v6_v7_defconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -294,6 +294,7 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_USB_SERIAL=m
+ CONFIG_USB_SERIAL_GENERIC=y
+ CONFIG_USB_SERIAL_FTDI_SIO=m
+@@ -330,6 +331,7 @@ CONFIG_USB_GADGETFS=m
+ CONFIG_USB_FUNCTIONFS=m
+ CONFIG_USB_MASS_STORAGE=m
+ CONFIG_USB_G_SERIAL=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Daniel Mack <daniel@zonque.org>
+Date: Fri, 6 Jul 2018 22:15:00 +0200
+Subject: ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ]
+
+PXA3xx platforms have 56 interrupts that are stored in two ICMR
+registers. The code in pxa_irq_suspend() and pxa_irq_resume() however
+does a simple division by 32 which only leads to one register being
+saved at suspend and restored at resume time. The NAND interrupt
+setting, for instance, is lost.
+
+Fix this by using DIV_ROUND_UP() instead.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-pxa/irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-pxa/irq.c
++++ b/arch/arm/mach-pxa/irq.c
+@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
+ {
+ int i;
+
+- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ void __iomem *base = irq_base(i);
+
+ saved_icmr[i] = __raw_readl(base + ICMR);
+@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
+ {
+ int i;
+
+- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ void __iomem *base = irq_base(i);
+
+ __raw_writel(saved_icmr[i], base + ICMR);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 22 Jun 2018 09:31:15 +0100
+Subject: arm64: Avoid flush_icache_range() in alternatives patching code
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 429388682dc266e7a693f9c27e3aabd341d55343 ]
+
+The implementation of flush_icache_range() includes instruction sequences
+which are themselves patched at runtime, so it is not safe to call from
+the patching framework.
+
+This patch reworks the alternatives cache-flushing code so that it rolls
+its own internal D-cache maintenance using DC CIVAC before invalidating
+the entire I-cache after all alternatives have been applied at boot.
+Modules don't cause any issues, since flush_icache_range() is safe to
+call by the time they are loaded.
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Reported-by: Rohit Khanna <rokhanna@nvidia.com>
+Cc: Alexander Van Brunt <avanbrunt@nvidia.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/alternative.h | 7 ++++
+ arch/arm64/kernel/alternative.c | 51 ++++++++++++++++++++++++++++++-----
+ arch/arm64/kernel/module.c | 5 +--
+ 3 files changed, 52 insertions(+), 11 deletions(-)
+
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -28,7 +28,12 @@ typedef void (*alternative_cb_t)(struct
+ __le32 *origptr, __le32 *updptr, int nr_inst);
+
+ void __init apply_alternatives_all(void);
+-void apply_alternatives(void *start, size_t length);
++
++#ifdef CONFIG_MODULES
++void apply_alternatives_module(void *start, size_t length);
++#else
++static inline void apply_alternatives_module(void *start, size_t length) { }
++#endif
+
+ #define ALTINSTR_ENTRY(feature,cb) \
+ " .word 661b - .\n" /* label */ \
+--- a/arch/arm64/kernel/alternative.c
++++ b/arch/arm64/kernel/alternative.c
+@@ -122,7 +122,30 @@ static void patch_alternative(struct alt
+ }
+ }
+
+-static void __apply_alternatives(void *alt_region, bool use_linear_alias)
++/*
++ * We provide our own, private D-cache cleaning function so that we don't
++ * accidentally call into the cache.S code, which is patched by us at
++ * runtime.
++ */
++static void clean_dcache_range_nopatch(u64 start, u64 end)
++{
++ u64 cur, d_size, ctr_el0;
++
++ ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0);
++ d_size = 4 << cpuid_feature_extract_unsigned_field(ctr_el0,
++ CTR_DMINLINE_SHIFT);
++ cur = start & ~(d_size - 1);
++ do {
++ /*
++ * We must clean+invalidate to the PoC in order to avoid
++ * Cortex-A53 errata 826319, 827319, 824069 and 819472
++ * (this corresponds to ARM64_WORKAROUND_CLEAN_CACHE)
++ */
++ asm volatile("dc civac, %0" : : "r" (cur) : "memory");
++ } while (cur += d_size, cur < end);
++}
++
++static void __apply_alternatives(void *alt_region, bool is_module)
+ {
+ struct alt_instr *alt;
+ struct alt_region *region = alt_region;
+@@ -145,7 +168,7 @@ static void __apply_alternatives(void *a
+ pr_info_once("patching kernel code\n");
+
+ origptr = ALT_ORIG_PTR(alt);
+- updptr = use_linear_alias ? lm_alias(origptr) : origptr;
++ updptr = is_module ? origptr : lm_alias(origptr);
+ nr_inst = alt->orig_len / AARCH64_INSN_SIZE;
+
+ if (alt->cpufeature < ARM64_CB_PATCH)
+@@ -155,8 +178,20 @@ static void __apply_alternatives(void *a
+
+ alt_cb(alt, origptr, updptr, nr_inst);
+
+- flush_icache_range((uintptr_t)origptr,
+- (uintptr_t)(origptr + nr_inst));
++ if (!is_module) {
++ clean_dcache_range_nopatch((u64)origptr,
++ (u64)(origptr + nr_inst));
++ }
++ }
++
++ /*
++ * The core module code takes care of cache maintenance in
++ * flush_module_icache().
++ */
++ if (!is_module) {
++ dsb(ish);
++ __flush_icache_all();
++ isb();
+ }
+ }
+
+@@ -178,7 +213,7 @@ static int __apply_alternatives_multi_st
+ isb();
+ } else {
+ BUG_ON(alternatives_applied);
+- __apply_alternatives(®ion, true);
++ __apply_alternatives(®ion, false);
+ /* Barriers provided by the cache flushing */
+ WRITE_ONCE(alternatives_applied, 1);
+ }
+@@ -192,12 +227,14 @@ void __init apply_alternatives_all(void)
+ stop_machine(__apply_alternatives_multi_stop, NULL, cpu_online_mask);
+ }
+
+-void apply_alternatives(void *start, size_t length)
++#ifdef CONFIG_MODULES
++void apply_alternatives_module(void *start, size_t length)
+ {
+ struct alt_region region = {
+ .begin = start,
+ .end = start + length,
+ };
+
+- __apply_alternatives(®ion, false);
++ __apply_alternatives(®ion, true);
+ }
++#endif
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -448,9 +448,8 @@ int module_finalize(const Elf_Ehdr *hdr,
+ const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+
+ for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) {
+- if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) {
+- apply_alternatives((void *)s->sh_addr, s->sh_size);
+- }
++ if (strcmp(".altinstructions", secstrs + s->sh_name) == 0)
++ apply_alternatives_module((void *)s->sh_addr, s->sh_size);
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+ if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
+ !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name))
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 12 Jun 2018 13:08:40 +0200
+Subject: arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit dd65a941f6ba473a5cb9d013d57fa43b48450a04 ]
+
+dma_alloc_*() buffers might be exposed to userspace via mmap() call, so
+they should be cleared on allocation. In case of IOMMU-based dma-mapping
+implementation such buffer clearing was missing in the code path for
+DMA_ATTR_FORCE_CONTIGUOUS flag handling, because dma_alloc_from_contiguous()
+doesn't honor __GFP_ZERO flag. This patch fixes this issue. For more
+information on clearing buffers allocated by dma_alloc_* functions,
+see commit 6829e274a623 ("arm64: dma-mapping: always clear allocated
+buffers").
+
+Fixes: 44176bb38fa4 ("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/mm/dma-mapping.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -588,13 +588,14 @@ static void *__iommu_alloc_attrs(struct
+ size >> PAGE_SHIFT);
+ return NULL;
+ }
+- if (!coherent)
+- __dma_flush_area(page_to_virt(page), iosize);
+-
+ addr = dma_common_contiguous_remap(page, size, VM_USERMAP,
+ prot,
+ __builtin_return_address(0));
+- if (!addr) {
++ if (addr) {
++ memset(addr, 0, size);
++ if (!coherent)
++ __dma_flush_area(page_to_virt(page), iosize);
++ } else {
+ iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
+ dma_release_from_contiguous(dev, page,
+ size >> PAGE_SHIFT);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 25 Jun 2018 14:56:53 +0200
+Subject: ARM64: dts: meson-axg: fix ethernet stability issue
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6d28d577510f1a51f7ffbe830fdbf42077e0058b ]
+
+Like the odroid-c2 and wetek, the s400 uses the RTL8211F and seems to
+suffer from the kind of stability issue.
+
+Doing an iperf3 download test, we can see a significant number of LPI
+interrupts on the tx path. After a short while (5 to 15 seconds), the
+network connection dies. If using rootfs over NFS, the connection may
+also break during the boot sequence.
+
+We still don't have a real explanation for this problem so let's disable
+EEE once again.
+
+Fixes: f6f6ac914b82 ("ARM64: dts: meson-axg: enable ethernet for A113D S400 board")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
+@@ -19,9 +19,22 @@
+
+ ðmac {
+ status = "okay";
+- phy-mode = "rgmii";
+ pinctrl-0 = <ð_rgmii_y_pins>;
+ pinctrl-names = "default";
++ phy-handle = <ð_phy0>;
++ phy-mode = "rgmii";
++
++ mdio {
++ compatible = "snps,dwmac-mdio";
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ eth_phy0: ethernet-phy@0 {
++ /* Realtek RTL8211F (0x001cc916) */
++ reg = <0>;
++ eee-broken-1000t;
++ };
++ };
+ };
+
+ &uart_A {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sat, 23 Jun 2018 17:00:56 +0200
+Subject: ARM64: dts: meson-gxl: fix Mali GPU compatible string
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 1c38f4afd5d40234b67635b3c608a4093be04b96 ]
+
+meson-gxl-mali.dtsi is only used on GXL SoCs. Thus it should use the GXL
+specific compatible string instead of the GXBB one.
+For now this is purely cosmetic since the (out-of-tree) lima driver for
+this GPU currently uses the "arm,mali-450" match instead of the SoC
+specific one. However, update the .dts to match the documentation since
+this driver behavior might change in the future.
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
+@@ -6,7 +6,7 @@
+
+ &apb {
+ mali: gpu@c0000 {
+- compatible = "amlogic,meson-gxbb-mali", "arm,mali-450";
++ compatible = "amlogic,meson-gxl-mali", "arm,mali-450";
+ reg = <0x0 0xc0000 0x0 0x40000>;
+ interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Rob Herring <robh@kernel.org>
+Date: Tue, 8 May 2018 10:09:51 -0500
+Subject: arm64: dts: msm8916: fix Coresight ETF graph connections
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 6b4154a655a258c67bcfabbd4c3a06637e74ebcd ]
+
+The ETF input should be connected to the funnel output, and the ETF
+output should be connected to the replicator input. The labels are wrong
+and these got swapped:
+
+Warning (graph_endpoint): /soc/funnel@821000/ports/port@8/endpoint: graph connection to node '/soc/etf@825000/ports/port@1/endpoint' is not bidirectional
+Warning (graph_endpoint): /soc/replicator@824000/ports/port@2/endpoint: graph connection to node '/soc/etf@825000/ports/port@0/endpoint' is not bidirectional
+
+Fixes: 7c10da373698 ("arm64: dts: qcom: Add msm8916 CoreSight components")
+Cc: Ivan T. Ivanov <ivan.ivanov@linaro.org>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Andy Gross <andy.gross@linaro.org>
+Cc: David Brown <david.brown@linaro.org>
+Cc: linux-arm-msm@vger.kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1191,14 +1191,14 @@
+
+ port@0 {
+ reg = <0>;
+- etf_out: endpoint {
++ etf_in: endpoint {
+ slave-mode;
+ remote-endpoint = <&funnel0_out>;
+ };
+ };
+ port@1 {
+ reg = <0>;
+- etf_in: endpoint {
++ etf_out: endpoint {
+ remote-endpoint = <&replicator_in>;
+ };
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Tue, 12 Jun 2018 13:21:29 -0700
+Subject: arm64: dts: ns2: Fix I2C controller interrupt type
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+[ Upstream commit e605c287deed45624e8d35a15e3f0b4faab1a62d ]
+
+Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom NS2
+SoC.
+
+Fixes: 7ac674e8df7a ("arm64: dts: Add I2C nodes for NS2")
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -566,7 +566,7 @@
+ reg = <0x66080000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
+@@ -594,7 +594,7 @@
+ reg = <0x660b0000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Tue, 12 Jun 2018 13:21:30 -0700
+Subject: arm64: dts: ns2: Fix PCIe controller interrupt type
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+[ Upstream commit d0b8aed9e80ab526dbb04020bfc94ecea7bddb44 ]
+
+Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
+NS2 SoC.
+
+Fixes: fd5e5dd56a2f ("arm64: dts: Add PCIe0 and PCIe4 DT nodes for NS2")
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -118,7 +118,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <0>;
+
+@@ -149,7 +149,7 @@
+
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0>;
+- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>;
++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>;
+
+ linux,pci-domain = <4>;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Scott Branden <scott.branden@broadcom.com>
+Date: Fri, 18 May 2018 08:21:20 -0700
+Subject: arm64: dts: specify 1.8V EMMC capabilities for bcm958742k
+
+From: Scott Branden <scott.branden@broadcom.com>
+
+[ Upstream commit eba92503e980c08ac353d0d669d0bb143979abcd ]
+
+Specify 1.8V EMMC capabilities for bcm958742k board to indicate support
+for UHS mode.
+
+Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC")
+Signed-off-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
+@@ -43,6 +43,10 @@
+ enet-phy-lane-swap;
+ };
+
++&sdio0 {
++ mmc-ddr-1_8v;
++};
++
+ &uart2 {
+ status = "okay";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Scott Branden <scott.branden@broadcom.com>
+Date: Tue, 22 May 2018 10:01:39 -0700
+Subject: arm64: dts: specify 1.8V EMMC capabilities for bcm958742t
+
+From: Scott Branden <scott.branden@broadcom.com>
+
+[ Upstream commit 37c2bd81a86ebb1cc934bf52a29c33d6f9abff7f ]
+
+Specify 1.8V EMMC capabilities for bcm958742t board to indicate support
+for UHS mode.
+
+Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC")
+Signed-off-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
+@@ -42,3 +42,7 @@
+ &gphy0 {
+ enet-phy-lane-swap;
+ };
++
++&sdio0 {
++ mmc-ddr-1_8v;
++};
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Tue, 12 Jun 2018 13:21:31 -0700
+Subject: arm64: dts: Stingray: Fix I2C controller interrupt type
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+[ Upstream commit 75af23c4736c5633894ea0baf9bca1cf6b248ca4 ]
+
+Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
+Stingray SoC.
+
+Fixes: 1256ea18875d ("arm64: dts: Add I2C DT nodes for Stingray SoC")
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -409,7 +409,7 @@
+ reg = <0x000b0000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 177 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 177 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
+@@ -453,7 +453,7 @@
+ reg = <0x000e0000 0x100>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- interrupts = <GIC_SPI 178 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 178 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <100000>;
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
+Date: Tue, 19 Jun 2018 13:12:05 +0900
+Subject: arm64: dts: uniphier: fix widget name of headphone for LD11/LD20 boards
+
+From: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
+
+[ Upstream commit 86676c4685f774d818f7a6c401c925bbf2a92903 ]
+
+This patch fixes wrong name of headphone widget for receiving events
+of insert/remove headphone plug from simple-card or audio-graph-card.
+
+If we use wrong widget name then we get warning messages such as
+"asoc-audio-graph-card sound: ASoC: DAPM unknown pin Headphones"
+when the plug is inserted or removed from headphone jack.
+
+Fixes: fb21a0acaa2b7 ("arm64: dts: uniphier: add sound node")
+Signed-off-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts | 2 +-
+ arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
+@@ -54,7 +54,7 @@
+ sound {
+ compatible = "audio-graph-card";
+ label = "UniPhier LD11";
+- widgets = "Headphone", "Headphone Jack";
++ widgets = "Headphone", "Headphones";
+ dais = <&i2s_port2
+ &i2s_port3
+ &i2s_port4
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
+@@ -54,7 +54,7 @@
+ sound {
+ compatible = "audio-graph-card";
+ label = "UniPhier LD20";
+- widgets = "Headphone", "Headphone Jack";
++ widgets = "Headphone", "Headphones";
+ dais = <&i2s_port2
+ &i2s_port3
+ &i2s_port4
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+Date: Tue, 12 Jun 2018 17:07:37 +0800
+Subject: arm64: make secondary_start_kernel() notrace
+
+From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+
+[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ]
+
+We can't call function trace hook before setup percpu offset.
+When entering secondary_start_kernel(), percpu offset has not
+been initialized. So this lead hotplug malfunction.
+Here is the flow to reproduce this bug:
+
+echo 0 > /sys/devices/system/cpu/cpu1/online
+echo function > /sys/kernel/debug/tracing/current_tracer
+echo 1 > /sys/kernel/debug/tracing/tracing_on
+echo 1 > /sys/devices/system/cpu/cpu1/online
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -179,7 +179,7 @@ int __cpu_up(unsigned int cpu, struct ta
+ * This is the secondary CPU boot entry. We're using this CPUs
+ * idle thread stack, but a set of temporary page tables.
+ */
+-asmlinkage void secondary_start_kernel(void)
++asmlinkage notrace void secondary_start_kernel(void)
+ {
+ u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK;
+ struct mm_struct *mm = &init_mm;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ryan Hsu <ryanhsu@codeaurora.org>
+Date: Mon, 18 Jun 2018 17:00:04 +0300
+Subject: ath10k: update the phymode along with bandwidth change request
+
+From: Ryan Hsu <ryanhsu@codeaurora.org>
+
+[ Upstream commit 9191fc2a431bade3dedc9ad17759495a9f82f41b ]
+
+In the case of Station connects to AP with narrower bandwidth at beginning.
+And later the AP changes the bandwidth to winder bandwidth, the AP will
+beacon with wider bandwidth IE, eg VHT20->VHT40->VHT80 or VHT40->VHT80.
+
+Since the supported BANDWIDTH will be limited by the PHYMODE, so while
+Station receives the bandwidth change request, it will also need to
+reconfigure the PHYMODE setting to firmware instead of just configuring
+the BANDWIDTH info, otherwise it'll trigger a firmware crash with
+non-support bandwidth.
+
+The issue was observed in WLAN.RM.4.4.1-00051-QCARMSWP-1, QCA6174 with
+below scenario:
+
+AP xxx changed bandwidth, new config is 5200 MHz, width 2 (5190/0 MHz)
+disconnect from AP xxx for new auth to yyy
+RX ReassocResp from xxx (capab=0x1111 status=0 aid=102)
+associated
+
+....
+
+AP xxx changed bandwidth, new config is 5200 MHz, width 2 (5190/0 MHz)
+AP xxx changed bandwidth, new config is 5200 MHz, width 3 (5210/0 MHz)
+
+....
+
+firmware register dump:
+[00]: 0x05030000 0x000015B3 0x00987291 0x00955B31
+[04]: 0x00987291 0x00060730 0x00000004 0x00000001
+[08]: 0x004089F0 0x00955A00 0x000A0B00 0x00400000
+[12]: 0x00000009 0x00000000 0x00952CD0 0x00952CE6
+[16]: 0x00952CC4 0x0098E25F 0x00000000 0x0091080D
+[20]: 0x40987291 0x0040E7A8 0x00000000 0x0041EE3C
+[24]: 0x809ABF05 0x0040E808 0x00000000 0xC0987291
+[28]: 0x809A650C 0x0040E948 0x0041FE40 0x004345C4
+[32]: 0x809A5C63 0x0040E988 0x0040E9AC 0x0042D1A8
+[36]: 0x8091D252 0x0040E9A8 0x00000002 0x00000001
+[40]: 0x809FDA9D 0x0040EA58 0x0043D554 0x0042D554
+[44]: 0x809F8B22 0x0040EA78 0x0043D554 0x00000001
+[48]: 0x80911210 0x0040EAC8 0x00000010 0x004041D0
+[52]: 0x80911154 0x0040EB28 0x00400000 0x00000000
+[56]: 0x8091122D 0x0040EB48 0x00000000 0x00400600
+
+Reported-by: Rouven Czerwinski <rouven@czerwinskis.de>
+Tested-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Ryan Hsu <ryanhsu@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 16 ++++++++++++++--
+ drivers/net/wireless/ath/ath10k/wmi.h | 1 +
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6018,8 +6018,19 @@ static void ath10k_sta_rc_update_wk(stru
+ ath10k_mac_max_vht_nss(vht_mcs_mask)));
+
+ if (changed & IEEE80211_RC_BW_CHANGED) {
+- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
+- sta->addr, bw);
++ enum wmi_phy_mode mode;
++
++ mode = chan_to_phymode(&def);
++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
++ sta->addr, bw, mode);
++
++ err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
++ WMI_PEER_PHYMODE, mode);
++ if (err) {
++ ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n",
++ sta->addr, mode, err);
++ goto exit;
++ }
+
+ err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
+ WMI_PEER_CHAN_WIDTH, bw);
+@@ -6060,6 +6071,7 @@ static void ath10k_sta_rc_update_wk(stru
+ sta->addr);
+ }
+
++exit:
+ mutex_unlock(&ar->conf_mutex);
+ }
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6098,6 +6098,7 @@ enum wmi_peer_param {
+ WMI_PEER_NSS = 0x5,
+ WMI_PEER_USE_4ADDR = 0x6,
+ WMI_PEER_DEBUG = 0xa,
++ WMI_PEER_PHYMODE = 0xd,
+ WMI_PEER_DUMMY_VAR = 0xff, /* dummy parameter for STA PS workaround */
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Linus Lüssing" <linus.luessing@c0d3.blue>
+Date: Thu, 7 Jun 2018 00:46:23 +0200
+Subject: batman-adv: Avoid storing non-TT-sync flags on singular entries too
+
+From: "Linus Lüssing" <linus.luessing@c0d3.blue>
+
+[ Upstream commit 4a519b83da16927fb98fd32b0f598e639d1f1859 ]
+
+Since commit 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies")
+TT sync flags and TT non-sync'd flags are supposed to be stored
+separately.
+
+The previous patch missed to apply this separation on a TT entry with
+only a single TT orig entry.
+
+This is a minor fix because with only a single TT orig entry the DDoS
+issue the former patch solves does not apply.
+
+Fixes: 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/translation-table.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -1705,7 +1705,8 @@ static bool batadv_tt_global_add(struct
+ ether_addr_copy(common->addr, tt_addr);
+ common->vid = vid;
+
+- common->flags = flags;
++ common->flags = flags & (~BATADV_TT_SYNC_MASK);
++
+ tt_global_entry->roam_at = 0;
+ /* node must store current time in case of roaming. This is
+ * needed to purge this entry out on timeout (if nobody claims
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sat, 2 Jun 2018 17:26:34 +0200
+Subject: batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit b5685d2687d6612adf5eac519eb7008f74dfd1ec ]
+
+A reference for the best gateway is taken when the list of gateways in the
+mesh is sent via netlink. This is necessary to check whether the currently
+dumped entry is the currently selected gateway or not. This information is
+then transferred as flag BATADV_ATTR_FLAG_BEST.
+
+After the comparison of the current entry is done,
+batadv_iv_gw_dump_entry() has to decrease the reference counter again.
+Otherwise the reference will be held and thus prevents a proper shutdown of
+the batman-adv interfaces (and some of the interfaces enslaved in it).
+
+Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations")
+Reported-by: Andreas Ziegler <dev@andreas-ziegler.de>
+Tested-by: Andreas Ziegler <dev@andreas-ziegler.de>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/bat_iv_ogm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struc
+ {
+ struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ struct batadv_neigh_node *router;
+- struct batadv_gw_node *curr_gw;
++ struct batadv_gw_node *curr_gw = NULL;
+ int ret = 0;
+ void *hdr;
+
+@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struc
+ ret = 0;
+
+ out:
++ if (curr_gw)
++ batadv_gw_node_put(curr_gw);
+ if (router_ifinfo)
+ batadv_neigh_ifinfo_put(router_ifinfo);
+ if (router)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sat, 2 Jun 2018 17:26:35 +0200
+Subject: batman-adv: Fix bat_v best gw refcnt after netlink dump
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 9713cb0cf19f1cec6c007e3b37be0697042b6720 ]
+
+A reference for the best gateway is taken when the list of gateways in the
+mesh is sent via netlink. This is necessary to check whether the currently
+dumped entry is the currently selected gateway or not. This information is
+then transferred as flag BATADV_ATTR_FLAG_BEST.
+
+After the comparison of the current entry is done,
+batadv_v_gw_dump_entry() has to decrease the reference counter again.
+Otherwise the reference will be held and thus prevents a proper shutdown of
+the batman-adv interfaces (and some of the interfaces enslaved in it).
+
+Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/bat_v.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/bat_v.c
++++ b/net/batman-adv/bat_v.c
+@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct
+ {
+ struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ struct batadv_neigh_node *router;
+- struct batadv_gw_node *curr_gw;
++ struct batadv_gw_node *curr_gw = NULL;
+ int ret = 0;
+ void *hdr;
+
+@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct
+ ret = 0;
+
+ out:
++ if (curr_gw)
++ batadv_gw_node_put(curr_gw);
+ if (router_ifinfo)
+ batadv_neigh_ifinfo_put(router_ifinfo);
+ if (router)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 1 Jun 2018 19:24:23 +0200
+Subject: batman-adv: Fix debugfs path for renamed hardif
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 36dc621ceca1be3ec885aeade5fdafbbcc452a6d ]
+
+batman-adv is creating special debugfs directories in the init
+net_namespace for each valid hard-interface (net_device). But it is
+possible to rename a net_device to a completely different name then the
+original one.
+
+It can therefore happen that a user registers a new net_device which gets
+the name "wlan0" assigned by default. batman-adv is also adding a new
+directory under $debugfs/batman-adv/ with the name "wlan0".
+
+The user then decides to rename this device to "wl_pri" and registers a
+different device. The kernel may now decide to use the name "wlan0" again
+for this new device. batman-adv will detect it as a valid net_device and
+tries to create a directory with the name "wlan0" under
+$debugfs/batman-adv/. But there already exists one with this name under
+this path and thus this fails. batman-adv will detect a problem and
+rollback the registering of this device.
+
+batman-adv must therefore take care of renaming the debugfs directories
+for hard-interfaces whenever it detects such a net_device rename.
+
+Fixes: 5bc7c1eb44f2 ("batman-adv: add debugfs structure for information per interface")
+Reported-by: John Soros <sorosj@gmail.com>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/debugfs.c | 20 ++++++++++++++++++++
+ net/batman-adv/debugfs.h | 6 ++++++
+ net/batman-adv/hard-interface.c | 3 +++
+ 3 files changed, 29 insertions(+)
+
+--- a/net/batman-adv/debugfs.c
++++ b/net/batman-adv/debugfs.c
+@@ -19,6 +19,7 @@
+ #include "debugfs.h"
+ #include "main.h"
+
++#include <linux/dcache.h>
+ #include <linux/debugfs.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+@@ -344,6 +345,25 @@ out:
+ }
+
+ /**
++ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif
++ * @hard_iface: hard interface which was renamed
++ */
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
++{
++ const char *name = hard_iface->net_dev->name;
++ struct dentry *dir;
++ struct dentry *d;
++
++ dir = hard_iface->debug_dir;
++ if (!dir)
++ return;
++
++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
++ if (!d)
++ pr_err("Can't rename debugfs dir to %s\n", name);
++}
++
++/**
+ * batadv_debugfs_del_hardif() - delete the base directory for a hard interface
+ * in debugfs.
+ * @hard_iface: hard interface which is deleted.
+--- a/net/batman-adv/debugfs.h
++++ b/net/batman-adv/debugfs.h
+@@ -32,6 +32,7 @@ void batadv_debugfs_destroy(void);
+ int batadv_debugfs_add_meshif(struct net_device *dev);
+ void batadv_debugfs_del_meshif(struct net_device *dev);
+ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface);
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface);
+ void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface);
+
+ #else
+@@ -60,6 +61,11 @@ int batadv_debugfs_add_hardif(struct bat
+ }
+
+ static inline
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
++{
++}
++
++static inline
+ void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface)
+ {
+ }
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -1051,6 +1051,9 @@ static int batadv_hard_if_event(struct n
+ if (batadv_is_wifi_hardif(hard_iface))
+ hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
+ break;
++ case NETDEV_CHANGENAME:
++ batadv_debugfs_rename_hardif(hard_iface);
++ break;
+ default:
+ break;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 1 Jun 2018 19:24:24 +0200
+Subject: batman-adv: Fix debugfs path for renamed softif
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 6da7be7d24b2921f8215473ba7552796dff05fe1 ]
+
+batman-adv is creating special debugfs directories in the init
+net_namespace for each created soft-interface (batadv net_device). But it
+is possible to rename a net_device to a completely different name then the
+original one.
+
+It can therefore happen that a user registers a new batadv net_device with
+the name "bat0". batman-adv is then also adding a new directory under
+$debugfs/batman-adv/ with the name "wlan0".
+
+The user then decides to rename this device to "bat1" and registers a
+different batadv device with the name "bat0". batman-adv will then try to
+create a directory with the name "bat0" under $debugfs/batman-adv/ again.
+But there already exists one with this name under this path and thus this
+fails. batman-adv will detect a problem and rollback the registering of
+this device.
+
+batman-adv must therefore take care of renaming the debugfs directories for
+soft-interfaces whenever it detects such a net_device rename.
+
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/debugfs.c | 20 ++++++++++++++++++++
+ net/batman-adv/debugfs.h | 5 +++++
+ net/batman-adv/hard-interface.c | 34 ++++++++++++++++++++++++++++------
+ 3 files changed, 53 insertions(+), 6 deletions(-)
+
+--- a/net/batman-adv/debugfs.c
++++ b/net/batman-adv/debugfs.c
+@@ -434,6 +434,26 @@ out:
+ }
+
+ /**
++ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif
++ * @dev: net_device which was renamed
++ */
++void batadv_debugfs_rename_meshif(struct net_device *dev)
++{
++ struct batadv_priv *bat_priv = netdev_priv(dev);
++ const char *name = dev->name;
++ struct dentry *dir;
++ struct dentry *d;
++
++ dir = bat_priv->debug_dir;
++ if (!dir)
++ return;
++
++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
++ if (!d)
++ pr_err("Can't rename debugfs dir to %s\n", name);
++}
++
++/**
+ * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries
+ * @dev: netdev struct of the soft interface
+ */
+--- a/net/batman-adv/debugfs.h
++++ b/net/batman-adv/debugfs.h
+@@ -30,6 +30,7 @@ struct net_device;
+ void batadv_debugfs_init(void);
+ void batadv_debugfs_destroy(void);
+ int batadv_debugfs_add_meshif(struct net_device *dev);
++void batadv_debugfs_rename_meshif(struct net_device *dev);
+ void batadv_debugfs_del_meshif(struct net_device *dev);
+ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface);
+ void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface);
+@@ -50,6 +51,10 @@ static inline int batadv_debugfs_add_mes
+ return 0;
+ }
+
++static inline void batadv_debugfs_rename_meshif(struct net_device *dev)
++{
++}
++
+ static inline void batadv_debugfs_del_meshif(struct net_device *dev)
+ {
+ }
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(voi
+ rtnl_unlock();
+ }
+
++/**
++ * batadv_hard_if_event_softif() - Handle events for soft interfaces
++ * @event: NETDEV_* event to handle
++ * @net_dev: net_device which generated an event
++ *
++ * Return: NOTIFY_* result
++ */
++static int batadv_hard_if_event_softif(unsigned long event,
++ struct net_device *net_dev)
++{
++ struct batadv_priv *bat_priv;
++
++ switch (event) {
++ case NETDEV_REGISTER:
++ batadv_sysfs_add_meshif(net_dev);
++ bat_priv = netdev_priv(net_dev);
++ batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
++ break;
++ case NETDEV_CHANGENAME:
++ batadv_debugfs_rename_meshif(net_dev);
++ break;
++ }
++
++ return NOTIFY_DONE;
++}
++
+ static int batadv_hard_if_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+ {
+@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct n
+ struct batadv_hard_iface *primary_if = NULL;
+ struct batadv_priv *bat_priv;
+
+- if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) {
+- batadv_sysfs_add_meshif(net_dev);
+- bat_priv = netdev_priv(net_dev);
+- batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
+- return NOTIFY_DONE;
+- }
++ if (batadv_softif_is_valid(net_dev))
++ return batadv_hard_if_event_softif(event, net_dev);
+
+ hard_iface = batadv_hardif_get_by_netdev(net_dev);
+ if (!hard_iface && (event == NETDEV_REGISTER ||
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Linus Lüssing" <linus.luessing@c0d3.blue>
+Date: Thu, 7 Jun 2018 00:46:24 +0200
+Subject: batman-adv: Fix multicast TT issues with bogus ROAM flags
+
+From: "Linus Lüssing" <linus.luessing@c0d3.blue>
+
+[ Upstream commit a44ebeff6bbd6ef50db41b4195fca87b21aefd20 ]
+
+When a (broken) node wrongly sends multicast TT entries with a ROAM
+flag then this causes any receiving node to drop all entries for the
+same multicast MAC address announced by other nodes, leading to
+packet loss.
+
+Fix this DoS vector by only storing TT sync flags. For multicast TT
+non-sync'ing flag bits like ROAM are unused so far anyway.
+
+Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
+Reported-by: Leonardo Mörlein <me@irrelefant.net>
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/translation-table.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -1705,7 +1705,8 @@ static bool batadv_tt_global_add(struct
+ ether_addr_copy(common->addr, tt_addr);
+ common->vid = vid;
+
+- common->flags = flags & (~BATADV_TT_SYNC_MASK);
++ if (!is_multicast_ether_addr(common->addr))
++ common->flags = flags & (~BATADV_TT_SYNC_MASK);
+
+ tt_global_entry->roam_at = 0;
+ /* node must store current time in case of roaming. This is
+@@ -1769,7 +1770,8 @@ static bool batadv_tt_global_add(struct
+ * TT_CLIENT_TEMP, therefore they have to be copied in the
+ * client entry
+ */
+- common->flags |= flags & (~BATADV_TT_SYNC_MASK);
++ if (!is_multicast_ether_addr(common->addr))
++ common->flags |= flags & (~BATADV_TT_SYNC_MASK);
+
+ /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
+ * one originator left in the list and we previously received a
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 20 Jun 2018 13:45:05 +0300
+Subject: blk-mq-debugfs: Off by one in blk_mq_rq_state_name()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a1e79188628580465ac6d7a93a313336ee3364f1 ]
+
+If rq_state == ARRAY_SIZE() then we read one element beyond the end of
+the blk_mq_rq_state_name_array[] array.
+
+Fixes: ec6dcf63c55c ("blk-mq-debugfs: Show more request state information")
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq-debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -357,7 +357,7 @@ static const char *const blk_mq_rq_state
+
+ static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
+ {
+- if (WARN_ON_ONCE((unsigned int)rq_state >
++ if (WARN_ON_ONCE((unsigned int)rq_state >=
+ ARRAY_SIZE(blk_mq_rq_state_name_array)))
+ return "(?)";
+ return blk_mq_rq_state_name_array[rq_state];
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jens Axboe <axboe@kernel.dk>
+Date: Thu, 28 Jun 2018 11:54:01 -0600
+Subject: blk-mq: don't queue more if we get a busy return
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 1f57f8d442f8017587eeebd8617913bfc3661d3d ]
+
+Some devices have different queue limits depending on the type of IO. A
+classic case is SATA NCQ, where some commands can queue, but others
+cannot. If we have NCQ commands inflight and encounter a non-queueable
+command, the driver returns busy. Currently we attempt to dispatch more
+from the scheduler, if we were able to queue some commands. But for the
+case where we ended up stopping due to BUSY, we should not attempt to
+retrieve more from the scheduler. If we do, we can get into a situation
+where we attempt to queue a non-queueable command, get BUSY, then
+successfully retrieve more commands from that scheduler and queue those.
+This can repeat forever, starving the non-queuable command indefinitely.
+
+Fix this by NOT attempting to pull more commands from the scheduler, if
+we get a BUSY return. This should also be more optimal in terms of
+letting requests stay in the scheduler for as long as possible, if we
+get a BUSY due to the regular out-of-tags condition.
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1174,6 +1174,9 @@ static bool blk_mq_mark_tag_wait(struct
+
+ #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */
+
++/*
++ * Returns true if we did some work AND can potentially do more.
++ */
+ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ bool got_budget)
+ {
+@@ -1304,8 +1307,17 @@ bool blk_mq_dispatch_rq_list(struct requ
+ blk_mq_run_hw_queue(hctx, true);
+ else if (needs_restart && (ret == BLK_STS_RESOURCE))
+ blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
++
++ return false;
+ }
+
++ /*
++ * If the host/device is unable to accept more work, inform the
++ * caller of that.
++ */
++ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
++ return false;
++
+ return (queued + errors) != 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 20 Jun 2018 13:41:51 +0300
+Subject: block: sed-opal: Fix a couple off by one bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ce042c183bcb94eb2919e8036473a1fc203420f9 ]
+
+resp->num is the number of tokens in resp->tok[]. It gets set in
+response_parse(). So if n == resp->num then we're reading beyond the
+end of the data.
+
+Fixes: 455a7b238cd6 ("block: Add Sed-opal library")
+Reviewed-by: Scott Bauer <scott.bauer@intel.com>
+Tested-by: Scott Bauer <scott.bauer@intel.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/sed-opal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/sed-opal.c
++++ b/block/sed-opal.c
+@@ -877,7 +877,7 @@ static size_t response_get_string(const
+ return 0;
+ }
+
+- if (n > resp->num) {
++ if (n >= resp->num) {
+ pr_debug("Response has %d tokens. Can't access %d\n",
+ resp->num, n);
+ return 0;
+@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct
+ return 0;
+ }
+
+- if (n > resp->num) {
++ if (n >= resp->num) {
+ pr_debug("Response has %d tokens. Can't access %d\n",
+ resp->num, n);
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Thu, 28 Jun 2018 04:52:15 -0700
+Subject: bnx2x: Fix receiving tx-timeout in error or recovery state.
+
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+
+[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ]
+
+Driver performs the internal reload when it receives tx-timeout event from
+the OS. Internal reload might fail in some scenarios e.g., fatal HW issues.
+In such cases OS still see the link, which would result in undesirable
+functionalities such as re-generation of tx-timeouts.
+The patch addresses this issue by indicating the link-down to OS when
+tx-timeout is detected, and keeping the link in down state till the
+internal reload is successful.
+
+Please consider applying it to 'net' branch.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++
+ 3 files changed, 13 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1533,6 +1533,7 @@ struct bnx2x {
+ struct link_vars link_vars;
+ u32 link_cnt;
+ struct bnx2x_link_report_data last_reported_link;
++ bool force_link_down;
+
+ struct mdio_if_info mdio;
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1261,6 +1261,11 @@ void __bnx2x_link_report(struct bnx2x *b
+ {
+ struct bnx2x_link_report_data cur_data;
+
++ if (bp->force_link_down) {
++ bp->link_vars.link_up = 0;
++ return;
++ }
++
+ /* reread mf_cfg */
+ if (IS_PF(bp) && !CHIP_IS_E1(bp))
+ bnx2x_read_mf_cfg(bp);
+@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int
+ bp->pending_max = 0;
+ }
+
++ bp->force_link_down = false;
+ if (bp->port.pmf) {
+ rc = bnx2x_initial_phy_init(bp, load_mode);
+ if (rc)
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct wo
+ bp->sp_rtnl_state = 0;
+ smp_mb();
+
++ /* Immediately indicate link as down */
++ bp->link_vars.link_up = 0;
++ bp->force_link_down = true;
++ netif_carrier_off(bp->dev);
++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
++
+ bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
+ /* When ret value shows failure of allocation failure,
+ * the nic is rebooted again. If open still fails, a error
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Mon, 9 Jul 2018 02:24:49 -0400
+Subject: bnxt_en: Always set output parameters in bnxt_get_max_rings().
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 78f058a4aa0f2280dc4d45d2c4a95728398ef857 ]
+
+The current code returns -ENOMEM and does not bother to set the output
+parameters to 0 when no rings are available. Some callers, such as
+bnxt_get_channels() will display garbage ring numbers when that happens.
+Fix it by always setting the output parameters.
+
+Fixes: 6e6c5a57fbe1 ("bnxt_en: Modify bnxt_get_max_rings() to support shared or non shared rings.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8467,11 +8467,11 @@ int bnxt_get_max_rings(struct bnxt *bp,
+ int rx, tx, cp;
+
+ _bnxt_get_max_rings(bp, &rx, &tx, &cp);
++ *max_rx = rx;
++ *max_tx = tx;
+ if (!rx || !tx || !cp)
+ return -ENOMEM;
+
+- *max_rx = rx;
+- *max_tx = tx;
+ return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Mon, 9 Jul 2018 02:24:51 -0400
+Subject: bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 30f529473ec962102e8bcd33a6a04f1e1b490ae2 ]
+
+Calling bnxt_set_max_func_irqs() to modify the max IRQ count requested or
+freed by the RDMA driver is flawed. The max IRQ count is checked when
+re-initializing the IRQ vectors and this can happen multiple times
+during ifup or ethtool -L. If the max IRQ is reduced and the RDMA
+driver is operational, we may not initailize IRQs correctly. This
+problem shows up on VFs with very small number of MSIX.
+
+There is no other logic that relies on the IRQ count excluding the ones
+used by RDMA. So we fix it by just removing the call to subtract or
+add the IRQs used by RDMA.
+
+Fixes: a588e4580a7e ("bnxt_en: Add interface to support RDMA driver.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 -
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 2 --
+ 3 files changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5915,7 +5915,7 @@ unsigned int bnxt_get_max_func_irqs(stru
+ return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings);
+ }
+
+-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
++static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
+ {
+ bp->hw_resc.max_irqs = max_irqs;
+ }
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1455,7 +1455,6 @@ void bnxt_set_max_func_stat_ctxs(struct
+ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
+ void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
+ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
+-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max);
+ int bnxt_get_avail_msix(struct bnxt *bp, int num);
+ int bnxt_reserve_rings(struct bnxt *bp);
+ void bnxt_tx_disable(struct bnxt *bp);
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnx
+ edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
+ }
+ bnxt_fill_msix_vecs(bp, ent);
+- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix);
+ bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
+ edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
+ return avail_msix;
+@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bn
+ msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
+ bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
+ edev->ulp_tbl[ulp_id].msix_requested = 0;
+- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested);
+ edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
+ if (netif_running(dev)) {
+ bnxt_close_nic(bp, true, false);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vikas Gupta <vikas.gupta@broadcom.com>
+Date: Mon, 9 Jul 2018 02:24:52 -0400
+Subject: bnxt_en: Fix for system hang if request_irq fails
+
+From: Vikas Gupta <vikas.gupta@broadcom.com>
+
+[ Upstream commit c58387ab1614f6d7fb9e244f214b61e7631421fc ]
+
+Fix bug in the error code path when bnxt_request_irq() returns failure.
+bnxt_disable_napi() should not be called in this error path because
+NAPI has not been enabled yet.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6875,7 +6875,7 @@ static int __bnxt_open_nic(struct bnxt *
+ rc = bnxt_request_irq(bp);
+ if (rc) {
+ netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
+- goto open_err;
++ goto open_err_irq;
+ }
+ }
+
+@@ -6913,6 +6913,8 @@ static int __bnxt_open_nic(struct bnxt *
+
+ open_err:
+ bnxt_disable_napi(bp);
++
++open_err_irq:
+ bnxt_del_napi(bp);
+
+ open_err_free_mem:
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Mon, 9 Jul 2018 02:24:48 -0400
+Subject: bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 07f4fde53d12eb8d921b465bb298e964e0bdc38c ]
+
+If there aren't enough RX rings available, the driver will attempt to
+use a single RX ring without the aggregation ring. If that also
+fails, the BNXT_FLAG_AGG_RINGS flag is cleared but the other ring
+parameters are not set consistently to reflect that. If more RX
+rings become available at the next open, the RX rings will be in
+an inconsistent state and may crash when freeing the RX rings.
+
+Fix it by restoring the BNXT_FLAG_AGG_RINGS if not enough RX rings are
+available to run without aggregation rings.
+
+Fixes: bdbd1eb59c56 ("bnxt_en: Handle no aggregation ring gracefully.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8485,8 +8485,11 @@ static int bnxt_get_dflt_rings(struct bn
+ /* Not enough rings, try disabling agg rings. */
+ bp->flags &= ~BNXT_FLAG_AGG_RINGS;
+ rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
+- if (rc)
++ if (rc) {
++ /* set BNXT_FLAG_AGG_RINGS back for consistency */
++ bp->flags |= BNXT_FLAG_AGG_RINGS;
+ return rc;
++ }
+ bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
+ bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
+ bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+Date: Mon, 9 Jul 2018 02:24:47 -0400
+Subject: bnxt_en: Fix the vlan_tci exact match check.
+
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+
+[ Upstream commit e32d4e60b350124065e0ffd9c91ac13a439aee9a ]
+
+It is possible that OVS may set don’t care for DEI/CFI bit in
+vlan_tci mask. Hence, checking for vlan_tci exact match will endup
+in a vlan flow rejection.
+
+This patch fixes the problem by checking for vlan_pcp and vid
+separately, instead of checking for the entire vlan_tci.
+
+Fixes: e85a9be93cf1 (bnxt_en: do not allow wildcard matches for L2 flows)
+Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 30 ++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+@@ -27,6 +27,15 @@
+ #define BNXT_FID_INVALID 0xffff
+ #define VLAN_TCI(vid, prio) ((vid) | ((prio) << VLAN_PRIO_SHIFT))
+
++#define is_vlan_pcp_wildcarded(vlan_tci_mask) \
++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000)
++#define is_vlan_pcp_exactmatch(vlan_tci_mask) \
++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK)
++#define is_vlan_pcp_zero(vlan_tci) \
++ ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000)
++#define is_vid_exactmatch(vlan_tci_mask) \
++ ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK)
++
+ /* Return the dst fid of the func for flow forwarding
+ * For PFs: src_fid is the fid of the PF
+ * For VF-reps: src_fid the fid of the VF
+@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, in
+ return true;
+ }
+
++static bool is_vlan_tci_allowed(__be16 vlan_tci_mask,
++ __be16 vlan_tci)
++{
++ /* VLAN priority must be either exactly zero or fully wildcarded and
++ * VLAN id must be exact match.
++ */
++ if (is_vid_exactmatch(vlan_tci_mask) &&
++ ((is_vlan_pcp_exactmatch(vlan_tci_mask) &&
++ is_vlan_pcp_zero(vlan_tci)) ||
++ is_vlan_pcp_wildcarded(vlan_tci_mask)))
++ return true;
++
++ return false;
++}
++
+ static bool bits_set(void *key, int len)
+ {
+ const u8 *p = key;
+@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct b
+ /* Currently VLAN fields cannot be partial wildcard */
+ if (bits_set(&flow->l2_key.inner_vlan_tci,
+ sizeof(flow->l2_key.inner_vlan_tci)) &&
+- !is_exactmatch(&flow->l2_mask.inner_vlan_tci,
+- sizeof(flow->l2_mask.inner_vlan_tci))) {
+- netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n");
++ !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci,
++ flow->l2_key.inner_vlan_tci)) {
++ netdev_info(bp->dev, "Unsupported VLAN TCI\n");
+ return false;
+ }
+ if (bits_set(&flow->l2_key.inner_vlan_tpid,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Thu, 5 Jul 2018 08:49:59 -0700
+Subject: bpf: fix sk_skb programs without skb->dev assigned
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 0c6bc6e531a6db36f49622f1f115770160f7afb0 ]
+
+Multiple BPF helpers in use by sk_skb programs calculate the max
+skb length using the __bpf_skb_max_len function. However, this
+calculates the max length using the skb->dev pointer which can be
+NULL when an sk_skb program is paired with an sk_msg program.
+
+To force this a sk_msg program needs to redirect into the ingress
+path of a sock with an attach sk_skb program. Then the the sk_skb
+program would need to call one of the helpers that adjust the skb
+size.
+
+To fix the null ptr dereference use SKB_MAX_ALLOC size if no dev
+is available.
+
+Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2516,7 +2516,8 @@ static int bpf_skb_net_shrink(struct sk_
+
+ static u32 __bpf_skb_max_len(const struct sk_buff *skb)
+ {
+- return skb->dev->mtu + skb->dev->hard_header_len;
++ return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len :
++ SKB_MAX_ALLOC;
+ }
+
+ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Mauricio Vasquez B <mauricio.vasquez@polito.it>
+Date: Fri, 29 Jun 2018 14:48:20 +0200
+Subject: bpf: hash map: decrement counter on error
+
+From: Mauricio Vasquez B <mauricio.vasquez@polito.it>
+
+[ Upstream commit ed2b82c03dc187018307c7c6bf9299705f3db383 ]
+
+Decrement the number of elements in the map in case the allocation
+of a new node fails.
+
+Fixes: 6c9059817432 ("bpf: pre-allocate hash map elements")
+Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/hashtab.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -743,13 +743,15 @@ static struct htab_elem *alloc_htab_elem
+ * old element will be freed immediately.
+ * Otherwise return an error
+ */
+- atomic_dec(&htab->count);
+- return ERR_PTR(-E2BIG);
++ l_new = ERR_PTR(-E2BIG);
++ goto dec_count;
+ }
+ l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
+ htab->map.numa_node);
+- if (!l_new)
+- return ERR_PTR(-ENOMEM);
++ if (!l_new) {
++ l_new = ERR_PTR(-ENOMEM);
++ goto dec_count;
++ }
+ }
+
+ memcpy(l_new->key, key, key_size);
+@@ -762,7 +764,8 @@ static struct htab_elem *alloc_htab_elem
+ GFP_ATOMIC | __GFP_NOWARN);
+ if (!pptr) {
+ kfree(l_new);
+- return ERR_PTR(-ENOMEM);
++ l_new = ERR_PTR(-ENOMEM);
++ goto dec_count;
+ }
+ }
+
+@@ -776,6 +779,9 @@ static struct htab_elem *alloc_htab_elem
+
+ l_new->hash = hash;
+ return l_new;
++dec_count:
++ atomic_dec(&htab->count);
++ return l_new;
+ }
+
+ static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 28 Jun 2018 23:34:58 +0200
+Subject: bpf, s390: fix potential memleak when later bpf_jit_prog fails
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit f605ce5eb26ac934fb8106d75d46a2c875a2bf23 ]
+
+If we would ever fail in the bpf_jit_prog() pass that writes the
+actual insns to the image after we got header via bpf_jit_binary_alloc()
+then we also need to make sure to free it through bpf_jit_binary_free()
+again when bailing out. Given we had prior bpf_jit_prog() passes to
+initially probe for clobbered registers, program size and to fill in
+addrs arrray for jump targets, this is more of a theoretical one,
+but at least make sure this doesn't break with future changes.
+
+Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1391,6 +1391,7 @@ struct bpf_prog *bpf_int_jit_compile(str
+ goto free_addrs;
+ }
+ if (bpf_jit_prog(&jit, fp)) {
++ bpf_jit_binary_free(header);
+ fp = orig_fp;
+ goto free_addrs;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Trimarchi <michael@amarulasolutions.com>
+Date: Wed, 30 May 2018 11:06:34 +0200
+Subject: brcmfmac: stop watchdog before detach and free everything
+
+From: Michael Trimarchi <michael@amarulasolutions.com>
+
+[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ]
+
+Using built-in in kernel image without a firmware in filesystem
+or in the kernel image can lead to a kernel NULL pointer deference.
+Watchdog need to be stopped in brcmf_sdio_remove
+
+The system is going down NOW!
+[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
+Sent SIGTERM to all processes
+[ 1348.121412] Mem abort info:
+[ 1348.126962] ESR = 0x96000004
+[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits
+[ 1348.135948] SET = 0, FnV = 0
+[ 1348.138997] EA = 0, S1PTW = 0
+[ 1348.142154] Data abort info:
+[ 1348.145045] ISV = 0, ISS = 0x00000004
+[ 1348.148884] CM = 0, WnR = 0
+[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
+[ 1348.158475] [00000000000002f8] pgd=0000000000000000
+[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 1348.168927] Modules linked in: ipv6
+[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
+[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
+[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
+[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
+[ 1348.200253] sp : ffff00000b85be30
+[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
+[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
+[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
+[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
+[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
+[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
+[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
+[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
+[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
+[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
+[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
+[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
+[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
+[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
+[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
+
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4294,6 +4294,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ brcmf_dbg(TRACE, "Enter\n");
+
+ if (bus) {
++ /* Stop watchdog task */
++ if (bus->watchdog_tsk) {
++ send_sig(SIGTERM, bus->watchdog_tsk, 1);
++ kthread_stop(bus->watchdog_tsk);
++ bus->watchdog_tsk = NULL;
++ }
++
+ /* De-register interrupt handler */
+ brcmf_sdiod_intr_unregister(bus->sdiodev);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Qu Wenruo <wqu@suse.com>
+Date: Wed, 11 Jul 2018 13:41:21 +0800
+Subject: btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade ]
+
+In commit ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device
+replace") we removed the branch of copy_nocow_pages() to avoid
+corruption for compressed nodatasum extents.
+
+However above commit only solves the problem in scrub_extent(), if
+during scrub_pages() we failed to read some pages,
+sctx->no_io_error_seen will be non-zero and we go to fixup function
+scrub_handle_errored_block().
+
+In scrub_handle_errored_block(), for sctx without csum (no matter if
+we're doing replace or scrub) we go to scrub_fixup_nodatasum() routine,
+which does the similar thing with copy_nocow_pages(), but does it
+without the extra check in copy_nocow_pages() routine.
+
+So for test cases like btrfs/100, where we emulate read errors during
+replace/scrub, we could corrupt compressed extent data again.
+
+This patch will fix it just by avoiding any "optimization" for
+nodatasum, just falls back to the normal fixup routine by try read from
+any good copy.
+
+This also solves WARN_ON() or dead lock caused by lame backref iteration
+in scrub_fixup_nodatasum() routine.
+
+The deadlock or WARN_ON() won't be triggered before commit ac0b4145d662
+("btrfs: scrub: Don't use inode pages for device replace") since
+copy_nocow_pages() have better locking and extra check for data extent,
+and it's already doing the fixup work by try to read data from any good
+copy, so it won't go scrub_fixup_nodatasum() anyway.
+
+This patch disables the faulty code and will be removed completely in a
+followup patch.
+
+Fixes: ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device replace")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/scrub.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(st
+ return ret;
+ }
+
+- if (sctx->is_dev_replace && !is_metadata && !have_csum) {
+- sblocks_for_recheck = NULL;
+- goto nodatasum_case;
+- }
+-
+ /*
+ * read all mirrors one after the other. This includes to
+ * re-read the extent or metadata block that failed (that was
+@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(st
+ goto out;
+ }
+
+- if (!is_metadata && !have_csum) {
++ /*
++ * NOTE: Even for nodatasum case, it's still possible that it's a
++ * compressed data extent, thus scrub_fixup_nodatasum(), which write
++ * inode page cache onto disk, could cause serious data corruption.
++ *
++ * So here we could only read from disk, and hope our recovery could
++ * reach disk before the newer write.
++ */
++ if (0 && !is_metadata && !have_csum) {
+ struct scrub_fixup_nodatasum *fixup_nodatasum;
+
+ WARN_ON(sctx->is_dev_replace);
+
+-nodatasum_case:
+-
+ /*
+ * !is_metadata and !have_csum, this means that the data
+ * might not be COWed, that it might be modified
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Tue, 19 Jun 2018 18:20:34 +0800
+Subject: ceph: fix dentry leak in splice_dentry()
+
+From: "Yan, Zheng" <zyan@redhat.com>
+
+[ Upstream commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3 ]
+
+In any case, d_splice_alias() does not drop reference of original
+dentry.
+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1123,6 +1123,7 @@ static struct dentry *splice_dentry(stru
+ if (IS_ERR(realdn)) {
+ pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+ PTR_ERR(realdn), dn, in, ceph_vinop(in));
++ dput(dn);
+ dn = realdn; /* note realdn contains the error */
+ goto out;
+ } else if (realdn) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 2 Jun 2018 10:52:56 +0300
+Subject: clk: davinci: cfgchip: testing the wrong variable
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0613de37373bbbc747d434f643620472bd13303b ]
+
+There is a copy and paste bug here. We should be testing "usb1" instead
+of "usb0".
+
+Fixes: 58e1e2d2cd89 ("clk: davinci: cfgchip: Add TI DA8XX USB PHY clocks")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David Lechner <david@lechnology.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/davinci/da8xx-cfgchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/davinci/da8xx-cfgchip.c
++++ b/drivers/clk/davinci/da8xx-cfgchip.c
+@@ -672,7 +672,7 @@ static int of_da8xx_usb_phy_clk_init(str
+
+ usb1 = da8xx_cfgchip_register_usb1_clk48(dev, regmap);
+ if (IS_ERR(usb1)) {
+- if (PTR_ERR(usb0) == -EPROBE_DEFER)
++ if (PTR_ERR(usb1) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ dev_warn(dev, "Failed to register usb1_clk48 (%ld)\n",
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 18 Apr 2018 20:52:31 +0900
+Subject: clk: sunxi-ng: replace lib-y with obj-y
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 12f8c553a503d98b519cca650b188bf51ebdbdbf ]
+
+We had commit 06e226c7fb23 ("clk: sunxi-ng: Move all clock types to a
+library") and commit 799c43415442 ("kbuild: thin archives make default
+for all archs") in the same development cycle, from different trees.
+
+With migration to the thin archive, the entire drivers/clk/sunxi-ng/lib.a
+is linked to the vmlinux. This does not break build, but we do not get
+any size saving.
+
+However, we do not need to go back to the individual Kconfig options.
+The default configuration pulls in all (or most) of the CCU parts anyway.
+Also, once we enable CONFIG_LD_DEAD_CODE_DATA_ELIMINATION, we can simply
+list all files with obj-y, and the linker will drop all unused functions
+by itself.
+
+After the long discussion [1], people there agreed to fix this, but
+nobody sent a patch after all. I am doing it now.
+
+I lifted up CONFIG_SUNXI_CCU to drivers/clk/Makefile because everything
+in drivers/clk/sunxi-ng/ depends on SUNXI_CCU.
+
+[1] https://patchwork.kernel.org/patch/9796521/
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/Makefile | 2 +-
+ drivers/clk/sunxi-ng/Makefile | 39 +++++++++++++++------------------------
+ 2 files changed, 16 insertions(+), 25 deletions(-)
+
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -94,7 +94,7 @@ obj-$(CONFIG_ARCH_SPRD) += sprd/
+ obj-$(CONFIG_ARCH_STI) += st/
+ obj-$(CONFIG_ARCH_STRATIX10) += socfpga/
+ obj-$(CONFIG_ARCH_SUNXI) += sunxi/
+-obj-$(CONFIG_ARCH_SUNXI) += sunxi-ng/
++obj-$(CONFIG_SUNXI_CCU) += sunxi-ng/
+ obj-$(CONFIG_ARCH_TEGRA) += tegra/
+ obj-y += ti/
+ obj-$(CONFIG_CLK_UNIPHIER) += uniphier/
+--- a/drivers/clk/sunxi-ng/Makefile
++++ b/drivers/clk/sunxi-ng/Makefile
+@@ -1,24 +1,24 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Common objects
+-lib-$(CONFIG_SUNXI_CCU) += ccu_common.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_mmc_timing.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_reset.o
++obj-y += ccu_common.o
++obj-y += ccu_mmc_timing.o
++obj-y += ccu_reset.o
+
+ # Base clock types
+-lib-$(CONFIG_SUNXI_CCU) += ccu_div.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_frac.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_gate.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_mux.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_mult.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_phase.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_sdm.o
++obj-y += ccu_div.o
++obj-y += ccu_frac.o
++obj-y += ccu_gate.o
++obj-y += ccu_mux.o
++obj-y += ccu_mult.o
++obj-y += ccu_phase.o
++obj-y += ccu_sdm.o
+
+ # Multi-factor clocks
+-lib-$(CONFIG_SUNXI_CCU) += ccu_nk.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_nkm.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_nkmp.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_nm.o
+-lib-$(CONFIG_SUNXI_CCU) += ccu_mp.o
++obj-y += ccu_nk.o
++obj-y += ccu_nkm.o
++obj-y += ccu_nkmp.o
++obj-y += ccu_nm.o
++obj-y += ccu_mp.o
+
+ # SoC support
+ obj-$(CONFIG_SUN50I_A64_CCU) += ccu-sun50i-a64.o
+@@ -37,12 +37,3 @@ obj-$(CONFIG_SUN8I_R40_CCU) += ccu-sun8i
+ obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80.o
+ obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-de.o
+ obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-usb.o
+-
+-# The lib-y file goals is supposed to work only in arch/*/lib or lib/. In our
+-# case, we want to use that goal, but even though lib.a will be properly
+-# generated, it will not be linked in, eventually resulting in a linker error
+-# for missing symbols.
+-#
+-# We can work around that by explicitly adding lib.a to the obj-y goal. This is
+-# an undocumented behaviour, but works well for now.
+-obj-$(CONFIG_SUNXI_CCU) += lib.a
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 10 Jun 2018 16:24:15 +0200
+Subject: clocksource/drivers/stm32: Fix error return code
+
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+
+[ Upstream commit a26ed66c20f080c510fcf5bd448bce204f2c19d7 ]
+
+Return an error code on failure.
+
+Problem found using Coccinelle.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: kernel-janitors@vger.kernel.org
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lkml.kernel.org/r1528640655-18948-3-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clocksource/timer-stm32.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/clocksource/timer-stm32.c
++++ b/drivers/clocksource/timer-stm32.c
+@@ -304,8 +304,10 @@ static int __init stm32_timer_init(struc
+
+ to->private_data = kzalloc(sizeof(struct stm32_timer_private),
+ GFP_KERNEL);
+- if (!to->private_data)
++ if (!to->private_data) {
++ ret = -ENOMEM;
+ goto deinit;
++ }
+
+ rstc = of_reset_control_get(node, NULL);
+ if (!IS_ERR(rstc)) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Jun 2018 15:33:23 -0700
+Subject: crypto: arm/speck - fix building in Thumb2 mode
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit a068b94d74ddb7776ca707b6d39d1ac0d2d057e6 ]
+
+Building the kernel with CONFIG_THUMB2_KERNEL=y and
+CONFIG_CRYPTO_SPECK_NEON set fails with the following errors:
+
+ arch/arm/crypto/speck-neon-core.S: Assembler messages:
+
+ arch/arm/crypto/speck-neon-core.S:419: Error: r13 not allowed here -- `bic sp,#0xf'
+ arch/arm/crypto/speck-neon-core.S:423: Error: r13 not allowed here -- `bic sp,#0xf'
+ arch/arm/crypto/speck-neon-core.S:427: Error: r13 not allowed here -- `bic sp,#0xf'
+ arch/arm/crypto/speck-neon-core.S:431: Error: r13 not allowed here -- `bic sp,#0xf'
+
+The problem is that the 'bic' instruction can't operate on the 'sp'
+register in Thumb2 mode. Fix it by using a temporary register. This
+isn't in the main loop, so the performance difference is negligible.
+This also matches what aes-neonbs-core.S does.
+
+Reported-by: Stefan Agner <stefan@agner.ch>
+Fixes: ede9622162fa ("crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Reviewed-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/crypto/speck-neon-core.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/crypto/speck-neon-core.S
++++ b/arch/arm/crypto/speck-neon-core.S
+@@ -272,9 +272,11 @@
+ * Allocate stack space to store 128 bytes worth of tweaks. For
+ * performance, this space is aligned to a 16-byte boundary so that we
+ * can use the load/store instructions that declare 16-byte alignment.
++ * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'.
+ */
+- sub sp, #128
+- bic sp, #0xf
++ sub r12, sp, #128
++ bic r12, #0xf
++ mov sp, r12
+
+ .if \n == 64
+ // Load first tweak
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Casey Leedom <leedom@chelsio.com>
+Date: Sat, 7 Jul 2018 12:38:07 +0530
+Subject: cxgb4: assume flash part size to be 4MB, if it can't be determined
+
+From: Casey Leedom <leedom@chelsio.com>
+
+[ Upstream commit 843789f6dd6ae1651a77ac99c13bcaf191ebe05c ]
+
+t4_get_flash_params() fails in a fatal fashion if the FLASH part isn't
+one of the recognized parts. But this leads to desperate efforts to update
+drivers when various FLASH parts which we are using suddenly become
+unavailable and we need to substitute new FLASH parts. This has lead to
+more than one Customer Field Emergency when a Customer has an old driver
+and suddenly can't use newly shipped adapters.
+
+This commit fixes this by simply assuming that the FLASH part is 4MB in
+size if it can't be identified. Note that all Chelsio adapters will have
+flash parts which are at least 4MB in size.
+
+Signed-off-by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 35 ++++++++++-------------------
+ 1 file changed, 13 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -8526,7 +8526,7 @@ static int t4_get_flash_params(struct ad
+ };
+
+ unsigned int part, manufacturer;
+- unsigned int density, size;
++ unsigned int density, size = 0;
+ u32 flashid = 0;
+ int ret;
+
+@@ -8596,11 +8596,6 @@ static int t4_get_flash_params(struct ad
+ case 0x22: /* 256MB */
+ size = 1 << 28;
+ break;
+-
+- default:
+- dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n",
+- flashid, density);
+- return -EINVAL;
+ }
+ break;
+ }
+@@ -8616,10 +8611,6 @@ static int t4_get_flash_params(struct ad
+ case 0x17: /* 64MB */
+ size = 1 << 26;
+ break;
+- default:
+- dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n",
+- flashid, density);
+- return -EINVAL;
+ }
+ break;
+ }
+@@ -8635,10 +8626,6 @@ static int t4_get_flash_params(struct ad
+ case 0x18: /* 16MB */
+ size = 1 << 24;
+ break;
+- default:
+- dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n",
+- flashid, density);
+- return -EINVAL;
+ }
+ break;
+ }
+@@ -8654,17 +8641,21 @@ static int t4_get_flash_params(struct ad
+ case 0x18: /* 16MB */
+ size = 1 << 24;
+ break;
+- default:
+- dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n",
+- flashid, density);
+- return -EINVAL;
+ }
+ break;
+ }
+- default:
+- dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n",
+- flashid);
+- return -EINVAL;
++ }
++
++ /* If we didn't recognize the FLASH part, that's no real issue: the
++ * Hardware/Software contract says that Hardware will _*ALWAYS*_
++ * use a FLASH part which is at least 4MB in size and has 64KB
++ * sectors. The unrecognized FLASH part is likely to be much larger
++ * than 4MB, but that's all we really need.
++ */
++ if (size == 0) {
++ dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n",
++ flashid);
++ size = 1 << 22;
+ }
+
+ /* Store decoded Flash size and fall through into vetting code. */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+Date: Sat, 23 Jun 2018 20:28:26 +0530
+Subject: cxgb4: when disabling dcb set txq dcb priority to 0
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ]
+
+When we are disabling DCB, store "0" in txq->dcb_prio
+since that's used for future TX Work Request "OVLAN_IDX"
+values. Setting non zero priority upon disabling DCB
+would halt the traffic.
+
+Reported-by: AMG Zollner Robert <robert@cloudmedia.eu>
+CC: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -263,7 +263,7 @@ static void dcb_tx_queue_prio_enable(str
+ "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
+ enable ? "set" : "unset", pi->port_id, i, -err);
+ else
+- txq->dcb_prio = value;
++ txq->dcb_prio = enable ? value : 0;
+ }
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jeff Moyer <jmoyer@redhat.com>
+Date: Wed, 27 Jun 2018 11:43:58 -0400
+Subject: dev-dax: check_vma: ratelimit dev_info-s
+
+From: Jeff Moyer <jmoyer@redhat.com>
+
+[ Upstream commit 5a14e91d559aee5bdb0e002e1153fd9c4338a29e ]
+
+This is easily triggered from userspace, so let's ratelimit the
+messages.
+
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dax/device.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/dax/device.c
++++ b/drivers/dax/device.c
+@@ -189,14 +189,16 @@ static int check_vma(struct dev_dax *dev
+
+ /* prevent private mappings from being established */
+ if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
+- dev_info(dev, "%s: %s: fail, attempted private mapping\n",
++ dev_info_ratelimited(dev,
++ "%s: %s: fail, attempted private mapping\n",
+ current->comm, func);
+ return -EINVAL;
+ }
+
+ mask = dax_region->align - 1;
+ if (vma->vm_start & mask || vma->vm_end & mask) {
+- dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
++ dev_info_ratelimited(dev,
++ "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
+ current->comm, func, vma->vm_start, vma->vm_end,
+ mask);
+ return -EINVAL;
+@@ -204,13 +206,15 @@ static int check_vma(struct dev_dax *dev
+
+ if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV
+ && (vma->vm_flags & VM_DONTCOPY) == 0) {
+- dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n",
++ dev_info_ratelimited(dev,
++ "%s: %s: fail, dax range requires MADV_DONTFORK\n",
+ current->comm, func);
+ return -EINVAL;
+ }
+
+ if (!vma_is_dax(vma)) {
+- dev_info(dev, "%s: %s: fail, vma is not DAX capable\n",
++ dev_info_ratelimited(dev,
++ "%s: %s: fail, vma is not DAX capable\n",
+ current->comm, func);
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Jun 2018 14:15:47 +0300
+Subject: dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ]
+
+The d->chans[] array has d->dma_requests elements so the > should be
+>= here.
+
+Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/k3dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/k3dma.c
++++ b/drivers/dma/k3dma.c
+@@ -794,7 +794,7 @@ static struct dma_chan *k3_of_dma_simple
+ struct k3_dma_dev *d = ofdma->of_dma_data;
+ unsigned int request = dma_spec->args[0];
+
+- if (request > d->dma_requests)
++ if (request >= d->dma_requests)
+ return NULL;
+
+ return dma_get_slave_channel(&(d->chans[request].vc.chan));
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 19 Jun 2018 15:20:50 +0200
+Subject: dmaengine: pl330: report BURST residue granularity
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e3f329c600033f011a978a8bc4ddb1e2e94c4f4d ]
+
+The reported residue is already calculated in BURST unit granularity, so
+advertise this capability properly to other devices in the system.
+
+Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/pl330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2924,7 +2924,7 @@ pl330_probe(struct amba_device *adev, co
+ pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
+ pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
+ pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
++ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
+ 1 : PL330_MAX_BURST);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Tue, 5 Jun 2018 18:59:57 +0200
+Subject: dmaengine: ti: omap-dma: Fix OMAP1510 incorrect residue_granularity
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit c9bd0946da243a8eb86b44ff613e2c813f9b683b ]
+
+Commit 0198d7bb8a0c ("ASoC: omap-mcbsp: Convert to use the sdma-pcm
+instead of omap-pcm") resulted in broken audio playback on OMAP1510
+(discovered on Amstrad Delta).
+
+When running on OMAP1510, omap-pcm used to obtain DMA offset from
+snd_dmaengine_pcm_pointer_no_residue() based on DMA interrupt triggered
+software calculations instead of snd_dmaengine_pcm_pointer() which
+depended on residue value calculated from omap_dma_get_src_pos().
+Similar code path is still available in now used
+sound/soc/soc-generic-dmaengine-pcm.c but it is not triggered.
+
+It was verified already before that omap_get_dma_src_pos() from
+arch/arm/plat-omap/dma.c didn't work correctly for OMAP1510 - see
+commit 1bdd7419910c ("ASoC: OMAP: fix OMAP1510 broken PCM pointer
+callback") for details. Apparently the same applies to its successor,
+omap_dma_get_src_pos() from drivers/dma/ti/omap-dma.c.
+
+On the other hand, snd_dmaengine_pcm_pointer_no_residue() is described
+as depreciated and discouraged for use in new drivers because of its
+unreliable accuracy. However, it seems the only working option for
+OPAM1510 now, as long as a software calculated residue is not
+implemented as OMAP1510 fallback in omap-dma.
+
+Using snd_dmaengine_pcm_pointer_no_residue() code path instead of
+snd_dmaengine_pcm_pointer() in sound/soc/soc-generic-dmaengine-pcm.c
+can be triggered in two ways:
+- by passing pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE from
+ sound/soc/omap/sdma-pcm.c,
+- by passing dma_caps.residue_granularity =
+ DMA_RESIDUE_GRANULARITY_DESCRIPTOR from DMA engine.
+
+Let's do the latter.
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/omap-dma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/omap-dma.c
++++ b/drivers/dma/omap-dma.c
+@@ -1485,7 +1485,11 @@ static int omap_dma_probe(struct platfor
+ od->ddev.src_addr_widths = OMAP_DMA_BUSWIDTHS;
+ od->ddev.dst_addr_widths = OMAP_DMA_BUSWIDTHS;
+ od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+- od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
++ if (__dma_omap15xx(od->plat->dma_attr))
++ od->ddev.residue_granularity =
++ DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
++ else
++ od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ od->ddev.max_burst = SZ_16M - 1; /* CCEN: 24bit unsigned */
+ od->ddev.dev = &pdev->dev;
+ INIT_LIST_HEAD(&od->ddev.channels);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Madalin Bucur <madalin.bucur@nxp.com>
+Date: Thu, 28 Jun 2018 15:26:51 +0300
+Subject: dpaa_eth: DPAA SGT needs to be 256B
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit 595e802e53f24642a145cf7f3e4ac9afab4c21ec ]
+
+The DPAA HW requires that at least 256 bytes from the start of the
+first scatter-gather table entry are allocated and accessible. The
+hardware reads the maximum size the table can have in one access,
+thus requiring that the allocation and mapping to be done for the
+maximum size of 256B even if there is a smaller number of entries
+in the table.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx tim
+ /* Default alignment for start of data in an Rx FD */
+ #define DPAA_FD_DATA_ALIGNMENT 16
+
++/* The DPAA requires 256 bytes reserved and mapped for the SGT */
++#define DPAA_SGT_SIZE 256
++
+ /* Values for the L3R field of the FM Parse Results
+ */
+ /* L3 Type field: First IP Present IPv4 */
+@@ -1617,8 +1620,8 @@ static struct sk_buff *dpaa_cleanup_tx_f
+
+ if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
+ nr_frags = skb_shinfo(skb)->nr_frags;
+- dma_unmap_single(dev, addr, qm_fd_get_offset(fd) +
+- sizeof(struct qm_sg_entry) * (1 + nr_frags),
++ dma_unmap_single(dev, addr,
++ qm_fd_get_offset(fd) + DPAA_SGT_SIZE,
+ dma_dir);
+
+ /* The sgt buffer has been allocated with netdev_alloc_frag(),
+@@ -1903,8 +1906,7 @@ static int skb_to_sg_fd(struct dpaa_priv
+ void *sgt_buf;
+
+ /* get a page frag to store the SGTable */
+- sz = SKB_DATA_ALIGN(priv->tx_headroom +
+- sizeof(struct qm_sg_entry) * (1 + nr_frags));
++ sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE);
+ sgt_buf = netdev_alloc_frag(sz);
+ if (unlikely(!sgt_buf)) {
+ netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n",
+@@ -1972,9 +1974,8 @@ static int skb_to_sg_fd(struct dpaa_priv
+ skbh = (struct sk_buff **)buffer_start;
+ *skbh = skb;
+
+- addr = dma_map_single(dev, buffer_start, priv->tx_headroom +
+- sizeof(struct qm_sg_entry) * (1 + nr_frags),
+- dma_dir);
++ addr = dma_map_single(dev, buffer_start,
++ priv->tx_headroom + DPAA_SGT_SIZE, dma_dir);
+ if (unlikely(dma_mapping_error(dev, addr))) {
+ dev_err(dev, "DMA mapping failed");
+ err = -EINVAL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 25 Jun 2018 15:51:30 -0700
+Subject: drbd: Fix drbd_request_prepare() discard handling
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+[ Upstream commit fad2d4ef636654e926d374ef038f4cd4286661f6 ]
+
+Fix the test that verifies whether bio_op(bio) represents a discard
+or write zeroes operation. Compile-tested only.
+
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: Lars Ellenberg <lars.ellenberg@linbit.com>
+Fixes: 7435e9018f91 ("drbd: zero-out partial unaligned discards on local backend")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/drbd/drbd_req.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/drbd/drbd_req.c
++++ b/drivers/block/drbd/drbd_req.c
+@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device
+ _drbd_start_io_acct(device, req);
+
+ /* process discards always from our submitter thread */
+- if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) ||
+- (bio_op(bio) & REQ_OP_DISCARD))
++ if (bio_op(bio) == REQ_OP_WRITE_ZEROES ||
++ bio_op(bio) == REQ_OP_DISCARD)
+ goto queue_for_submitter_thread;
+
+ if (rw == WRITE && req->private_bio && req->i.size
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Hoan Tran <hoan.tran@amperecomputing.com>
+Date: Thu, 7 Jun 2018 14:35:01 +0100
+Subject: drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error
+
+From: Hoan Tran <hoan.tran@amperecomputing.com>
+
+[ Upstream commit a45fc268db20ecd859bb61e25045912b3194b5e6 ]
+
+This patch fixes the below parser error of the IOB SLOW PMU.
+
+ # perf stat -a -e iob-slow0/cycle-count/ sleep 1
+ evenf syntax error: 'iob-slow0/cycle-count/'
+ \___ parser error
+
+It replaces the "-" character by "_" character inside the PMU name.
+
+Signed-off-by: Hoan Tran <hoan.tran@amperecomputing.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/perf/xgene_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/perf/xgene_pmu.c
++++ b/drivers/perf/xgene_pmu.c
+@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct d
+ case PMU_TYPE_IOB:
+ return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id);
+ case PMU_TYPE_IOB_SLOW:
+- return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id);
++ return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id);
+ case PMU_TYPE_MCB:
+ return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id);
+ case PMU_TYPE_MC:
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Evan Quan <evan.quan@amd.com>
+Date: Mon, 11 Jun 2018 16:46:40 +0800
+Subject: drm/amd/powerplay: correct vega12 thermal support as true
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 363a3d3fb7d478d7dd49b8c6294436b8ba5984cc ]
+
+Thermal support is enabled on vega12.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+@@ -82,6 +82,7 @@ static void vega12_set_default_registry_
+
+ data->registry_data.disallowed_features = 0x0;
+ data->registry_data.od_state_in_dc_support = 0;
++ data->registry_data.thermal_support = 1;
+ data->registry_data.skip_baco_hardware = 0;
+
+ data->registry_data.log_avfs_param = 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 28 Jun 2018 12:38:53 -0500
+Subject: drm/amdgpu: fix swapped emit_ib_size in vce3
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 0859df22ab7cfb3ad2df2caed76cadce6ac33a80 ]
+
+The phys and vm versions had the values swapped.
+
+Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+@@ -899,7 +899,7 @@ static const struct amdgpu_ring_funcs vc
+ .emit_frame_size =
+ 4 + /* vce_v3_0_emit_pipeline_sync */
+ 6, /* amdgpu_vce_ring_emit_fence x1 no user fence */
+- .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
++ .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
+ .emit_ib = amdgpu_vce_ring_emit_ib,
+ .emit_fence = amdgpu_vce_ring_emit_fence,
+ .test_ring = amdgpu_vce_ring_test_ring,
+@@ -923,7 +923,7 @@ static const struct amdgpu_ring_funcs vc
+ 6 + /* vce_v3_0_emit_vm_flush */
+ 4 + /* vce_v3_0_emit_pipeline_sync */
+ 6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */
+- .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
++ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
+ .emit_ib = vce_v3_0_ring_emit_ib,
+ .emit_vm_flush = vce_v3_0_emit_vm_flush,
+ .emit_pipeline_sync = vce_v3_0_emit_pipeline_sync,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+Date: Fri, 20 Apr 2018 15:44:57 +0100
+Subject: drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector
+
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+
+[ Upstream commit 109c4d18e57445afcaf728b8716a69375a3daab2 ]
+
+One needs to ensure that the crtcs are shutdown so that the
+drm_crtc_state->connector_mask reflects that no connectors
+are currently active. Further, it reduces the reference
+count for each connector. This ensures that the connectors
+and encoders can be cleanly removed either when _unbind
+is called for the corresponding drivers or by
+drm_mode_config_cleanup().
+We need drm_atomic_helper_shutdown() to be called before
+component_unbind_all() otherwise the connectors attached to the
+component device will have the wrong reference count value and will not
+be cleanly removed.
+
+Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/arm/malidp_drv.c
++++ b/drivers/gpu/drm/arm/malidp_drv.c
+@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device
+
+ static void malidp_fini(struct drm_device *drm)
+ {
+- drm_atomic_helper_shutdown(drm);
+ drm_mode_config_cleanup(drm);
+ }
+
+@@ -646,6 +645,7 @@ vblank_fail:
+ malidp_de_irq_fini(drm);
+ drm->irq_enabled = false;
+ irq_init_fail:
++ drm_atomic_helper_shutdown(drm);
+ component_unbind_all(dev, drm);
+ bind_fail:
+ of_node_put(malidp->crtc.port);
+@@ -681,6 +681,7 @@ static void malidp_unbind(struct device
+ malidp_se_irq_fini(drm);
+ malidp_de_irq_fini(drm);
+ drm->irq_enabled = false;
++ drm_atomic_helper_shutdown(drm);
+ component_unbind_all(dev, drm);
+ of_node_put(malidp->crtc.port);
+ malidp->crtc.port = NULL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+Date: Tue, 10 Apr 2018 19:25:03 +0100
+Subject: drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format
+
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+
+[ Upstream commit ad7fda2e378f4356df621a39655f7c200b495d81 ]
+
+On some Mali-DP processors, the LAYER_FORMAT register contains fields
+other than the format. These bits were unconditionally cleared when
+setting the pixel format, whereas they should be preserved at their
+reset values.
+
+Reported-by: Brian Starkey <brian.starkey@arm.com>
+Reported-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Ayan Kumar halder <ayan.halder@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/arm/malidp_planes.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -23,6 +23,7 @@
+
+ /* Layer specific register offsets */
+ #define MALIDP_LAYER_FORMAT 0x000
++#define LAYER_FORMAT_MASK 0x3f
+ #define MALIDP_LAYER_CONTROL 0x004
+ #define LAYER_ENABLE (1 << 0)
+ #define LAYER_FLOWCFG_MASK 7
+@@ -337,7 +338,9 @@ static void malidp_de_plane_update(struc
+ dest_w = plane->state->crtc_w;
+ dest_h = plane->state->crtc_h;
+
+- malidp_hw_write(mp->hwdev, ms->format, mp->layer->base);
++ val = malidp_hw_read(mp->hwdev, mp->layer->base);
++ val = (val & ~LAYER_FORMAT_MASK) | ms->format;
++ malidp_hw_write(mp->hwdev, val, mp->layer->base);
+
+ for (i = 0; i < ms->n_planes; i++) {
+ /* calculate the offset for the layer's plane registers */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sun, 24 Jun 2018 14:35:10 +0100
+Subject: drm/armada: fix colorkey mode property
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ]
+
+The colorkey mode property was not correctly disabling the colorkeying
+when "disabled" mode was selected. Arrange for this to work as one
+would expect.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/armada/armada_hw.h | 1 +
+ drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++--------
+ 2 files changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/armada/armada_hw.h
++++ b/drivers/gpu/drm/armada/armada_hw.h
+@@ -160,6 +160,7 @@ enum {
+ CFG_ALPHAM_GRA = 0x1 << 16,
+ CFG_ALPHAM_CFG = 0x2 << 16,
+ CFG_ALPHA_MASK = 0xff << 8,
++#define CFG_ALPHA(x) ((x) << 8)
+ CFG_PIXCMD_MASK = 0xff,
+ };
+
+--- a/drivers/gpu/drm/armada/armada_overlay.c
++++ b/drivers/gpu/drm/armada/armada_overlay.c
+@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties {
+ uint16_t contrast;
+ uint16_t saturation;
+ uint32_t colorkey_mode;
++ uint32_t colorkey_enable;
+ };
+
+ struct armada_ovl_plane {
+@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl
+ writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
+
+ spin_lock_irq(&dcrtc->irq_lock);
+- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
+- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+- dcrtc->base + LCD_SPU_DMA_CTRL1);
+-
+- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
++ armada_updatel(prop->colorkey_mode,
++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
++ dcrtc->base + LCD_SPU_DMA_CTRL1);
++ if (dcrtc->variant->has_spu_adv_reg)
++ armada_updatel(prop->colorkey_enable,
++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
++ dcrtc->base + LCD_SPU_ADV_REG);
+ spin_unlock_irq(&dcrtc->irq_lock);
+ }
+
+@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property
+ dplane->prop.colorkey_vb |= K2B(val);
+ update_attr = true;
+ } else if (property == priv->colorkey_mode_prop) {
+- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
+- dplane->prop.colorkey_mode |= CFG_CKMODE(val);
++ if (val == CKMODE_DISABLE) {
++ dplane->prop.colorkey_mode =
++ CFG_CKMODE(CKMODE_DISABLE) |
++ CFG_ALPHAM_CFG | CFG_ALPHA(255);
++ dplane->prop.colorkey_enable = 0;
++ } else {
++ dplane->prop.colorkey_mode =
++ CFG_CKMODE(val) |
++ CFG_ALPHAM_GRA | CFG_ALPHA(0);
++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
++ }
+ update_attr = true;
+ } else if (property == priv->brightness_prop) {
+ dplane->prop.brightness = val - 256;
+@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct d
+ dplane->prop.colorkey_yr = 0xfefefe00;
+ dplane->prop.colorkey_ug = 0x01010100;
+ dplane->prop.colorkey_vb = 0x01010100;
+- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
++ CFG_ALPHAM_GRA | CFG_ALPHA(0);
++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ dplane->prop.brightness = 0;
+ dplane->prop.contrast = 0x4000;
+ dplane->prop.saturation = 0x4000;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 26 Jun 2018 17:06:06 +0100
+Subject: drm/armada: fix irq handling
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 92298c1cd8e8a6b56322b602ad72b54e6237631d ]
+
+Add the missing locks to the IRQ enable/disable paths, and fix a comment
+in the interrupt handler: reading the ISR clears down the status bits,
+but does not reset the interrupt so it can signal again. That seems to
+require a write.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/armada/armada_crtc.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/armada/armada_crtc.c
++++ b/drivers/gpu/drm/armada/armada_crtc.c
+@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int ir
+ u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
+
+ /*
+- * This is rediculous - rather than writing bits to clear, we
+- * have to set the actual status register value. This is racy.
++ * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR
++ * is set. Writing has some other effect to acknowledge the IRQ -
++ * without this, we only get a single IRQ.
+ */
+ writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
+
+@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_
+ static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc)
+ {
+ struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
++ unsigned long flags;
+
++ spin_lock_irqsave(&dcrtc->irq_lock, flags);
+ armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA);
++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
+ return 0;
+ }
+
+ static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc)
+ {
+ struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
++ unsigned long flags;
+
++ spin_lock_irqsave(&dcrtc->irq_lock, flags);
+ armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA);
++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
+ }
+
+ static const struct drm_crtc_funcs armada_crtc_funcs = {
+@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct
+ CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1);
+ writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1);
+ writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA);
++ readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
+ writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
+
+ ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Maciej Purski <m.purski@samsung.com>
+Date: Fri, 2 Feb 2018 11:54:25 +0100
+Subject: drm/bridge/sii8620: fix display modes validation
+
+From: Maciej Purski <m.purski@samsung.com>
+
+[ Upstream commit ecba7cfa3afbe489288f2c819158b7402afd7ee9 ]
+
+Current implementation of mode_valid() and mode_fixup() callbacks
+handle packed pixel modes improperly.
+
+Fix it by using proper maximum clock values from the documentation.
+
+Signed-off-by: Maciej Purski <m.purski@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1517568865-25219-1-git-send-email-m.purski@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 78 +++++++++++++++++------------------
+ 1 file changed, 40 insertions(+), 38 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -36,8 +36,11 @@
+
+ #define SII8620_BURST_BUF_LEN 288
+ #define VAL_RX_HDMI_CTRL2_DEFVAL VAL_RX_HDMI_CTRL2_IDLE_CNT(3)
+-#define MHL1_MAX_LCLK 225000
+-#define MHL3_MAX_LCLK 600000
++
++#define MHL1_MAX_PCLK 75000
++#define MHL1_MAX_PCLK_PP_MODE 150000
++#define MHL3_MAX_PCLK 200000
++#define MHL3_MAX_PCLK_PP_MODE 300000
+
+ enum sii8620_mode {
+ CM_DISCONNECTED,
+@@ -2277,17 +2280,43 @@ static void sii8620_detach(struct drm_br
+ rc_unregister_device(ctx->rc_dev);
+ }
+
++static int sii8620_is_packing_required(struct sii8620 *ctx,
++ const struct drm_display_mode *mode)
++{
++ int max_pclk, max_pclk_pp_mode;
++
++ if (sii8620_is_mhl3(ctx)) {
++ max_pclk = MHL3_MAX_PCLK;
++ max_pclk_pp_mode = MHL3_MAX_PCLK_PP_MODE;
++ } else {
++ max_pclk = MHL1_MAX_PCLK;
++ max_pclk_pp_mode = MHL1_MAX_PCLK_PP_MODE;
++ }
++
++ if (mode->clock < max_pclk)
++ return 0;
++ else if (mode->clock < max_pclk_pp_mode)
++ return 1;
++ else
++ return -1;
++}
++
+ static enum drm_mode_status sii8620_mode_valid(struct drm_bridge *bridge,
+ const struct drm_display_mode *mode)
+ {
+ struct sii8620 *ctx = bridge_to_sii8620(bridge);
++ int pack_required = sii8620_is_packing_required(ctx, mode);
+ bool can_pack = ctx->devcap[MHL_DCAP_VID_LINK_MODE] &
+ MHL_DCAP_VID_LINK_PPIXEL;
+- unsigned int max_pclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK :
+- MHL1_MAX_LCLK;
+- max_pclk /= can_pack ? 2 : 3;
+
+- return (mode->clock > max_pclk) ? MODE_CLOCK_HIGH : MODE_OK;
++ switch (pack_required) {
++ case 0:
++ return MODE_OK;
++ case 1:
++ return (can_pack) ? MODE_OK : MODE_CLOCK_HIGH;
++ default:
++ return MODE_CLOCK_HIGH;
++ }
+ }
+
+ static bool sii8620_mode_fixup(struct drm_bridge *bridge,
+@@ -2295,43 +2324,16 @@ static bool sii8620_mode_fixup(struct dr
+ struct drm_display_mode *adjusted_mode)
+ {
+ struct sii8620 *ctx = bridge_to_sii8620(bridge);
+- int max_lclk;
+- bool ret = true;
+
+ mutex_lock(&ctx->lock);
+
+- max_lclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : MHL1_MAX_LCLK;
+- if (max_lclk > 3 * adjusted_mode->clock) {
+- ctx->use_packed_pixel = 0;
+- goto end;
+- }
+- if ((ctx->devcap[MHL_DCAP_VID_LINK_MODE] & MHL_DCAP_VID_LINK_PPIXEL) &&
+- max_lclk > 2 * adjusted_mode->clock) {
+- ctx->use_packed_pixel = 1;
+- goto end;
+- }
+- ret = false;
+-end:
+- if (ret) {
+- u8 vic = drm_match_cea_mode(adjusted_mode);
++ ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode);
++ ctx->video_code = drm_match_cea_mode(adjusted_mode);
++ ctx->pixel_clock = adjusted_mode->clock;
+
+- if (!vic) {
+- union hdmi_infoframe frm;
+- u8 mhl_vic[] = { 0, 95, 94, 93, 98 };
+-
+- /* FIXME: We need the connector here */
+- drm_hdmi_vendor_infoframe_from_display_mode(
+- &frm.vendor.hdmi, NULL, adjusted_mode);
+- vic = frm.vendor.hdmi.vic;
+- if (vic >= ARRAY_SIZE(mhl_vic))
+- vic = 0;
+- vic = mhl_vic[vic];
+- }
+- ctx->video_code = vic;
+- ctx->pixel_clock = adjusted_mode->clock;
+- }
+ mutex_unlock(&ctx->lock);
+- return ret;
++
++ return true;
+ }
+
+ static const struct drm_bridge_funcs sii8620_bridge_funcs = {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Maciej Purski <m.purski@samsung.com>
+Date: Tue, 23 Jan 2018 12:17:19 +0100
+Subject: drm/bridge/sii8620: fix display of packed pixel modes in MHL2
+
+From: Maciej Purski <m.purski@samsung.com>
+
+[ Upstream commit e8b92efa629dac0e70ea4145c5e70616de5f89c8 ]
+
+Currently packed pixel modes in MHL2 can't be displayed. The device
+automatically recognizes output format, so setting format other than
+RGB causes failure. Fix it by writing proper values to registers.
+
+Tested on MHL1 and MHL2 using various vendors' dongles both in
+DVI and HDMI mode.
+
+Signed-off-by: Maciej Purski <m.purski@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1516706239-9104-1-git-send-email-m.purski@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -1060,20 +1060,11 @@ static void sii8620_stop_video(struct si
+
+ static void sii8620_set_format(struct sii8620 *ctx)
+ {
+- u8 out_fmt;
+-
+ if (sii8620_is_mhl3(ctx)) {
+ sii8620_setbits(ctx, REG_M3_P0CTRL,
+ BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
+ ctx->use_packed_pixel ? ~0 : 0);
+ } else {
+- if (ctx->use_packed_pixel)
+- sii8620_write_seq_static(ctx,
+- REG_VID_MODE, BIT_VID_MODE_M1080P,
+- REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
+- REG_MHLTX_CTL6, 0x60
+- );
+- else
+ sii8620_write_seq_static(ctx,
+ REG_VID_MODE, 0,
+ REG_MHL_TOP_CTL, 1,
+@@ -1081,15 +1072,9 @@ static void sii8620_set_format(struct si
+ );
+ }
+
+- if (ctx->use_packed_pixel)
+- out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) |
+- BIT_TPI_OUTPUT_CSCMODE709;
+- else
+- out_fmt = VAL_TPI_FORMAT(RGB, FULL);
+-
+ sii8620_write_seq(ctx,
+ REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
+- REG_TPI_OUTPUT, out_fmt,
++ REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
+ );
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Maciej Purski <m.purski@samsung.com>
+Date: Thu, 28 Jun 2018 18:44:02 +0200
+Subject: drm/bridge/sii8620: Fix display of packed pixel modes
+
+From: Maciej Purski <m.purski@samsung.com>
+
+[ Upstream commit fdddc65ab35d575b42aab411b2dc687601eab680 ]
+
+Current implementation does not guarantee packed pixel modes working
+with every dongle. There are some dongles, which require selecting
+the output mode explicitly.
+
+Write proper values to registers in packed_pixel mode, based on how it
+is done in vendor's code. Select output color space: RGB
+(no packed pixel) or YCBCR422 (packed pixel).
+
+This reverts commit e8b92efa629dac0e70ea4145c5e70616de5f89c8
+("drm/bridge/sii8620: fix display of packed pixel modes in MHL2").
+
+Signed-off-by: Maciej Purski <m.purski@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1530204243-6370-3-git-send-email-m.purski@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -1060,21 +1060,36 @@ static void sii8620_stop_video(struct si
+
+ static void sii8620_set_format(struct sii8620 *ctx)
+ {
++ u8 out_fmt;
++
+ if (sii8620_is_mhl3(ctx)) {
+ sii8620_setbits(ctx, REG_M3_P0CTRL,
+ BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
+ ctx->use_packed_pixel ? ~0 : 0);
+ } else {
++ if (ctx->use_packed_pixel) {
++ sii8620_write_seq_static(ctx,
++ REG_VID_MODE, BIT_VID_MODE_M1080P,
++ REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
++ REG_MHLTX_CTL6, 0x60
++ );
++ } else {
+ sii8620_write_seq_static(ctx,
+ REG_VID_MODE, 0,
+ REG_MHL_TOP_CTL, 1,
+ REG_MHLTX_CTL6, 0xa0
+ );
++ }
+ }
+
++ if (ctx->use_packed_pixel)
++ out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL);
++ else
++ out_fmt = VAL_TPI_FORMAT(RGB, FULL);
++
+ sii8620_write_seq(ctx,
+ REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL),
+- REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL),
++ REG_TPI_OUTPUT, out_fmt,
+ );
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Mon, 15 Jan 2018 18:33:57 +0100
+Subject: drm/bridge/sii8620: fix loops in EDID fetch logic
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 8e627a1b1ce8feb3e1da4428b71b9b4905f04888 ]
+
+Function should constantly check if cable is connected and finish
+in finite time.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Maciej Purski <m.purski@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180115173357.31067-4-a.hajda@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -807,6 +807,7 @@ static void sii8620_burst_rx_all(struct
+ static void sii8620_fetch_edid(struct sii8620 *ctx)
+ {
+ u8 lm_ddc, ddc_cmd, int3, cbus;
++ unsigned long timeout;
+ int fetched, i;
+ int edid_len = EDID_LENGTH;
+ u8 *edid;
+@@ -856,23 +857,31 @@ static void sii8620_fetch_edid(struct si
+ REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK
+ );
+
+- do {
+- int3 = sii8620_readb(ctx, REG_INTR3);
++ int3 = 0;
++ timeout = jiffies + msecs_to_jiffies(200);
++ for (;;) {
+ cbus = sii8620_readb(ctx, REG_CBUS_STATUS);
+-
+- if (int3 & BIT_DDC_CMD_DONE)
+- break;
+-
+- if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) {
++ if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) {
++ kfree(edid);
++ edid = NULL;
++ goto end;
++ }
++ if (int3 & BIT_DDC_CMD_DONE) {
++ if (sii8620_readb(ctx, REG_DDC_DOUT_CNT)
++ >= FETCH_SIZE)
++ break;
++ } else {
++ int3 = sii8620_readb(ctx, REG_INTR3);
++ }
++ if (time_is_before_jiffies(timeout)) {
++ ctx->error = -ETIMEDOUT;
++ dev_err(ctx->dev, "timeout during EDID read\n");
+ kfree(edid);
+ edid = NULL;
+ goto end;
+ }
+- } while (1);
+-
+- sii8620_readb(ctx, REG_DDC_STATUS);
+- while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE)
+ usleep_range(10, 20);
++ }
+
+ sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE);
+ if (fetched + FETCH_SIZE == EDID_LENGTH) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Maciej Purski <m.purski@samsung.com>
+Date: Wed, 22 Nov 2017 10:08:38 +0100
+Subject: drm/bridge/sii8620: fix potential buffer overflow
+
+From: Maciej Purski <m.purski@samsung.com>
+
+[ Upstream commit 9378cecb1ce5d618b8aff4d65113ddcf72fc1011 ]
+
+Buffer overflow error should not occur, as mode_fixup() callback
+filters pixel clock value and it should never exceed 600000. However,
+current implementation is not obviously safe and relies on
+implementation of mode_fixup().
+
+Make 'i' variable never reach unsafe value in order to avoid buffer
+overflow error.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: bf1722ca ("drm/bridge/sii8620: rewrite hdmi start sequence")
+Signed-off-by: Maciej Purski <m.purski@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1511341718-6974-1-git-send-email-m.purski@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -1228,7 +1228,7 @@ static void sii8620_start_video(struct s
+ int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3);
+ int i;
+
+- for (i = 0; i < ARRAY_SIZE(clk_spec); ++i)
++ for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i)
+ if (clk < clk_spec[i].max_clk)
+ break;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 7 Jun 2018 13:07:40 +0200
+Subject: drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ab337fc274a1957ff0771f19e826c736253f7c39 ]
+
+Set per-plane global alpha to maximum value to get proper blending of
+XRGB and ARGB planes. This fixes the strange order of overlapping planes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -351,8 +351,8 @@ static void decon_update_plane(struct ex
+ writel(val, ctx->addr + DECON_VIDOSDxB(win));
+ }
+
+- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
+- VIDOSD_Wx_ALPHA_B_F(0x0);
++ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) |
++ VIDOSD_Wx_ALPHA_B_F(0xff);
+ writel(val, ctx->addr + DECON_VIDOSDxC(win));
+
+ val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 7 Jun 2018 13:07:49 +0200
+Subject: drm/exynos: decon5433: Fix WINCONx reset value
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 7b7aa62c05eac9789c208b946f515983a9255d8d ]
+
+The only bits that should be preserved in decon_win_set_fmt() is
+WINCONx_ENWIN_F. All other bits depends on the selected pixel formats and
+are set by the mentioned function.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -260,7 +260,7 @@ static void decon_win_set_pixfmt(struct
+ unsigned long val;
+
+ val = readl(ctx->addr + DECON_WINCONx(win));
+- val &= ~WINCONx_BPPMODE_MASK;
++ val &= WINCONx_ENWIN_F;
+
+ switch (fb->format->format) {
+ case DRM_FORMAT_XRGB1555:
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 7 Jun 2018 13:06:13 +0200
+Subject: drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ]
+
+Fix following issues related to planar YUV pixel format configuration:
+- NV16/61 modes were incorrectly programmed as NV12/21,
+- YVU420 was programmed as YUV420 on source,
+- YVU420 and YUV422 were programmed as YUV420 on output.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++---------
+ drivers/gpu/drm/exynos/regs-gsc.h | 1 +
+ 2 files changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device
+ GSC_IN_CHROMA_ORDER_CRCB);
+ break;
+ case DRM_FORMAT_NV21:
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV61:
+- cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
+- GSC_IN_YUV420_2P);
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
+ break;
+ case DRM_FORMAT_YUV422:
+ cfg |= GSC_IN_YUV422_3P;
+ break;
+ case DRM_FORMAT_YUV420:
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
++ break;
+ case DRM_FORMAT_YVU420:
+- cfg |= GSC_IN_YUV420_3P;
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
+ break;
+ case DRM_FORMAT_NV12:
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV16:
+- cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
+- GSC_IN_YUV420_2P);
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
+ break;
+ default:
+ dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device
+ GSC_OUT_CHROMA_ORDER_CRCB);
+ break;
+ case DRM_FORMAT_NV21:
+- case DRM_FORMAT_NV61:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
+ break;
++ case DRM_FORMAT_NV61:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
++ break;
+ case DRM_FORMAT_YUV422:
++ cfg |= GSC_OUT_YUV422_3P;
++ break;
+ case DRM_FORMAT_YUV420:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
++ break;
+ case DRM_FORMAT_YVU420:
+- cfg |= GSC_OUT_YUV420_3P;
++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
+ break;
+ case DRM_FORMAT_NV12:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV16:
+- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
+- GSC_OUT_YUV420_2P);
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
+ break;
+ default:
+ dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+--- a/drivers/gpu/drm/exynos/regs-gsc.h
++++ b/drivers/gpu/drm/exynos/regs-gsc.h
+@@ -138,6 +138,7 @@
+ #define GSC_OUT_YUV420_3P (3 << 4)
+ #define GSC_OUT_YUV422_1P (4 << 4)
+ #define GSC_OUT_YUV422_2P (5 << 4)
++#define GSC_OUT_YUV422_3P (6 << 4)
+ #define GSC_OUT_YUV444 (7 << 4)
+ #define GSC_OUT_TILE_TYPE_MASK (1 << 2)
+ #define GSC_OUT_TILE_C_16x8 (0 << 2)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Alison Wang <alison.wang@nxp.com>
+Date: Tue, 24 Apr 2018 10:42:32 +0800
+Subject: drm: mali-dp: Enable Global SE interrupts mask for DP500
+
+From: Alison Wang <alison.wang@nxp.com>
+
+[ Upstream commit 89610dc2c235e7b02bb9fba0ce247e12d4dde7cd ]
+
+In the situation that DE and SE aren’t shared the same interrupt number,
+the Global SE interrupts mask bit MASK_IRQ_EN in MASKIRQ must be set, or
+else other mask bits will not work and no SE interrupt will occur. This
+patch enables MASK_IRQ_EN for SE to fix this problem.
+
+Signed-off-by: Alison Wang <alison.wang@nxp.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/arm/malidp_hw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/arm/malidp_hw.c
++++ b/drivers/gpu/drm/arm/malidp_hw.c
+@@ -634,7 +634,8 @@ const struct malidp_hw malidp_device[MAL
+ .vsync_irq = MALIDP500_DE_IRQ_VSYNC,
+ },
+ .se_irq_map = {
+- .irq_mask = MALIDP500_SE_IRQ_CONF_MODE,
++ .irq_mask = MALIDP500_SE_IRQ_CONF_MODE |
++ MALIDP500_SE_IRQ_GLOBAL,
+ .vsync_irq = 0,
+ },
+ .dc_irq_map = {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+Date: Mon, 18 Jun 2018 18:08:43 +0100
+Subject: drm/mali-dp: Rectify the width and height passed to rotmem_required()
+
+From: Ayan Kumar Halder <ayan.halder@arm.com>
+
+[ Upstream commit c6cf387ec56c19028333274747bbb4ae145a2d13 ]
+
+The width and height needs to be swapped
+
+Signed-off-by: Ayan Kumar halder <ayan.halder@arm.com>
+Reviewed-by: Brian Starkey <brian.starkey@arm.com>
+Reviewed-by: Alexandru Gheorghe <alexandru-cosmin.gheorghe@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+[rebased on top of v4.18-rc1]
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/arm/malidp_planes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -236,8 +236,8 @@ static int malidp_de_plane_check(struct
+ if (state->rotation & MALIDP_ROTATED_MASK) {
+ int val;
+
+- val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_h,
+- state->crtc_w,
++ val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_w,
++ state->crtc_h,
+ fb->format->format);
+ if (val < 0)
+ return val;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 3 Jul 2018 15:30:56 +0300
+Subject: drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7f073d011f93e92d4d225526b9ab6b8b0bbd6613 ]
+
+The bo array has req->nr_buffers elements so the > should be >= so we
+don't read beyond the end of the array.
+
+Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -617,7 +617,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
+ struct nouveau_bo *nvbo;
+ uint32_t data;
+
+- if (unlikely(r->bo_index > req->nr_buffers)) {
++ if (unlikely(r->bo_index >= req->nr_buffers)) {
+ NV_PRINTK(err, cli, "reloc bo index invalid\n");
+ ret = -EINVAL;
+ break;
+@@ -627,7 +627,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
+ if (b->presumed.valid)
+ continue;
+
+- if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
++ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
+ NV_PRINTK(err, cli, "reloc container bo index invalid\n");
+ ret = -EINVAL;
+ break;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 6 Jul 2018 16:28:28 +0200
+Subject: drm/sun4i: link in front-end code if needed
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 3156b53c2e2fadafa1a16412a8791b38f94b5bdc ]
+
+When the base sun4i DRM driver is built-in but the back-end is
+a loadable module, we run into a link error:
+
+drivers/gpu/drm/sun4i/sun4i_drv.o: In function `sun4i_drv_probe':
+sun4i_drv.c:(.text+0x60c): undefined reference to `sun4i_frontend_of_table'
+
+The dependency is a bit tricky, the best workaround I have come up
+with is to use a Makefile hack to to interpret both
+CONFIG_DRM_SUN4I_BACKEND=m and CONFIG_DRM_SUN4I_BACKEND=y
+as a directive to build the front-end the same way as the main module.
+
+Fixes: dd0421f47505 ("drm/sun4i: Add a driver for the display frontend")
+Link: https://lore.kernel.org/lkml/20180301091908.zcptz3ezqr2c6ly5@flea/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180706142847.2032381-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sun4i/Makefile | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/sun4i/Makefile
++++ b/drivers/gpu/drm/sun4i/Makefile
+@@ -29,7 +29,10 @@ obj-$(CONFIG_DRM_SUN4I) += sun4i-tcon.o
+ obj-$(CONFIG_DRM_SUN4I) += sun4i_tv.o
+ obj-$(CONFIG_DRM_SUN4I) += sun6i_drc.o
+
+-obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o sun4i-frontend.o
++obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o
++ifdef CONFIG_DRM_SUN4I_BACKEND
++obj-$(CONFIG_DRM_SUN4I) += sun4i-frontend.o
++endif
+ obj-$(CONFIG_DRM_SUN4I_HDMI) += sun4i-drm-hdmi.o
+ obj-$(CONFIG_DRM_SUN8I_DW_HDMI) += sun8i-drm-hdmi.o
+ obj-$(CONFIG_DRM_SUN8I_MIXER) += sun8i-mixer.o
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Mikko Perttunen <mperttunen@nvidia.com>
+Date: Wed, 20 Jun 2018 16:03:58 +0300
+Subject: drm/tegra: Fix comparison operator for buffer size
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 5265f0338bc0feec6c0d544dfe005dec1a93cb93 ]
+
+Here we are checking for the buffer length, not an offset for writing
+to, so using > is correct. The current code incorrectly rejects a
+command buffer ending at the memory buffer's end.
+
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tegra/drm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -436,7 +436,7 @@ int tegra_drm_submit(struct tegra_drm_co
+ * unaligned offset is malformed and cause commands stream
+ * corruption on the buffer address relocation.
+ */
+- if (offset & 3 || offset >= obj->gem.size) {
++ if (offset & 3 || offset > obj->gem.size) {
+ err = -EINVAL;
+ goto fail;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Wed, 23 May 2018 16:24:44 +0400
+Subject: dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+[ Upstream commit 1d8e5c00275825fc42aaa5597dab1d0b5b26bb64 ]
+
+PID bitfield in descriptor should be set based on particular request
+length, not based on EP's mc value. PID value can't be set to 0 even
+request length is 0.
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -808,6 +808,7 @@ static int dwc2_gadget_fill_isoc_desc(st
+ u32 index;
+ u32 maxsize = 0;
+ u32 mask = 0;
++ u8 pid = 0;
+
+ maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask);
+ if (len > maxsize) {
+@@ -853,7 +854,11 @@ static int dwc2_gadget_fill_isoc_desc(st
+ ((len << DEV_DMA_NBYTES_SHIFT) & mask));
+
+ if (hs_ep->dir_in) {
+- desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) &
++ if (len)
++ pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket);
++ else
++ pid = 1;
++ desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) &
+ DEV_DMA_ISOC_PID_MASK) |
+ ((len % hs_ep->ep.maxpacket) ?
+ DEV_DMA_SHORT : 0) |
--- /dev/null
+From b748f2de4b2f578599f46c6000683a8da755bf68 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 10 Aug 2018 16:14:26 +0200
+Subject: EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b748f2de4b2f578599f46c6000683a8da755bf68 upstream.
+
+The edac_mem_types[] array misses a MEM_LRDDR4 entry, which leads to
+NULL pointer dereference when accessed via sysfs or such.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20180810141426.8918-1-tiwai@suse.de
+Fixes: 1e8096bb2031 ("EDAC: Add LRDDR4 DRAM type")
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/edac_mc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -215,6 +215,7 @@ const char * const edac_mem_types[] = {
+ [MEM_LRDDR3] = "Load-Reduced-DDR3-RAM",
+ [MEM_DDR4] = "Unbuffered-DDR4",
+ [MEM_RDDR4] = "Registered-DDR4",
++ [MEM_LRDDR4] = "Load-Reduced-DDR4-RAM",
+ [MEM_NVDIMM] = "Non-volatile-RAM",
+ };
+ EXPORT_SYMBOL_GPL(edac_mem_types);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Date: Tue, 19 Jun 2018 08:15:24 -0700
+Subject: enic: initialize enic->rfs_h.lock in enic_probe
+
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+
+[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ]
+
+lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without
+initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops
+can be called when interface is down.
+
+Move enic_rfs_flw_tbl_init to enic_probe.
+
+INFO: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
+Call Trace:
+dump_stack+0x85/0xc0
+register_lock_class+0x550/0x560
+? __handle_mm_fault+0xa8b/0x1100
+__lock_acquire+0x81/0x670
+lock_acquire+0xb9/0x1e0
+? enic_get_rxnfc+0x139/0x2b0 [enic]
+_raw_spin_lock_bh+0x38/0x80
+? enic_get_rxnfc+0x139/0x2b0 [enic]
+enic_get_rxnfc+0x139/0x2b0 [enic]
+ethtool_get_rxnfc+0x8d/0x1c0
+dev_ethtool+0x16c8/0x2400
+? __mutex_lock+0x64d/0xa00
+? dev_load+0x6a/0x150
+dev_ioctl+0x253/0x4b0
+sock_do_ioctl+0x9a/0x130
+sock_ioctl+0x1af/0x350
+do_vfs_ioctl+0x8e/0x670
+? syscall_trace_enter+0x1e2/0x380
+ksys_ioctl+0x60/0x90
+__x64_sys_ioctl+0x16/0x20
+do_syscall_64+0x5a/0x170
+entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +--
+ drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic *
+ enic->rfs_h.max = enic->config.num_arfs;
+ enic->rfs_h.free = enic->rfs_h.max;
+ enic->rfs_h.toclean = 0;
+- enic_rfs_timer_start(enic);
+ }
+
+ void enic_rfs_flw_tbl_free(struct enic *enic)
+@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic *
+
+ enic_rfs_timer_stop(enic);
+ spin_lock_bh(&enic->rfs_h.lock);
+- enic->rfs_h.free = 0;
+ for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
+ struct hlist_head *hhead;
+ struct hlist_node *tmp;
+@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic *
+ enic_delfltr(enic, n->fltr_id);
+ hlist_del(&n->node);
+ kfree(n);
++ enic->rfs_h.free++;
+ }
+ }
+ spin_unlock_bh(&enic->rfs_h.lock);
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1971,7 +1971,7 @@ static int enic_open(struct net_device *
+ vnic_intr_unmask(&enic->intr[i]);
+
+ enic_notify_timer_start(enic);
+- enic_rfs_flw_tbl_init(enic);
++ enic_rfs_timer_start(enic);
+
+ return 0;
+
+@@ -2895,6 +2895,7 @@ static int enic_probe(struct pci_dev *pd
+
+ timer_setup(&enic->notify_timer, enic_notify_timer, 0);
+
++ enic_rfs_flw_tbl_init(enic);
+ enic_set_rx_coal_setting(enic);
+ INIT_WORK(&enic->reset, enic_reset);
+ INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Madalin Bucur <madalin.bucur@nxp.com>
+Date: Thu, 28 Jun 2018 15:26:50 +0300
+Subject: fsl/fman: fix parser reporting bad checksum on short frames
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit b95f6fbc8e15803a596ca5e5e21008fba29694c6 ]
+
+The FMan hardware parser needs to be configured to remove the
+short frame padding from the checksum calculation, otherwise
+short UDP and TCP frames are likely to be marked as having a
+bad checksum.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_port.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/freescale/fman/fman_port.c
++++ b/drivers/net/ethernet/freescale/fman/fman_port.c
+@@ -324,6 +324,10 @@ struct fman_port_qmi_regs {
+ #define HWP_HXS_PHE_REPORT 0x00000800
+ #define HWP_HXS_PCAC_PSTAT 0x00000100
+ #define HWP_HXS_PCAC_PSTOP 0x00000001
++#define HWP_HXS_TCP_OFFSET 0xA
++#define HWP_HXS_UDP_OFFSET 0xB
++#define HWP_HXS_SH_PAD_REM 0x80000000
++
+ struct fman_port_hwp_regs {
+ struct {
+ u32 ssa; /* Soft Sequence Attachment */
+@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *p
+ iowrite32be(0xffffffff, ®s->pmda[i].lcv);
+ }
+
++ /* Short packet padding removal from checksum calculation */
++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_TCP_OFFSET].ssa);
++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_UDP_OFFSET].ssa);
++
+ start_port_hwp(port);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 6 Jul 2018 21:02:36 +0300
+Subject: gpu: host1x: Check whether size of unpin isn't 0
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit ec58923215dbbeef59ee82923ee94d745f73db58 ]
+
+Only gather pins are mapped by the Host1x driver, regular BO relocations
+are not. Check whether size of unpin isn't 0, otherwise IOVA allocation at
+0x0 could be erroneously released.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/host1x/job.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/host1x/job.c
++++ b/drivers/gpu/host1x/job.c
+@@ -686,7 +686,8 @@ void host1x_job_unpin(struct host1x_job
+ for (i = 0; i < job->num_unpins; i++) {
+ struct host1x_job_unpin_data *unpin = &job->unpins[i];
+
+- if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
++ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
++ unpin->size && host->domain) {
+ iommu_unmap(host->domain, job->addr_phys[i],
+ unpin->size);
+ free_iova(&host->iova,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Sat, 19 May 2018 04:07:10 +0300
+Subject: gpu: host1x: Skip IOMMU initialization if firewall is enabled
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 4466b1f0e022f94a026bd700fee34bff15cdc4ef ]
+
+Host1x's CDMA can't access the command buffers if IOMMU and Host1x
+firewall are enabled in the kernels config because firewall doesn't map
+the copied buffer into IOVA space. Fix this by skipping IOMMU
+initialization if firewall is enabled as firewall merges sparse cmdbufs
+into a single contiguous buffer and hence IOMMU isn't needed in this case.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/host1x/dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_
+ return err;
+ }
+
++ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
++ goto skip_iommu;
++
+ host->group = iommu_group_get(&pdev->dev);
+ if (host->group) {
+ struct iommu_domain_geometry *geometry;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Fri, 8 Jun 2018 08:14:50 +0800
+Subject: HID: google: Add support for whiskers
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 3e84c7651dde7cca43c5cfd7385086599cce5a5d ]
+
+Another device in the hammer class, with USB id 0x5030.
+
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-google-hammer.c | 2 ++
+ drivers/hid/hid-ids.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -124,6 +124,8 @@ static const struct hid_device_id hammer
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WHISKERS) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, hammer_devices);
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -452,6 +452,7 @@
+ #define USB_DEVICE_ID_GOOGLE_TOUCH_ROSE 0x5028
+ #define USB_DEVICE_ID_GOOGLE_STAFF 0x502b
+ #define USB_DEVICE_ID_GOOGLE_WAND 0x502d
++#define USB_DEVICE_ID_GOOGLE_WHISKERS 0x5030
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jason Gerecke <killertofu@gmail.com>
+Date: Tue, 26 Jun 2018 09:58:02 -0700
+Subject: HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
+
+From: Jason Gerecke <killertofu@gmail.com>
+
+[ Upstream commit 3b8d573586d1b9dee33edf6cb6f2ca05f4bca568 ]
+
+The touch sensors on the 2nd-gen Intuos tablets don't use a 4096x4096
+sensor like other similar tablets (3rd-gen Bamboo, Intuos5, etc.).
+The incorrect maximum XY values don't normally affect userspace since
+touch input from these devices is typically relative rather than
+absolute. It does, however, cause problems when absolute distances
+need to be measured, e.g. for gesture recognition. Since the resolution
+of the touch sensor on these devices is 10 units / mm (versus 100 for
+the pen sensor), the proper maximum values can be calculated by simply
+dividing by 10.
+
+Fixes: b5fd2a3e92 ("Input: wacom - add support for three new Intuos devices")
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_wac.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3361,8 +3361,14 @@ void wacom_setup_device_quirks(struct wa
+ if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
+ features->device_type |= WACOM_DEVICETYPE_PAD;
+
+- features->x_max = 4096;
+- features->y_max = 4096;
++ if (features->type == INTUOSHT2) {
++ features->x_max = features->x_max / 10;
++ features->y_max = features->y_max / 10;
++ }
++ else {
++ features->x_max = 4096;
++ features->y_max = 4096;
++ }
+ }
+ else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
+ features->device_type |= WACOM_DEVICETYPE_PAD;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Fri, 13 Jul 2018 10:38:38 -0700
+Subject: hv/netvsc: fix handling of fallback to single queue mode
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 916c5e1413be058d1c1f6e502db350df890730ce ]
+
+The netvsc device may need to fallback to running in single queue
+mode if host side only wants to support single queue.
+
+Recent change for handling mtu broke this in setup logic.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 3ffe64f1a641 ("hv_netvsc: split sub-channel setup into async and sync")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/rndis_filter.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -1307,6 +1307,7 @@ out:
+ /* setting up multiple channels failed */
+ net_device->max_chn = 1;
+ net_device->num_chn = 1;
++ return 0;
+
+ err_dev_remv:
+ rndis_filter_device_remove(dev, net_device);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Helge Eichelberg <kernelorg@elchenberg.name>
+Date: Tue, 5 Jun 2018 19:38:32 +0200
+Subject: hwmon: (dell-smm) Disable fan support for Dell XPS13 9333
+
+From: Helge Eichelberg <kernelorg@elchenberg.name>
+
+[ Upstream commit 536e0019b7da4eb3badb4da5acbb70ae29e1b5ef ]
+
+Calling fan related SMM functions implemented by Dell BIOS firmware on Dell
+XPS13 9333 freeze kernel for about 500ms. Until Dell fixes it we need to
+disable fan support for Dell XPS13 9333.
+
+Via "force" module param fan support can be enabled.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=195751
+Signed-off-by: Helge Eichelberg <kernelorg@elchenberg.name>
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1074,6 +1074,13 @@ static struct dmi_system_id i8k_blacklis
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Vostro 3360"),
+ },
+ },
++ {
++ .ident = "Dell XPS13 9333",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 12 Jun 2018 15:19:35 -0700
+Subject: hwmon: (nct6775) Fix loop limit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 91bb8f45f73f19a0150c233c0f11cdeb6d71d1e9 ]
+
+Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label
+handling") changed a loop limit from "data->temp_label_num - 1" to "32",
+as part of moving from a string array to a bit mask. This results in the
+following error, reported by UBSAN.
+
+UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27
+shift exponent 32 is too large for 32-bit type 'long unsigned int'
+
+Similar to the original loop, the limit has to be one less than the
+number of bits.
+
+Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling")
+Reported-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
+Cc: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
+Tested-by: Paul Menzel <pmenzel+linux-hwmon@molgen.mpg.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/nct6775.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform
+ * The temperature is already monitored if the respective bit in <mask>
+ * is set.
+ */
+- for (i = 0; i < 32; i++) {
++ for (i = 0; i < 31; i++) {
+ if (!(data->temp_mask & BIT(i + 1)))
+ continue;
+ if (!reg_temp_alternate[i])
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+Date: Mon, 11 Jun 2018 20:15:11 +0200
+Subject: IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
+
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3dc7c7badb7502ec3e3aa817a8bdd9e53aa54c52 ]
+
+Before returning -EPERM we should release some resources, as already done
+in the other error handling path of the function.
+
+Fixes: d8f9cc328c88 ("IB/mlx4: Mark user MR as writable if actual virtual memory is writable")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/mr.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -486,8 +486,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *
+ }
+
+ if (flags & IB_MR_REREG_ACCESS) {
+- if (ib_access_writable(mr_access_flags) && !mmr->umem->writable)
+- return -EPERM;
++ if (ib_access_writable(mr_access_flags) &&
++ !mmr->umem->writable) {
++ err = -EPERM;
++ goto release_mpt_entry;
++ }
+
+ err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
+ convert_access(mr_access_flags));
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+Date: Thu, 7 Jun 2018 02:32:52 -0400
+Subject: IB/rxe: avoid double kfree skb
+
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+
+[ Upstream commit 828d810550abc1fffff9b20545fec4bc150d5e82 ]
+
+In rxe_send, when network_type is not RDMA_NETWORK_IPV4 or
+RDMA_NETWORK_IPV6, skb is freed and -EINVAL is returned.
+Then rxe_xmit_packet will return -EINVAL, too. In rxe_requester,
+this skb is double freed.
+In rxe_requester, kfree_skb is needed only after fill_packet fails.
+So kfree_skb is moved from label err to test fill_packet.
+
+Fixes: 5793b4652155 ("IB/rxe: remove unnecessary skb_clone in xmit")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -709,6 +709,7 @@ next_wqe:
+
+ if (fill_packet(qp, wqe, &pkt, skb, payload)) {
+ pr_debug("qp#%d Error during fill packet\n", qp_num(qp));
++ kfree_skb(skb);
+ goto err;
+ }
+
+@@ -740,7 +741,6 @@ next_wqe:
+ goto next_wqe;
+
+ err:
+- kfree_skb(skb);
+ wqe->status = IB_WC_LOC_PROT_ERR;
+ wqe->state = wqe_state_error;
+ __rxe_do_task(&qp->comp.task);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Vijay Immanuel <vijayi@attalasystems.com>
+Date: Tue, 12 Jun 2018 18:16:05 -0700
+Subject: IB/rxe: Fix missing completion for mem_reg work requests
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit 375dc53d032fc11e98036b5f228ad13f7c5933f5 ]
+
+Run the completer task to post a work completion after processing
+a memory registration or invalidate work request. This covers the
+case where the memory registration or invalidate was the last work
+request posted to the qp.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Reviewed-by: Yonatan Cohen <yonatanc@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -645,6 +645,9 @@ next_wqe:
+ } else {
+ goto exit;
+ }
++ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
++ qp->sq_sig_type == IB_SIGNAL_ALL_WR)
++ rxe_run_task(&qp->comp.task, 1);
+ qp->req.wqe_index = next_index(qp->sq.queue,
+ qp->req.wqe_index);
+ goto next_wqe;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: John Allen <jallen@linux.ibm.com>
+Date: Mon, 16 Jul 2018 10:29:30 -0500
+Subject: ibmvnic: Fix error recovery on login failure
+
+From: John Allen <jallen@linux.ibm.com>
+
+[ Upstream commit 3578a7ecb69920efc3885dbd610e98c00dbdf5db ]
+
+Testing has uncovered a failure case that is not handled properly. In the
+event that a login fails and we are not able to recover on the spot, we
+return 0 from do_reset, preventing any error recovery code from being
+triggered. Additionally, the state is set to "probed" meaning that when we
+are able to trigger the error recovery, the driver always comes up in the
+probed state. To handle the case properly, we need to return a failure code
+here and set the adapter state to the state that we entered the reset in
+indicating the state that we would like to come out of the recovery reset
+in.
+
+Signed-off-by: John Allen <jallen@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1801,8 +1801,8 @@ static int do_reset(struct ibmvnic_adapt
+
+ rc = ibmvnic_login(netdev);
+ if (rc) {
+- adapter->state = VNIC_PROBED;
+- return 0;
++ adapter->state = reset_state;
++ return rc;
+ }
+
+ if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Date: Fri, 13 Jul 2018 12:03:32 -0500
+Subject: ibmvnic: Revise RX/TX queue error messages
+
+From: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+
+[ Upstream commit 2d14d3795294d42aacc278948984a480569bcc23 ]
+
+During a device failover, there may be latency between the loss
+of the current backing device and a notification from firmware that
+a failover has occurred. This latency can result in a large amount of
+error printouts as firmware returns outgoing traffic with a generic
+error code. These are not necessarily errors in this case as the
+firmware is busy swapping in a new backing adapter and is not ready
+to send packets yet. This patch reclassifies those error codes as
+warnings with an explanation that a failover may be pending. All
+other return codes will be considered errors.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 39 +++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -319,7 +319,8 @@ static void replenish_rx_pool(struct ibm
+ return;
+
+ failure:
+- dev_info(dev, "replenish pools failure\n");
++ if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
++ dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
+ pool->free_map[pool->next_free] = index;
+ pool->rx_buff[index].skb = NULL;
+
+@@ -1594,7 +1595,8 @@ static int ibmvnic_xmit(struct sk_buff *
+ &tx_crq);
+ }
+ if (lpar_rc != H_SUCCESS) {
+- dev_err(dev, "tx failed with code %ld\n", lpar_rc);
++ if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
++ dev_err_ratelimited(dev, "tx: send failed\n");
+ dev_kfree_skb_any(skb);
+ tx_buff->skb = NULL;
+
+@@ -3085,6 +3087,25 @@ static union ibmvnic_crq *ibmvnic_next_c
+ return crq;
+ }
+
++static void print_subcrq_error(struct device *dev, int rc, const char *func)
++{
++ switch (rc) {
++ case H_PARAMETER:
++ dev_warn_ratelimited(dev,
++ "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
++ func, rc);
++ break;
++ case H_CLOSED:
++ dev_warn_ratelimited(dev,
++ "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
++ func, rc);
++ break;
++ default:
++ dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
++ break;
++ }
++}
++
+ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
+ union sub_crq *sub_crq)
+ {
+@@ -3111,11 +3132,8 @@ static int send_subcrq(struct ibmvnic_ad
+ cpu_to_be64(u64_crq[2]),
+ cpu_to_be64(u64_crq[3]));
+
+- if (rc) {
+- if (rc == H_CLOSED)
+- dev_warn(dev, "CRQ Queue closed\n");
+- dev_err(dev, "Send error (rc=%d)\n", rc);
+- }
++ if (rc)
++ print_subcrq_error(dev, rc, __func__);
+
+ return rc;
+ }
+@@ -3133,11 +3151,8 @@ static int send_subcrq_indirect(struct i
+ cpu_to_be64(remote_handle),
+ ioba, num_entries);
+
+- if (rc) {
+- if (rc == H_CLOSED)
+- dev_warn(dev, "CRQ Queue closed\n");
+- dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
+- }
++ if (rc)
++ print_subcrq_error(dev, rc, __func__);
+
+ return rc;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Mon, 2 Jul 2018 11:21:47 +0200
+Subject: ieee802154: 6lowpan: set IFLA_LINK
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit b30c122c0bbb0a1dc413085e177ea09467e65fdb ]
+
+Otherwise NetworkManager (and iproute alike) is not able to identify the
+parent IEEE 802.15.4 interface of a 6LoWPAN link.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/6lowpan/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ieee802154/6lowpan/core.c
++++ b/net/ieee802154/6lowpan/core.c
+@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct
+ return 0;
+ }
+
++static int lowpan_get_iflink(const struct net_device *dev)
++{
++ return lowpan_802154_dev(dev)->wdev->ifindex;
++}
++
+ static const struct net_device_ops lowpan_netdev_ops = {
+ .ndo_init = lowpan_dev_init,
+ .ndo_start_xmit = lowpan_xmit,
+ .ndo_open = lowpan_open,
+ .ndo_stop = lowpan_stop,
+ .ndo_neigh_construct = lowpan_neigh_construct,
++ .ndo_get_iflink = lowpan_get_iflink,
+ };
+
+ static void lowpan_setup(struct net_device *ldev)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+Date: Fri, 22 Sep 2017 14:13:53 +0200
+Subject: ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
+
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+
+[ Upstream commit 20f330452ad8814f2289a589baf65e21270879a7 ]
+
+The check is valid but it does not warrant to crash the kernel. A
+WARN_ON() is good enough here.
+Found by checkpatch.
+
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/at86rf230.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw,
+ static int
+ at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+- BUG_ON(!level);
++ WARN_ON(!level);
+ *level = 0xbe;
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+Date: Fri, 22 Sep 2017 14:13:54 +0200
+Subject: ieee802154: at86rf230: use __func__ macro for debug messages
+
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+
+[ Upstream commit 8a81388ec27c4c0adbdecd20e67bb5f411ab46b2 ]
+
+Instead of having the function name hard-coded (it might change and we
+forgot to update them in the debug output) we can use __func__ instead
+and also shorter the line so we do not need to break it. Also fix an
+extra blank line while being here.
+Found by checkpatch.
+
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/at86rf230.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
+ if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ u16 addr = le16_to_cpu(filt->short_addr);
+
+- dev_vdbg(&lp->spi->dev,
+- "at86rf230_set_hw_addr_filt called for saddr\n");
++ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
+ __at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
+ __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
+ }
+@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
+ if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ u16 pan = le16_to_cpu(filt->pan_id);
+
+- dev_vdbg(&lp->spi->dev,
+- "at86rf230_set_hw_addr_filt called for pan id\n");
++ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
+ __at86rf230_write(lp, RG_PAN_ID_0, pan);
+ __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
+ }
+@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee80
+ u8 i, addr[8];
+
+ memcpy(addr, &filt->ieee_addr, 8);
+- dev_vdbg(&lp->spi->dev,
+- "at86rf230_set_hw_addr_filt called for IEEE addr\n");
++ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
+ for (i = 0; i < 8; i++)
+ __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
+ }
+
+ if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+- dev_vdbg(&lp->spi->dev,
+- "at86rf230_set_hw_addr_filt called for panc change\n");
++ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
+ if (filt->pan_coord)
+ at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
+ else
+@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154
+ return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
+ }
+
+-
+ static int
+ at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
+ {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+Date: Fri, 22 Sep 2017 14:14:05 +0200
+Subject: ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
+
+From: Stefan Schmidt <stefan@datenfreihafen.org>
+
+[ Upstream commit 8f2fbc6c60ff213369e06a73610fc882a42fdf20 ]
+
+The check is valid but it does not warrant to crash the kernel. A
+WARN_ON() is good enough here.
+Found by checkpatch.
+
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/fakelb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/fakelb.c
++++ b/drivers/net/ieee802154/fakelb.c
+@@ -49,7 +49,7 @@ struct fakelb_phy {
+
+ static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+- BUG_ON(!level);
++ WARN_ON(!level);
+ *level = 0xbe;
+
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 30 May 2018 23:47:09 +0200
+Subject: ieee802154: mcr20a: add missing includes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a6032120d341badd9b034cb64411e7089d8f4285 ]
+
+Without CONFIG_GPIOLIB, some headers are not included implicitly,
+leading to a build failure:
+
+drivers/net/ieee802154/mcr20a.c: In function 'mcr20a_probe':
+drivers/net/ieee802154/mcr20a.c:1347:13: error: implicit declaration of function 'irq_get_trigger_type'; did you mean 'irq_get_irqchip_state'? [-Werror=implicit-function-declaration]
+
+This includes gpio/consumer.h and irq.h directly rather through the
+gpiolib header.
+
+Fixes: 8c6ad9cc5157 ("ieee802154: Add NXP MCR20A IEEE 802.15.4 transceiver driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Xue Liu <liuxuenetmail@gmail.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/mcr20a.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/mcr20a.c
++++ b/drivers/net/ieee802154/mcr20a.c
+@@ -15,10 +15,11 @@
+ */
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
+ #include <linux/spi/spi.h>
+ #include <linux/workqueue.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+ #include <linux/skbuff.h>
+ #include <linux/of_gpio.h>
+ #include <linux/regmap.h>
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Tomasz Duszynski <tduszyns@gmail.com>
+Date: Mon, 28 May 2018 17:38:59 +0200
+Subject: iio: pressure: bmp280: fix relative humidity unit
+
+From: Tomasz Duszynski <tduszyns@gmail.com>
+
+[ Upstream commit 13399ff25f179811ce9c1df1523eb39f9e4a4772 ]
+
+According to IIO ABI relative humidity reading should be
+returned in milli percent.
+
+This patch addresses that by applying proper scaling and
+returning integer instead of fractional format type specifier.
+
+Note that the fixes tag is before the driver was heavily refactored
+to introduce spi support, so the patch won't apply that far back.
+
+Signed-off-by: Tomasz Duszynski <tduszyns@gmail.com>
+Fixes: 14beaa8f5ab1 ("iio: pressure: bmp280: add humidity support")
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/bmp280-core.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -415,10 +415,9 @@ static int bmp280_read_humid(struct bmp2
+ }
+ comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
+
+- *val = comp_humidity;
+- *val2 = 1024;
++ *val = comp_humidity * 1000 / 1024;
+
+- return IIO_VAL_FRACTIONAL;
++ return IIO_VAL_INT;
+ }
+
+ static int bmp280_read_raw(struct iio_dev *indio_dev,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Tue, 5 Jun 2018 10:34:54 -0700
+Subject: Input: synaptics-rmi4 - fix axis-swap behavior
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 645a397d325db6e1bb36588095ae637738b37693 ]
+
+The documentation for the touchscreen-swapped-x-y property states that
+swapping is done after inverting if both are used. RMI4 did it the other
+way around, leading to inconsistent behavior with regard to other
+touchscreens.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Tested-by: Nick Dyer <nick@shmanahar.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/rmi4/rmi_2d_sensor.c | 34 ++++++++++++++++------------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_2d_sensor.c
++++ b/drivers/input/rmi4/rmi_2d_sensor.c
+@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rm
+ if (obj->type == RMI_2D_OBJECT_NONE)
+ return;
+
+- if (axis_align->swap_axes)
+- swap(obj->x, obj->y);
+-
+ if (axis_align->flip_x)
+ obj->x = sensor->max_x - obj->x;
+
+ if (axis_align->flip_y)
+ obj->y = sensor->max_y - obj->y;
+
++ if (axis_align->swap_axes)
++ swap(obj->x, obj->y);
++
+ /*
+ * Here checking if X offset or y offset are specified is
+ * redundant. We just add the offsets or clip the values.
+@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi
+ x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x));
+ y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y));
+
+- if (axis_align->swap_axes)
+- swap(x, y);
+-
+ if (axis_align->flip_x)
+ x = min(RMI_2D_REL_POS_MAX, -x);
+
+ if (axis_align->flip_y)
+ y = min(RMI_2D_REL_POS_MAX, -y);
+
++ if (axis_align->swap_axes)
++ swap(x, y);
++
+ if (x || y) {
+ input_report_rel(sensor->input, REL_X, x);
+ input_report_rel(sensor->input, REL_Y, y);
+@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_para
+ struct input_dev *input = sensor->input;
+ int res_x;
+ int res_y;
++ int max_x, max_y;
+ int input_flags = 0;
+
+ if (sensor->report_abs) {
+- if (sensor->axis_align.swap_axes) {
+- swap(sensor->max_x, sensor->max_y);
+- swap(sensor->axis_align.clip_x_low,
+- sensor->axis_align.clip_y_low);
+- swap(sensor->axis_align.clip_x_high,
+- sensor->axis_align.clip_y_high);
+- }
+-
+ sensor->min_x = sensor->axis_align.clip_x_low;
+ if (sensor->axis_align.clip_x_high)
+ sensor->max_x = min(sensor->max_x,
+@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_para
+ sensor->axis_align.clip_y_high);
+
+ set_bit(EV_ABS, input->evbit);
+- input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x,
+- 0, 0);
+- input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y,
+- 0, 0);
++
++ max_x = sensor->max_x;
++ max_y = sensor->max_y;
++ if (sensor->axis_align.swap_axes)
++ swap(max_x, max_y);
++ input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
++ input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
+
+ if (sensor->x_mm && sensor->y_mm) {
+ res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm;
+ res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm;
++ if (sensor->axis_align.swap_axes)
++ swap(res_x, res_y);
+
+ input_abs_set_res(input, ABS_X, res_x);
+ input_abs_set_res(input, ABS_Y, res_y);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Fri, 6 Jul 2018 12:30:20 +0200
+Subject: ipfrag: really prevent allocation on netns exit
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit f6f2a4a2eb92bc73671204198bb2f8ab53ff59fb ]
+
+Setting the low threshold to 0 has no effect on frags allocation,
+we need to clear high_thresh instead.
+
+The code was pre-existent to commit 648700f76b03 ("inet: frags:
+use rhashtables for reassembly units"), but before the above,
+such assignment had a different role: prevent concurrent eviction
+from the worker and the netns cleanup helper.
+
+Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_fragment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr
+
+ void inet_frags_exit_net(struct netns_frags *nf)
+ {
+- nf->low_thresh = 0; /* prevent creation of new frags */
++ nf->high_thresh = 0; /* prevent creation of new frags */
+
+ rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Haiyue Wang <haiyue.wang@linux.intel.com>
+Date: Sat, 23 Jun 2018 21:51:13 +0800
+Subject: ipmi: kcs_bmc: fix IRQ exception if the channel is not open
+
+From: Haiyue Wang <haiyue.wang@linux.intel.com>
+
+[ Upstream commit dc0f0a026d33819bb82d5c26ab2fca838e2004be ]
+
+When kcs_bmc_handle_event calls kcs_force_abort function to handle the
+not open (no user running) KCS channel transaction, the returned status
+value -ENODEV causes the low level IRQ handler indicating that the irq
+was not for him by returning IRQ_NONE. After some time, this IRQ will
+be treated to be spurious one, and the exception dump happens.
+
+ irq 30: nobody cared (try booting with the "irqpoll" option)
+ CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.15-npcm750 #1
+ Hardware name: NPCMX50 Chip family
+ [<c010b264>] (unwind_backtrace) from [<c0106930>] (show_stack+0x20/0x24)
+ [<c0106930>] (show_stack) from [<c03dad38>] (dump_stack+0x8c/0xa0)
+ [<c03dad38>] (dump_stack) from [<c0168810>] (__report_bad_irq+0x3c/0xdc)
+ [<c0168810>] (__report_bad_irq) from [<c0168c34>] (note_interrupt+0x29c/0x2ec)
+ [<c0168c34>] (note_interrupt) from [<c0165c80>] (handle_irq_event_percpu+0x5c/0x68)
+ [<c0165c80>] (handle_irq_event_percpu) from [<c0165cd4>] (handle_irq_event+0x48/0x6c)
+ [<c0165cd4>] (handle_irq_event) from [<c0169664>] (handle_fasteoi_irq+0xc8/0x198)
+ [<c0169664>] (handle_fasteoi_irq) from [<c016529c>] (__handle_domain_irq+0x90/0xe8)
+ [<c016529c>] (__handle_domain_irq) from [<c01014bc>] (gic_handle_irq+0x58/0x9c)
+ [<c01014bc>] (gic_handle_irq) from [<c010752c>] (__irq_svc+0x6c/0x90)
+ Exception stack(0xc0a01de8 to 0xc0a01e30)
+ 1de0: 00002080 c0a6fbc0 00000000 00000000 00000000 c096d294
+ 1e00: 00000000 00000001 dc406400 f03ff100 00000082 c0a01e94 c0a6fbc0 c0a01e38
+ 1e20: 00200102 c01015bc 60000113 ffffffff
+ [<c010752c>] (__irq_svc) from [<c01015bc>] (__do_softirq+0xbc/0x358)
+ [<c01015bc>] (__do_softirq) from [<c011c798>] (irq_exit+0xb8/0xec)
+ [<c011c798>] (irq_exit) from [<c01652a0>] (__handle_domain_irq+0x94/0xe8)
+ [<c01652a0>] (__handle_domain_irq) from [<c01014bc>] (gic_handle_irq+0x58/0x9c)
+ [<c01014bc>] (gic_handle_irq) from [<c010752c>] (__irq_svc+0x6c/0x90)
+ Exception stack(0xc0a01ef8 to 0xc0a01f40)
+ 1ee0: 00000000 000003ae
+ 1f00: dcc0f338 c0111060 c0a00000 c0a0cc44 c0a0cbe4 c0a1c22b c07bc218 00000001
+ 1f20: dcffca40 c0a01f54 c0a01f58 c0a01f48 c0103524 c0103528 60000013 ffffffff
+ [<c010752c>] (__irq_svc) from [<c0103528>] (arch_cpu_idle+0x48/0x4c)
+ [<c0103528>] (arch_cpu_idle) from [<c0681390>] (default_idle_call+0x30/0x3c)
+ [<c0681390>] (default_idle_call) from [<c0156f24>] (do_idle+0xc8/0x134)
+ [<c0156f24>] (do_idle) from [<c015722c>] (cpu_startup_entry+0x28/0x2c)
+ [<c015722c>] (cpu_startup_entry) from [<c067ad74>] (rest_init+0x84/0x88)
+ [<c067ad74>] (rest_init) from [<c0900d44>] (start_kernel+0x388/0x394)
+ [<c0900d44>] (start_kernel) from [<0000807c>] (0x807c)
+ handlers:
+ [<c041c5dc>] npcm7xx_kcs_irq
+ Disabling IRQ #30
+
+It needs to change the returned status from -ENODEV to 0. The -ENODEV
+was originally used to tell the low level IRQ handler that no user was
+running, but not consider the IRQ handling desgin.
+
+And multiple KCS channels share one IRQ handler, it needs to check the
+IBF flag before doing force abort. If the IBF is set, after handling,
+return 0 to low level IRQ handler to indicate that the IRQ is handled.
+
+Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/kcs_bmc.c | 31 ++++++++++---------------------
+ 1 file changed, 10 insertions(+), 21 deletions(-)
+
+--- a/drivers/char/ipmi/kcs_bmc.c
++++ b/drivers/char/ipmi/kcs_bmc.c
+@@ -210,34 +210,23 @@ static void kcs_bmc_handle_cmd(struct kc
+ int kcs_bmc_handle_event(struct kcs_bmc *kcs_bmc)
+ {
+ unsigned long flags;
+- int ret = 0;
++ int ret = -ENODATA;
+ u8 status;
+
+ spin_lock_irqsave(&kcs_bmc->lock, flags);
+
+- if (!kcs_bmc->running) {
+- kcs_force_abort(kcs_bmc);
+- ret = -ENODEV;
+- goto out_unlock;
+- }
+-
+- status = read_status(kcs_bmc) & (KCS_STATUS_IBF | KCS_STATUS_CMD_DAT);
+-
+- switch (status) {
+- case KCS_STATUS_IBF | KCS_STATUS_CMD_DAT:
+- kcs_bmc_handle_cmd(kcs_bmc);
+- break;
+-
+- case KCS_STATUS_IBF:
+- kcs_bmc_handle_data(kcs_bmc);
+- break;
++ status = read_status(kcs_bmc);
++ if (status & KCS_STATUS_IBF) {
++ if (!kcs_bmc->running)
++ kcs_force_abort(kcs_bmc);
++ else if (status & KCS_STATUS_CMD_DAT)
++ kcs_bmc_handle_cmd(kcs_bmc);
++ else
++ kcs_bmc_handle_data(kcs_bmc);
+
+- default:
+- ret = -ENODATA;
+- break;
++ ret = 0;
+ }
+
+-out_unlock:
+ spin_unlock_irqrestore(&kcs_bmc->lock, flags);
+
+ return ret;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Paul Moore <paul@paul-moore.com>
+Date: Wed, 4 Jul 2018 09:58:05 -0400
+Subject: ipv6: make ipv6_renew_options() interrupt/kernel safe
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit a9ba23d48dbc6ffd08426bb10f05720e0b9f5c14 ]
+
+At present the ipv6_renew_options_kern() function ends up calling into
+access_ok() which is problematic if done from inside an interrupt as
+access_ok() calls WARN_ON_IN_IRQ() on some (all?) architectures
+(x86-64 is affected). Example warning/backtrace is shown below:
+
+ WARNING: CPU: 1 PID: 3144 at lib/usercopy.c:11 _copy_from_user+0x85/0x90
+ ...
+ Call Trace:
+ <IRQ>
+ ipv6_renew_option+0xb2/0xf0
+ ipv6_renew_options+0x26a/0x340
+ ipv6_renew_options_kern+0x2c/0x40
+ calipso_req_setattr+0x72/0xe0
+ netlbl_req_setattr+0x126/0x1b0
+ selinux_netlbl_inet_conn_request+0x80/0x100
+ selinux_inet_conn_request+0x6d/0xb0
+ security_inet_conn_request+0x32/0x50
+ tcp_conn_request+0x35f/0xe00
+ ? __lock_acquire+0x250/0x16c0
+ ? selinux_socket_sock_rcv_skb+0x1ae/0x210
+ ? tcp_rcv_state_process+0x289/0x106b
+ tcp_rcv_state_process+0x289/0x106b
+ ? tcp_v6_do_rcv+0x1a7/0x3c0
+ tcp_v6_do_rcv+0x1a7/0x3c0
+ tcp_v6_rcv+0xc82/0xcf0
+ ip6_input_finish+0x10d/0x690
+ ip6_input+0x45/0x1e0
+ ? ip6_rcv_finish+0x1d0/0x1d0
+ ipv6_rcv+0x32b/0x880
+ ? ip6_make_skb+0x1e0/0x1e0
+ __netif_receive_skb_core+0x6f2/0xdf0
+ ? process_backlog+0x85/0x250
+ ? process_backlog+0x85/0x250
+ ? process_backlog+0xec/0x250
+ process_backlog+0xec/0x250
+ net_rx_action+0x153/0x480
+ __do_softirq+0xd9/0x4f7
+ do_softirq_own_stack+0x2a/0x40
+ </IRQ>
+ ...
+
+While not present in the backtrace, ipv6_renew_option() ends up calling
+access_ok() via the following chain:
+
+ access_ok()
+ _copy_from_user()
+ copy_from_user()
+ ipv6_renew_option()
+
+The fix presented in this patch is to perform the userspace copy
+earlier in the call chain such that it is only called when the option
+data is actually coming from userspace; that place is
+do_ipv6_setsockopt(). Not only does this solve the problem seen in
+the backtrace above, it also allows us to simplify the code quite a
+bit by removing ipv6_renew_options_kern() completely. We also take
+this opportunity to cleanup ipv6_renew_options()/ipv6_renew_option()
+a small amount as well.
+
+This patch is heavily based on a rough patch by Al Viro. I've taken
+his original patch, converted a kmemdup() call in do_ipv6_setsockopt()
+to a memdup_user() call, made better use of the e_inval jump target in
+the same function, and cleaned up the use ipv6_renew_option() by
+ipv6_renew_options().
+
+CC: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/ipv6.h | 9 ---
+ net/ipv6/calipso.c | 9 +--
+ net/ipv6/exthdrs.c | 111 ++++++++++++-----------------------------------
+ net/ipv6/ipv6_sockglue.c | 27 ++++++++---
+ 4 files changed, 53 insertions(+), 103 deletions(-)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -354,14 +354,7 @@ struct ipv6_txoptions *ipv6_dup_options(
+ struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
+ struct ipv6_txoptions *opt,
+ int newtype,
+- struct ipv6_opt_hdr __user *newopt,
+- int newoptlen);
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk,
+- struct ipv6_txoptions *opt,
+- int newtype,
+- struct ipv6_opt_hdr *newopt,
+- int newoptlen);
++ struct ipv6_opt_hdr *newopt);
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+ struct ipv6_txoptions *opt);
+
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -799,8 +799,7 @@ static int calipso_opt_update(struct soc
+ {
+ struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
+
+- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
+- hop, hop ? ipv6_optlen(hop) : 0);
++ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
+ txopt_put(old);
+ if (IS_ERR(txopts))
+ return PTR_ERR(txopts);
+@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct re
+ if (IS_ERR(new))
+ return PTR_ERR(new);
+
+- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+- new, new ? ipv6_optlen(new) : 0);
++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+
+ kfree(new);
+
+@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct r
+ if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
+ return; /* Nothing to do */
+
+- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+- new, new ? ipv6_optlen(new) : 0);
++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+
+ if (!IS_ERR(txopts)) {
+ txopts = xchg(&req_inet->ipv6_opt, txopts);
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -1028,29 +1028,21 @@ ipv6_dup_options(struct sock *sk, struct
+ }
+ EXPORT_SYMBOL_GPL(ipv6_dup_options);
+
+-static int ipv6_renew_option(void *ohdr,
+- struct ipv6_opt_hdr __user *newopt, int newoptlen,
+- int inherit,
+- struct ipv6_opt_hdr **hdr,
+- char **p)
++static void ipv6_renew_option(int renewtype,
++ struct ipv6_opt_hdr **dest,
++ struct ipv6_opt_hdr *old,
++ struct ipv6_opt_hdr *new,
++ int newtype, char **p)
+ {
+- if (inherit) {
+- if (ohdr) {
+- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
+- *hdr = (struct ipv6_opt_hdr *)*p;
+- *p += CMSG_ALIGN(ipv6_optlen(*hdr));
+- }
+- } else {
+- if (newopt) {
+- if (copy_from_user(*p, newopt, newoptlen))
+- return -EFAULT;
+- *hdr = (struct ipv6_opt_hdr *)*p;
+- if (ipv6_optlen(*hdr) > newoptlen)
+- return -EINVAL;
+- *p += CMSG_ALIGN(newoptlen);
+- }
+- }
+- return 0;
++ struct ipv6_opt_hdr *src;
++
++ src = (renewtype == newtype ? new : old);
++ if (!src)
++ return;
++
++ memcpy(*p, src, ipv6_optlen(src));
++ *dest = (struct ipv6_opt_hdr *)*p;
++ *p += CMSG_ALIGN(ipv6_optlen(*dest));
+ }
+
+ /**
+@@ -1076,13 +1068,11 @@ static int ipv6_renew_option(void *ohdr,
+ */
+ struct ipv6_txoptions *
+ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+- int newtype,
+- struct ipv6_opt_hdr __user *newopt, int newoptlen)
++ int newtype, struct ipv6_opt_hdr *newopt)
+ {
+ int tot_len = 0;
+ char *p;
+ struct ipv6_txoptions *opt2;
+- int err;
+
+ if (opt) {
+ if (newtype != IPV6_HOPOPTS && opt->hopopt)
+@@ -1095,8 +1085,8 @@ ipv6_renew_options(struct sock *sk, stru
+ tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+ }
+
+- if (newopt && newoptlen)
+- tot_len += CMSG_ALIGN(newoptlen);
++ if (newopt)
++ tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
+
+ if (!tot_len)
+ return NULL;
+@@ -1111,29 +1101,19 @@ ipv6_renew_options(struct sock *sk, stru
+ opt2->tot_len = tot_len;
+ p = (char *)(opt2 + 1);
+
+- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
+- newtype != IPV6_HOPOPTS,
+- &opt2->hopopt, &p);
+- if (err)
+- goto out;
+-
+- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
+- newtype != IPV6_RTHDRDSTOPTS,
+- &opt2->dst0opt, &p);
+- if (err)
+- goto out;
+-
+- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
+- newtype != IPV6_RTHDR,
+- (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
+- if (err)
+- goto out;
+-
+- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
+- newtype != IPV6_DSTOPTS,
+- &opt2->dst1opt, &p);
+- if (err)
+- goto out;
++ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
++ (opt ? opt->hopopt : NULL),
++ newopt, newtype, &p);
++ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
++ (opt ? opt->dst0opt : NULL),
++ newopt, newtype, &p);
++ ipv6_renew_option(IPV6_RTHDR,
++ (struct ipv6_opt_hdr **)&opt2->srcrt,
++ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
++ newopt, newtype, &p);
++ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
++ (opt ? opt->dst1opt : NULL),
++ newopt, newtype, &p);
+
+ opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
+ (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
+@@ -1141,37 +1121,6 @@ ipv6_renew_options(struct sock *sk, stru
+ opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
+
+ return opt2;
+-out:
+- sock_kfree_s(sk, opt2, opt2->tot_len);
+- return ERR_PTR(err);
+-}
+-
+-/**
+- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
+- *
+- * @sk: sock from which to allocate memory
+- * @opt: original options
+- * @newtype: option type to replace in @opt
+- * @newopt: new option of type @newtype to replace (kernel-mem)
+- * @newoptlen: length of @newopt
+- *
+- * See ipv6_renew_options(). The difference is that @newopt is
+- * kernel memory, rather than user memory.
+- */
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
+- int newtype, struct ipv6_opt_hdr *newopt,
+- int newoptlen)
+-{
+- struct ipv6_txoptions *ret_val;
+- const mm_segment_t old_fs = get_fs();
+-
+- set_fs(KERNEL_DS);
+- ret_val = ipv6_renew_options(sk, opt, newtype,
+- (struct ipv6_opt_hdr __user *)newopt,
+- newoptlen);
+- set_fs(old_fs);
+- return ret_val;
+ }
+
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct soc
+ case IPV6_DSTOPTS:
+ {
+ struct ipv6_txoptions *opt;
++ struct ipv6_opt_hdr *new = NULL;
++
++ /* hop-by-hop / destination options are privileged option */
++ retv = -EPERM;
++ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
++ break;
+
+ /* remove any sticky options header with a zero option
+ * length, per RFC3542.
+@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct soc
+ else if (optlen < sizeof(struct ipv6_opt_hdr) ||
+ optlen & 0x7 || optlen > 8 * 255)
+ goto e_inval;
+-
+- /* hop-by-hop / destination options are privileged option */
+- retv = -EPERM;
+- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+- break;
++ else {
++ new = memdup_user(optval, optlen);
++ if (IS_ERR(new)) {
++ retv = PTR_ERR(new);
++ break;
++ }
++ if (unlikely(ipv6_optlen(new) > optlen)) {
++ kfree(new);
++ goto e_inval;
++ }
++ }
+
+ opt = rcu_dereference_protected(np->opt,
+ lockdep_sock_is_held(sk));
+- opt = ipv6_renew_options(sk, opt, optname,
+- (struct ipv6_opt_hdr __user *)optval,
+- optlen);
++ opt = ipv6_renew_options(sk, opt, optname, new);
++ kfree(new);
+ if (IS_ERR(opt)) {
+ retv = PTR_ERR(opt);
+ break;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Thu, 21 Jun 2018 19:49:36 +0800
+Subject: ipv6: mcast: fix unsolicited report interval after receiving querys
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ]
+
+After recieving MLD querys, we update idev->mc_maxdelay with max_delay
+from query header. This make the later unsolicited reports have the same
+interval with mc_maxdelay, which means we may send unsolicited reports with
+long interval time instead of default configured interval time.
+
+Also as we will not call ipv6_mc_reset() after device up. This issue will
+be there even after leave the group and join other groups.
+
+Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2081,7 +2081,8 @@ void ipv6_mc_dad_complete(struct inet6_d
+ mld_send_initial_cr(idev);
+ idev->mc_dad_count--;
+ if (idev->mc_dad_count)
+- mld_dad_start_timer(idev, idev->mc_maxdelay);
++ mld_dad_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ }
+
+@@ -2093,7 +2094,8 @@ static void mld_dad_timer_expire(struct
+ if (idev->mc_dad_count) {
+ idev->mc_dad_count--;
+ if (idev->mc_dad_count)
+- mld_dad_start_timer(idev, idev->mc_maxdelay);
++ mld_dad_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ in6_dev_put(idev);
+ }
+@@ -2451,7 +2453,8 @@ static void mld_ifc_timer_expire(struct
+ if (idev->mc_ifc_count) {
+ idev->mc_ifc_count--;
+ if (idev->mc_ifc_count)
+- mld_ifc_start_timer(idev, idev->mc_maxdelay);
++ mld_ifc_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ in6_dev_put(idev);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Sun, 1 Jul 2018 16:21:21 +0800
+Subject: ipvlan: call dev_change_flags when ipvlan mode is reset
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 5dc2d3996a8b221c20dd0900bdad45031a572530 ]
+
+After we change the ipvlan mode from l3 to l2, or vice versa, we only
+reset IFF_NOARP flag, but don't flush the ARP table cache, which will
+cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
+Then the message will not come out of host.
+
+Here is the reproducer on local host:
+
+ip link set eth1 up
+ip addr add 192.168.1.1/24 dev eth1
+ip link add link eth1 ipvlan1 type ipvlan mode l3
+
+ip netns add net1
+ip link set ipvlan1 netns net1
+ip netns exec net1 ip link set ipvlan1 up
+ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
+
+ip route add 192.168.2.0/24 via 192.168.1.2
+ping 192.168.2.2 -c 2
+
+ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
+ping 192.168.2.2 -c 2
+
+Add the same configuration on remote host. After we set the mode to l2,
+we could find that the src/dst MAC addresses are the same on eth1:
+
+21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
+ 192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
+
+Fix this by calling dev_change_flags(), which will call netdevice notifier
+with flag change info.
+
+v2:
+a) As pointed out by Wang Cong, check return value for dev_change_flags() when
+change dev flags.
+b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
+So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
+
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipvlan/ipvlan_main.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -75,10 +75,23 @@ static int ipvlan_set_port_mode(struct i
+ {
+ struct ipvl_dev *ipvlan;
+ struct net_device *mdev = port->dev;
+- int err = 0;
++ unsigned int flags;
++ int err;
+
+ ASSERT_RTNL();
+ if (port->mode != nval) {
++ list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
++ flags = ipvlan->dev->flags;
++ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
++ err = dev_change_flags(ipvlan->dev,
++ flags | IFF_NOARP);
++ } else {
++ err = dev_change_flags(ipvlan->dev,
++ flags & ~IFF_NOARP);
++ }
++ if (unlikely(err))
++ goto fail;
++ }
+ if (nval == IPVLAN_MODE_L3S) {
+ /* New mode is L3S */
+ err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
+@@ -86,21 +99,28 @@ static int ipvlan_set_port_mode(struct i
+ mdev->l3mdev_ops = &ipvl_l3mdev_ops;
+ mdev->priv_flags |= IFF_L3MDEV_MASTER;
+ } else
+- return err;
++ goto fail;
+ } else if (port->mode == IPVLAN_MODE_L3S) {
+ /* Old mode was L3S */
+ mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
+ ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
+ mdev->l3mdev_ops = NULL;
+ }
+- list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
+- ipvlan->dev->flags |= IFF_NOARP;
+- else
+- ipvlan->dev->flags &= ~IFF_NOARP;
+- }
+ port->mode = nval;
+ }
++ return 0;
++
++fail:
++ /* Undo the flags changes that have been done so far. */
++ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
++ flags = ipvlan->dev->flags;
++ if (port->mode == IPVLAN_MODE_L3 ||
++ port->mode == IPVLAN_MODE_L3S)
++ dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
++ else
++ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
++ }
++
+ return err;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 22 Jun 2018 10:52:50 +0100
+Subject: irqchip/gic-v2m: Fix SPI release on error path
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit cbaf45a6be497c272e80500e4fd9bccdf20d5050 ]
+
+On failing to allocate the required SPIs, the actual number of interrupts
+should be freed and not its log2 value.
+
+Fixes: de337ee30142 ("irqchip/gic-v2m: Add PCI Multi-MSI support")
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Yang Yingliang <yangyingliang@huawei.com>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Link: https://lkml.kernel.org/r/20180622095254.5906-4-marc.zyngier@arm.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -199,7 +199,7 @@ static int gicv2m_irq_domain_alloc(struc
+
+ fail:
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+- gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
++ gicv2m_unalloc_msi(v2m, hwirq, nr_irqs);
+ return err;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 22 Jun 2018 10:52:54 +0100
+Subject: irqchip/gic-v3-its: Fix reprogramming of redistributors on CPU hotplug
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 82f499c8811149069ec958b72a86643a7a289b25 ]
+
+Enabling LPIs was made a lot stricter recently, by checking that they are
+disabled before enabling them. By doing so, the CPU hotplug case was missed
+altogether, which leaves LPIs enabled on hotplug off (expecting the CPU to
+eventually come back), and won't write a different value anyway on hotplug
+on.
+
+So skip that check if that particular case is detected
+
+Fixes: 6eb486b66a30 ("irqchip/gic-v3: Ensure GICR_CTLR.EnableLPI=0 is observed before enabling")
+Reported-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Sumit Garg <sumit.garg@linaro.org>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lkml.kernel.org/r/20180622095254.5906-8-marc.zyngier@arm.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -3405,6 +3405,16 @@ static int redist_disable_lpis(void)
+ u64 timeout = USEC_PER_SEC;
+ u64 val;
+
++ /*
++ * If coming via a CPU hotplug event, we don't need to disable
++ * LPIs before trying to re-enable them. They are already
++ * configured and all is well in the world. Detect this case
++ * by checking the allocation of the pending table for the
++ * current CPU.
++ */
++ if (gic_data_rdist()->pend_page)
++ return 0;
++
+ if (!gic_rdists_supports_plpis()) {
+ pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+ return -ENXIO;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Mon, 18 Jun 2018 12:02:00 -0400
+Subject: ixgbe: Be more careful when modifying MAC filters
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ]
+
+This change makes it so that we are much more explicit about the ordering
+of updates to the receive address register (RAR) table. Prior to this patch
+I believe we may have been updating the table while entries were still
+active, or possibly allowing for reordering of things since we weren't
+explicitly flushing writes to either the lower or upper portion of the
+register prior to accessing the other half.
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Reviewed-by: Shannon Nelson <shannon.nelson@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -1897,7 +1897,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h
+ if (enable_addr != 0)
+ rar_high |= IXGBE_RAH_AV;
+
++ /* Record lower 32 bits of MAC address and then make
++ * sure that write is flushed to hardware before writing
++ * the upper 16 bits and setting the valid bit.
++ */
+ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
++ IXGBE_WRITE_FLUSH(hw);
+ IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+
+ return 0;
+@@ -1929,8 +1934,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe
+ rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
+ rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
+
+- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
++ /* Clear the address valid bit and upper 16 bits of the address
++ * before clearing the lower bits. This way we aren't updating
++ * a live filter.
++ */
+ IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
++ IXGBE_WRITE_FLUSH(hw);
++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+
+ /* clear VMDq pool/queue selection for this RAR */
+ hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:53:37 +0300
+Subject: ixgbe: Off by one in ixgbe_ipsec_tx()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c411104115e6821f26fc8f6de8b235ddf98de688 ]
+
+The ipsec->tx_tbl[] has IXGBE_IPSEC_MAX_SA_COUNT elements so the > needs
+to be changed to >= so we don't read one element beyond the end of the
+array.
+
+Fixes: 592594704761 ("ixgbe: process the Tx ipsec offload")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Shannon Nelson <shannon.nelson@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -759,7 +759,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx
+ }
+
+ itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
+- if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) {
++ if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
+ netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
+ __func__, itd->sa_idx, xs->xso.offload_handle);
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Zhen Lei <thunder.leizhen@huawei.com>
+Date: Tue, 3 Jul 2018 17:02:46 -0700
+Subject: kasan: fix shadow_size calculation error in kasan_module_alloc
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 1e8e18f694a52d703665012ca486826f64bac29d ]
+
+There is a special case that the size is "(N << KASAN_SHADOW_SCALE_SHIFT)
+Pages plus X", the value of X is [1, KASAN_SHADOW_SCALE_SIZE-1]. The
+operation "size >> KASAN_SHADOW_SCALE_SHIFT" will drop X, and the
+roundup operation can not retrieve the missed one page. For example:
+size=0x28006, PAGE_SIZE=0x1000, KASAN_SHADOW_SCALE_SHIFT=3, we will get
+shadow_size=0x5000, but actually we need 6 pages.
+
+ shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, PAGE_SIZE);
+
+This can lead to a kernel crash when kasan is enabled and the value of
+mod->core_layout.size or mod->init_layout.size is like above. Because
+the shadow memory of X has not been allocated and mapped.
+
+move_module:
+ ptr = module_alloc(mod->core_layout.size);
+ ...
+ memset(ptr, 0, mod->core_layout.size); //crashed
+
+ Unable to handle kernel paging request at virtual address ffff0fffff97b000
+ ......
+ Call trace:
+ __asan_storeN+0x174/0x1a8
+ memset+0x24/0x48
+ layout_and_allocate+0xcd8/0x1800
+ load_module+0x190/0x23e8
+ SyS_finit_module+0x148/0x180
+
+Link: http://lkml.kernel.org/r/1529659626-12660-1-git-send-email-thunder.leizhen@huawei.com
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Reviewed-by: Dmitriy Vyukov <dvyukov@google.com>
+Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Hanjun Guo <guohanjun@huawei.com>
+Cc: Libin <huawei.libin@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/kasan/kasan.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/mm/kasan/kasan.c
++++ b/mm/kasan/kasan.c
+@@ -619,12 +619,13 @@ void kasan_kfree_large(void *ptr, unsign
+ int kasan_module_alloc(void *addr, size_t size)
+ {
+ void *ret;
++ size_t scaled_size;
+ size_t shadow_size;
+ unsigned long shadow_start;
+
+ shadow_start = (unsigned long)kasan_mem_to_shadow(addr);
+- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT,
+- PAGE_SIZE);
++ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
++ shadow_size = round_up(scaled_size, PAGE_SIZE);
+
+ if (WARN_ON(!PAGE_ALIGNED(shadow_start)))
+ return -EINVAL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Thu, 12 Jul 2018 19:38:36 +0900
+Subject: kbuild: suppress warnings from 'getconf LFS_*'
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 6d79a7b424a5630a6fcab31fd7c38af4ea9c9a0f ]
+
+Suppress warnings for systems that do not recognize LFS_*.
+
+ getconf: no such configuration parameter `LFS_CFLAGS'
+ getconf: no such configuration parameter `LFS_LDFLAGS'
+ getconf: no such configuration parameter `LFS_LIBS'
+
+Fixes: d7f14c66c273 ("kbuild: Enable Large File Support for hostprogs")
+Reported-by: Chen Feng <puck.chen@hisilicon.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -356,9 +356,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
+ else if [ -x /bin/bash ]; then echo /bin/bash; \
+ else echo sh; fi ; fi)
+
+-HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS)
+-HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS)
+-HOST_LFS_LIBS := $(shell getconf LFS_LIBS)
++HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null)
++HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null)
++HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null)
+
+ HOSTCC = gcc
+ HOSTCXX = g++
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dirk Gouders <dirk@gouders.net>
+Date: Thu, 21 Jun 2018 15:30:54 +0200
+Subject: kconfig: fix line numbers for if-entries in menu tree
+
+From: Dirk Gouders <dirk@gouders.net>
+
+[ Upstream commit b2d00d7c61c84edd150310af3f556f8a3c6e2e67 ]
+
+The line numers for if-entries in the menu tree are off by one or more
+lines which is confusing when debugging for correctness of unrelated changes.
+
+According to the git log, commit a02f0570ae201c49 (kconfig: improve
+error handling in the parser) was the last one that changed that part
+of the parser and replaced
+
+ "if_entry: T_IF expr T_EOL"
+by
+ "if_entry: T_IF expr nl"
+
+but the commit message does not state why this has been done.
+
+When reverting that part of the commit, only the line numers are
+corrected (checked with cdebug = DEBUG_PARSE in zconf.y), otherwise
+the menu tree remains unchanged (checked with zconfdump() enabled in
+conf.c).
+
+An example for the corrected line numbers:
+
+drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig
+drivers/soc/tegra/Kconfig:4:if
+drivers/soc/tegra/Kconfig:6:if
+
+changes to:
+
+drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig
+drivers/soc/tegra/Kconfig:1:if
+drivers/soc/tegra/Kconfig:4:if
+
+Signed-off-by: Dirk Gouders <dirk@gouders.net>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/kconfig/zconf.y | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/kconfig/zconf.y
++++ b/scripts/kconfig/zconf.y
+@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSI
+ static struct menu *current_menu, *current_entry;
+
+ %}
+-%expect 32
++%expect 31
+
+ %union
+ {
+@@ -345,7 +345,7 @@ choice_block:
+
+ /* if entry */
+
+-if_entry: T_IF expr nl
++if_entry: T_IF expr T_EOL
+ {
+ printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno());
+ menu_add_entry(NULL);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 7 Jun 2018 11:45:49 +0200
+Subject: kthread, sched/core: Fix kthread_parkme() (again...)
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1cef1150ef40ec52f507436a14230cbc2623299c ]
+
+Gaurav reports that commit:
+
+ 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme() completion issue")
+
+isn't working for him. Because of the following race:
+
+> controller Thread CPUHP Thread
+> takedown_cpu
+> kthread_park
+> kthread_parkme
+> Set KTHREAD_SHOULD_PARK
+> smpboot_thread_fn
+> set Task interruptible
+>
+>
+> wake_up_process
+> if (!(p->state & state))
+> goto out;
+>
+> Kthread_parkme
+> SET TASK_PARKED
+> schedule
+> raw_spin_lock(&rq->lock)
+> ttwu_remote
+> waiting for __task_rq_lock
+> context_switch
+>
+> finish_lock_switch
+>
+>
+>
+> Case TASK_PARKED
+> kthread_park_complete
+>
+>
+> SET Running
+
+Furthermore, Oleg noticed that the whole scheduler TASK_PARKED
+handling is buggered because the TASK_DEAD thing is done with
+preemption disabled, the current code can still complete early on
+preemption :/
+
+So basically revert that earlier fix and go with a variant of the
+alternative mentioned in the commit. Promote TASK_PARKED to special
+state to avoid the store-store issue on task->state leading to the
+WARN in kthread_unpark() -> __kthread_bind().
+
+But in addition, add wait_task_inactive() to kthread_park() to ensure
+the task really is PARKED when we return from kthread_park(). This
+avoids the whole kthread still gets migrated nonsense -- although it
+would be really good to get this done differently.
+
+Reported-by: Gaurav Kohli <gkohli@codeaurora.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme() completion issue")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/kthread.h | 1 -
+ include/linux/sched.h | 2 +-
+ kernel/kthread.c | 30 ++++++++++++++++++++++++------
+ kernel/sched/core.c | 31 +++++++++++--------------------
+ 4 files changed, 36 insertions(+), 28 deletions(-)
+
+--- a/include/linux/kthread.h
++++ b/include/linux/kthread.h
+@@ -62,7 +62,6 @@ void *kthread_probe_data(struct task_str
+ int kthread_park(struct task_struct *k);
+ void kthread_unpark(struct task_struct *k);
+ void kthread_parkme(void);
+-void kthread_park_complete(struct task_struct *k);
+
+ int kthreadd(void *unused);
+ extern struct task_struct *kthreadd_task;
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -117,7 +117,7 @@ struct task_group;
+ * the comment with set_special_state().
+ */
+ #define is_special_task_state(state) \
+- ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD))
++ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | TASK_DEAD))
+
+ #define __set_current_state(state_value) \
+ do { \
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -177,9 +177,20 @@ void *kthread_probe_data(struct task_str
+ static void __kthread_parkme(struct kthread *self)
+ {
+ for (;;) {
+- set_current_state(TASK_PARKED);
++ /*
++ * TASK_PARKED is a special state; we must serialize against
++ * possible pending wakeups to avoid store-store collisions on
++ * task->state.
++ *
++ * Such a collision might possibly result in the task state
++ * changin from TASK_PARKED and us failing the
++ * wait_task_inactive() in kthread_park().
++ */
++ set_special_state(TASK_PARKED);
+ if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
+ break;
++
++ complete_all(&self->parked);
+ schedule();
+ }
+ __set_current_state(TASK_RUNNING);
+@@ -191,11 +202,6 @@ void kthread_parkme(void)
+ }
+ EXPORT_SYMBOL_GPL(kthread_parkme);
+
+-void kthread_park_complete(struct task_struct *k)
+-{
+- complete_all(&to_kthread(k)->parked);
+-}
+-
+ static int kthread(void *_create)
+ {
+ /* Copy data: it's on kthread's stack */
+@@ -467,6 +473,9 @@ void kthread_unpark(struct task_struct *
+
+ reinit_completion(&kthread->parked);
+ clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++ /*
++ * __kthread_parkme() will either see !SHOULD_PARK or get the wakeup.
++ */
+ wake_up_state(k, TASK_PARKED);
+ }
+ EXPORT_SYMBOL_GPL(kthread_unpark);
+@@ -493,7 +502,16 @@ int kthread_park(struct task_struct *k)
+ set_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+ if (k != current) {
+ wake_up_process(k);
++ /*
++ * Wait for __kthread_parkme() to complete(), this means we
++ * _will_ have TASK_PARKED and are about to call schedule().
++ */
+ wait_for_completion(&kthread->parked);
++ /*
++ * Now wait for that schedule() to complete and the task to
++ * get scheduled out.
++ */
++ WARN_ON_ONCE(!wait_task_inactive(k, TASK_PARKED));
+ }
+
+ return 0;
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7,7 +7,6 @@
+ */
+ #include "sched.h"
+
+-#include <linux/kthread.h>
+ #include <linux/nospec.h>
+
+ #include <asm/switch_to.h>
+@@ -2738,28 +2737,20 @@ static struct rq *finish_task_switch(str
+ membarrier_mm_sync_core_before_usermode(mm);
+ mmdrop(mm);
+ }
+- if (unlikely(prev_state & (TASK_DEAD|TASK_PARKED))) {
+- switch (prev_state) {
+- case TASK_DEAD:
+- if (prev->sched_class->task_dead)
+- prev->sched_class->task_dead(prev);
+-
+- /*
+- * Remove function-return probe instances associated with this
+- * task and put them back on the free list.
+- */
+- kprobe_flush_task(prev);
++ if (unlikely(prev_state == TASK_DEAD)) {
++ if (prev->sched_class->task_dead)
++ prev->sched_class->task_dead(prev);
+
+- /* Task is done with its stack. */
+- put_task_stack(prev);
++ /*
++ * Remove function-return probe instances associated with this
++ * task and put them back on the free list.
++ */
++ kprobe_flush_task(prev);
+
+- put_task_struct(prev);
+- break;
++ /* Task is done with its stack. */
++ put_task_stack(prev);
+
+- case TASK_PARKED:
+- kthread_park_complete(prev);
+- break;
+- }
++ put_task_struct(prev);
+ }
+
+ tick_nohz_task_switch();
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Fri, 1 Jun 2018 17:06:28 +0200
+Subject: KVM: arm/arm64: Drop resource size check for GICV window
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit ba56bc3a0786992755e6804fbcbdc60ef6cfc24c ]
+
+When booting a 64 KB pages kernel on a ACPI GICv3 system that
+implements support for v2 emulation, the following warning is
+produced
+
+ GICV size 0x2000 not a multiple of page size 0x10000
+
+and support for v2 emulation is disabled, preventing GICv2 VMs
+from being able to run on such hosts.
+
+The reason is that vgic_v3_probe() performs a sanity check on the
+size of the window (it should be a multiple of the page size),
+while the ACPI MADT parsing code hardcodes the size of the window
+to 8 KB. This makes sense, considering that ACPI does not bother
+to describe the size in the first place, under the assumption that
+platforms implementing ACPI will follow the architecture and not
+put anything else in the same 64 KB window.
+
+So let's just drop the sanity check altogether, and assume that
+the window is at least 64 KB in size.
+
+Fixes: 909777324588 ("KVM: arm/arm64: vgic-new: vgic_init: implement kvm_vgic_hyp_init")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/arm/vgic/vgic-v3.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -552,11 +552,6 @@ int vgic_v3_probe(const struct gic_kvm_i
+ pr_warn("GICV physical address 0x%llx not page aligned\n",
+ (unsigned long long)info->vcpu.start);
+ kvm_vgic_global_state.vcpu_base = 0;
+- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
+- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
+- (unsigned long long)resource_size(&info->vcpu),
+- PAGE_SIZE);
+- kvm_vgic_global_state.vcpu_base = 0;
+ } else {
+ kvm_vgic_global_state.vcpu_base = info->vcpu.start;
+ kvm_vgic_global_state.can_emulate_gicv2 = true;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jim Mattson <jmattson@google.com>
+Date: Wed, 30 May 2018 16:00:02 -0700
+Subject: kvm: nVMX: Restore exit qual for VM-entry failure due to MSR loading
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit 0b88abdc3f964c28ec03bc69eb17cb6b3b034564 ]
+
+This exit qualification was inadvertently dropped when the two
+VM-entry failure blocks were coalesced.
+
+Fixes: e79f245ddec1 ("X86/KVM: Properly update 'tsc_offset' to represent the running guest")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -11791,7 +11791,6 @@ static int enter_vmx_non_root_mode(struc
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- u32 msr_entry_idx;
+ u32 exit_qual;
+ int r;
+
+@@ -11813,10 +11812,10 @@ static int enter_vmx_non_root_mode(struc
+ nested_get_vmcs12_pages(vcpu, vmcs12);
+
+ r = EXIT_REASON_MSR_LOAD_FAIL;
+- msr_entry_idx = nested_vmx_load_msr(vcpu,
+- vmcs12->vm_entry_msr_load_addr,
+- vmcs12->vm_entry_msr_load_count);
+- if (msr_entry_idx)
++ exit_qual = nested_vmx_load_msr(vcpu,
++ vmcs12->vm_entry_msr_load_addr,
++ vmcs12->vm_entry_msr_load_count);
++ if (exit_qual)
+ goto fail;
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Peng Hao <peng.hao2@zte.com.cn>
+Date: Sat, 14 Jul 2018 23:28:29 +0800
+Subject: kvmclock: fix TSC calibration for nested guests
+
+From: Peng Hao <peng.hao2@zte.com.cn>
+
+[ Upstream commit e10f7805032365cc11c739a97f226ebb48aee042 ]
+
+Inside a nested guest, access to hardware can be slow enough that
+tsc_read_refs always return ULLONG_MAX, causing tsc_refine_calibration_work
+to be called periodically and the nested guest to spend a lot of time
+reading the ACPI timer.
+
+However, if the TSC frequency is available from the pvclock page,
+we can just set X86_FEATURE_TSC_KNOWN_FREQ and avoid the recalibration.
+'refine' operation.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Peng Hao <peng.hao2@zte.com.cn>
+[Commit message rewritten. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/kvmclock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -138,6 +138,7 @@ static unsigned long kvm_get_tsc_khz(voi
+ src = &hv_clock[cpu].pvti;
+ tsc_khz = pvclock_tsc_khz(src);
+ put_cpu();
++ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
+ return tsc_khz;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: John Garry <john.garry@huawei.com>
+Date: Fri, 8 Jun 2018 18:26:33 +0800
+Subject: libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit fae2a63737e5973f1426bc139935a0f42e232844 ]
+
+Currently smatch warns of possible Spectre-V1 issue in ahci_led_store():
+drivers/ata/libahci.c:1150 ahci_led_store() warn: potential spectre issue 'pp->em_priv' (local cap)
+
+Userspace controls @pmp from following callchain:
+em_message->store()
+->ata_scsi_em_message_store()
+-->ap->ops->em_store()
+--->ahci_led_store()
+
+After the mask+shift @pmp is effectively an 8b value, which is used to
+index into an array of length 8, so sanitize the array index.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libahci.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -35,6 +35,7 @@
+ #include <linux/kernel.h>
+ #include <linux/gfp.h>
+ #include <linux/module.h>
++#include <linux/nospec.h>
+ #include <linux/blkdev.h>
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+@@ -1146,10 +1147,12 @@ static ssize_t ahci_led_store(struct ata
+
+ /* get the slot number from the message */
+ pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
+- if (pmp < EM_MAX_SLOTS)
++ if (pmp < EM_MAX_SLOTS) {
++ pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
+ emp = &pp->em_priv[pmp];
+- else
++ } else {
+ return -EINVAL;
++ }
+
+ /* mask off the activity bits if we are in sw_activity
+ * mode, user should turn off sw_activity before setting
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Wed, 4 Apr 2018 14:06:30 -0400
+Subject: locking/lockdep: Do not record IRQ state within lockdep code
+
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+
+[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ]
+
+While debugging where things were going wrong with mapping
+enabling/disabling interrupts with the lockdep state and actual real
+enabling and disabling interrupts, I had to silent the IRQ
+disabling/enabling in debug_check_no_locks_freed() because it was
+always showing up as it was called before the splat was.
+
+Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed()
+but for all internal lockdep functions, as they hide useful information
+about where interrupts were used incorrectly last.
+
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1261,11 +1261,11 @@ unsigned long lockdep_count_forward_deps
+ this.parent = NULL;
+ this.class = class;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_forward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+
+ return ret;
+ }
+@@ -1288,11 +1288,11 @@ unsigned long lockdep_count_backward_dep
+ this.parent = NULL;
+ this.class = class;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_backward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+
+ return ret;
+ }
+@@ -4407,7 +4407,7 @@ void debug_check_no_locks_freed(const vo
+ if (unlikely(!debug_locks))
+ return;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ for (i = 0; i < curr->lockdep_depth; i++) {
+ hlock = curr->held_locks + i;
+
+@@ -4418,7 +4418,7 @@ void debug_check_no_locks_freed(const vo
+ print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
+ break;
+ }
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Greg Ungerer <gerg@linux-m68k.org>
+Date: Mon, 18 Jun 2018 15:34:14 +1000
+Subject: m68k: fix "bad page state" oops on ColdFire boot
+
+From: Greg Ungerer <gerg@linux-m68k.org>
+
+[ Upstream commit ecd60532e060e45c63c57ecf1c8549b1d656d34d ]
+
+Booting a ColdFire m68k core with MMU enabled causes a "bad page state"
+oops since commit 1d40a5ea01d5 ("mm: mark pages in use for page tables"):
+
+ BUG: Bad page state in process sh pfn:01ce2
+ page:004fefc8 count:0 mapcount:-1024 mapping:00000000 index:0x0
+ flags: 0x0()
+ raw: 00000000 00000000 00000000 fffffbff 00000000 00000100 00000200 00000000
+ raw: 039c4000
+ page dumped because: nonzero mapcount
+ Modules linked in:
+ CPU: 0 PID: 22 Comm: sh Not tainted 4.17.0-07461-g1d40a5ea01d5 #13
+
+Fix by calling pgtable_page_dtor() in our __pte_free_tlb() code path,
+so that the PG_table flag is cleared before we free the pte page.
+
+Note that I had to change the type of pte_free() to be static from
+extern. Otherwise you get a lot of warnings like this:
+
+./arch/m68k/include/asm/mcf_pgalloc.h:80:2: warning: ‘pgtable_page_dtor’ is static but used in inline function ‘pte_free’ which is not static
+ pgtable_page_dtor(page);
+ ^
+
+And making it static is consistent with our use of this in the other
+m68k pgalloc definitions of pte_free().
+
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+CC: Matthew Wilcox <willy@infradead.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/include/asm/mcf_pgalloc.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/m68k/include/asm/mcf_pgalloc.h
++++ b/arch/m68k/include/asm/mcf_pgalloc.h
+@@ -44,6 +44,7 @@ extern inline pmd_t *pmd_alloc_kernel(pg
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+ unsigned long address)
+ {
++ pgtable_page_dtor(page);
+ __free_page(page);
+ }
+
+@@ -74,8 +75,9 @@ static inline struct page *pte_alloc_one
+ return page;
+ }
+
+-extern inline void pte_free(struct mm_struct *mm, struct page *page)
++static inline void pte_free(struct mm_struct *mm, struct page *page)
+ {
++ pgtable_page_dtor(page);
+ __free_page(page);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Denis Kenzior <denkenz@gmail.com>
+Date: Tue, 19 Jun 2018 10:39:50 -0500
+Subject: mac80211: disable BHs/preemption in ieee80211_tx_control_port()
+
+From: Denis Kenzior <denkenz@gmail.com>
+
+[ Upstream commit e7441c9274a6a5453e06f4c2b8b5f72eca0a3f17 ]
+
+On pre-emption enabled kernels the following print was being seen due to
+missing local_bh_disable/local_bh_enable calls. mac80211 assumes that
+pre-emption is disabled in the data path.
+
+ BUG: using smp_processor_id() in preemptible [00000000] code: iwd/517
+ caller is __ieee80211_subif_start_xmit+0x144/0x210 [mac80211]
+ [...]
+ Call Trace:
+ dump_stack+0x5c/0x80
+ check_preemption_disabled.cold.0+0x46/0x51
+ __ieee80211_subif_start_xmit+0x144/0x210 [mac80211]
+
+Fixes: 911806491425 ("mac80211: Add support for tx_control_port")
+Signed-off-by: Denis Kenzior <denkenz@gmail.com>
+[commit message rewrite, fixes tag]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/tx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4800,7 +4800,9 @@ int ieee80211_tx_control_port(struct wip
+ skb_reset_network_header(skb);
+ skb_reset_mac_header(skb);
+
++ local_bh_disable();
+ __ieee80211_subif_start_xmit(skb, skb->dev, flags);
++ local_bh_enable();
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: BingJing Chang <bingjingc@synology.com>
+Date: Thu, 28 Jun 2018 18:40:11 +0800
+Subject: md/raid10: fix that replacement cannot complete recovery after reassemble
+
+From: BingJing Chang <bingjingc@synology.com>
+
+[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ]
+
+During assemble, the spare marked for replacement is not checked.
+conf->fullsync cannot be updated to be 1. As a result, recovery will
+treat it as a clean array. All recovering sectors are skipped. Original
+device is replaced with the not-recovered spare.
+
+mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123]
+mdadm /dev/md0 -a /dev/loop4
+mdadm /dev/md0 --replace /dev/loop0
+mdadm -S /dev/md0 # stop array during recovery
+
+mdadm -A /dev/md0 /dev/loop[01234]
+
+After reassemble, you can see recovery go on, but it completes
+immediately. In fact, recovery is not actually processed.
+
+To solve this problem, we just add the missing logics for replacment
+spares. (In raid1.c or raid5.c, they have already been checked.)
+
+Reported-by: Alex Chen <alexchen@synology.com>
+Reviewed-by: Alex Wu <alexwu@synology.com>
+Reviewed-by: Chung-Chiang Cheng <cccheng@synology.com>
+Signed-off-by: BingJing Chang <bingjingc@synology.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid10.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3892,6 +3892,13 @@ static int raid10_run(struct mddev *mdde
+ disk->rdev->saved_raid_disk < 0)
+ conf->fullsync = 1;
+ }
++
++ if (disk->replacement &&
++ !test_bit(In_sync, &disk->replacement->flags) &&
++ disk->replacement->saved_raid_disk < 0) {
++ conf->fullsync = 1;
++ }
++
+ disk->recovery_disabled = mddev->recovery_disabled - 1;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 21 Jul 2018 15:24:03 -0700
+Subject: mm: make vm_area_alloc() initialize core fields
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 490fc053865c9cc40f1085ef8a5504f5341f79d2 ]
+
+Like vm_area_dup(), it initializes the anon_vma_chain head, and the
+basic mm pointer.
+
+The rest of the fields end up being different for different users,
+although the plan is to also initialize the 'vm_ops' field to a dummy
+entry.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/ia64/kernel/perfmon.c | 4 +---
+ arch/ia64/mm/init.c | 8 ++------
+ fs/exec.c | 4 +---
+ include/linux/mm.h | 2 +-
+ kernel/fork.c | 10 ++++++++--
+ mm/mmap.c | 12 +++---------
+ mm/nommu.c | 3 +--
+ 7 files changed, 17 insertions(+), 26 deletions(-)
+
+--- a/arch/ia64/kernel/perfmon.c
++++ b/arch/ia64/kernel/perfmon.c
+@@ -2278,17 +2278,15 @@ pfm_smpl_buffer_alloc(struct task_struct
+ DPRINT(("smpl_buf @%p\n", smpl_buf));
+
+ /* allocate vma */
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(mm);
+ if (!vma) {
+ DPRINT(("Cannot allocate vma\n"));
+ goto error_kmem;
+ }
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+
+ /*
+ * partially initialize the vma for the sampling buffer
+ */
+- vma->vm_mm = mm;
+ vma->vm_file = get_file(filp);
+ vma->vm_flags = VM_READ|VM_MAYREAD|VM_DONTEXPAND|VM_DONTDUMP;
+ vma->vm_page_prot = PAGE_READONLY; /* XXX may need to change */
+--- a/arch/ia64/mm/init.c
++++ b/arch/ia64/mm/init.c
+@@ -114,10 +114,8 @@ ia64_init_addr_space (void)
+ * the problem. When the process attempts to write to the register backing store
+ * for the first time, it will get a SEGFAULT in this case.
+ */
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(current->mm);
+ if (vma) {
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+- vma->vm_mm = current->mm;
+ vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
+ vma->vm_end = vma->vm_start + PAGE_SIZE;
+ vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
+@@ -133,10 +131,8 @@ ia64_init_addr_space (void)
+
+ /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */
+ if (!(current->personality & MMAP_PAGE_ZERO)) {
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(current->mm);
+ if (vma) {
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+- vma->vm_mm = current->mm;
+ vma->vm_end = PAGE_SIZE;
+ vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
+ vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO |
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_b
+ struct vm_area_struct *vma = NULL;
+ struct mm_struct *mm = bprm->mm;
+
+- bprm->vma = vma = vm_area_alloc();
++ bprm->vma = vma = vm_area_alloc(mm);
+ if (!vma)
+ return -ENOMEM;
+
+@@ -298,7 +298,6 @@ static int __bprm_mm_init(struct linux_b
+ err = -EINTR;
+ goto err_free;
+ }
+- vma->vm_mm = mm;
+
+ /*
+ * Place the stack at the largest stack address the architecture
+@@ -311,7 +310,6 @@ static int __bprm_mm_init(struct linux_b
+ vma->vm_start = vma->vm_end - PAGE_SIZE;
+ vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+
+ err = insert_vm_struct(mm, vma);
+ if (err)
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -154,7 +154,7 @@ extern int overcommit_kbytes_handler(str
+ * mmap() functions).
+ */
+
+-struct vm_area_struct *vm_area_alloc(void);
++struct vm_area_struct *vm_area_alloc(struct mm_struct *);
+ struct vm_area_struct *vm_area_dup(struct vm_area_struct *);
+ void vm_area_free(struct vm_area_struct *);
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -308,9 +308,15 @@ static struct kmem_cache *vm_area_cachep
+ /* SLAB cache for mm_struct structures (tsk->mm) */
+ static struct kmem_cache *mm_cachep;
+
+-struct vm_area_struct *vm_area_alloc(void)
++struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
+ {
+- return kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++ if (vma) {
++ vma->vm_mm = mm;
++ INIT_LIST_HEAD(&vma->anon_vma_chain);
++ }
++ return vma;
+ }
+
+ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1729,19 +1729,17 @@ unsigned long mmap_region(struct file *f
+ * specific mapper. the address has already been validated, but
+ * not unmapped, but the maps are removed from the list.
+ */
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(mm);
+ if (!vma) {
+ error = -ENOMEM;
+ goto unacct_error;
+ }
+
+- vma->vm_mm = mm;
+ vma->vm_start = addr;
+ vma->vm_end = addr + len;
+ vma->vm_flags = vm_flags;
+ vma->vm_page_prot = vm_get_page_prot(vm_flags);
+ vma->vm_pgoff = pgoff;
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+
+ if (file) {
+ if (vm_flags & VM_DENYWRITE) {
+@@ -2979,14 +2977,12 @@ static int do_brk_flags(unsigned long ad
+ /*
+ * create a vma struct for an anonymous mapping
+ */
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(mm);
+ if (!vma) {
+ vm_unacct_memory(len >> PAGE_SHIFT);
+ return -ENOMEM;
+ }
+
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+- vma->vm_mm = mm;
+ vma->vm_start = addr;
+ vma->vm_end = addr + len;
+ vma->vm_pgoff = pgoff;
+@@ -3343,12 +3339,10 @@ static struct vm_area_struct *__install_
+ int ret;
+ struct vm_area_struct *vma;
+
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(mm);
+ if (unlikely(vma == NULL))
+ return ERR_PTR(-ENOMEM);
+
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+- vma->vm_mm = mm;
+ vma->vm_start = addr;
+ vma->vm_end = addr + len;
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file,
+ if (!region)
+ goto error_getting_region;
+
+- vma = vm_area_alloc();
++ vma = vm_area_alloc(current->mm);
+ if (!vma)
+ goto error_getting_vma;
+
+@@ -1212,7 +1212,6 @@ unsigned long do_mmap(struct file *file,
+ region->vm_flags = vm_flags;
+ region->vm_pgoff = pgoff;
+
+- INIT_LIST_HEAD(&vma->anon_vma_chain);
+ vma->vm_flags = vm_flags;
+ vma->vm_pgoff = pgoff;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 21 Jul 2018 14:48:45 -0700
+Subject: mm: make vm_area_dup() actually copy the old vma data
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 95faf6992df468f617edb788da8c21c6eed0dfa7 ]
+
+.. and re-initialize th eanon_vma_chain head.
+
+This removes some boiler-plate from the users, and also makes it clear
+why it didn't need use the 'zalloc()' version.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c | 10 +++++++---
+ mm/mmap.c | 7 -------
+ mm/nommu.c | 1 -
+ 3 files changed, 7 insertions(+), 11 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -315,7 +315,13 @@ struct vm_area_struct *vm_area_alloc(voi
+
+ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
+ {
+- return kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++
++ if (new) {
++ *new = *orig;
++ INIT_LIST_HEAD(&new->anon_vma_chain);
++ }
++ return new;
+ }
+
+ void vm_area_free(struct vm_area_struct *vma)
+@@ -473,8 +479,6 @@ static __latent_entropy int dup_mmap(str
+ tmp = vm_area_dup(mpnt);
+ if (!tmp)
+ goto fail_nomem;
+- *tmp = *mpnt;
+- INIT_LIST_HEAD(&tmp->anon_vma_chain);
+ retval = vma_dup_policy(mpnt, tmp);
+ if (retval)
+ goto fail_nomem_policy;
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2624,11 +2624,6 @@ int __split_vma(struct mm_struct *mm, st
+ if (!new)
+ return -ENOMEM;
+
+- /* most fields are the same, copy all, and then fixup */
+- *new = *vma;
+-
+- INIT_LIST_HEAD(&new->anon_vma_chain);
+-
+ if (new_below)
+ new->vm_end = addr;
+ else {
+@@ -3205,13 +3200,11 @@ struct vm_area_struct *copy_vma(struct v
+ new_vma = vm_area_dup(vma);
+ if (!new_vma)
+ goto out;
+- *new_vma = *vma;
+ new_vma->vm_start = addr;
+ new_vma->vm_end = addr + len;
+ new_vma->vm_pgoff = pgoff;
+ if (vma_dup_policy(vma, new_vma))
+ goto out_free_vma;
+- INIT_LIST_HEAD(&new_vma->anon_vma_chain);
+ if (anon_vma_clone(new_vma, vma))
+ goto out_free_mempol;
+ if (new_vma->vm_file)
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1476,7 +1476,6 @@ int split_vma(struct mm_struct *mm, stru
+ }
+
+ /* most fields are the same, copy all, and then fixup */
+- *new = *vma;
+ *region = *vma->vm_region;
+ new->vm_region = region;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 21 Jul 2018 13:48:51 -0700
+Subject: mm: use helper functions for allocating and freeing vm_area structs
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 3928d4f5ee37cdc523894f6e549e6aae521d8980 ]
+
+The vm_area_struct is one of the most fundamental memory management
+objects, but the management of it is entirely open-coded evertwhere,
+ranging from allocation and freeing (using kmem_cache_[z]alloc and
+kmem_cache_free) to initializing all the fields.
+
+We want to unify this in order to end up having some unified
+initialization of the vmas, and the first step to this is to at least
+have basic allocation functions.
+
+Right now those functions are literally just wrappers around the
+kmem_cache_*() calls. This is a purely mechanical conversion:
+
+ # new vma:
+ kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL) -> vm_area_alloc()
+
+ # copy old vma
+ kmem_cache_alloc(vm_area_cachep, GFP_KERNEL) -> vm_area_dup(old)
+
+ # free vma
+ kmem_cache_free(vm_area_cachep, vma) -> vm_area_free(vma)
+
+to the point where the old vma passed in to the vm_area_dup() function
+isn't even used yet (because I've left all the old manual initialization
+alone).
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/ia64/kernel/perfmon.c | 4 ++--
+ arch/ia64/mm/init.c | 8 ++++----
+ fs/exec.c | 4 ++--
+ include/linux/mm.h | 4 +++-
+ kernel/fork.c | 21 ++++++++++++++++++---
+ mm/mmap.c | 22 +++++++++++-----------
+ mm/nommu.c | 8 ++++----
+ 7 files changed, 44 insertions(+), 27 deletions(-)
+
+--- a/arch/ia64/kernel/perfmon.c
++++ b/arch/ia64/kernel/perfmon.c
+@@ -2278,7 +2278,7 @@ pfm_smpl_buffer_alloc(struct task_struct
+ DPRINT(("smpl_buf @%p\n", smpl_buf));
+
+ /* allocate vma */
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (!vma) {
+ DPRINT(("Cannot allocate vma\n"));
+ goto error_kmem;
+@@ -2346,7 +2346,7 @@ pfm_smpl_buffer_alloc(struct task_struct
+ return 0;
+
+ error:
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ error_kmem:
+ pfm_rvfree(smpl_buf, size);
+
+--- a/arch/ia64/mm/init.c
++++ b/arch/ia64/mm/init.c
+@@ -114,7 +114,7 @@ ia64_init_addr_space (void)
+ * the problem. When the process attempts to write to the register backing store
+ * for the first time, it will get a SEGFAULT in this case.
+ */
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (vma) {
+ INIT_LIST_HEAD(&vma->anon_vma_chain);
+ vma->vm_mm = current->mm;
+@@ -125,7 +125,7 @@ ia64_init_addr_space (void)
+ down_write(¤t->mm->mmap_sem);
+ if (insert_vm_struct(current->mm, vma)) {
+ up_write(¤t->mm->mmap_sem);
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return;
+ }
+ up_write(¤t->mm->mmap_sem);
+@@ -133,7 +133,7 @@ ia64_init_addr_space (void)
+
+ /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */
+ if (!(current->personality & MMAP_PAGE_ZERO)) {
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (vma) {
+ INIT_LIST_HEAD(&vma->anon_vma_chain);
+ vma->vm_mm = current->mm;
+@@ -144,7 +144,7 @@ ia64_init_addr_space (void)
+ down_write(¤t->mm->mmap_sem);
+ if (insert_vm_struct(current->mm, vma)) {
+ up_write(¤t->mm->mmap_sem);
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return;
+ }
+ up_write(¤t->mm->mmap_sem);
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_b
+ struct vm_area_struct *vma = NULL;
+ struct mm_struct *mm = bprm->mm;
+
+- bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ bprm->vma = vma = vm_area_alloc();
+ if (!vma)
+ return -ENOMEM;
+
+@@ -326,7 +326,7 @@ err:
+ up_write(&mm->mmap_sem);
+ err_free:
+ bprm->vma = NULL;
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return err;
+ }
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -154,7 +154,9 @@ extern int overcommit_kbytes_handler(str
+ * mmap() functions).
+ */
+
+-extern struct kmem_cache *vm_area_cachep;
++struct vm_area_struct *vm_area_alloc(void);
++struct vm_area_struct *vm_area_dup(struct vm_area_struct *);
++void vm_area_free(struct vm_area_struct *);
+
+ #ifndef CONFIG_MMU
+ extern struct rb_root nommu_region_tree;
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -303,11 +303,26 @@ struct kmem_cache *files_cachep;
+ struct kmem_cache *fs_cachep;
+
+ /* SLAB cache for vm_area_struct structures */
+-struct kmem_cache *vm_area_cachep;
++static struct kmem_cache *vm_area_cachep;
+
+ /* SLAB cache for mm_struct structures (tsk->mm) */
+ static struct kmem_cache *mm_cachep;
+
++struct vm_area_struct *vm_area_alloc(void)
++{
++ return kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++}
++
++struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
++{
++ return kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++}
++
++void vm_area_free(struct vm_area_struct *vma)
++{
++ kmem_cache_free(vm_area_cachep, vma);
++}
++
+ static void account_kernel_stack(struct task_struct *tsk, int account)
+ {
+ void *stack = task_stack_page(tsk);
+@@ -455,7 +470,7 @@ static __latent_entropy int dup_mmap(str
+ goto fail_nomem;
+ charge = len;
+ }
+- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ tmp = vm_area_dup(mpnt);
+ if (!tmp)
+ goto fail_nomem;
+ *tmp = *mpnt;
+@@ -539,7 +554,7 @@ fail_uprobe_end:
+ fail_nomem_anon_vma_fork:
+ mpol_put(vma_policy(tmp));
+ fail_nomem_policy:
+- kmem_cache_free(vm_area_cachep, tmp);
++ vm_area_free(tmp);
+ fail_nomem:
+ retval = -ENOMEM;
+ vm_unacct_memory(charge);
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -182,7 +182,7 @@ static struct vm_area_struct *remove_vma
+ if (vma->vm_file)
+ fput(vma->vm_file);
+ mpol_put(vma_policy(vma));
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return next;
+ }
+
+@@ -911,7 +911,7 @@ again:
+ anon_vma_merge(vma, next);
+ mm->map_count--;
+ mpol_put(vma_policy(next));
+- kmem_cache_free(vm_area_cachep, next);
++ vm_area_free(next);
+ /*
+ * In mprotect's case 6 (see comments on vma_merge),
+ * we must remove another next too. It would clutter
+@@ -1729,7 +1729,7 @@ unsigned long mmap_region(struct file *f
+ * specific mapper. the address has already been validated, but
+ * not unmapped, but the maps are removed from the list.
+ */
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (!vma) {
+ error = -ENOMEM;
+ goto unacct_error;
+@@ -1832,7 +1832,7 @@ allow_write_and_free_vma:
+ if (vm_flags & VM_DENYWRITE)
+ allow_write_access(file);
+ free_vma:
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ unacct_error:
+ if (charged)
+ vm_unacct_memory(charged);
+@@ -2620,7 +2620,7 @@ int __split_vma(struct mm_struct *mm, st
+ return err;
+ }
+
+- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ new = vm_area_dup(vma);
+ if (!new)
+ return -ENOMEM;
+
+@@ -2669,7 +2669,7 @@ int __split_vma(struct mm_struct *mm, st
+ out_free_mpol:
+ mpol_put(vma_policy(new));
+ out_free_vma:
+- kmem_cache_free(vm_area_cachep, new);
++ vm_area_free(new);
+ return err;
+ }
+
+@@ -2984,7 +2984,7 @@ static int do_brk_flags(unsigned long ad
+ /*
+ * create a vma struct for an anonymous mapping
+ */
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (!vma) {
+ vm_unacct_memory(len >> PAGE_SHIFT);
+ return -ENOMEM;
+@@ -3202,7 +3202,7 @@ struct vm_area_struct *copy_vma(struct v
+ }
+ *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
+ } else {
+- new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ new_vma = vm_area_dup(vma);
+ if (!new_vma)
+ goto out;
+ *new_vma = *vma;
+@@ -3226,7 +3226,7 @@ struct vm_area_struct *copy_vma(struct v
+ out_free_mempol:
+ mpol_put(vma_policy(new_vma));
+ out_free_vma:
+- kmem_cache_free(vm_area_cachep, new_vma);
++ vm_area_free(new_vma);
+ out:
+ return NULL;
+ }
+@@ -3350,7 +3350,7 @@ static struct vm_area_struct *__install_
+ int ret;
+ struct vm_area_struct *vma;
+
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (unlikely(vma == NULL))
+ return ERR_PTR(-ENOMEM);
+
+@@ -3376,7 +3376,7 @@ static struct vm_area_struct *__install_
+ return vma;
+
+ out:
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return ERR_PTR(ret);
+ }
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -769,7 +769,7 @@ static void delete_vma(struct mm_struct
+ if (vma->vm_file)
+ fput(vma->vm_file);
+ put_nommu_region(vma->vm_region);
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ }
+
+ /*
+@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file,
+ if (!region)
+ goto error_getting_region;
+
+- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ vma = vm_area_alloc();
+ if (!vma)
+ goto error_getting_vma;
+
+@@ -1368,7 +1368,7 @@ error:
+ kmem_cache_free(vm_region_jar, region);
+ if (vma->vm_file)
+ fput(vma->vm_file);
+- kmem_cache_free(vm_area_cachep, vma);
++ vm_area_free(vma);
+ return ret;
+
+ sharing_violation:
+@@ -1469,7 +1469,7 @@ int split_vma(struct mm_struct *mm, stru
+ if (!region)
+ return -ENOMEM;
+
+- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ new = vm_area_dup(vma);
+ if (!new) {
+ kmem_cache_free(vm_region_jar, region);
+ return -ENOMEM;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Fri, 22 Jun 2018 09:04:25 +0200
+Subject: mtd: dataflash: Use ULL suffix for 64-bit constants
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit cbdceb9b3e1928554fffd0d889adf2d0d8edee4d ]
+
+With gcc 4.1.2 when compiling for 32-bit:
+
+ drivers/mtd/devices/mtd_dataflash.c:736: warning: integer constant is too large for ‘long’ type
+ drivers/mtd/devices/mtd_dataflash.c:737: warning: integer constant is too large for ‘long’ type
+
+Add the missing "ULL" suffixes to fix this.
+
+Fixes: 67e4145ebf2c161d ("mtd: dataflash: Add flash_info for AT45DB641E")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/devices/mtd_dataflash.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/devices/mtd_dataflash.c
++++ b/drivers/mtd/devices/mtd_dataflash.c
+@@ -733,8 +733,8 @@ static struct flash_info dataflash_data[
+ { "AT45DB642x", 0x1f2800, 8192, 1056, 11, SUP_POW2PS},
+ { "at45db642d", 0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS},
+
+- { "AT45DB641E", 0x1f28000100, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
+- { "at45db641e", 0x1f28000100, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
++ { "AT45DB641E", 0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
++ { "at45db641e", 0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
+ };
+
+ static struct flash_info *jedec_lookup(struct spi_device *spi,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Doron Roberts-Kedes <doronrk@fb.com>
+Date: Fri, 15 Jun 2018 14:05:32 -0700
+Subject: nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag.
+
+From: Doron Roberts-Kedes <doronrk@fb.com>
+
+[ Upstream commit 08ba91ee6e2c1c08d3f0648f978cbb5dbf3491d8 ]
+
+If NBD_DISCONNECT_ON_CLOSE is set on a device, then the driver will
+issue a disconnect from nbd_release if the device has no remaining
+bdev->bd_openers.
+
+Fix ret val so reconfigure with only setting the flag succeeds.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Doron Roberts-Kedes <doronrk@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/nbd.c | 40 +++++++++++++++++++++++++++++++++-------
+ include/uapi/linux/nbd.h | 3 +++
+ 2 files changed, 36 insertions(+), 7 deletions(-)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -76,6 +76,7 @@ struct link_dead_args {
+ #define NBD_HAS_CONFIG_REF 4
+ #define NBD_BOUND 5
+ #define NBD_DESTROY_ON_DISCONNECT 6
++#define NBD_DISCONNECT_ON_CLOSE 7
+
+ struct nbd_config {
+ u32 flags;
+@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_de
+ static void nbd_connect_reply(struct genl_info *info, int index);
+ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
+ static void nbd_dead_link_work(struct work_struct *work);
++static void nbd_disconnect_and_put(struct nbd_device *nbd);
+
+ static inline struct device *nbd_to_dev(struct nbd_device *nbd)
+ {
+@@ -1291,6 +1293,12 @@ out:
+ static void nbd_release(struct gendisk *disk, fmode_t mode)
+ {
+ struct nbd_device *nbd = disk->private_data;
++ struct block_device *bdev = bdget_disk(disk, 0);
++
++ if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
++ bdev->bd_openers == 0)
++ nbd_disconnect_and_put(nbd);
++
+ nbd_config_put(nbd);
+ nbd_put(nbd);
+ }
+@@ -1690,6 +1698,10 @@ again:
+ &config->runtime_flags);
+ put_dev = true;
+ }
++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
++ set_bit(NBD_DISCONNECT_ON_CLOSE,
++ &config->runtime_flags);
++ }
+ }
+
+ if (info->attrs[NBD_ATTR_SOCKETS]) {
+@@ -1734,6 +1746,16 @@ out:
+ return ret;
+ }
+
++static void nbd_disconnect_and_put(struct nbd_device *nbd)
++{
++ mutex_lock(&nbd->config_lock);
++ nbd_disconnect(nbd);
++ mutex_unlock(&nbd->config_lock);
++ if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
++ &nbd->config->runtime_flags))
++ nbd_config_put(nbd);
++}
++
+ static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
+ {
+ struct nbd_device *nbd;
+@@ -1766,12 +1788,7 @@ static int nbd_genl_disconnect(struct sk
+ nbd_put(nbd);
+ return 0;
+ }
+- mutex_lock(&nbd->config_lock);
+- nbd_disconnect(nbd);
+- mutex_unlock(&nbd->config_lock);
+- if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+- &nbd->config->runtime_flags))
+- nbd_config_put(nbd);
++ nbd_disconnect_and_put(nbd);
+ nbd_config_put(nbd);
+ nbd_put(nbd);
+ return 0;
+@@ -1782,7 +1799,7 @@ static int nbd_genl_reconfigure(struct s
+ struct nbd_device *nbd = NULL;
+ struct nbd_config *config;
+ int index;
+- int ret = -EINVAL;
++ int ret = 0;
+ bool put_dev = false;
+
+ if (!netlink_capable(skb, CAP_SYS_ADMIN))
+@@ -1822,6 +1839,7 @@ static int nbd_genl_reconfigure(struct s
+ !nbd->task_recv) {
+ dev_err(nbd_to_dev(nbd),
+ "not configured, cannot reconfigure\n");
++ ret = -EINVAL;
+ goto out;
+ }
+
+@@ -1846,6 +1864,14 @@ static int nbd_genl_reconfigure(struct s
+ &config->runtime_flags))
+ refcount_inc(&nbd->refs);
+ }
++
++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
++ set_bit(NBD_DISCONNECT_ON_CLOSE,
++ &config->runtime_flags);
++ } else {
++ clear_bit(NBD_DISCONNECT_ON_CLOSE,
++ &config->runtime_flags);
++ }
+ }
+
+ if (info->attrs[NBD_ATTR_SOCKETS]) {
+--- a/include/uapi/linux/nbd.h
++++ b/include/uapi/linux/nbd.h
+@@ -53,6 +53,9 @@ enum {
+ /* These are client behavior specific flags. */
+ #define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on
+ disconnect. */
++#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on
++ * close by last opener.
++ */
+
+ /* userspace doesn't need the nbd_device structure */
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Greentime Hu <greentime@andestech.com>
+Date: Thu, 28 Jun 2018 18:29:21 +0800
+Subject: nds32: Fix the dts pointer is not passed correctly issue.
+
+From: Greentime Hu <greentime@andestech.com>
+
+[ Upstream commit 6897e6ecb3167598cb45e1a1424dd4d5e3778837 ]
+
+We found that the original implementation will only use the built-in dtb
+pointer instead of the pointer pass from bootloader. This bug is fixed
+by this patch.
+
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/nds32/kernel/setup.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/nds32/kernel/setup.c
++++ b/arch/nds32/kernel/setup.c
+@@ -278,7 +278,8 @@ static void __init setup_memory(void)
+
+ void __init setup_arch(char **cmdline_p)
+ {
+- early_init_devtree( __dtb_start);
++ early_init_devtree(__atags_pointer ? \
++ phys_to_virt(__atags_pointer) : __dtb_start);
+
+ setup_cpuinfo();
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: piaojun <piaojun@huawei.com>
+Date: Fri, 13 Jul 2018 16:59:06 -0700
+Subject: net/9p/client.c: put refcount of trans_mod in error case in parse_opts()
+
+From: piaojun <piaojun@huawei.com>
+
+[ Upstream commit c290fba8c4ce6530cd941ea14db5a4ac2f77183f ]
+
+In my testing, the second mount will fail after umounting successfully.
+The reason is that we put refcount of trans_mod in the correct case
+rather than the error case in parse_opts() at last. That will cause the
+refcount decrease to -1, and when we try to get trans_mod again in
+try_module_get(), we could only increase refcount to 0 which will cause
+failure as follows:
+
+parse_opts
+ v9fs_get_trans_by_name
+ try_module_get : return NULL to caller which cause error
+
+So we should put refcount of trans_mod in error case.
+
+Link: http://lkml.kernel.org/r/5B3F39A0.2030509@huawei.com
+Fixes: 9421c3e64137ec ("net/9p/client.c: fix potential refcnt problem of trans module")
+Signed-off-by: Jun Piao <piaojun@huawei.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Reviewed-by: Dominique Martinet <dominique.martinet@cea.fr>
+Tested-by: Dominique Martinet <dominique.martinet@cea.fr>
+Cc: Eric Van Hensbergen <ericvh@gmail.com>
+Cc: Ron Minnich <rminnich@sandia.gov>
+Cc: Latchesar Ionkov <lucho@ionkov.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/9p/client.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -228,7 +228,8 @@ static int parse_opts(char *opts, struct
+ }
+
+ free_and_return:
+- v9fs_put_trans(clnt->trans_mod);
++ if (ret)
++ v9fs_put_trans(clnt->trans_mod);
+ kfree(tmp_options);
+ return ret;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Tue, 17 Jul 2018 18:23:58 +0200
+Subject: net: cavium: Add fine-granular dependencies on PCI
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+[ Upstream commit e40562abdf81f32356218d4196c33f5f93c040f7 ]
+
+Add dependencies on PCI where necessary.
+
+Fixes: 7e2bc7fb65 ("net: cavium: Drop dependency of NET_VENDOR_CAVIUM on PCI")
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/Kconfig | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/Kconfig
++++ b/drivers/net/ethernet/cavium/Kconfig
+@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM
+
+ config THUNDER_NIC_PF
+ tristate "Thunder Physical function driver"
+- depends on 64BIT
++ depends on 64BIT && PCI
+ select THUNDER_NIC_BGX
+ ---help---
+ This driver supports Thunder's NIC physical function.
+@@ -28,13 +28,13 @@ config THUNDER_NIC_PF
+ config THUNDER_NIC_VF
+ tristate "Thunder Virtual function driver"
+ imply CAVIUM_PTP
+- depends on 64BIT
++ depends on 64BIT && PCI
+ ---help---
+ This driver supports Thunder's NIC virtual function
+
+ config THUNDER_NIC_BGX
+ tristate "Thunder MAC interface driver (BGX)"
+- depends on 64BIT
++ depends on 64BIT && PCI
+ select PHYLIB
+ select MDIO_THUNDER
+ select THUNDER_NIC_RGX
+@@ -44,7 +44,7 @@ config THUNDER_NIC_BGX
+
+ config THUNDER_NIC_RGX
+ tristate "Thunder MAC interface driver (RGX)"
+- depends on 64BIT
++ depends on 64BIT && PCI
+ select PHYLIB
+ select MDIO_THUNDER
+ ---help---
+@@ -53,7 +53,7 @@ config THUNDER_NIC_RGX
+
+ config CAVIUM_PTP
+ tristate "Cavium PTP coprocessor as PTP clock"
+- depends on 64BIT
++ depends on 64BIT && PCI
+ imply PTP_1588_CLOCK
+ default y
+ ---help---
+@@ -65,7 +65,7 @@ config CAVIUM_PTP
+
+ config LIQUIDIO
+ tristate "Cavium LiquidIO support"
+- depends on 64BIT
++ depends on 64BIT && PCI
+ depends on MAY_USE_DEVLINK
+ imply PTP_1588_CLOCK
+ select FW_LOADER
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 20 Jun 2018 10:03:56 +0200
+Subject: net: davinci_emac: match the mdio device against its compatible if possible
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ]
+
+Device tree based systems without of_dev_auxdata will have the mdio
+device named differently than "davinci_mdio(.0)". In this case use the
+device's parent's compatible string for matching
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_devi
+
+ static int match_first_device(struct device *dev, void *data)
+ {
++ if (dev->parent && dev->parent->of_node)
++ return of_device_is_compatible(dev->parent->of_node,
++ "ti,davinci_mdio");
++
+ return !strncmp(dev_name(dev), "davinci_mdio", 12);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 13 Jul 2018 21:25:19 -0700
+Subject: net/ethernet/freescale/fman: fix cross-build error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c133459765fae249ba482f62e12f987aec4376f0 ]
+
+ CC [M] drivers/net/ethernet/freescale/fman/fman.o
+In file included from ../drivers/net/ethernet/freescale/fman/fman.c:35:
+../include/linux/fsl/guts.h: In function 'guts_set_dmacr':
+../include/linux/fsl/guts.h:165:2: error: implicit declaration of function 'clrsetbits_be32' [-Werror=implicit-function-declaration]
+ clrsetbits_be32(&guts->dmacr, 3 << shift, device << shift);
+ ^~~~~~~~~~~~~~~
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Madalin Bucur <madalin.bucur@nxp.com>
+Cc: netdev@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/fsl/guts.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/fsl/guts.h
++++ b/include/linux/fsl/guts.h
+@@ -16,6 +16,7 @@
+ #define __FSL_GUTS_H__
+
+ #include <linux/types.h>
++#include <linux/io.h>
+
+ /**
+ * Global Utility Registers.
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Stefan Agner <stefan@agner.ch>
+Date: Sun, 17 Jun 2018 23:40:53 +0200
+Subject: net: hamradio: use eth_broadcast_addr
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ]
+
+The array bpq_eth_addr is only used to get the size of an
+address, whereas the bcast_addr is used to set the broadcast
+address. This leads to a warning when using clang:
+drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not
+ needed and will not be emitted [-Wunneeded-internal-declaration]
+static char bpq_eth_addr[6];
+ ^
+
+Remove both variables and use the common eth_broadcast_addr
+to set the broadcast address.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hamradio/bpqether.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/hamradio/bpqether.c
++++ b/drivers/net/hamradio/bpqether.c
+@@ -89,10 +89,6 @@
+ static const char banner[] __initconst = KERN_INFO \
+ "AX.25: bpqether driver version 004\n";
+
+-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
+-
+-static char bpq_eth_addr[6];
+-
+ static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+ static int bpq_device_event(struct notifier_block *, unsigned long, void *);
+
+@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_dev
+ bpq->ethdev = edev;
+ bpq->axdev = ndev;
+
+- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
+- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
++ eth_broadcast_addr(bpq->dest_addr);
++ eth_broadcast_addr(bpq->acpt_addr);
+
+ err = register_netdevice(ndev);
+ if (err)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Mon, 25 Jun 2018 16:49:51 +0300
+Subject: net: ieee802154: adf7242: Fix erroneous RX enable
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+[ Upstream commit 36d26d6b6208399070a9d7993534fef9fc26b1ba ]
+
+Only enable RX mode if the netdev is opened.
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/adf7242.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -719,7 +719,10 @@ static int adf7242_channel(struct ieee80
+ adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8);
+ adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16);
+
+- return adf7242_cmd(lp, CMD_RC_RX);
++ if (test_bit(FLAG_START, &lp->flags))
++ return adf7242_cmd_rx(lp);
++ else
++ return adf7242_cmd(lp, CMD_RC_PHY_RDY);
+ }
+
+ static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Mon, 25 Jun 2018 16:57:37 +0300
+Subject: net: ieee802154: adf7242: Fix OCL calibration runs
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+[ Upstream commit 58e9683d14752debc6f22daf6b23e031787df31f ]
+
+Reissuing RC_RX every 400ms - to adjust for offset drift in
+receiver see datasheet page 61, OCL section.
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/adf7242.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -275,6 +275,8 @@ struct adf7242_local {
+ struct spi_message stat_msg;
+ struct spi_transfer stat_xfer;
+ struct dentry *debugfs_root;
++ struct delayed_work work;
++ struct workqueue_struct *wqueue;
+ unsigned long flags;
+ int tx_stat;
+ bool promiscuous;
+@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242
+ /* Wait until the ACK is sent */
+ adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__);
+ adf7242_clear_irqstat(lp);
++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
+
+ return adf7242_cmd(lp, CMD_RC_RX);
+ }
+
++static void adf7242_rx_cal_work(struct work_struct *work)
++{
++ struct adf7242_local *lp =
++ container_of(work, struct adf7242_local, work.work);
++
++ /* Reissuing RC_RX every 400ms - to adjust for offset
++ * drift in receiver (datasheet page 61, OCL section)
++ */
++
++ if (!test_bit(FLAG_XMIT, &lp->flags)) {
++ adf7242_cmd(lp, CMD_RC_PHY_RDY);
++ adf7242_cmd_rx(lp);
++ }
++}
++
+ static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm)
+ {
+ struct adf7242_local *lp = hw->priv;
+@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee8021
+ enable_irq(lp->spi->irq);
+ set_bit(FLAG_START, &lp->flags);
+
+- return adf7242_cmd(lp, CMD_RC_RX);
++ return adf7242_cmd_rx(lp);
+ }
+
+ static void adf7242_stop(struct ieee802154_hw *hw)
+@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee8021
+ struct adf7242_local *lp = hw->priv;
+
+ disable_irq(lp->spi->irq);
++ cancel_delayed_work_sync(&lp->work);
+ adf7242_cmd(lp, CMD_RC_IDLE);
+ clear_bit(FLAG_START, &lp->flags);
+ adf7242_clear_irqstat(lp);
+@@ -817,6 +836,7 @@ static int adf7242_xmit(struct ieee80215
+ /* ensure existing instances of the IRQ handler have completed */
+ disable_irq(lp->spi->irq);
+ set_bit(FLAG_XMIT, &lp->flags);
++ cancel_delayed_work_sync(&lp->work);
+ reinit_completion(&lp->tx_complete);
+ adf7242_cmd(lp, CMD_RC_PHY_RDY);
+ adf7242_clear_irqstat(lp);
+@@ -955,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq,
+ unsigned int xmit;
+ u8 irq1;
+
++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
+ adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1);
+
+ if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA)))
+@@ -1244,6 +1265,9 @@ static int adf7242_probe(struct spi_devi
+ spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg);
+
+ spi_set_drvdata(spi, lp);
++ INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
++ lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
++ WQ_MEM_RECLAIM);
+
+ ret = adf7242_hw_init(lp);
+ if (ret)
+@@ -1287,6 +1311,9 @@ static int adf7242_remove(struct spi_dev
+ if (!IS_ERR_OR_NULL(lp->debugfs_root))
+ debugfs_remove_recursive(lp->debugfs_root);
+
++ cancel_delayed_work_sync(&lp->work);
++ destroy_workqueue(lp->wqueue);
++
+ ieee802154_unregister_hw(lp->hw);
+ mutex_destroy(&lp->bmux);
+ ieee802154_free_hw(lp->hw);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Harini Katakam <harini.katakam@xilinx.com>
+Date: Fri, 6 Jul 2018 12:18:57 +0530
+Subject: net: macb: Free RX ring for all queues
+
+From: Harini Katakam <harini.katakam@xilinx.com>
+
+[ Upstream commit e50b770ea5c9eff0013e8ae714d20182ed50d5e6 ]
+
+rx ring is allocated for all queues in macb_alloc_consistent.
+Free the same for all queues instead of just Q0.
+
+Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1818,13 +1818,7 @@ static void macb_free_consistent(struct
+ struct macb_queue *queue;
+ unsigned int q;
+
+- queue = &bp->queues[0];
+ bp->macbgem_ops.mog_free_rx_buffers(bp);
+- if (queue->rx_ring) {
+- dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
+- queue->rx_ring, queue->rx_ring_dma);
+- queue->rx_ring = NULL;
+- }
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+ kfree(queue->tx_skb);
+@@ -1834,6 +1828,11 @@ static void macb_free_consistent(struct
+ queue->tx_ring, queue->tx_ring_dma);
+ queue->tx_ring = NULL;
+ }
++ if (queue->rx_ring) {
++ dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
++ queue->rx_ring, queue->rx_ring_dma);
++ queue->rx_ring = NULL;
++ }
+ }
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Eli Cohen <eli@mellanox.com>
+Date: Thu, 31 May 2018 12:24:48 +0300
+Subject: net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager
+
+From: Eli Cohen <eli@mellanox.com>
+
+[ Upstream commit a8d70a054a718b63058b3d3ac58b6181815e4289 ]
+
+In smartnic env, if the host (PF) driver is not an e-switch manager, we
+are not allowed to apply eswitch ports setups such as vlan (VST),
+spoof-checks, min/max rate or state.
+
+Make sure we are eswitch manager when coming to issue these callbacks
+and err otherwise.
+
+Also fix the definition of ESW_ALLOWED to rely on eswitch_manager
+capability and on the vport_group_manger.
+
+Operations on the VF nic vport context, such as setting a mac or reading
+the vport counters are allowed to the PF in this scheme.
+
+The modify nic vport guid code was modified to omit checking the
+nic_vport_node_guid_modify eswitch capability.
+The reason for doing so is that modifying node guid requires vport group
+manager capability, and there's no need to check further capabilities.
+
+1. set_vf_vlan - disallowed
+2. set_vf_spoofchk - disallowed
+3. set_vf_mac - allowed
+4. get_vf_config - allowed
+5. set_vf_trust - disallowed
+6. set_vf_rate - disallowed
+7. get_vf_stat - allowed
+8. set_vf_link_state - disallowed
+
+Fixes: f942380c1239 ('net/mlx5: E-Switch, Vport ingress/egress ACLs rules for spoofchk')
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
+Tested-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 12 +++++-------
+ drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 --
+ 2 files changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1594,17 +1594,15 @@ static void esw_disable_vport(struct mlx
+ }
+
+ /* Public E-Switch API */
+-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev))
++#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev))
++
+
+ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
+ {
+ int err;
+ int i, enabled_events;
+
+- if (!ESW_ALLOWED(esw))
+- return 0;
+-
+- if (!MLX5_ESWITCH_MANAGER(esw->dev) ||
++ if (!ESW_ALLOWED(esw) ||
+ !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
+ esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
+ return -EOPNOTSUPP;
+@@ -1806,7 +1804,7 @@ int mlx5_eswitch_set_vport_mac(struct ml
+ u64 node_guid;
+ int err = 0;
+
+- if (!ESW_ALLOWED(esw))
++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
+ return -EINVAL;
+@@ -1883,7 +1881,7 @@ int mlx5_eswitch_get_vport_config(struct
+ {
+ struct mlx5_vport *evport;
+
+- if (!ESW_ALLOWED(esw))
++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport))
+ return -EINVAL;
+--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(stru
+ return -EINVAL;
+ if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+ return -EACCES;
+- if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
+- return -EOPNOTSUPP;
+
+ in = kvzalloc(inlen, GFP_KERNEL);
+ if (!in)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+Date: Sun, 1 Jul 2018 23:15:46 -0700
+Subject: net: phy: marvell: change default m88e1510 LED configuration
+
+From: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+
+[ Upstream commit 077772468ec141b22e1e7c0c58bc09e2f9dc8762 ]
+
+The m88e1121 LED default configuration does not apply m88e151x.
+So add a function to relpace m88e1121 LED configuration.
+
+Signed-off-by: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/marvell.c | 54 +++++++++++++++++++++++++++++---------------
+ include/linux/marvell_phy.h | 2 +
+ 2 files changed, 38 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -130,8 +130,9 @@
+ #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS BIT(12)
+ #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE BIT(14)
+
+-#define MII_88E1121_PHY_LED_CTRL 16
++#define MII_PHY_LED_CTRL 16
+ #define MII_88E1121_PHY_LED_DEF 0x0030
++#define MII_88E1510_PHY_LED_DEF 0x1177
+
+ #define MII_M1011_PHY_STATUS 0x11
+ #define MII_M1011_PHY_STATUS_1000 0x8000
+@@ -632,8 +633,40 @@ error:
+ return err;
+ }
+
++static void marvell_config_led(struct phy_device *phydev)
++{
++ u16 def_config;
++ int err;
++
++ switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
++ /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S):
++ def_config = MII_88E1121_PHY_LED_DEF;
++ break;
++ /* Default PHY LED config:
++ * LED[0] .. 1000Mbps Link
++ * LED[1] .. 100Mbps Link
++ * LED[2] .. Blink, Activity
++ */
++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510):
++ def_config = MII_88E1510_PHY_LED_DEF;
++ break;
++ default:
++ return;
++ }
++
++ err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL,
++ def_config);
++ if (err < 0)
++ pr_warn("Fail to config marvell phy LED.\n");
++}
++
+ static int marvell_config_init(struct phy_device *phydev)
+ {
++ /* Set defalut LED */
++ marvell_config_led(phydev);
++
+ /* Set registers from marvell,reg-init DT property */
+ return marvell_of_reg_init(phydev);
+ }
+@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct p
+ return genphy_soft_reset(phydev);
+ }
+
+-static int m88e1121_config_init(struct phy_device *phydev)
+-{
+- int err;
+-
+- /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+- err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
+- MII_88E1121_PHY_LED_CTRL,
+- MII_88E1121_PHY_LED_DEF);
+- if (err < 0)
+- return err;
+-
+- /* Set marvell,reg-init configuration from device tree */
+- return marvell_config_init(phydev);
+-}
+-
+ static int m88e1318_config_init(struct phy_device *phydev)
+ {
+ if (phy_interrupt_is_valid(phydev)) {
+@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct p
+ return err;
+ }
+
+- return m88e1121_config_init(phydev);
++ return marvell_config_init(phydev);
+ }
+
+ static int m88e1510_config_init(struct phy_device *phydev)
+@@ -2090,7 +2108,7 @@ static struct phy_driver marvell_drivers
+ .features = PHY_GBIT_FEATURES,
+ .flags = PHY_HAS_INTERRUPT,
+ .probe = &m88e1121_probe,
+- .config_init = &m88e1121_config_init,
++ .config_init = &marvell_config_init,
+ .config_aneg = &m88e1121_config_aneg,
+ .read_status = &marvell_read_status,
+ .ack_interrupt = &marvell_ack_interrupt,
+--- a/include/linux/marvell_phy.h
++++ b/include/linux/marvell_phy.h
+@@ -27,6 +27,8 @@
+ */
+ #define MARVELL_PHY_ID_88E6390 0x01410f90
+
++#define MARVELL_PHY_FAMILY_ID(id) ((id) >> 4)
++
+ /* struct phy_device dev_flags definitions */
+ #define MARVELL_PHY_M1145_FLAGS_RESISTANCE 0x00000001
+ #define MARVELL_PHY_M1118_DNS323_LEDS 0x00000002
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Li RongQing <lirongqing@baidu.com>
+Date: Tue, 19 Jun 2018 17:23:17 +0800
+Subject: net: propagate dev_get_valid_name return code
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ]
+
+if dev_get_valid_name failed, propagate its return code
+
+and remove the setting err to ENODEV, it will be set to
+0 again before dev_change_net_namespace exits.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8608,7 +8608,8 @@ int dev_change_net_namespace(struct net_
+ /* We get here if we can't use the current device name */
+ if (!pat)
+ goto out;
+- if (dev_get_valid_name(net, dev, pat) < 0)
++ err = dev_get_valid_name(net, dev, pat);
++ if (err < 0)
+ goto out;
+ }
+
+@@ -8620,7 +8621,6 @@ int dev_change_net_namespace(struct net_
+ dev_close(dev);
+
+ /* And unlink it from device chain */
+- err = -ENODEV;
+ unlist_netdevice(dev);
+
+ synchronize_net();
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 18 Jul 2018 08:31:43 +0200
+Subject: net: qca_spi: Avoid packet drop during initial sync
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ]
+
+As long as the synchronization with the QCA7000 isn't finished, we
+cannot accept packets from the upper layers. So let the SPI thread
+enable the TX queue after sync and avoid unwanted packet drop.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *de
+ return ret;
+ }
+
+- netif_start_queue(qca->net_dev);
++ /* SPI thread takes care of TX queue */
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 18 Jul 2018 08:31:45 +0200
+Subject: net: qca_spi: Fix log level if probe fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 50973993260a6934f0a00da53d9b746cfbea89ab ]
+
+In cases the probing fails the log level of the messages should
+be an error.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -881,22 +881,22 @@ qca_spi_probe(struct spi_device *spi)
+
+ if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
+ (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
+- dev_info(&spi->dev, "Invalid clkspeed: %d\n",
+- qcaspi_clkspeed);
++ dev_err(&spi->dev, "Invalid clkspeed: %d\n",
++ qcaspi_clkspeed);
+ return -EINVAL;
+ }
+
+ if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
+ (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
+- dev_info(&spi->dev, "Invalid burst len: %d\n",
+- qcaspi_burst_len);
++ dev_err(&spi->dev, "Invalid burst len: %d\n",
++ qcaspi_burst_len);
+ return -EINVAL;
+ }
+
+ if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
+ (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
+- dev_info(&spi->dev, "Invalid pluggable: %d\n",
+- qcaspi_pluggable);
++ dev_err(&spi->dev, "Invalid pluggable: %d\n",
++ qcaspi_pluggable);
+ return -EINVAL;
+ }
+
+@@ -958,8 +958,8 @@ qca_spi_probe(struct spi_device *spi)
+ }
+
+ if (register_netdev(qcaspi_devs)) {
+- dev_info(&spi->dev, "Unable to register net device %s\n",
+- qcaspi_devs->name);
++ dev_err(&spi->dev, "Unable to register net device %s\n",
++ qcaspi_devs->name);
+ free_netdev(qcaspi_devs);
+ return -EFAULT;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 18 Jul 2018 08:31:44 +0200
+Subject: net: qca_spi: Make sure the QCA7000 reset is triggered
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ]
+
+In case the SPI thread is not running, a simple reset of sync
+state won't fix the transmit timeout. We also need to wake up the kernel
+thread.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_devi
+ qca->net_dev->stats.tx_errors++;
+ /* Trigger tx queue flush and QCA7000 reset */
+ qca->sync = QCASPI_SYNC_UNKNOWN;
++
++ if (qca->spi_thread)
++ wake_up_process(qca->spi_thread);
+ }
+
+ static int
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Arun Kumar Neelakantam <aneela@codeaurora.org>
+Date: Wed, 4 Jul 2018 19:49:32 +0530
+Subject: net: qrtr: Broadcast messages only from control port
+
+From: Arun Kumar Neelakantam <aneela@codeaurora.org>
+
+[ Upstream commit fdf5fd3975666804118e62c69de25dc85cc0909c ]
+
+The broadcast node id should only be sent with the control port id.
+
+Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/qrtr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -764,6 +764,10 @@ static int qrtr_sendmsg(struct socket *s
+ node = NULL;
+ if (addr->sq_node == QRTR_NODE_BCAST) {
+ enqueue_fn = qrtr_bcast_enqueue;
++ if (addr->sq_port != QRTR_PORT_CTRL) {
++ release_sock(sk);
++ return -ENOTCONN;
++ }
+ } else if (addr->sq_node == ipc->us.sq_node) {
+ enqueue_fn = qrtr_local_enqueue;
+ } else {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Arun Kumar Neelakantam <aneela@codeaurora.org>
+Date: Wed, 4 Jul 2018 19:49:33 +0530
+Subject: net: qrtr: Reset the node and port ID of broadcast messages
+
+From: Arun Kumar Neelakantam <aneela@codeaurora.org>
+
+[ Upstream commit d27e77a3de2866b0a772803fd03cd667b5ff8a9a ]
+
+All the control messages broadcast to remote routers are using
+QRTR_NODE_BCAST instead of using local router NODE ID which cause
+the packets to be dropped on remote router due to invalid NODE ID.
+
+Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/qrtr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr
+ hdr->type = cpu_to_le32(type);
+ hdr->src_node_id = cpu_to_le32(from->sq_node);
+ hdr->src_port_id = cpu_to_le32(from->sq_port);
+- hdr->dst_node_id = cpu_to_le32(to->sq_node);
+- hdr->dst_port_id = cpu_to_le32(to->sq_port);
++ if (to->sq_port == QRTR_PORT_CTRL) {
++ hdr->dst_node_id = cpu_to_le32(node->nid);
++ hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST);
++ } else {
++ hdr->dst_node_id = cpu_to_le32(to->sq_node);
++ hdr->dst_port_id = cpu_to_le32(to->sq_port);
++ }
+
+ hdr->size = cpu_to_le32(len);
+ hdr->confirm_rx = 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 6 Jul 2018 21:01:05 +0200
+Subject: net/sched: act_csum: fix NULL dereference when 'goto chain' is used
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 11a245e2f7bf25fc21f47e4c9c8491841b128890 ]
+
+the control action in the common member of struct tcf_csum must be a valid
+value, as it can contain the chain index when 'goto chain' is used. Ensure
+that the control action can be read as x->tcfa_action, when x is a pointer
+to struct tc_action and x->ops->type is TCA_ACT_CSUM, to prevent the
+following command:
+
+ # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+ > $tcflags dst_mac $h2mac action csum ip or tcp or udp or sctp goto chain 1
+
+from triggering a NULL pointer dereference when a matching packet is
+received.
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+ PGD 800000010416b067 P4D 800000010416b067 PUD 1041be067 PMD 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 0 PID: 3072 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421
+ Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
+ RIP: 0010:tcf_action_exec+0xb8/0x100
+ Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
+ RSP: 0018:ffffa020dea03c40 EFLAGS: 00010246
+ RAX: 0000000020000001 RBX: ffffa020d7ccef00 RCX: 0000000000000054
+ RDX: 0000000000000000 RSI: ffffa020ca5ae000 RDI: ffffa020d7ccef00
+ RBP: ffffa020dea03e60 R08: 0000000000000000 R09: ffffa020dea03c9c
+ R10: ffffa020dea03c78 R11: 0000000000000008 R12: ffffa020d3fe4f00
+ R13: ffffa020d3fe4f08 R14: 0000000000000001 R15: ffffa020d53ca300
+ FS: 00007f5a46942740(0000) GS:ffffa020dea00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 0000000104218002 CR4: 00000000001606f0
+ Call Trace:
+ <IRQ>
+ fl_classify+0x1ad/0x1c0 [cls_flower]
+ ? arp_rcv+0x121/0x1b0
+ ? __x2apic_send_IPI_dest+0x40/0x40
+ ? smp_reschedule_interrupt+0x1c/0xd0
+ ? reschedule_interrupt+0xf/0x20
+ ? reschedule_interrupt+0xa/0x20
+ ? device_is_rmrr_locked+0xe/0x50
+ ? iommu_should_identity_map+0x49/0xd0
+ ? __intel_map_single+0x30/0x140
+ ? e1000e_update_rdt_wa.isra.52+0x22/0xb0 [e1000e]
+ ? e1000_alloc_rx_buffers+0x233/0x250 [e1000e]
+ ? kmem_cache_alloc+0x38/0x1c0
+ tcf_classify+0x89/0x140
+ __netif_receive_skb_core+0x5ea/0xb70
+ ? enqueue_task_fair+0xb6/0x7d0
+ ? process_backlog+0x97/0x150
+ process_backlog+0x97/0x150
+ net_rx_action+0x14b/0x3e0
+ __do_softirq+0xde/0x2b4
+ do_softirq_own_stack+0x2a/0x40
+ </IRQ>
+ do_softirq.part.18+0x49/0x50
+ __local_bh_enable_ip+0x49/0x50
+ __dev_queue_xmit+0x4ab/0x8a0
+ ? wait_woken+0x80/0x80
+ ? packet_sendmsg+0x38f/0x810
+ ? __dev_queue_xmit+0x8a0/0x8a0
+ packet_sendmsg+0x38f/0x810
+ sock_sendmsg+0x36/0x40
+ __sys_sendto+0x10e/0x140
+ ? do_vfs_ioctl+0xa4/0x630
+ ? syscall_trace_enter+0x1df/0x2e0
+ ? __audit_syscall_exit+0x22a/0x290
+ __x64_sys_sendto+0x24/0x30
+ do_syscall_64+0x5b/0x180
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f5a45cbec93
+ Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
+ RSP: 002b:00007ffd0ee6d748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+ RAX: ffffffffffffffda RBX: 0000000001161010 RCX: 00007f5a45cbec93
+ RDX: 0000000000000062 RSI: 0000000001161322 RDI: 0000000000000003
+ RBP: 00007ffd0ee6d780 R08: 00007ffd0ee6d760 R09: 0000000000000014
+ R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
+ R13: 0000000001161322 R14: 00007ffd0ee6d760 R15: 0000000000000003
+ Modules linked in: act_csum act_gact cls_flower sch_ingress vrf veth act_tunnel_key(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_hdmi snd_hda_codec_realtek kvm snd_hda_codec_generic hp_wmi iTCO_wdt sparse_keymap rfkill mei_wdt iTCO_vendor_support wmi_bmof gpio_ich irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel snd_hda_intel crypto_simd cryptd snd_hda_codec glue_helper snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm pcspkr i2c_i801 snd_timer snd sg lpc_ich soundcore wmi mei_me
+ mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod ahci libahci crc32c_intel i915 ixgbe serio_raw libata video dca i2c_algo_bit sfc drm_kms_helper syscopyarea mtd sysfillrect mdio sysimgblt fb_sys_fops drm e1000e i2c_core
+ CR2: 0000000000000000
+ ---[ end trace 3c9e9d1a77df4026 ]---
+ RIP: 0010:tcf_action_exec+0xb8/0x100
+ Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
+ RSP: 0018:ffffa020dea03c40 EFLAGS: 00010246
+ RAX: 0000000020000001 RBX: ffffa020d7ccef00 RCX: 0000000000000054
+ RDX: 0000000000000000 RSI: ffffa020ca5ae000 RDI: ffffa020d7ccef00
+ RBP: ffffa020dea03e60 R08: 0000000000000000 R09: ffffa020dea03c9c
+ R10: ffffa020dea03c78 R11: 0000000000000008 R12: ffffa020d3fe4f00
+ R13: ffffa020d3fe4f08 R14: 0000000000000001 R15: ffffa020d53ca300
+ FS: 00007f5a46942740(0000) GS:ffffa020dea00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 0000000104218002 CR4: 00000000001606f0
+ Kernel panic - not syncing: Fatal exception in interrupt
+ Kernel Offset: 0x26400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+ ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
+
+Fixes: 9c5f69bbd75a ("net/sched: act_csum: don't use spinlock in the fast path")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/tc_act/tc_csum.h | 1 -
+ net/sched/act_csum.c | 6 +++---
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+--- a/include/net/tc_act/tc_csum.h
++++ b/include/net/tc_act/tc_csum.h
+@@ -7,7 +7,6 @@
+ #include <linux/tc_act/tc_csum.h>
+
+ struct tcf_csum_params {
+- int action;
+ u32 update_flags;
+ struct rcu_head rcu;
+ };
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net
+ }
+ params_old = rtnl_dereference(p->params);
+
+- params_new->action = parm->action;
++ p->tcf_action = parm->action;
+ params_new->update_flags = parm->update_flags;
+ rcu_assign_pointer(p->params, params_new);
+ if (params_old)
+@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb,
+ tcf_lastuse_update(&p->tcf_tm);
+ bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb);
+
+- action = params->action;
++ action = READ_ONCE(p->tcf_action);
+ if (unlikely(action == TC_ACT_SHOT))
+ goto drop_stats;
+
+@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff
+ .index = p->tcf_index,
+ .refcnt = p->tcf_refcnt - ref,
+ .bindcnt = p->tcf_bindcnt - bind,
++ .action = p->tcf_action,
+ };
+ struct tcf_t t;
+
+ params = rtnl_dereference(p->params);
+- opt.action = params->action;
+ opt.update_flags = params->update_flags;
+
+ if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt))
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 6 Jul 2018 21:01:06 +0200
+Subject: net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 38230a3e0e0933bbcf5df6fa469ba0667f667568 ]
+
+the control action in the common member of struct tcf_tunnel_key must be a
+valid value, as it can contain the chain index when 'goto chain' is used.
+Ensure that the control action can be read as x->tcfa_action, when x is a
+pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to
+prevent the following command:
+
+ # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
+ > $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1
+
+from causing a NULL dereference when a matching packet is received:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+ PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 0 PID: 3491 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421
+ Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
+ RIP: 0010:tcf_action_exec+0xb8/0x100
+ Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
+ RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
+ RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
+ RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
+ RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
+ R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
+ R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
+ FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
+ Call Trace:
+ <IRQ>
+ fl_classify+0x1ad/0x1c0 [cls_flower]
+ ? __update_load_avg_se.isra.47+0x1ca/0x1d0
+ ? __update_load_avg_se.isra.47+0x1ca/0x1d0
+ ? update_load_avg+0x665/0x690
+ ? update_load_avg+0x665/0x690
+ ? kmem_cache_alloc+0x38/0x1c0
+ tcf_classify+0x89/0x140
+ __netif_receive_skb_core+0x5ea/0xb70
+ ? enqueue_entity+0xd0/0x270
+ ? process_backlog+0x97/0x150
+ process_backlog+0x97/0x150
+ net_rx_action+0x14b/0x3e0
+ __do_softirq+0xde/0x2b4
+ do_softirq_own_stack+0x2a/0x40
+ </IRQ>
+ do_softirq.part.18+0x49/0x50
+ __local_bh_enable_ip+0x49/0x50
+ __dev_queue_xmit+0x4ab/0x8a0
+ ? wait_woken+0x80/0x80
+ ? packet_sendmsg+0x38f/0x810
+ ? __dev_queue_xmit+0x8a0/0x8a0
+ packet_sendmsg+0x38f/0x810
+ sock_sendmsg+0x36/0x40
+ __sys_sendto+0x10e/0x140
+ ? do_vfs_ioctl+0xa4/0x630
+ ? syscall_trace_enter+0x1df/0x2e0
+ ? __audit_syscall_exit+0x22a/0x290
+ __x64_sys_sendto+0x24/0x30
+ do_syscall_64+0x5b/0x180
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7fd67e18dc93
+ Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
+ RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+ RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93
+ RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003
+ RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014
+ R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
+ R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003
+ Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me
+ mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca
+ CR2: 0000000000000000
+ ---[ end trace 1ab8b5b5d4639dfc ]---
+ RIP: 0010:tcf_action_exec+0xb8/0x100
+ Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
+ RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
+ RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
+ RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
+ RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
+ R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
+ R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
+ FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
+ Kernel panic - not syncing: Fatal exception in interrupt
+ Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+ ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
+
+Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/tc_act/tc_tunnel_key.h | 1 -
+ net/sched/act_tunnel_key.c | 6 +++---
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+--- a/include/net/tc_act/tc_tunnel_key.h
++++ b/include/net/tc_act/tc_tunnel_key.h
+@@ -18,7 +18,6 @@
+ struct tcf_tunnel_key_params {
+ struct rcu_head rcu;
+ int tcft_action;
+- int action;
+ struct metadata_dst *tcft_enc_metadata;
+ };
+
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff
+
+ tcf_lastuse_update(&t->tcf_tm);
+ bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
+- action = params->action;
++ action = READ_ONCE(t->tcf_action);
+
+ switch (params->tcft_action) {
+ case TCA_TUNNEL_KEY_ACT_RELEASE:
+@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *n
+
+ params_old = rtnl_dereference(t->params);
+
+- params_new->action = parm->action;
++ t->tcf_action = parm->action;
+ params_new->tcft_action = parm->t_action;
+ params_new->tcft_enc_metadata = metadata;
+
+@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buf
+ .index = t->tcf_index,
+ .refcnt = t->tcf_refcnt - ref,
+ .bindcnt = t->tcf_bindcnt - bind,
++ .action = t->tcf_action,
+ };
+ struct tcf_t tm;
+
+ params = rtnl_dereference(t->params);
+
+ opt.t_action = params->tcft_action;
+- opt.action = params->action;
+
+ if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
+ goto nla_put_failure;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Karsten Graul <kgraul@linux.ibm.com>
+Date: Wed, 18 Jul 2018 15:22:51 +0200
+Subject: net/smc: reset recv timeout after clc handshake
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit f6bdc42f021194ec095914b92c7a8b1a09789e6d ]
+
+During clc handshake the receive timeout is set to CLC_WAIT_TIME.
+Remember and reset the original timeout value after the receive calls,
+and remove a duplicate assignment of CLC_WAIT_TIME.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/smc_clc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -250,6 +250,7 @@ out:
+ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ u8 expected_type)
+ {
++ long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo;
+ struct sock *clc_sk = smc->clcsock->sk;
+ struct smc_clc_msg_hdr *clcm = buf;
+ struct msghdr msg = {NULL, 0};
+@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *sm
+ memset(&msg, 0, sizeof(struct msghdr));
+ iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
+ krflags = MSG_WAITALL;
+- smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
+ len = sock_recvmsg(smc->clcsock, &msg, krflags);
+ if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) {
+ smc->sk.sk_err = EPROTO;
+@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *sm
+ }
+
+ out:
++ smc->clcsock->sk->sk_rcvtimeo = rcvtimeo;
+ return reason_code;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Dinh Nguyen <dinguyen@kernel.org>
+Date: Tue, 19 Jun 2018 10:35:38 -0500
+Subject: net: stmmac: socfpga: add additional ocp reset line for Stratix10
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit bc8a2d9bcbf1ca548b1deb315d14e1da81945bea ]
+
+The Stratix10 platform has an additional reset line, OCP(Open Core Protocol),
+that also needs to get deasserted for the stmmac ethernet controller to work.
+Thus we need to update the Kconfig to include ARCH_STRATIX10 in order to build
+dwmac-socfpga.
+
+Also, remove the redundant check for the reset controller pointer. The
+reset driver already checks for the pointer and returns 0 if the pointer
+is NULL.
+
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +-
+ drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 18 ++++++++++++++----
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP
+ config DWMAC_SOCFPGA
+ tristate "SOCFPGA dwmac support"
+ default ARCH_SOCFPGA
+- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
++ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
+ select MFD_SYSCON
+ help
+ Support for ethernet controller on Altera SOCFPGA
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -55,6 +55,7 @@ struct socfpga_dwmac {
+ struct device *dev;
+ struct regmap *sys_mgr_base_addr;
+ struct reset_control *stmmac_rst;
++ struct reset_control *stmmac_ocp_rst;
+ void __iomem *splitter_base;
+ bool f2h_ptp_ref_clk;
+ struct tse_pcs pcs;
+@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(st
+ val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
+
+ /* Assert reset to the enet controller before changing the phy mode */
+- if (dwmac->stmmac_rst)
+- reset_control_assert(dwmac->stmmac_rst);
++ reset_control_assert(dwmac->stmmac_ocp_rst);
++ reset_control_assert(dwmac->stmmac_rst);
+
+ regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
+ ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
+@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(st
+ /* Deassert reset for the phy configuration to be sampled by
+ * the enet controller, and operation to start in requested mode
+ */
+- if (dwmac->stmmac_rst)
+- reset_control_deassert(dwmac->stmmac_rst);
++ reset_control_deassert(dwmac->stmmac_ocp_rst);
++ reset_control_deassert(dwmac->stmmac_rst);
+ if (phymode == PHY_INTERFACE_MODE_SGMII) {
+ if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
+ dev_err(dwmac->dev, "Unable to initialize TSE PCS");
+@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct pl
+ goto err_remove_config_dt;
+ }
+
++ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
++ if (IS_ERR(dwmac->stmmac_ocp_rst)) {
++ ret = PTR_ERR(dwmac->stmmac_ocp_rst);
++ dev_err(dev, "error getting reset control of ocp %d\n", ret);
++ goto err_remove_config_dt;
++ }
++
++ reset_control_deassert(dwmac->stmmac_ocp_rst);
++
+ ret = socfpga_dwmac_parse_data(dwmac, dev);
+ if (ret) {
+ dev_err(dev, "Unable to parse OF data\n");
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: David Lechner <david@lechnology.com>
+Date: Mon, 16 Jul 2018 17:58:10 -0500
+Subject: net: usb: rtl8150: demote allmulti message to dev_dbg()
+
+From: David Lechner <david@lechnology.com>
+
+[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ]
+
+This driver can spam the kernel log with multiple messages of:
+
+ net eth0: eth0: allmulti set
+
+Usually 4 or 8 at a time (probably because of using ConnMan).
+
+This message doesn't seem useful, so let's demote it from dev_info()
+to dev_dbg().
+
+Signed-off-by: David Lechner <david@lechnology.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/rtl8150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct
+ (netdev->flags & IFF_ALLMULTI)) {
+ rx_creg &= 0xfffe;
+ rx_creg |= 0x0002;
+- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ } else {
+ /* ~RX_MULTICAST, ~RX_PROMISCUOUS */
+ rx_creg &= 0x00fc;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 13 Jun 2018 10:11:56 -0700
+Subject: netfilter: ipv6: nf_defrag: reduce struct net memory waste
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ]
+
+It is a waste of memory to use a full "struct netns_sysctl_ipv6"
+while only one pointer is really used, considering netns_sysctl_ipv6
+keeps growing.
+
+Also, since "struct netns_frags" has cache line alignment,
+it is better to move the frags_hdr pointer outside, otherwise
+we spend a full cache line for this pointer.
+
+This saves 192 bytes of memory per netns.
+
+Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/net_namespace.h | 1 +
+ include/net/netns/ipv6.h | 1 -
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++---
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -128,6 +128,7 @@ struct net {
+ #endif
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag nf_frag;
++ struct ctl_table_header *nf_frag_frags_hdr;
+ #endif
+ struct sock *nfnl;
+ struct sock *nfnl_stash;
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -107,7 +107,6 @@ struct netns_ipv6 {
+
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag {
+- struct netns_sysctl_ipv6 sysctl;
+ struct netns_frags frags;
+ };
+ #endif
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(s
+ if (hdr == NULL)
+ goto err_reg;
+
+- net->nf_frag.sysctl.frags_hdr = hdr;
++ net->nf_frag_frags_hdr = hdr;
+ return 0;
+
+ err_reg:
+@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysc
+ {
+ struct ctl_table *table;
+
+- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
+- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
++ table = net->nf_frag_frags_hdr->ctl_table_arg;
++ unregister_net_sysctl_table(net->nf_frag_frags_hdr);
+ if (!net_eq(net, &init_net))
+ kfree(table);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Date: Fri, 6 Jul 2018 16:38:53 +0300
+Subject: netfilter: nf_conntrack: Fix possible possible crash on module loading.
+
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+
+[ Upstream commit 2045cdfa1b40d66f126f3fd05604fc7c754f0022 ]
+
+Loading the nf_conntrack module with doubled hashsize parameter, i.e.
+ modprobe nf_conntrack hashsize=12345 hashsize=12345
+causes NULL-ptr deref.
+
+If 'hashsize' specified twice, the nf_conntrack_set_hashsize() function
+will be called also twice.
+The first nf_conntrack_set_hashsize() call will set the
+'nf_conntrack_htable_size' variable:
+
+ nf_conntrack_set_hashsize()
+ ...
+ /* On boot, we can set this without any fancy locking. */
+ if (!nf_conntrack_htable_size)
+ return param_set_uint(val, kp);
+
+But on the second invocation, the nf_conntrack_htable_size is already set,
+so the nf_conntrack_set_hashsize() will take a different path and call
+the nf_conntrack_hash_resize() function. Which will crash on the attempt
+to dereference 'nf_conntrack_hash' pointer:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
+ RIP: 0010:nf_conntrack_hash_resize+0x255/0x490 [nf_conntrack]
+ Call Trace:
+ nf_conntrack_set_hashsize+0xcd/0x100 [nf_conntrack]
+ parse_args+0x1f9/0x5a0
+ load_module+0x1281/0x1a50
+ __se_sys_finit_module+0xbe/0xf0
+ do_syscall_64+0x7c/0x390
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fix this, by checking !nf_conntrack_hash instead of
+!nf_conntrack_htable_size. nf_conntrack_hash will be initialized only
+after the module loaded, so the second invocation of the
+nf_conntrack_set_hashsize() won't crash, it will just reinitialize
+nf_conntrack_htable_size again.
+
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1972,7 +1972,7 @@ int nf_conntrack_set_hashsize(const char
+ return -EOPNOTSUPP;
+
+ /* On boot, we can set this without any fancy locking. */
+- if (!nf_conntrack_htable_size)
++ if (!nf_conntrack_hash)
+ return param_set_uint(val, kp);
+
+ rc = kstrtouint(val, 0, &hashsize);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Gao Feng <gfree.wind@vip.163.com>
+Date: Wed, 13 Jun 2018 12:26:13 +0800
+Subject: netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister
+
+From: Gao Feng <gfree.wind@vip.163.com>
+
+[ Upstream commit ad9852af97587b8abe8102f9ddcb05c9769656f6 ]
+
+The helper module would be unloaded after nf_conntrack_helper_unregister,
+so it may cause a possible panic caused by race.
+
+nf_ct_iterate_destroy(unhelp, me) reset the helper of conntrack as NULL,
+but maybe someone has gotten the helper pointer during this period. Then
+it would panic, when it accesses the helper and the module was unloaded.
+
+Take an example as following:
+CPU0 CPU1
+ctnetlink_dump_helpinfo
+helper = rcu_dereference(help->helper);
+ unhelp
+ set helper as NULL
+ unload helper module
+helper->to_nlattr(skb, ct);
+
+As above, the cpu0 tries to access the helper and its module is unloaded,
+then the panic happens.
+
+Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_helper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(stru
+
+ nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
+ nf_ct_iterate_destroy(unhelp, me);
++
++ /* Maybe someone has gotten the helper already when unhelp above.
++ * So need to wait it.
++ */
++ synchronize_rcu();
+ }
+ EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jann Horn <jannh@google.com>
+Date: Wed, 20 Jun 2018 18:33:45 +0200
+Subject: netfilter: nf_log: fix uninit read in nf_log_proc_dostring
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit dffd22aed2aa1e804bccf19b30a421e89ee2ae61 ]
+
+When proc_dostring() is called with a non-zero offset in strict mode, it
+doesn't just write to the ->data buffer, it also reads. Make sure it
+doesn't read uninitialized data.
+
+Fixes: c6ac37d8d884 ("netfilter: nf_log: fix error on write NONE to [...]")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_log.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -439,6 +439,10 @@ static int nf_log_proc_dostring(struct c
+ if (write) {
+ struct ctl_table tmp = *table;
+
++ /* proc_dostring() can append to existing strings, so we need to
++ * initialize it as an empty string.
++ */
++ buf[0] = '\0';
+ tmp.data = buf;
+ r = proc_dostring(&tmp, write, buffer, lenp, ppos);
+ if (r)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 6 Jul 2018 20:06:05 +0200
+Subject: netfilter: nft_compat: explicitly reject ERROR and standard target
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 21d5e078192d244df3d6049f9464fff2f72cfd68 ]
+
+iptables-nft never requests these, but make this explicitly illegal.
+If it were quested, kernel could oops as ->eval is NULL, furthermore,
+the builtin targets have no owning module so its possible to rmmod
+eb/ip/ip6_tables module even if they would be loaded.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_compat.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -825,10 +825,18 @@ nft_target_select_ops(const struct nft_c
+ rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
+ family = ctx->family;
+
++ if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
++ strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
++ strcmp(tg_name, "standard") == 0)
++ return ERR_PTR(-EINVAL);
++
+ /* Re-use the existing target if it's already loaded. */
+ list_for_each_entry(nft_target, &nft_target_list, head) {
+ struct xt_target *target = nft_target->ops.data;
+
++ if (!target->target)
++ continue;
++
+ if (nft_target_cmp(target, tg_name, rev, family))
+ return &nft_target->ops;
+ }
+@@ -837,6 +845,11 @@ nft_target_select_ops(const struct nft_c
+ if (IS_ERR(target))
+ return ERR_PTR(-ENOENT);
+
++ if (!target->target) {
++ err = -EINVAL;
++ goto err;
++ }
++
+ if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
+ err = -EINVAL;
+ goto err;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 4 Jul 2018 20:25:32 +0200
+Subject: netfilter: x_tables: set module owner for icmp(6) matches
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ]
+
+nft_compat relies on xt_request_find_match to increment
+refcount of the module that provides the match/target.
+
+The (builtin) icmp matches did't set the module owner so it
+was possible to rmmod ip(6)tables while icmp extensions were still in use.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/netfilter/ip_tables.c | 1 +
+ net/ipv6/netfilter/ip6_tables.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1895,6 +1895,7 @@ static struct xt_match ipt_builtin_mt[]
+ .checkentry = icmp_checkentry,
+ .proto = IPPROTO_ICMP,
+ .family = NFPROTO_IPV4,
++ .me = THIS_MODULE,
+ },
+ };
+
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1907,6 +1907,7 @@ static struct xt_match ip6t_builtin_mt[]
+ .checkentry = icmp6_checkentry,
+ .proto = IPPROTO_ICMPV6,
+ .family = NFPROTO_IPV6,
++ .me = THIS_MODULE,
+ },
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 7 Jun 2018 15:54:48 +0200
+Subject: NFC: pn533: Fix wrong GFP flag usage
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit ecc443c03fb14abfb8a6af5e3b2d43b5257e60f2 ]
+
+pn533_recv_response() is an urb completion handler, so it must use
+GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping
+context, so the pn533_submit_urb_for_response() there (and only there)
+can use the regular GFP_KERNEL flags.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134
+Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...")
+Cc: Michael Thalmeier <michael.thalmeier@hale.at>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/pn533/usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -74,7 +74,7 @@ static void pn533_recv_response(struct u
+ struct sk_buff *skb = NULL;
+
+ if (!urb->status) {
+- skb = alloc_skb(urb->actual_length, GFP_KERNEL);
++ skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
+ if (!skb) {
+ nfc_err(&phy->udev->dev, "failed to alloc memory\n");
+ } else {
+@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct p
+
+ if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
+ /* request for response for sent packet directly */
+- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
++ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
+ if (rc)
+ goto error;
+ } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Wed, 11 Jul 2018 10:10:11 -0700
+Subject: nfit: fix unchecked dereference in acpi_nfit_ctl
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit ee6581ceba7f8314b81b2f2a81f1cf3f67c679e2 ]
+
+Incremental patch to fix the unchecked dereference in acpi_nfit_ctl.
+Reported by Dan Carpenter:
+
+"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to
+always return a value" from Jun 28, 2018, leads to the following
+Smatch complaint:
+
+ drivers/acpi/nfit/core.c:578 acpi_nfit_ctl()
+ warn: variable dereferenced before check 'cmd_rc' (see line 411)
+
+drivers/acpi/nfit/core.c
+ 410
+ 411 *cmd_rc = -EINVAL;
+ ^^^^^^^^^^^^^^^^^^
+Patch adds unchecked dereference.
+
+Fixes: c1985cefd844 ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value")
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -408,7 +408,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ const guid_t *guid;
+ int rc, i;
+
+- *cmd_rc = -EINVAL;
++ if (cmd_rc)
++ *cmd_rc = -EINVAL;
+ func = cmd;
+ if (cmd == ND_CMD_CALL) {
+ call_pkg = buf;
+@@ -519,7 +520,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ * If we return an error (like elsewhere) then caller wouldn't
+ * be able to rely upon data returned to make calculation.
+ */
+- *cmd_rc = 0;
++ if (cmd_rc)
++ *cmd_rc = 0;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Fri, 22 Jun 2018 11:56:56 -0700
+Subject: nfp: bpf: don't stop offload if replace failed
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 68d676a089625daed9d61df56ac63b5cd7189efe ]
+
+Stopping offload completely if replace of program failed dates
+back to days of transparent offload. Back then we wanted to
+silently fall back to the in-driver processing. Today we mark
+programs for offload when they are loaded into the kernel, so
+the transparent offload is no longer a reality.
+
+Flags check in the driver will only allow replace of a driver
+program with another driver program or an offload program with
+another offload program.
+
+When driver program is replaced stopping offload is a no-op,
+because driver program isn't offloaded. When replacing
+offloaded program if the offload fails the entire operation
+will fail all the way back to user space and we should continue
+using the old program. IOW when replacing a driver program
+stopping offload is unnecessary and when replacing offloaded
+program - it's a bug, old program should continue to run.
+
+In practice this bug would mean that if offload operation was to
+fail (either due to FW communication error, kernel OOM or new
+program being offloaded but for a different netdev) driver
+would continue reporting that previous XDP program is offloaded
+but in fact no program will be loaded in hardware. The failure
+is fairly unlikely (found by inspection, when working on the code)
+but it's unpleasant.
+
+Backport note: even though the bug was introduced in commit
+cafa92ac2553 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE"),
+this fix depends on commit 441a33031fe5 ("net: xdp: don't allow
+device-bound programs in driver mode"), so this fix is sufficient
+only in v4.15 or newer. Kernels v4.13.x and v4.14.x do need to
+stop offload if it was transparent/opportunistic, i.e. if
+XDP_FLAGS_HW_MODE was not set on running program.
+
+Fixes: cafa92ac2553 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/bpf/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
+@@ -73,10 +73,10 @@ nfp_bpf_xdp_offload(struct nfp_app *app,
+
+ ret = nfp_net_bpf_offload(nn, prog, running, extack);
+ /* Stop offload if replace not possible */
+- if (ret && prog)
+- nfp_bpf_xdp_offload(app, nn, NULL, extack);
++ if (ret)
++ return ret;
+
+- nn->dp.bpf_offload_xdp = prog && !ret;
++ nn->dp.bpf_offload_xdp = !!prog;
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Chengguang Xu <cgxu519@gmx.com>
+Date: Tue, 26 Jun 2018 09:16:31 +0800
+Subject: nfp: cast sizeof() to int when comparing with error code
+
+From: Chengguang Xu <cgxu519@gmx.com>
+
+[ Upstream commit 2d2595719a97c876f35b1e60e5768e58753b268c ]
+
+sizeof() will return unsigned value so in the error check
+negative error code will be always larger than sizeof().
+
+Fixes: a0d8e02c35ff ("nfp: add support for reading nffw info")
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
+@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open
+ err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res),
+ nfp_resource_address(state->res),
+ fwinf, sizeof(*fwinf));
+- if (err < sizeof(*fwinf))
++ if (err < (int)sizeof(*fwinf))
+ goto err_release;
+
+ if (!nffw_res_flg_init_get(fwinf))
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 29 Jun 2018 09:33:39 +0200
+Subject: nl80211: check nla_parse_nested() return values
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 95bca62fb723a121954fc7ae5473bb2c1f0d5986 ]
+
+At the very least we should check the return value if
+nla_parse_nested() is called with a non-NULL policy.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -10703,9 +10703,12 @@ static int nl80211_set_wowlan(struct sk_
+ rem) {
+ u8 *mask_pat;
+
+- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+- nl80211_packet_pattern_policy,
+- info->extack);
++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
++ nl80211_packet_pattern_policy,
++ info->extack);
++ if (err)
++ goto error;
++
+ err = -EINVAL;
+ if (!pat_tb[NL80211_PKTPAT_MASK] ||
+ !pat_tb[NL80211_PKTPAT_PATTERN])
+@@ -10954,8 +10957,11 @@ static int nl80211_parse_coalesce_rule(s
+ rem) {
+ u8 *mask_pat;
+
+- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+- nl80211_packet_pattern_policy, NULL);
++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
++ nl80211_packet_pattern_policy, NULL);
++ if (err)
++ return err;
++
+ if (!pat_tb[NL80211_PKTPAT_MASK] ||
+ !pat_tb[NL80211_PKTPAT_PATTERN])
+ return -EINVAL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Bob Copeland <me@bobcopeland.com>
+Date: Sun, 24 Jun 2018 21:10:49 -0400
+Subject: nl80211: relax ht operation checks for mesh
+
+From: Bob Copeland <me@bobcopeland.com>
+
+[ Upstream commit 188f60ab8e787fcbb5ac9d64ede23a0070231f09 ]
+
+Commit 9757235f451c, "nl80211: correct checks for
+NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT
+operation field in meshconf, while also adding checks requiring
+the non-greenfield and non-ht-sta bits to be set in certain
+circumstances. The latter bit is actually reserved for mesh BSSes
+according to Table 9-168 in 802.11-2016, so in fact it should not
+be set.
+
+wpa_supplicant sets these bits because the mesh and AP code share
+the same implementation, but authsae does not. As a result, some
+meshconf updates from authsae which set only the NONHT_MIXED
+protection bits were being rejected.
+
+In order to avoid breaking userspace by changing the rules again,
+simply accept the values with or without the bits set, and mask
+off the reserved bit to match the spec.
+
+While in here, update the 802.11-2012 reference to 802.11-2016.
+
+Fixes: 9757235f451c ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value")
+Cc: Masashi Honma <masashi.honma@gmail.com>
+Signed-off-by: Bob Copeland <bobcopeland@fb.com>
+Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
+Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 19 +++----------------
+ 1 file changed, 3 insertions(+), 16 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6061,7 +6061,7 @@ do { \
+ nl80211_check_s32);
+ /*
+ * Check HT operation mode based on
+- * IEEE 802.11 2012 8.4.2.59 HT Operation element.
++ * IEEE 802.11-2016 9.4.2.57 HT Operation element.
+ */
+ if (tb[NL80211_MESHCONF_HT_OPMODE]) {
+ ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
+@@ -6071,22 +6071,9 @@ do { \
+ IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+ return -EINVAL;
+
+- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+- return -EINVAL;
++ /* NON_HT_STA bit is reserved, but some programs set it */
++ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
+
+- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
+- case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
+- return -EINVAL;
+- break;
+- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+- return -EINVAL;
+- break;
+- }
+ cfg->ht_opmode = ht_opmode;
+ mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Scott Bauer <scott.bauer@intel.com>
+Date: Fri, 29 Jun 2018 13:03:28 -0600
+Subject: nvme: ensure forward progress during Admin passthru
+
+From: Scott Bauer <scott.bauer@intel.com>
+
+[ Upstream commit cf39a6bc342b980f10f344d88035829638a89a48 ]
+
+If the controller supports effects and goes down during the passthru admin
+command we will deadlock during namespace revalidation.
+
+[ 363.488275] INFO: task kworker/u16:5:231 blocked for more than 120 seconds.
+[ 363.488290] Not tainted 4.17.0+ #2
+[ 363.488296] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 363.488303] kworker/u16:5 D 0 231 2 0x80000000
+[ 363.488331] Workqueue: nvme-reset-wq nvme_reset_work [nvme]
+[ 363.488338] Call Trace:
+[ 363.488385] schedule+0x75/0x190
+[ 363.488396] rwsem_down_read_failed+0x1c3/0x2f0
+[ 363.488481] call_rwsem_down_read_failed+0x14/0x30
+[ 363.488504] down_read+0x1d/0x80
+[ 363.488523] nvme_stop_queues+0x1e/0xa0 [nvme_core]
+[ 363.488536] nvme_dev_disable+0xae4/0x1620 [nvme]
+[ 363.488614] nvme_reset_work+0xd1e/0x49d9 [nvme]
+[ 363.488911] process_one_work+0x81a/0x1400
+[ 363.488934] worker_thread+0x87/0xe80
+[ 363.488955] kthread+0x2db/0x390
+[ 363.488977] ret_from_fork+0x35/0x40
+
+Fixes: 84fef62d135b6 ("nvme: check admin passthru command effects")
+Signed-off-by: Scott Bauer <scott.bauer@intel.com>
+Reviewed-by: Keith Busch <keith.busch@linux.intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/core.c | 50 ++++++++++++++++++++++++-----------------------
+ 1 file changed, 26 insertions(+), 24 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class;
+ static void nvme_ns_remove(struct nvme_ns *ns);
+ static int nvme_revalidate_disk(struct gendisk *disk);
+ static void nvme_put_subsystem(struct nvme_subsystem *subsys);
++static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
++ unsigned nsid);
++
++static void nvme_set_queue_dying(struct nvme_ns *ns)
++{
++ /*
++ * Revalidating a dead namespace sets capacity to 0. This will end
++ * buffered writers dirtying pages that can't be synced.
++ */
++ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
++ return;
++ revalidate_disk(ns->disk);
++ blk_set_queue_dying(ns->queue);
++ /* Forcibly unquiesce queues to avoid blocking dispatch */
++ blk_mq_unquiesce_queue(ns->queue);
++}
+
+ int nvme_reset_ctrl(struct nvme_ctrl *ctrl)
+ {
+@@ -1130,19 +1146,15 @@ static u32 nvme_passthru_start(struct nv
+
+ static void nvme_update_formats(struct nvme_ctrl *ctrl)
+ {
+- struct nvme_ns *ns, *next;
+- LIST_HEAD(rm_list);
++ struct nvme_ns *ns;
+
+- down_write(&ctrl->namespaces_rwsem);
+- list_for_each_entry(ns, &ctrl->namespaces, list) {
+- if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+- list_move_tail(&ns->list, &rm_list);
+- }
+- }
+- up_write(&ctrl->namespaces_rwsem);
++ down_read(&ctrl->namespaces_rwsem);
++ list_for_each_entry(ns, &ctrl->namespaces, list)
++ if (ns->disk && nvme_revalidate_disk(ns->disk))
++ nvme_set_queue_dying(ns);
++ up_read(&ctrl->namespaces_rwsem);
+
+- list_for_each_entry_safe(ns, next, &rm_list, list)
+- nvme_ns_remove(ns);
++ nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL);
+ }
+
+ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+@@ -3110,7 +3122,7 @@ static void nvme_remove_invalid_namespac
+
+ down_write(&ctrl->namespaces_rwsem);
+ list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
+- if (ns->head->ns_id > nsid)
++ if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags))
+ list_move_tail(&ns->list, &rm_list);
+ }
+ up_write(&ctrl->namespaces_rwsem);
+@@ -3488,19 +3500,9 @@ void nvme_kill_queues(struct nvme_ctrl *
+ if (ctrl->admin_q)
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+
+- list_for_each_entry(ns, &ctrl->namespaces, list) {
+- /*
+- * Revalidating a dead namespace sets capacity to 0. This will
+- * end buffered writers dirtying pages that can't be synced.
+- */
+- if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+- continue;
+- revalidate_disk(ns->disk);
+- blk_set_queue_dying(ns->queue);
++ list_for_each_entry(ns, &ctrl->namespaces, list)
++ nvme_set_queue_dying(ns);
+
+- /* Forcibly unquiesce queues to avoid blocking dispatch */
+- blk_mq_unquiesce_queue(ns->queue);
+- }
+ up_read(&ctrl->namespaces_rwsem);
+ }
+ EXPORT_SYMBOL_GPL(nvme_kill_queues);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Roland Dreier <roland@purestorage.com>
+Date: Thu, 19 Jul 2018 20:07:59 -0700
+Subject: nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD
+
+From: Roland Dreier <roland@purestorage.com>
+
+[ Upstream commit 9b382768135ee3ff282f828c906574a8478e036b ]
+
+The old code in nvme_user_cmd() passed the userspace virtual address
+from nvme_passthru_cmd.metadata as the length of the metadata buffer
+as well as the address to nvme_submit_user_cmd().
+
+Fixes: 63263d60 ("nvme: Use metadata for passthrough commands")
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1209,7 +1209,7 @@ static int nvme_user_cmd(struct nvme_ctr
+ effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
+ status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
+ (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
+- (void __user *)(uintptr_t)cmd.metadata, cmd.metadata,
++ (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len,
+ 0, &cmd.result, timeout);
+ nvme_passthru_end(ctrl, effects);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+Date: Wed, 20 Jun 2018 13:42:22 +0800
+Subject: nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl
+
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+
+[ Upstream commit 9f9cafc14016f23f982d3ce18f9057923bd3037a ]
+
+There is race between nvme_remove and nvme_reset_work that can
+lead to io hang.
+
+nvme_remove nvme_reset_work
+ -> nvme_remove_dead_ctrl
+ -> nvme_dev_disable
+ -> quiesce request_queue
+ -> queue remove_work
+-> cancel_work_sync reset_work
+-> nvme_remove_namespaces
+ -> splice ctrl->namespaces
+ nvme_remove_dead_ctrl_work
+ -> nvme_kill_queues
+ -> nvme_ns_remove do nothing
+ -> blk_cleanup_queue
+ -> blk_freeze_queue
+
+Finally, the request_queue is quiesced state when wait freeze,
+we will get io hang here. To fix it, move the nvme_kill_queues
+from nvme_remove_dead_ctrl_work to nvme_remove_dead_ctrl.
+
+Suggested-by: Keith Busch <keith.busch@linux.intel.com>
+Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2291,6 +2291,7 @@ static void nvme_remove_dead_ctrl(struct
+
+ nvme_get_ctrl(&dev->ctrl);
+ nvme_dev_disable(dev, false);
++ nvme_kill_queues(&dev->ctrl);
+ if (!queue_work(nvme_wq, &dev->remove_work))
+ nvme_put_ctrl(&dev->ctrl);
+ }
+@@ -2407,7 +2408,6 @@ static void nvme_remove_dead_ctrl_work(s
+ struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
+ struct pci_dev *pdev = to_pci_dev(dev->dev);
+
+- nvme_kill_queues(&dev->ctrl);
+ if (pci_get_drvdata(pdev))
+ device_release_driver(&pdev->dev);
+ nvme_put_ctrl(&dev->ctrl);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Israel Rukshin <israelr@mellanox.com>
+Date: Tue, 19 Jun 2018 15:34:11 +0300
+Subject: nvme-rdma: Fix command completion race at error recovery
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit c947657b15379505a9bba36a02005882b66abe57 ]
+
+The race is between completing the request at error recovery work and
+rdma completions. If we cancel the request before getting the good
+rdma completion we get a NULL deref of the request MR at
+nvme_rdma_process_nvme_rsp().
+
+When Canceling the request we return its mr to the mr pool (set mr to
+NULL) and also unmap its data. Canceling the requests while the rdma
+queues are active is not safe. Because rdma queues are active and we
+get good rdma completions that can use the mr pointer which may be NULL.
+Completing the request too soon may lead also to performing DMA to/from
+user buffers which might have been already unmapped.
+
+The commit fixes the race by draining the QP before starting the abort
+commands mechanism.
+
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -734,7 +734,6 @@ out:
+ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
+- nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (remove) {
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+@@ -819,7 +818,6 @@ out_free_queue:
+ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
+- nvme_rdma_stop_io_queues(ctrl);
+ if (remove) {
+ blk_cleanup_queue(ctrl->ctrl.connect_q);
+ nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset);
+@@ -949,6 +947,7 @@ static void nvme_rdma_reconnect_ctrl_wor
+ return;
+
+ destroy_admin:
++ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ nvme_rdma_destroy_admin_queue(ctrl, false);
+ requeue:
+ dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
+@@ -965,12 +964,14 @@ static void nvme_rdma_error_recovery_wor
+
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
+ blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ nvme_cancel_request, &ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, false);
+ }
+
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+ nvme_cancel_request, &ctrl->ctrl);
+ nvme_rdma_destroy_admin_queue(ctrl, false);
+@@ -1720,6 +1721,7 @@ static void nvme_rdma_shutdown_ctrl(stru
+ {
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
+ blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ nvme_cancel_request, &ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, shutdown);
+@@ -1731,6 +1733,7 @@ static void nvme_rdma_shutdown_ctrl(stru
+ nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
+
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+ nvme_cancel_request, &ctrl->ctrl);
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+@@ -1996,6 +1999,7 @@ static struct nvme_ctrl *nvme_rdma_creat
+ return &ctrl->ctrl;
+
+ out_remove_admin_queue:
++ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ nvme_rdma_destroy_admin_queue(ctrl, true);
+ out_uninit_ctrl:
+ nvme_uninit_ctrl(&ctrl->ctrl);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Tue, 19 Jun 2018 15:34:09 +0300
+Subject: nvme-rdma: fix possible double free condition when failing to create a controller
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 3d0641015bf73aaa1cb54c936674959e7805070f ]
+
+Failures after nvme_init_ctrl will defer resource cleanups to .free_ctrl
+when the reference is released, hence we should not free the controller
+queues for these failures.
+
+Fix that by moving controller queues allocation before controller
+initialization and correctly freeing them for failures before
+initialization and skip them for failures after initialization.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -888,9 +888,9 @@ static void nvme_rdma_free_ctrl(struct n
+ list_del(&ctrl->list);
+ mutex_unlock(&nvme_rdma_ctrl_mutex);
+
+- kfree(ctrl->queues);
+ nvmf_free_options(nctrl->opts);
+ free_ctrl:
++ kfree(ctrl->queues);
+ kfree(ctrl);
+ }
+
+@@ -1916,11 +1916,6 @@ static struct nvme_ctrl *nvme_rdma_creat
+ goto out_free_ctrl;
+ }
+
+- ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
+- 0 /* no quirks, we're perfect! */);
+- if (ret)
+- goto out_free_ctrl;
+-
+ INIT_DELAYED_WORK(&ctrl->reconnect_work,
+ nvme_rdma_reconnect_ctrl_work);
+ INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work);
+@@ -1934,14 +1929,19 @@ static struct nvme_ctrl *nvme_rdma_creat
+ ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues),
+ GFP_KERNEL);
+ if (!ctrl->queues)
+- goto out_uninit_ctrl;
++ goto out_free_ctrl;
++
++ ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
++ 0 /* no quirks, we're perfect! */);
++ if (ret)
++ goto out_kfree_queues;
+
+ changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+ WARN_ON_ONCE(!changed);
+
+ ret = nvme_rdma_configure_admin_queue(ctrl, true);
+ if (ret)
+- goto out_kfree_queues;
++ goto out_uninit_ctrl;
+
+ /* sanity check icdoff */
+ if (ctrl->ctrl.icdoff) {
+@@ -1997,14 +1997,14 @@ static struct nvme_ctrl *nvme_rdma_creat
+
+ out_remove_admin_queue:
+ nvme_rdma_destroy_admin_queue(ctrl, true);
+-out_kfree_queues:
+- kfree(ctrl->queues);
+ out_uninit_ctrl:
+ nvme_uninit_ctrl(&ctrl->ctrl);
+ nvme_put_ctrl(&ctrl->ctrl);
+ if (ret > 0)
+ ret = -EIO;
+ return ERR_PTR(ret);
++out_kfree_queues:
++ kfree(ctrl->queues);
+ out_free_ctrl:
+ kfree(ctrl);
+ return ERR_PTR(ret);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Mon, 18 Jun 2018 18:30:43 +0100
+Subject: nvmem: Don't let a NULL cell_id for nvmem_cell_get() crash us
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 87ed1405ef09d29a14df43295f7b6a93b63bfe6e ]
+
+In commit ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on
+Qcom chips") you can see a call like:
+
+ devm_nvmem_cell_get(dev, NULL);
+
+Note that the cell ID passed to the function is NULL. This is because
+the qcom-qusb2 driver is expected to work only on systems where the
+PHY node is hooked up via device-tree and is nameless.
+
+This works OK for the most part. The first thing nvmem_cell_get()
+does is to call of_nvmem_cell_get() and there it's documented that a
+NULL name is fine. The problem happens when the call to
+of_nvmem_cell_get() returns -EINVAL. In such a case we'll fall back
+to nvmem_cell_get_from_list() and eventually might (if nvmem_cells
+isn't an empty list) crash with something that looks like:
+
+ strcmp
+ nvmem_find_cell
+ __nvmem_device_get
+ nvmem_cell_get_from_list
+ nvmem_cell_get
+ devm_nvmem_cell_get
+ qusb2_phy_probe
+
+There are several different ways we could fix this problem:
+
+One could argue that perhaps the qcom-qusb2 driver should be changed
+to use of_nvmem_cell_get() which is allowed to have a NULL name. In
+that case, we'd need to add a patche to introduce
+devm_of_nvmem_cell_get() since the qcom-qusb2 driver is using devm
+managed resources.
+
+One could also argue that perhaps we could just add a name to
+qcom-qusb2. That would be OK but I believe it effectively changes the
+device tree bindings, so maybe it's a no-go.
+
+In this patch I have chosen to fix the problem by simply not crashing
+when a NULL cell_id is passed to nvmem_cell_get().
+
+NOTE: that for the qcom-qusb2 driver the "nvmem-cells" property is
+defined to be optional and thus it's expected to be a common case that
+we would hit this crash and this is more than just a theoretical fix.
+
+Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -924,6 +924,10 @@ struct nvmem_cell *nvmem_cell_get(struct
+ return cell;
+ }
+
++ /* NULL cell_id only allowed for device tree; invalid otherwise */
++ if (!cell_id)
++ return ERR_PTR(-EINVAL);
++
+ return nvmem_cell_get_from_list(cell_id);
+ }
+ EXPORT_SYMBOL_GPL(nvmem_cell_get);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Max Gurtuvoy <maxg@mellanox.com>
+Date: Tue, 19 Jun 2018 15:45:33 +0300
+Subject: nvmet: reset keep alive timer in controller enable
+
+From: Max Gurtuvoy <maxg@mellanox.com>
+
+[ Upstream commit d68a90e148f5a82aa67654c5012071e31c0e4baa ]
+
+Controllers that are not yet enabled should not really enforce keep alive
+timeouts, but we still want to track a timeout and cleanup in case a host
+died before it enabled the controller. Hence, simply reset the keep
+alive timer when the controller is enabled.
+
+Suggested-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -624,6 +624,14 @@ static void nvmet_start_ctrl(struct nvme
+ }
+
+ ctrl->csts = NVME_CSTS_RDY;
++
++ /*
++ * Controllers that are not yet enabled should not really enforce the
++ * keep alive timeout, but we still want to track a timeout and cleanup
++ * in case a host died before it enabled the controller. Hence, simply
++ * reset the keep alive timer when the controller is enabled.
++ */
++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+ }
+
+ static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Wed, 27 Jun 2018 17:03:45 -0500
+Subject: objtool: Support GCC 8 '-fnoreorder-functions'
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 08b393d01c88aff27347ed2b1b354eb4db2f1532 ]
+
+Since the following commit:
+
+ cd77849a69cf ("objtool: Fix GCC 8 cold subfunction detection for aliased functions")
+
+... if the kernel is built with EXTRA_CFLAGS='-fno-reorder-functions',
+objtool can get stuck in an infinite loop.
+
+That flag causes the new GCC 8 cold subfunctions to be placed in .text
+instead of .text.unlikely. But it also has an unfortunate quirk: in the
+symbol table, the subfunction (e.g., nmi_panic.cold.7) is nested inside
+the parent (nmi_panic).
+
+That function overlap confuses objtool, and causes it to get into an
+infinite loop in next_insn_same_func(). Here's Allan's description of
+the loop:
+
+ "Objtool iterates through the instructions in nmi_panic using
+ next_insn_same_func. Once it reaches the end of nmi_panic at 0x534 it
+ jumps to 0x528 as that's the start of nmi_panic.cold.7. However, since
+ the instructions starting at 0x528 are still associated with nmi_panic
+ objtool will get stuck in a loop, continually jumping back to 0x528
+ after reaching 0x534."
+
+Fix it by shortening the length of the parent function so that the
+functions no longer overlap.
+
+Reported-and-analyzed-by: Allan Xavier <allan.x.xavier@oracle.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Allan Xavier <allan.x.xavier@oracle.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/9e704c52bee651129b036be14feda317ae5606ae.1530136978.git.jpoimboe@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/objtool/elf.c | 37 ++++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf)
+ continue;
+ sym->pfunc = sym->cfunc = sym;
+ coldstr = strstr(sym->name, ".cold.");
+- if (coldstr) {
+- coldstr[0] = '\0';
+- pfunc = find_symbol_by_name(elf, sym->name);
+- coldstr[0] = '.';
++ if (!coldstr)
++ continue;
++
++ coldstr[0] = '\0';
++ pfunc = find_symbol_by_name(elf, sym->name);
++ coldstr[0] = '.';
++
++ if (!pfunc) {
++ WARN("%s(): can't find parent function",
++ sym->name);
++ goto err;
++ }
+
+- if (!pfunc) {
+- WARN("%s(): can't find parent function",
+- sym->name);
+- goto err;
+- }
++ sym->pfunc = pfunc;
++ pfunc->cfunc = sym;
+
+- sym->pfunc = pfunc;
+- pfunc->cfunc = sym;
++ /*
++ * Unfortunately, -fnoreorder-functions puts the child
++ * inside the parent. Remove the overlap so we can
++ * have sane assumptions.
++ *
++ * Note that pfunc->len now no longer matches
++ * pfunc->sym.st_size.
++ */
++ if (sym->sec == pfunc->sec &&
++ sym->offset >= pfunc->offset &&
++ sym->offset + sym->len == pfunc->offset + pfunc->len) {
++ pfunc->len -= sym->len;
+ }
+ }
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+Date: Fri, 13 Jul 2018 17:31:50 +0200
+Subject: octeon_mgmt: Fix MIX registers configuration on MTU setup
+
+From: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+
+[ Upstream commit 4aac0b43474d18f6160302a3caa147d77fa3baa1 ]
+
+octeon_mgmt driver doesn't drop RX frames that are 1-4 bytes bigger than
+MTU set for the corresponding interface. The problem is in the
+AGL_GMX_RX0/1_FRM_MAX register setting, which should not account for VLAN
+tagging.
+
+According to Octeon HW manual:
+"For tagged frames, MAX increases by four bytes for each VLAN found up to a
+maximum of two VLANs, or MAX + 8 bytes."
+
+OCTEON_FRAME_HEADER_LEN "define" is fine for ring buffer management, but
+should not be used for AGL_GMX_RX0/1_FRM_MAX.
+
+The problem could be easily reproduced using "ping" command. If affected
+system has default MTU 1500, other host (having MTU >= 1504) can
+successfully "ping" the affected system with payload size 1473-1476,
+resulting in IP packets of size 1501-1504 accepted by the mgmt driver.
+Fixed system still accepts IP packets of 1500 bytes even with VLAN tagging,
+because the limits are lifted in HW as expected, for every VLAN tag.
+
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(s
+ static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ struct octeon_mgmt *p = netdev_priv(netdev);
+- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
++ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+
+ netdev->mtu = new_mtu;
+
+- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
++ /* HW lifts the limit if the frame is VLAN tagged
++ * (+4 bytes per each tag, up to two tags)
++ */
++ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
++ /* Set the hardware to truncate packets larger than the MTU. The jabber
++ * register must be set to a multiple of 8 bytes, so round up. JABBER is
++ * an unconditional limit, so we need to account for two possible VLAN
++ * tags.
++ */
+ cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
+- (size_without_fcs + 7) & 0xfff8);
++ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Frank Rowand <frank.rowand@sony.com>
+Date: Thu, 12 Jul 2018 14:00:07 -0700
+Subject: of: overlay: update phandle cache on overlay apply and remove
+
+From: Frank Rowand <frank.rowand@sony.com>
+
+[ Upstream commit b9952b5218added5577e4a3443969bc20884cea9 ]
+
+A comment in the review of the patch adding the phandle cache said that
+the cache would have to be updated when modules are applied and removed.
+This patch implements the cache updates.
+
+Fixes: 0b3ce78e90fc ("of: cache phandle nodes to reduce cost of of_find_node_by_phandle()")
+Reported-by: Alan Tull <atull@kernel.org>
+Suggested-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/base.c | 6 +++---
+ drivers/of/of_private.h | 2 ++
+ drivers/of/overlay.c | 11 +++++++++++
+ 3 files changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -102,7 +102,7 @@ static u32 phandle_cache_mask;
+ * - the phandle lookup overhead reduction provided by the cache
+ * will likely be less
+ */
+-static void of_populate_phandle_cache(void)
++void of_populate_phandle_cache(void)
+ {
+ unsigned long flags;
+ u32 cache_entries;
+@@ -134,8 +134,7 @@ out:
+ raw_spin_unlock_irqrestore(&devtree_lock, flags);
+ }
+
+-#ifndef CONFIG_MODULES
+-static int __init of_free_phandle_cache(void)
++int of_free_phandle_cache(void)
+ {
+ unsigned long flags;
+
+@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache(
+
+ return 0;
+ }
++#if !defined(CONFIG_MODULES)
+ late_initcall_sync(of_free_phandle_cache);
+ #endif
+
+--- a/drivers/of/of_private.h
++++ b/drivers/of/of_private.h
+@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_no
+ #if defined(CONFIG_OF_OVERLAY)
+ void of_overlay_mutex_lock(void);
+ void of_overlay_mutex_unlock(void);
++int of_free_phandle_cache(void);
++void of_populate_phandle_cache(void);
+ #else
+ static inline void of_overlay_mutex_lock(void) {};
+ static inline void of_overlay_mutex_unlock(void) {};
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -804,6 +804,8 @@ static int of_overlay_apply(const void *
+ goto err_free_overlay_changeset;
+ }
+
++ of_populate_phandle_cache();
++
+ ret = __of_changeset_apply_notify(&ovcs->cset);
+ if (ret)
+ pr_err("overlay changeset entry notify error %d\n", ret);
+@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id)
+
+ list_del(&ovcs->ovcs_list);
+
++ /*
++ * Disable phandle cache. Avoids race condition that would arise
++ * from removing cache entry when the associated node is deleted.
++ */
++ of_free_phandle_cache();
++
+ ret_apply = 0;
+ ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply);
++
++ of_populate_phandle_cache();
++
+ if (ret) {
+ if (ret_apply)
+ devicetree_state_flags |= DTSF_REVERT_FAIL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Stafford Horne <shorne@gmail.com>
+Date: Sun, 1 Jul 2018 14:17:36 +0900
+Subject: openrisc: entry: Fix delay slot exception detection
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit ae15a41a641449f536578b0d9ec0e4ade130deb5 ]
+
+Originally in patch e6d20c55a4 ("openrisc: entry: Fix delay slot
+detection") I fixed delay slot detection, but only for QEMU. We missed
+that hardware delay slot detection using delay slot exception flag (DSX)
+was still broken. This was because QEMU set the DSX flag in both
+pre-exception supervision register (ESR) and supervision register (SR)
+register, but on real hardware the DSX flag is only set on the SR
+register during exceptions.
+
+Fix this by carrying the DSX flag into the SR register during exception.
+We also update the DSX flag read locations to read the value from the SR
+register not the pt_regs SR register which represents ESR. The ESR
+should never have the DSX flag set.
+
+In the process I updated/removed a few comments to match the current
+state. Including removing a comment saying that the DSX detection logic
+was inefficient and needed to be rewritten.
+
+I have tested this on QEMU with a patch ensuring it matches the hardware
+specification.
+
+Link: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00000.html
+Fixes: e6d20c55a4 ("openrisc: entry: Fix delay slot detection")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/openrisc/kernel/entry.S | 8 +-------
+ arch/openrisc/kernel/head.S | 9 ++++++---
+ arch/openrisc/kernel/traps.c | 2 +-
+ 3 files changed, 8 insertions(+), 11 deletions(-)
+
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -277,12 +277,6 @@ EXCEPTION_ENTRY(_data_page_fault_handler
+ l.addi r3,r1,0 // pt_regs
+ /* r4 set be EXCEPTION_HANDLE */ // effective address of fault
+
+- /*
+- * __PHX__: TODO
+- *
+- * all this can be written much simpler. look at
+- * DTLB miss handler in the CONFIG_GUARD_PROTECTED_CORE part
+- */
+ #ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX
+ l.lwz r6,PT_PC(r3) // address of an offending insn
+ l.lwz r6,0(r6) // instruction that caused pf
+@@ -314,7 +308,7 @@ EXCEPTION_ENTRY(_data_page_fault_handler
+
+ #else
+
+- l.lwz r6,PT_SR(r3) // SR
++ l.mfspr r6,r0,SPR_SR // SR
+ l.andi r6,r6,SPR_SR_DSX // check for delay slot exception
+ l.sfne r6,r0 // exception happened in delay slot
+ l.bnf 7f
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -210,8 +210,7 @@
+ * r4 - EEAR exception EA
+ * r10 - current pointing to current_thread_info struct
+ * r12 - syscall 0, since we didn't come from syscall
+- * r13 - temp it actually contains new SR, not needed anymore
+- * r31 - handler address of the handler we'll jump to
++ * r30 - handler address of the handler we'll jump to
+ *
+ * handler has to save remaining registers to the exception
+ * ksp frame *before* tainting them!
+@@ -244,6 +243,7 @@
+ /* r1 is KSP, r30 is __pa(KSP) */ ;\
+ tophys (r30,r1) ;\
+ l.sw PT_GPR12(r30),r12 ;\
++ /* r4 use for tmp before EA */ ;\
+ l.mfspr r12,r0,SPR_EPCR_BASE ;\
+ l.sw PT_PC(r30),r12 ;\
+ l.mfspr r12,r0,SPR_ESR_BASE ;\
+@@ -263,7 +263,10 @@
+ /* r12 == 1 if we come from syscall */ ;\
+ CLEAR_GPR(r12) ;\
+ /* ----- turn on MMU ----- */ ;\
+- l.ori r30,r0,(EXCEPTION_SR) ;\
++ /* Carry DSX into exception SR */ ;\
++ l.mfspr r30,r0,SPR_SR ;\
++ l.andi r30,r30,SPR_SR_DSX ;\
++ l.ori r30,r30,(EXCEPTION_SR) ;\
+ l.mtspr r0,r30,SPR_ESR_BASE ;\
+ /* r30: EA address of handler */ ;\
+ LOAD_SYMBOL_2_GPR(r30,handler) ;\
+--- a/arch/openrisc/kernel/traps.c
++++ b/arch/openrisc/kernel/traps.c
+@@ -317,7 +317,7 @@ static inline int in_delay_slot(struct p
+ return 0;
+ }
+ #else
+- return regs->sr & SPR_SR_DSX;
++ return mfspr(SPR_SR) & SPR_SR_DSX;
+ #endif
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Willem de Bruijn <willemb@google.com>
+Date: Wed, 11 Jul 2018 12:00:45 -0400
+Subject: packet: reset network header if packet shorter than ll reserved space
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit 993675a3100b16a4c80dfd70cbcde8ea7127b31d ]
+
+If variable length link layer headers result in a packet shorter
+than dev->hard_header_len, reset the network header offset. Else
+skb->mac_len may exceed skb->len after skb_mac_reset_len.
+
+packet_sendmsg_spkt already has similar logic.
+
+Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2910,6 +2910,8 @@ static int packet_snd(struct socket *soc
+ goto out_free;
+ } else if (reserve) {
+ skb_reserve(skb, -reserve);
++ if (len < reserve)
++ skb_reset_network_header(skb);
+ }
+
+ /* Returns -EFAULT on error */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:53 -0500
+Subject: PCI: aardvark: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 1df3e5b3feebf29a3ecfa0c0f06f79544ca573e4 ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The Aardvark PCI controller driver has the same issue.
+Replace pci_remap_iospace() with its devm_ managed version to fix the bug.
+
+Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-aardvark.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pc
+ 0, 0xF8000000, 0,
+ lower_32_bits(res->start),
+ OB_PCIE_IO);
+- err = pci_remap_iospace(res, iobase);
++ err = devm_pci_remap_iospace(dev, res, iobase);
+ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:46 -0500
+Subject: PCI: designware: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit fd07f5e19c6fcdfa318944764248cf44eb06e532 ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver is left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The DesignWare PCIe controller driver has the same issue.
+
+Replace devm_pci_remap_iospace() with a devm_ managed version to fix the
+bug.
+
+Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Jingoo Han <jingoohan1@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/dwc/pcie-designware-host.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/dwc/pcie-designware-host.c
++++ b/drivers/pci/dwc/pcie-designware-host.c
+@@ -355,7 +355,8 @@ int dw_pcie_host_init(struct pcie_port *
+ resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
+ switch (resource_type(win->res)) {
+ case IORESOURCE_IO:
+- ret = pci_remap_iospace(win->res, pp->io_base);
++ ret = devm_pci_remap_iospace(dev, win->res,
++ pp->io_base);
+ if (ret) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ ret, win->res);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Fri, 29 Jun 2018 13:50:27 -0500
+Subject: PCI: faraday: Add missing of_node_put()
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 3dc6ddfedc2818eaaa36842fbb049191e0c5e50f ]
+
+The call to of_get_next_child() returns a node pointer with refcount
+incremented thus it must be explicitly decremented here in the error
+path and after the last usage.
+
+Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver")
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+[lorenzo.pieralisi@arm.com: updated commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-ftpci100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/host/pci-ftpci100.c
++++ b/drivers/pci/host/pci-ftpci100.c
+@@ -353,11 +353,13 @@ static int faraday_pci_setup_cascaded_ir
+ irq = of_irq_get(intc, 0);
+ if (irq <= 0) {
+ dev_err(p->dev, "failed to get parent IRQ\n");
++ of_node_put(intc);
+ return irq ?: -EINVAL;
+ }
+
+ p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX,
+ &faraday_pci_irqdomain_ops, p);
++ of_node_put(intc);
+ if (!p->irqdomain) {
+ dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n");
+ return -EINVAL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:59 -0500
+Subject: PCI: faraday: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit e30609454b39139a91faf631685f503b7ea3f27d ]
+
+When testing the R-Car PCIe driver on the Condor board, if
+the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The Faraday PCI driver has the same issue. Replace pci_remap_iospace()
+with its devm_ managed version to fix the bug.
+
+Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-ftpci100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-ftpci100.c
++++ b/drivers/pci/host/pci-ftpci100.c
+@@ -501,7 +501,7 @@ static int faraday_pci_probe(struct plat
+ dev_err(dev, "illegal IO mem size\n");
+ return -EINVAL;
+ }
+- ret = pci_remap_iospace(io, io_base);
++ ret = devm_pci_remap_iospace(dev, io, io_base);
+ if (ret) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ ret, io);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:41:05 -0500
+Subject: PCI: mediatek: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 438477b9a089e45ea7c8fb549553e52833117ed8 ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The MediaTek PCIe driver has the same issue.
+
+Replace devm_pci_remap_iospace() with its devm_ managed counterpart
+to fix the bug.
+
+Fixes: 637cfacae96f ("PCI: mediatek: Add MediaTek PCIe host controller support")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pcie-mediatek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pcie-mediatek.c
++++ b/drivers/pci/host/pcie-mediatek.c
+@@ -1063,7 +1063,7 @@ static int mtk_pcie_request_resources(st
+ if (err < 0)
+ return err;
+
+- pci_remap_iospace(&pcie->pio, pcie->io.start);
++ devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:26 -0500
+Subject: PCI: OF: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+Introduce the devm_pci_remap_iospace() managed API and replace the
+pci_remap_iospace() call with it to fix the bug.
+
+Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: split commit/updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/of.c | 2 +-
+ drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
+ include/linux/pci.h | 2 ++
+ 3 files changed, 41 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/of.c
++++ b/drivers/pci/of.c
+@@ -617,7 +617,7 @@ int pci_parse_request_of_pci_ranges(stru
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+- err = pci_remap_iospace(res, iobase);
++ err = devm_pci_remap_iospace(dev, res, iobase);
+ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3573,6 +3573,44 @@ void pci_unmap_iospace(struct resource *
+ }
+ EXPORT_SYMBOL(pci_unmap_iospace);
+
++static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
++{
++ struct resource **res = ptr;
++
++ pci_unmap_iospace(*res);
++}
++
++/**
++ * devm_pci_remap_iospace - Managed pci_remap_iospace()
++ * @dev: Generic device to remap IO address for
++ * @res: Resource describing the I/O space
++ * @phys_addr: physical address of range to be mapped
++ *
++ * Managed pci_remap_iospace(). Map is automatically unmapped on driver
++ * detach.
++ */
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++ phys_addr_t phys_addr)
++{
++ const struct resource **ptr;
++ int error;
++
++ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
++ if (!ptr)
++ return -ENOMEM;
++
++ error = pci_remap_iospace(res, phys_addr);
++ if (error) {
++ devres_free(ptr);
++ } else {
++ *ptr = res;
++ devres_add(dev, ptr);
++ }
++
++ return error;
++}
++EXPORT_SYMBOL(devm_pci_remap_iospace);
++
+ /**
+ * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
+ * @dev: Generic device to remap IO address for
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1236,6 +1236,8 @@ int pci_register_io_range(struct fwnode_
+ unsigned long pci_address_to_pio(phys_addr_t addr);
+ phys_addr_t pci_pio_to_address(unsigned long pio);
+ int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++ phys_addr_t phys_addr);
+ void pci_unmap_iospace(struct resource *res);
+ void __iomem *devm_pci_remap_cfgspace(struct device *dev,
+ resource_size_t offset,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:41:11 -0500
+Subject: PCI: v3-semi: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 270ed733e68955049b693bea8f4a1efb293a96ae ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The V3 Semiconductor PCI driver has the same issue.
+Replace devm_pci_remap_iospace() with its devm_ managed version to fix
+the bug.
+
+Fixes: 68a15eb7bd0c ("PCI: v3-semi: Add V3 Semiconductor PCI host driver")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-v3-semi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-v3-semi.c
++++ b/drivers/pci/host/pci-v3-semi.c
+@@ -535,7 +535,7 @@ static int v3_pci_setup_resource(struct
+ v3->io_bus_addr = io->start - win->offset;
+ dev_dbg(dev, "I/O window %pR, bus addr %pap\n",
+ io, &v3->io_bus_addr);
+- ret = pci_remap_iospace(io, io_base);
++ ret = devm_pci_remap_iospace(dev, io, io_base);
+ if (ret) {
+ dev_warn(dev,
+ "error %d: failed to map resource %pR\n",
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:40 -0500
+Subject: PCI: versatile: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The Versatile PCI controller driver has the same issue.
+Replace pci_remap_iospace() with the devm_ managed version to fix the bug.
+
+Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-versatile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-versatile.c
++++ b/drivers/pci/host/pci-versatile.c
+@@ -81,7 +81,7 @@ static int versatile_pci_parse_request_o
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+- err = pci_remap_iospace(res, iobase);
++ err = devm_pci_remap_iospace(dev, res, iobase);
+ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 18 Jul 2018 15:40:34 -0500
+Subject: PCI: xgene: Fix I/O space page leak
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 925652d03589084850023d8924b376b7ee3c1b1b ]
+
+When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
+driver was left disabled, the kernel crashed with this BUG:
+
+ kernel BUG at lib/ioremap.c:72!
+ Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
+ Hardware name: Renesas Condor board based on r8a77980 (DT)
+ Workqueue: events deferred_probe_work_func
+ pstate: 80000005 (Nzcv daif -PAN -UAO)
+ pc : ioremap_page_range+0x370/0x3c8
+ lr : ioremap_page_range+0x40/0x3c8
+ sp : ffff000008da39e0
+ x29: ffff000008da39e0 x28: 00e8000000000f07
+ x27: ffff7dfffee00000 x26: 0140000000000000
+ x25: ffff7dfffef00000 x24: 00000000000fe100
+ x23: ffff80007b906000 x22: ffff000008ab8000
+ x21: ffff000008bb1d58 x20: ffff7dfffef00000
+ x19: ffff800009c30fb8 x18: 0000000000000001
+ x17: 00000000000152d0 x16: 00000000014012d0
+ x15: 0000000000000000 x14: 0720072007200720
+ x13: 0720072007200720 x12: 0720072007200720
+ x11: 0720072007300730 x10: 00000000000000ae
+ x9 : 0000000000000000 x8 : ffff7dffff000000
+ x7 : 0000000000000000 x6 : 0000000000000100
+ x5 : 0000000000000000 x4 : 000000007b906000
+ x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
+ x1 : 0000000040000000 x0 : 00e80000fe100f07
+ Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
+ Call trace:
+ ioremap_page_range+0x370/0x3c8
+ pci_remap_iospace+0x7c/0xac
+ pci_parse_request_of_pci_ranges+0x13c/0x190
+ rcar_pcie_probe+0x4c/0xb04
+ platform_drv_probe+0x50/0xbc
+ driver_probe_device+0x21c/0x308
+ __device_attach_driver+0x98/0xc8
+ bus_for_each_drv+0x54/0x94
+ __device_attach+0xc4/0x12c
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0xb0/0x150
+ process_one_work+0x12c/0x29c
+ worker_thread+0x200/0x3fc
+ kthread+0x108/0x134
+ ret_from_fork+0x10/0x18
+ Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
+
+It turned out that pci_remap_iospace() wasn't undone when the driver's
+probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
+the probe was retried, finally causing the BUG due to trying to remap
+already remapped pages.
+
+The X-Gene PCI controller driver has the same issue.
+Replace pci_remap_iospace() with the devm_ managed version so that the
+pages get unmapped automagically on any probe failure.
+
+Fixes: 5f6b6ccdbe1c ("PCI: xgene: Add APM X-Gene PCIe driver")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+[lorenzo.pieralisi@arm.com: updated the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pci-xgene.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-xgene.c
++++ b/drivers/pci/host/pci-xgene.c
+@@ -421,7 +421,7 @@ static int xgene_pcie_map_ranges(struct
+ case IORESOURCE_IO:
+ xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base,
+ res->start - window->offset);
+- ret = pci_remap_iospace(res, io_base);
++ ret = devm_pci_remap_iospace(dev, res, io_base);
+ if (ret < 0)
+ return ret;
+ break;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Fri, 29 Jun 2018 13:49:54 -0500
+Subject: PCI: xilinx: Add missing of_node_put()
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 8c3f9bd851a4d3acf0a0f222d4e9e41c0cd1ea8e ]
+
+The call to of_get_next_child() returns a node pointer with refcount
+incremented thus it must be explicitly decremented here after the last
+usage.
+
+Fixes: 8961def56845 ("PCI: xilinx: Add Xilinx AXI PCIe Host Bridge IP driver")
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+[lorenzo.pieralisi@arm.com: reworked commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pcie-xilinx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/host/pcie-xilinx.c
++++ b/drivers/pci/host/pcie-xilinx.c
+@@ -507,6 +507,7 @@ static int xilinx_pcie_init_irq_domain(s
+ port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
+ &intx_domain_ops,
+ port);
++ of_node_put(pcie_intc_node);
+ if (!port->leg_domain) {
+ dev_err(dev, "Failed to get a INTx IRQ domain\n");
+ return -ENODEV;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Fri, 29 Jun 2018 13:50:10 -0500
+Subject: PCI: xilinx-nwl: Add missing of_node_put()
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 342639d996f18bc0a4db2f42a84230c0a966dc94 ]
+
+The call to of_get_next_child() returns a node pointer with
+refcount incremented thus it must be explicitly decremented
+here after the last usage.
+
+Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller")
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+[lorenzo.pieralisi@arm.com: updated commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pcie-xilinx-nwl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pcie-xilinx-nwl.c
++++ b/drivers/pci/host/pcie-xilinx-nwl.c
+@@ -557,7 +557,7 @@ static int nwl_pcie_init_irq_domain(stru
+ PCI_NUM_INTX,
+ &legacy_domain_ops,
+ pcie);
+-
++ of_node_put(legacy_intc_node);
+ if (!pcie->legacy_irq_domain) {
+ dev_err(dev, "failed to create IRQ domain\n");
+ return -ENOMEM;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 20 Jun 2018 11:40:36 +0200
+Subject: perf bench: Fix numa report output code
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 983107072be1a39cbde67d45cb0059138190e015 ]
+
+Currently we can hit following assert when running numa bench:
+
+ $ perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZ0cm --thp 1
+ perf: bench/numa.c:1577: __bench_numa: Assertion `!(!(((wait_stat) & 0x7f) == 0))' failed.
+
+The assertion is correct, because we hit the SIGFPE in following line:
+
+ Thread 2.2 "thread 0/0" received signal SIGFPE, Arithmetic exception.
+ [Switching to Thread 0x7fffd28c6700 (LWP 11750)]
+ 0x000.. in worker_thread (__tdata=0x7.. ) at bench/numa.c:1257
+ 1257 td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
+
+We don't check if the runtime is actually bigger than 1 second,
+and thus this might end up with zero division within FPU.
+
+Adding the check to prevent this.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180620094036.17278-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/bench/numa.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata
+ u8 *global_data;
+ u8 *process_data;
+ u8 *thread_data;
+- u64 bytes_done;
++ u64 bytes_done, secs;
+ long work_done;
+ u32 l;
+ struct rusage rusage;
+@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata
+ timersub(&stop, &start0, &diff);
+ td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
+ td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
+- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
++ secs = td->runtime_ns / NSEC_PER_SEC;
++ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
+
+ getrusage(RUSAGE_THREAD, &rusage);
+ td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Kim Phillips <kim.phillips@arm.com>
+Date: Fri, 29 Jun 2018 12:46:52 -0500
+Subject: perf llvm-utils: Remove bashism from kernel include fetch script
+
+From: Kim Phillips <kim.phillips@arm.com>
+
+[ Upstream commit f6432b9f65001651412dbc3589d251534822d4ab ]
+
+Like system(), popen() calls /bin/sh, which may/may not be bash.
+
+Script when run on dash and encounters the line, yields:
+
+ exit: Illegal number: -1
+
+checkbashisms report on script content:
+
+ possible bashism (exit|return with negative status code):
+ exit -1
+
+Remove the bashism and use the more portable non-zero failure
+status code 1.
+
+Signed-off-by: Kim Phillips <kim.phillips@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20180629124652.8d0af7e2281fd3fd8262cacc@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/llvm-utils.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -265,16 +265,16 @@ static const char *kinc_fetch_script =
+ "#!/usr/bin/env sh\n"
+ "if ! test -d \"$KBUILD_DIR\"\n"
+ "then\n"
+-" exit -1\n"
++" exit 1\n"
+ "fi\n"
+ "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n"
+ "then\n"
+-" exit -1\n"
++" exit 1\n"
+ "fi\n"
+ "TMPDIR=`mktemp -d`\n"
+ "if test -z \"$TMPDIR\"\n"
+ "then\n"
+-" exit -1\n"
++" exit 1\n"
+ "fi\n"
+ "cat << EOF > $TMPDIR/Makefile\n"
+ "obj-y := dummy.o\n"
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Mon, 11 Jun 2018 09:31:52 +0200
+Subject: perf record: Support s390 random socket_id assignment
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 01766229533f9bdb1144a41b4345c8c7286da7b4 ]
+
+On s390 the socket identifier assigned to a CPU identifier is random and
+(depending on the configuration of the LPAR) may be higher than the CPU
+identifier. This is currently not supported.
+
+Fix this by allowing arbitrary socket identifiers being assigned to
+CPU id.
+
+Output before:
+
+ [root@p23lp27 perf]# ./perf report --header -I -v
+ ...
+ socket_id number is too big.You may need to upgrade the perf tool.
+ Error:
+ The perf.data file has no samples!
+ # ========
+ # captured on : Tue May 29 09:29:57 2018
+ # header version : 1
+ ...
+ # Core ID and Socket ID information is not available
+ ...
+ [root@p23lp27 perf]#
+
+Output after:
+
+ [root@p23lp27 perf]# ./perf report --header -I -v
+ ...
+ Error:
+ The perf.data file has no samples!
+ # ========
+ # captured on : Tue May 29 09:29:57 2018
+ # header version : 1
+ ...
+ # CPU 0: Core ID 0, Socket ID 6
+ # CPU 1: Core ID 1, Socket ID 3
+ # CPU 2: Core ID -1, Socket ID -1
+ ...
+ [root@p23lp27 perf]#
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Link: http://lkml.kernel.org/r/20180611073153.15592-1-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/header.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2113,6 +2113,7 @@ static int process_cpu_topology(struct f
+ int cpu_nr = ff->ph->env.nr_cpus_avail;
+ u64 size = 0;
+ struct perf_header *ph = ff->ph;
++ bool do_core_id_test = true;
+
+ ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu));
+ if (!ph->env.cpu)
+@@ -2167,6 +2168,13 @@ static int process_cpu_topology(struct f
+ return 0;
+ }
+
++ /* On s390 the socket_id number is not related to the numbers of cpus.
++ * The socket_id number might be higher than the numbers of cpus.
++ * This depends on the configuration.
++ */
++ if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
++ do_core_id_test = false;
++
+ for (i = 0; i < (u32)cpu_nr; i++) {
+ if (do_read_u32(ff, &nr))
+ goto free_cpu;
+@@ -2176,7 +2184,7 @@ static int process_cpu_topology(struct f
+ if (do_read_u32(ff, &nr))
+ goto free_cpu;
+
+- if (nr != (u32)-1 && nr > (u32)cpu_nr) {
++ if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) {
+ pr_debug("socket_id number is too big."
+ "You may need to upgrade the perf tool.\n");
+ goto free_cpu;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Mon, 11 Jun 2018 16:10:49 +0530
+Subject: perf report powerpc: Fix crash if callchain is empty
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ]
+
+For some cases, the callchain provided by the kernel may be empty. So,
+the callchain ip filtering code will cause a crash if we do not check
+whether the struct ip_callchain pointer is NULL before accessing any
+members.
+
+This can be observed on a powerpc64le system running Fedora 27 as shown
+below.
+
+ # perf record -b -e cycles:u ls
+
+Before:
+
+ # perf report --branch-history
+
+ perf: Segmentation fault
+ -------- backtrace --------
+ perf[0x1027615c]
+ linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
+ perf(arch_skip_callchain_idx+0x44)[0x10257c58]
+ perf[0x1017f2e4]
+ perf(thread__resolve_callchain+0x124)[0x1017ff5c]
+ perf(sample__resolve_callchain+0xf0)[0x10172788]
+ ...
+
+After:
+
+ # perf report --branch-history
+
+ Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
+ Overhead Source:Line Symbol Shared Object
+ + 11.60% _init+35736 [.] _init ls
+ + 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ + 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ + 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ + 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ + 8.83% _init+236 [.] _init ls
+ ...
+
+Reported-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Acked-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct threa
+ u64 ip;
+ u64 skip_slot = -1;
+
+- if (chain->nr < 3)
++ if (!chain || chain->nr < 3)
+ return skip_slot;
+
+ ip = chain->ips[2];
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Date: Mon, 25 Jun 2018 18:12:19 +0530
+Subject: perf script: Fix crash because of missing evsel->priv
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit a3af66f51bd0bca72881ead4bf2bd19cb366582b ]
+
+'perf script' in piped mode is crashing because evsel->priv is not set
+properly. Fix it.
+
+Before:
+
+ # perf record -o - -- ls | perf script
+ <SNIP 'ls' output>
+ Segmentation fault (core dumped)
+ #
+
+After:
+
+ # perf record -o - -- ls | perf script
+ <SNIP 'ls' output>
+ ls 2282 1031.731974: 250000 cpu-clock:uhH: 7effe4b3d29e
+ ls 2282 1031.732222: 250000 cpu-clock:uhH: 7effe4b3a650
+ #
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: David Carrillo-Cisneros <davidcc@google.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Fixes: a14390fde64e ("perf script: Allow creating per-event dump files")
+Link: http://lkml.kernel.org/r/20180625124220.6434-3-ravi.bangoria@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-script.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1832,6 +1832,7 @@ static int process_attr(struct perf_tool
+ struct perf_evlist *evlist;
+ struct perf_evsel *evsel, *pos;
+ int err;
++ static struct perf_evsel_script *es;
+
+ err = perf_event__process_attr(tool, event, pevlist);
+ if (err)
+@@ -1840,6 +1841,19 @@ static int process_attr(struct perf_tool
+ evlist = *pevlist;
+ evsel = perf_evlist__last(*pevlist);
+
++ if (!evsel->priv) {
++ if (scr->per_event_dump) {
++ evsel->priv = perf_evsel_script__new(evsel,
++ scr->session->data);
++ } else {
++ es = zalloc(sizeof(*es));
++ if (!es)
++ return -ENOMEM;
++ es->fp = stdout;
++ evsel->priv = es;
++ }
++ }
++
+ if (evsel->attr.type >= PERF_TYPE_MAX &&
+ evsel->attr.type != PERF_TYPE_SYNTH)
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Janne Huttunen <janne.huttunen@nokia.com>
+Date: Mon, 9 Jul 2018 13:59:50 +0300
+Subject: perf script python: Fix dict reference counting
+
+From: Janne Huttunen <janne.huttunen@nokia.com>
+
+[ Upstream commit db0ba84c04ef2cf293aaada5ae97531127844d9d ]
+
+The dictionaries are attached to the parameter tuple that steals the
+references and takes care of releasing them when appropriate. The code
+should not decrement the reference counts explicitly. E.g. if libpython
+has been built with reference debugging enabled, the superfluous DECREFs
+will trigger this error when running perf script:
+
+ Fatal Python error: Objects/tupleobject.c:238 object at
+ 0x7f10f2041b40 has negative ref count -1
+ Aborted (core dumped)
+
+If the reference debugging is not enabled, the superfluous DECREFs might
+cause the dict objects to be silently released while they are still in
+use. This may trigger various other assertions or just cause perf
+crashes and/or weird and unexpected data changes in the stored Python
+objects.
+
+Signed-off-by: Janne Huttunen <janne.huttunen@nokia.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jaroslav Skarvada <jskarvad@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1531133990-17485-1-git-send-email-janne.huttunen@nokia.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/scripting-engines/trace-event-python.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -676,14 +676,11 @@ static void python_process_tracepoint(st
+ if (_PyTuple_Resize(&t, n) == -1)
+ Py_FatalError("error resizing Python tuple");
+
+- if (!dict) {
++ if (!dict)
+ call_object(handler, t, handler_name);
+- } else {
++ else
+ call_object(handler, t, default_handler_name);
+- Py_DECREF(dict);
+- }
+
+- Py_XDECREF(all_entries_dict);
+ Py_DECREF(t);
+ }
+
+@@ -1003,7 +1000,6 @@ static void python_process_general_event
+
+ call_object(handler, t, handler_name);
+
+- Py_DECREF(dict);
+ Py_DECREF(t);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Mon, 11 Jun 2018 09:31:53 +0200
+Subject: perf test session topology: Fix test on s390
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b930e62ecd362843002bdf84c2940439822af321 ]
+
+On s390 this test case fails because the socket identifiction numbers
+assigned to the CPU are higher than the CPU identification numbers.
+
+F/ix this by adding the platform architecture into the perf data header
+flag information. This helps identifiing the test platform and handles
+s390 specifics in process_cpu_topology().
+
+Before:
+
+ [root@p23lp27 perf]# perf test -vvvvv -F 39
+ 39: Session topology :
+ --- start ---
+ templ file: /tmp/perf-test-iUv755
+ socket_id number is too big.You may need to upgrade the perf tool.
+ ---- end ----
+ Session topology: Skip
+ [root@p23lp27 perf]#
+
+After:
+
+ [root@p23lp27 perf]# perf test -vvvvv -F 39
+ 39: Session topology :
+ --- start ---
+ templ file: /tmp/perf-test-8X8VTs
+ CPU 0, core 0, socket 6
+ CPU 1, core 1, socket 3
+ ---- end ----
+ Session topology: Ok
+ [root@p23lp27 perf]#
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Fixes: c84974ed9fb6 ("perf test: Add entry to test cpu topology")
+Link: http://lkml.kernel.org/r/20180611073153.15592-2-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/topology.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/perf/tests/topology.c
++++ b/tools/perf/tests/topology.c
+@@ -45,6 +45,7 @@ static int session_write_header(char *pa
+
+ perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
+ perf_header__set_feat(&session->header, HEADER_NRCPUS);
++ perf_header__set_feat(&session->header, HEADER_ARCH);
+
+ session->header.data_size += DATA_SIZE;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Kim Phillips <kim.phillips@arm.com>
+Date: Fri, 29 Jun 2018 12:46:58 -0500
+Subject: perf test shell: Prevent temporary editor files from being considered test scripts
+
+From: Kim Phillips <kim.phillips@arm.com>
+
+[ Upstream commit db8fec583f250557ddd6def1505a6c466c9747aa ]
+
+Allows a perf shell test developer to concurrently edit and run their
+test scripts, avoiding perf test attempts to execute their editor
+temporary files, such as seen here:
+
+ $ sudo taskset -c 0 ./perf test -vvvvvvvv -F 63
+ 63: 0VIM 8.0 :
+ --- start ---
+ sh: 1: ./tests/shell/.record+probe_libc_inet_pton.sh.swp: Permission denied
+ ---- end ----
+ 0VIM 8.0: FAILED!
+
+Signed-off-by: Kim Phillips <kim.phillips@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20180629124658.15a506b41fc4539c08eb9426@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/builtin-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/tests/builtin-test.c
++++ b/tools/perf/tests/builtin-test.c
+@@ -422,7 +422,7 @@ static const char *shell_test__descripti
+
+ #define for_each_shell_test(dir, base, ent) \
+ while ((ent = readdir(dir)) != NULL) \
+- if (!is_directory(base, ent))
++ if (!is_directory(base, ent) && ent->d_name[0] != '.')
+
+ static const char *shell_tests__dir(char *path, size_t size)
+ {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Mon, 11 Jun 2018 11:34:21 +0200
+Subject: perf tests: Add event parsing error handling to parse events test
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 933ccf2002aaef1037cb676622a694f5390c3d59 ]
+
+Add missing error handling for parse_events calls in test_event function
+that led to following segfault on s390:
+
+ running test 52 'intel_pt//u'
+ perf: Segmentation fault
+ ...
+ /lib64/libc.so.6(vasprintf+0xe6) [0x3fffca3f106]
+ /lib64/libc.so.6(asprintf+0x46) [0x3fffca1aa96]
+ ./perf(parse_events_add_pmu+0xb8) [0x80132088]
+ ./perf(parse_events_parse+0xc62) [0x8019529a]
+ ./perf(parse_events+0x98) [0x801341c0]
+ ./perf(test__parse_events+0x48) [0x800cd140]
+ ./perf(cmd_test+0x26a) [0x800bd44a]
+ test child interrupted
+
+Adding the struct parse_events_error argument to parse_events call. Also
+adding parse_events_print_error to get more details on the parsing
+failures, like:
+
+ # perf test 6 -v
+ running test 52 'intel_pt//u'failed to parse event 'intel_pt//u', err 1, str 'Cannot find PMU `intel_pt'. Missing kernel support?'
+ event syntax error: 'intel_pt//u'
+ \___ Cannot find PMU `intel_pt'. Missing kernel support?
+
+Committer note:
+
+Use named initializers in the struct parse_events_error variable to
+avoid breaking the build on centos5, 6 and others with a similar gcc:
+
+ cc1: warnings being treated as errors
+ tests/parse-events.c: In function 'test_event':
+ tests/parse-events.c:1696: error: missing initializer
+ tests/parse-events.c:1696: error: (near initialization for 'err.str')
+
+Reported-by: Kim Phillips <kim.phillips@arm.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Kim Phillips <kim.phillips@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Link: http://lkml.kernel.org/r/20180611093422.1005-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/parse-events.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/tests/parse-events.c
++++ b/tools/perf/tests/parse-events.c
+@@ -1672,6 +1672,7 @@ static struct terms_test test__terms[] =
+
+ static int test_event(struct evlist_test *e)
+ {
++ struct parse_events_error err = { .idx = 0, };
+ struct perf_evlist *evlist;
+ int ret;
+
+@@ -1679,10 +1680,11 @@ static int test_event(struct evlist_test
+ if (evlist == NULL)
+ return -ENOMEM;
+
+- ret = parse_events(evlist, e->name, NULL);
++ ret = parse_events(evlist, e->name, &err);
+ if (ret) {
+- pr_debug("failed to parse event '%s', err %d\n",
+- e->name, ret);
++ pr_debug("failed to parse event '%s', err %d, str '%s'\n",
++ e->name, ret, err.str);
++ parse_events_print_error(&err, e->name);
+ } else {
+ ret = e->check(evlist);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Yonghong Song <yhs@fb.com>
+Date: Sat, 16 Jun 2018 10:47:39 -0700
+Subject: perf tools: Fix a clang 7.0 compilation error
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit c6555c14572aeadf4fe2819abd971c4e7608b926 ]
+
+Arnaldo reported the perf build failure with latest llvm/clang compiler
+(7.0).
+
+ $ make LIBCLANGLLVM=1 -C tools/perf/
+ <SNIP>
+ CC /tmp/tmp.t53Qo38zci/tests/kmod-path.o
+ util/c++/clang.cpp: In function ‘std::unique_ptr<llvm::SmallVectorImpl<char> >
+ perf::getBPFObjectFromModule(llvm::Module*)’:
+ util/c++/clang.cpp:150:43: error: no matching function for call to
+ ‘llvm::TargetMachine::addPassesToEmitFile(llvm::legacy::PassManager&,
+ llvm::raw_svector_ostream&, llvm::TargetMachine::CodeGenFileType)’
+ TargetMachine::CGFT_ObjectFile)) {
+ ^
+ In file included from util/c++/clang.cpp:25:0:
+ /usr/local/include/llvm/Target/TargetMachine.h:254:16: note: candidate:
+ virtual bool llvm::TargetMachine::addPassesToEmitFile(
+ llvm::legacy::PassManagerBase&, llvm::raw_pwrite_stream&,
+ llvm::raw_pwrite_stream*, llvm::TargetMachine::CodeGenFileType, bool,
+ llvm::MachineModuleInfo*)
+ virtual bool addPassesToEmitFile(PassManagerBase &, raw_pwrite_stream &,
+ ^~~~~~~~~~~~~~~~~~~
+ /usr/local/include/llvm/Target/TargetMachine.h:254:16: note:
+ candidate expects 6 arguments, 3 provided
+ mv: cannot stat '/tmp/tmp.t53Qo38zci/util/c++/.clang.o.tmp': No such file or directory
+ make[7]: *** [/home/acme/git/perf/tools/build/Makefile.build:101:
+ /tmp/tmp.t53Qo38zci/util/c++/clang.o] Error 1
+ make[6]: *** [/home/acme/git/perf/tools/build/Makefile.build:139: c++] Error 2
+ make[5]: *** [/home/acme/git/perf/tools/build/Makefile.build:139: util] Error 2
+ make[5]: *** Waiting for unfinished jobs....
+ CC /tmp/tmp.t53Qo38zci/tests/thread-map.o
+
+The function addPassesToEmitFile signature changed in llvm 7.0 and such
+a change caused the failure. This patch fixed the issue with using
+proper function signatures under different compiler versions.
+
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexei Starovoitov <ast@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/20180616174739.1076733-1-yhs@fb.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/c++/clang.cpp | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/c++/clang.cpp
++++ b/tools/perf/util/c++/clang.cpp
+@@ -146,8 +146,15 @@ getBPFObjectFromModule(llvm::Module *Mod
+ raw_svector_ostream ostream(*Buffer);
+
+ legacy::PassManager PM;
+- if (TargetMachine->addPassesToEmitFile(PM, ostream,
+- TargetMachine::CGFT_ObjectFile)) {
++ bool NotAdded;
++#if CLANG_VERSION_MAJOR < 7
++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream,
++ TargetMachine::CGFT_ObjectFile);
++#else
++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, nullptr,
++ TargetMachine::CGFT_ObjectFile);
++#endif
++ if (NotAdded) {
+ llvm::errs() << "TargetMachine can't emit a file of this type\n";
+ return std::unique_ptr<llvm::SmallVectorImpl<char>>(nullptr);;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Mon, 2 Jul 2018 15:42:01 +0200
+Subject: perf tools: Fix compilation errors on gcc8
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit a09603f851045b031e990d2d663958ccb49db525 ]
+
+We are getting following warnings on gcc8 that break compilation:
+
+ $ make
+ CC jvmti/jvmti_agent.o
+ jvmti/jvmti_agent.c: In function ‘jvmti_open’:
+ jvmti/jvmti_agent.c:252:35: error: ‘/jit-’ directive output may be truncated \
+ writing 5 bytes into a region of size between 1 and 4096 [-Werror=format-truncation=]
+ snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
+
+There's no point in checking the result of snprintf call in
+jvmti_open, the following open call will fail in case the
+name is mangled or too long.
+
+Using tools/lib/ function scnprintf that touches the return value from
+the snprintf() calls and thus get rid of those warnings.
+
+ $ make DEBUG=1
+ CC arch/x86/util/perf_regs.o
+ arch/x86/util/perf_regs.c: In function ‘arch_sdt_arg_parse_op’:
+ arch/x86/util/perf_regs.c:229:4: error: ‘strncpy’ output truncated before terminating nul
+ copying 2 bytes from a string of the same length [-Werror=stringop-truncation]
+ strncpy(prefix, "+0", 2);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Using scnprintf instead of the strncpy (which we know is safe in here)
+to get rid of that warning.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180702134202.17745-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/x86/util/perf_regs.c | 2 +-
+ tools/perf/jvmti/jvmti_agent.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/arch/x86/util/perf_regs.c
++++ b/tools/perf/arch/x86/util/perf_regs.c
+@@ -226,7 +226,7 @@ int arch_sdt_arg_parse_op(char *old_op,
+ else if (rm[2].rm_so != rm[2].rm_eo)
+ prefix[0] = '+';
+ else
+- strncpy(prefix, "+0", 2);
++ scnprintf(prefix, sizeof(prefix), "+0");
+ }
+
+ /* Rename register */
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -35,6 +35,7 @@
+ #include <sys/mman.h>
+ #include <syscall.h> /* for gettid() */
+ #include <err.h>
++#include <linux/kernel.h>
+
+ #include "jvmti_agent.h"
+ #include "../util/jitdump.h"
+@@ -249,7 +250,7 @@ void *jvmti_open(void)
+ /*
+ * jitdump file name
+ */
+- snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++ scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
+
+ fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
+ if (fd == -1)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Date: Mon, 25 Jun 2018 18:12:20 +0530
+Subject: perf tools: Fix crash caused by accessing feat_ops[HEADER_LAST_FEATURE]
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 92ead7ee30c80f8852d28735cbcb9d79bc85f715 ]
+
+perf_event__process_feature() accesses feat_ops[HEADER_LAST_FEATURE]
+which is not defined and thus perf is crashing. HEADER_LAST_FEATURE is
+used as an end marker for the perf report but it's unused for perf
+script/annotate. Ignore HEADER_LAST_FEATURE for perf script/annotate,
+just like it is done in 'perf report'.
+
+Before:
+ # perf record -o - ls | perf script
+ <SNIP 'ls' output>
+ Segmentation fault (core dumped)
+ #
+
+After:
+ # perf record -o - ls | perf script
+ <SNIP 'ls' output>
+ Segmentation fault (core dumped)
+ ls 7031 4392.099856: 250000 cpu-clock:uhH: 7f5e0ce7cd60
+ ls 7031 4392.100355: 250000 cpu-clock:uhH: 7f5e0c706ef7
+ #
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: David Carrillo-Cisneros <davidcc@google.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Fixes: 57b5de463925 ("perf report: Support forced leader feature in pipe mode")
+Link: http://lkml.kernel.org/r/20180625124220.6434-4-ravi.bangoria@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-annotate.c | 11 ++++++++++-
+ tools/perf/builtin-report.c | 3 ++-
+ tools/perf/builtin-script.c | 11 ++++++++++-
+ tools/perf/util/header.c | 2 +-
+ 4 files changed, 23 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/builtin-annotate.c
++++ b/tools/perf/builtin-annotate.c
+@@ -283,6 +283,15 @@ out_put:
+ return ret;
+ }
+
++static int process_feature_event(struct perf_tool *tool,
++ union perf_event *event,
++ struct perf_session *session)
++{
++ if (event->feat.feat_id < HEADER_LAST_FEATURE)
++ return perf_event__process_feature(tool, event, session);
++ return 0;
++}
++
+ static int hist_entry__tty_annotate(struct hist_entry *he,
+ struct perf_evsel *evsel,
+ struct perf_annotate *ann)
+@@ -471,7 +480,7 @@ int cmd_annotate(int argc, const char **
+ .attr = perf_event__process_attr,
+ .build_id = perf_event__process_build_id,
+ .tracing_data = perf_event__process_tracing_data,
+- .feature = perf_event__process_feature,
++ .feature = process_feature_event,
+ .ordered_events = true,
+ .ordering_requires_timestamps = true,
+ },
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -226,7 +226,8 @@ static int process_feature_event(struct
+ }
+
+ /*
+- * All features are received, we can force the
++ * (feat_id = HEADER_LAST_FEATURE) is the end marker which
++ * means all features are received, now we can force the
+ * group if needed.
+ */
+ setup_forced_leader(rep, session->evlist);
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -3042,6 +3042,15 @@ int process_cpu_map_event(struct perf_to
+ return set_maps(script);
+ }
+
++static int process_feature_event(struct perf_tool *tool,
++ union perf_event *event,
++ struct perf_session *session)
++{
++ if (event->feat.feat_id < HEADER_LAST_FEATURE)
++ return perf_event__process_feature(tool, event, session);
++ return 0;
++}
++
+ #ifdef HAVE_AUXTRACE_SUPPORT
+ static int perf_script__process_auxtrace_info(struct perf_tool *tool,
+ union perf_event *event,
+@@ -3086,7 +3095,7 @@ int cmd_script(int argc, const char **ar
+ .attr = process_attr,
+ .event_update = perf_event__process_event_update,
+ .tracing_data = perf_event__process_tracing_data,
+- .feature = perf_event__process_feature,
++ .feature = process_feature_event,
+ .build_id = perf_event__process_build_id,
+ .id_index = perf_event__process_id_index,
+ .auxtrace_info = perf_script__process_auxtrace_info,
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3450,7 +3450,7 @@ int perf_event__process_feature(struct p
+ pr_warning("invalid record type %d in pipe-mode\n", type);
+ return 0;
+ }
+- if (feat == HEADER_RESERVED || feat > HEADER_LAST_FEATURE) {
++ if (feat == HEADER_RESERVED || feat >= HEADER_LAST_FEATURE) {
+ pr_warning("invalid record type %d in pipe-mode\n", type);
+ return -1;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Thu, 7 Jun 2018 00:15:05 +0200
+Subject: perf tools: Fix error index for pmu event parser
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit f7fa827f5f432a0b1f34e10fc49da93aeef9f817 ]
+
+For events we provide specific error message we need to set error column
+index, PMU parser is missing that, adding it.
+
+Before:
+
+ $ perf stat -e cycles,krava/cycles/ kill
+ event syntax error: 'cycles,krava/cycles/'
+ \___ Cannot find PMU `krava'. Missing kernel support?
+
+After:
+
+ $ perf stat -e cycles,krava/cycles/ kill
+ event syntax error: 'cycles,krava/cycles/'
+ \___ Cannot find PMU `krava'. Missing kernel support?
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: Milian Wolff <milian.wolff@kdab.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/20180606221513.11302-3-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/parse-events.y | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/tools/perf/util/parse-events.y
++++ b/tools/perf/util/parse-events.y
+@@ -227,11 +227,16 @@ event_def: event_pmu |
+ event_pmu:
+ PE_NAME opt_pmu_config
+ {
++ struct parse_events_state *parse_state = _parse_state;
++ struct parse_events_error *error = parse_state->error;
+ struct list_head *list, *orig_terms, *terms;
+
+ if (parse_events_copy_term_list($2, &orig_terms))
+ YYABORT;
+
++ if (error)
++ error->idx = @1.first_column;
++
+ ALLOC_LIST(list);
+ if (parse_events_add_pmu(_parse_state, list, $1, $2, false, false)) {
+ struct perf_pmu *pmu = NULL;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jeremy Cline <jcline@redhat.com>
+Date: Tue, 10 Jul 2018 11:46:12 -0400
+Subject: perf tools: Use python-config --includes rather than --cflags
+
+From: Jeremy Cline <jcline@redhat.com>
+
+[ Upstream commit 32aa928a7b817140c84987b726d5014911808fa4 ]
+
+Builds started failing in Fedora on Python 3.7 with:
+
+ `.gnu.debuglto_.debug_macro' referenced in section
+ `.gnu.debuglto_.debug_macro' of
+ util/scripting-engines/trace-event-python.o: defined in discarded
+ section
+
+In Fedora, Python 3.7 added -flto to the list of --cflags and since it
+was only applied to util/scripting-engines/trace-event-python.c and
+scripts/python/Perf-Trace-Util/Context.c, linking failed.
+
+It's not the first time the addition of flags has broken builds: commit
+c6707fdef7e2 ("perf tools: Fix up build in hardnened environments")
+appears to have fixed a similar problem. "python-config --includes"
+provides the proper -I flags and doesn't introduce additional CFLAGS.
+
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180710154612.6285-1-jcline@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/Makefile.config | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -207,8 +207,7 @@ ifdef PYTHON_CONFIG
+ PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) --ldflags 2>/dev/null)
+ PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS))
+ PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil
+- PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null)
+- PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS))
++ PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null)
+ FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS)
+ endif
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Wed, 27 Jun 2018 13:49:02 +0200
+Subject: pinctrl: ingenic: Fix inverted direction for < JZ4770
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 0084a786ca8c84b443f67c4a697b4f2552761650 ]
+
+The .gpio_set_direction() callback was setting inverted direction
+for SoCs older than the JZ4770, this restores the correct behaviour.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-ingenic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direc
+ ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input);
+ } else {
+ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false);
+- ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input);
++ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input);
+ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 11 Jul 2018 12:34:21 +0000
+Subject: pinctrl: nsp: Fix potential NULL dereference
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit c29e9da56bebb4c2c794e871b0dc0298bbf08142 ]
+
+platform_get_resource() may fail and return NULL, so we should
+better check it's return value to avoid a NULL pointer dereference
+a bit later in the code.
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = platform_get_resource(pdev, t, n);
++ if (!res)
++ return -EINVAL;
+... when != res == NULL
+e = devm_ioremap_nocache(e1, res->start, e2);
+
+Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platf
+ return PTR_ERR(pinctrl->base0);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res)
++ return -EINVAL;
+ pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
+ resource_size(res));
+ if (!pinctrl->base1) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 3 Jul 2018 15:04:25 +0300
+Subject: pinctrl: nsp: off by ones in nsp_pinmux_enable()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f90a21c898db58eaea14b8ad7e9af3b9e15e5f8a ]
+
+The > comparisons should be >= or else we read beyond the end of the
+pinctrl->functions[] array.
+
+Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinc
+ const struct nsp_pin_function *func;
+ const struct nsp_pin_group *grp;
+
+- if (grp_select > pinctrl->num_groups ||
+- func_select > pinctrl->num_functions)
++ if (grp_select >= pinctrl->num_groups ||
++ func_select >= pinctrl->num_functions)
+ return -EINVAL;
+
+ func = &pinctrl->functions[func_select];
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: "Damien Thébault" <damien@dtbo.net>
+Date: Wed, 18 Jul 2018 12:06:01 +0200
+Subject: platform/x86: dell-laptop: Fix backlight detection
+
+From: "Damien Thébault" <damien@dtbo.net>
+
+[ Upstream commit 2502e5a025935b7b476b69eda4959b3c4022c72b ]
+
+Fix return code check for "max brightness" ACPI call.
+
+The Dell laptop ACPI video brightness control is not present on dell
+laptops anymore, but was present in older kernel versions.
+
+The code that checks the return value is incorrect since the SMM
+refactoring.
+
+The old code was:
+ if (buffer->output[0] == 0)
+
+Which was changed to:
+ ret = dell_send_request(...)
+ if (ret)
+
+However, dell_send_request() will return 0 if buffer->output[0] == 0,
+so we must change the check to:
+ if (ret == 0)
+
+This issue was found on a Dell M4800 laptop, and the fix tested on it
+as well.
+
+Fixes: 549b4930f057 ("dell-smbios: Introduce dispatcher for SMM calls")
+Signed-off-by: Damien Thébault <damien@dtbo.net>
+Tested-by: Damien Thébault <damien@dtbo.net>
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell-laptop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -2170,7 +2170,7 @@ static int __init dell_init(void)
+ dell_fill_request(&buffer, token->location, 0, 0, 0);
+ ret = dell_send_request(&buffer,
+ CLASS_TOKEN_READ, SELECT_TOKEN_AC);
+- if (ret)
++ if (ret == 0)
+ max_intensity = buffer.output[3];
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Fri, 15 Jun 2018 15:58:45 -0400
+Subject: pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 2dbf8dffbf35fd8f611083b9d9fe74fdccf912a3 ]
+
+Right now, we can call nfs_commit_inode() while holding the session slot,
+which could lead to NFSv4 deadlocks. Ensure we only keep the slot if
+the server returned a layout that we have to process.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8620,6 +8620,8 @@ nfs4_layoutget_handle_exception(struct r
+
+ dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
+
++ nfs4_sequence_free_slot(&lgp->res.seq_res);
++
+ switch (nfs4err) {
+ case 0:
+ goto out;
+@@ -8684,7 +8686,6 @@ nfs4_layoutget_handle_exception(struct r
+ goto out;
+ }
+
+- nfs4_sequence_free_slot(&lgp->res.seq_res);
+ err = nfs4_handle_exception(server, nfs4err, exception);
+ if (!status) {
+ if (exception->retry)
+@@ -8810,20 +8811,22 @@ nfs4_proc_layoutget(struct nfs4_layoutge
+ if (IS_ERR(task))
+ return ERR_CAST(task);
+ status = rpc_wait_for_completion_task(task);
+- if (status == 0) {
++ if (status != 0)
++ goto out;
++
++ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
++ if (task->tk_status < 0 || lgp->res.layoutp->len == 0) {
+ status = nfs4_layoutget_handle_exception(task, lgp, &exception);
+ *timeout = exception.timeout;
+- }
+-
++ } else
++ lseg = pnfs_layout_process(lgp);
++out:
+ trace_nfs4_layoutget(lgp->args.ctx,
+ &lgp->args.range,
+ &lgp->res.range,
+ &lgp->res.stateid,
+ status);
+
+- /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+- if (status == 0 && lgp->res.layoutp->len)
+- lseg = pnfs_layout_process(lgp);
+ rpc_put_task(task);
+ dprintk("<-- %s status=%d\n", __func__, status);
+ if (status)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 18 Jun 2018 16:07:59 +0200
+Subject: posix-timers: Fix nanosleep_copyout() for CONFIG_COMPAT_32BIT_TIME
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0fe2795516b9e1c59b58b02bdf8658698117ec4e ]
+
+Commit b5793b0d92c9 added support for building the nanosleep compat system
+call on 32-bit architectures, but missed one change in nanosleep_copyout(),
+which would trigger a BUG() as soon as any architecture is switched over to
+use it.
+
+Use the proper config symbol to enable the code path.
+
+Fixes: Commit b5793b0d92c9 ("posix-timers: Make compat syscalls depend on CONFIG_COMPAT_32BIT_TIME")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: y2038@lists.linaro.org
+Cc: Anna-Maria Gleixner <anna-maria@linutronix.de>
+Cc: Deepa Dinamani <deepa.kernel@gmail.com>
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Link: https://lkml.kernel.org/r/20180618140811.2998503-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/hrtimer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1659,7 +1659,7 @@ EXPORT_SYMBOL_GPL(hrtimer_init_sleeper);
+ int nanosleep_copyout(struct restart_block *restart, struct timespec64 *ts)
+ {
+ switch(restart->nanosleep.type) {
+-#ifdef CONFIG_COMPAT
++#ifdef CONFIG_COMPAT_32BIT_TIME
+ case TT_COMPAT:
+ if (compat_put_timespec64(ts, restart->nanosleep.compat_rmtp))
+ return -EFAULT;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Sat, 19 May 2018 14:35:53 +1000
+Subject: powerpc: smp_send_stop do not offline stopped CPUs
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit de6e5d38417e6cdb005843db420a2974993d36ff ]
+
+Marking CPUs stopped by smp_send_stop as offline can cause warnings
+due to cross-CPU wakeups. This trace was noticed on a busy system
+running a sysrq+c crash test, after the injected crash:
+
+WARNING: CPU: 51 PID: 1546 at kernel/sched/core.c:1179 set_task_cpu+0x22c/0x240
+CPU: 51 PID: 1546 Comm: kworker/u352:1 Tainted: G D
+Workqueue: mlx5e mlx5e_update_stats_work [mlx5_core]
+[...]
+NIP [c00000000017c21c] set_task_cpu+0x22c/0x240
+LR [c00000000017d580] try_to_wake_up+0x230/0x720
+Call Trace:
+[c000000001017700] runqueues+0x0/0xb00 (unreliable)
+[c00000000017d580] try_to_wake_up+0x230/0x720
+[c00000000015a214] insert_work+0x104/0x140
+[c00000000015adb0] __queue_work+0x230/0x690
+[c000003fc5007910] [c00000000015b26c] queue_work_on+0x5c/0x90
+[c0080000135fc8f8] mlx5_cmd_exec+0x538/0xcb0 [mlx5_core]
+[c008000013608fd0] mlx5_core_access_reg+0x140/0x1d0 [mlx5_core]
+[c00800001362777c] mlx5e_update_pport_counters.constprop.59+0x6c/0x90 [mlx5_core]
+[c008000013628868] mlx5e_update_ndo_stats+0x28/0x90 [mlx5_core]
+[c008000013625558] mlx5e_update_stats_work+0x68/0xb0 [mlx5_core]
+[c00000000015bcec] process_one_work+0x1bc/0x5f0
+[c00000000015ecac] worker_thread+0xac/0x6b0
+[c000000000168338] kthread+0x168/0x1b0
+[c00000000000b628] ret_from_kernel_thread+0x5c/0xb4
+
+This happens because firstly the CPU is not really offline in the
+usual sense, processes and interrupts have not been migrated away.
+Secondly smp_send_stop does not happen atomically on all CPUs, so
+one CPU can have marked itself offline, while another CPU is still
+running processes or interrupts which can affect the first CPU.
+
+Fix this by just not marking the CPU as offline. It's more like
+frozen in time, so offline does not really reflect its state properly
+anyway. There should be nothing in the crash/panic path that walks
+online CPUs and synchronously waits for them, so this change should
+not introduce new hangs.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/smp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -579,9 +579,6 @@ static void nmi_stop_this_cpu(struct pt_
+ nmi_ipi_busy_count--;
+ nmi_ipi_unlock();
+
+- /* Remove this CPU */
+- set_cpu_online(smp_processor_id(), false);
+-
+ spin_begin();
+ while (1)
+ spin_cpu_relax();
+@@ -596,9 +593,6 @@ void smp_send_stop(void)
+
+ static void stop_this_cpu(void *dummy)
+ {
+- /* Remove this CPU */
+- set_cpu_online(smp_processor_id(), false);
+-
+ hard_irq_disable();
+ spin_begin();
+ while (1)
--- /dev/null
+From 36ecc1481dc8d8c52d43ba18c6b642c1d2fde789 Mon Sep 17 00:00:00 2001
+From: Matthijs van Duin <matthijsvanduin@gmail.com>
+Date: Thu, 19 Jul 2018 10:43:46 +0200
+Subject: pty: fix O_CLOEXEC for TIOCGPTPEER
+
+From: Matthijs van Duin <matthijsvanduin@gmail.com>
+
+commit 36ecc1481dc8d8c52d43ba18c6b642c1d2fde789 upstream.
+
+It was being ignored because the flags were not passed to fd allocation.
+
+Fixes: 54ebbfb16034 ("tty: add TIOCGPTPEER ioctl")
+Signed-off-by: Matthijs van Duin <matthijsvanduin@gmail.com>
+Acked-by: Aleksa Sarai <asarai@suse.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/pty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -625,7 +625,7 @@ int ptm_open_peer(struct file *master, s
+ if (tty->driver != ptm_driver)
+ return -EIO;
+
+- fd = get_unused_fd_flags(0);
++ fd = get_unused_fd_flags(flags);
+ if (fd < 0) {
+ retval = fd;
+ goto err;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 18 Jun 2018 21:58:01 -0700
+Subject: qed: Add sanity check for SIMD fastpath handler.
+
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+
+[ Upstream commit 3935a70968820c3994db4de7e6e1c7e814bff875 ]
+
+Avoid calling a SIMD fastpath handler if it is NULL. The check is needed
+to handle an unlikely scenario where unsolicited interrupt is destined to
+a PF in INTa mode.
+
+Fixes: fe56b9e6a ("qed: Add module with basic common support")
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -566,8 +566,16 @@ static irqreturn_t qed_single_int(int ir
+ /* Fastpath interrupts */
+ for (j = 0; j < 64; j++) {
+ if ((0x2ULL << j) & status) {
+- hwfn->simd_proto_handler[j].func(
+- hwfn->simd_proto_handler[j].token);
++ struct qed_simd_fp_handler *p_handler =
++ &hwfn->simd_proto_handler[j];
++
++ if (p_handler->func)
++ p_handler->func(p_handler->token);
++ else
++ DP_NOTICE(hwfn,
++ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
++ j, status);
++
+ status &= ~(0x2ULL << j);
+ rc = IRQ_HANDLED;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 18 Jun 2018 21:58:02 -0700
+Subject: qed: Do not advertise DCBX_LLD_MANAGED capability.
+
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+
+[ Upstream commit ff54d5cd9ec15546abc870452dd0b66eef4b4606 ]
+
+Do not advertise DCBX_LLD_MANAGED capability i.e., do not allow
+external agent to manage the dcbx/lldp negotiation. MFW acts as lldp agent
+for qed* devices, and no other lldp agent is allowed to coexist with mfw.
+
+Also updated a debug print, to not to display the redundant info.
+
+Fixes: a1d8d8a51 ("qed: Add dcbnl support.")
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qe
+ *type = DCBX_PROTOCOL_ROCE_V2;
+ } else {
+ *type = DCBX_MAX_PROTOCOL_TYPE;
+- DP_ERR(p_hwfn,
+- "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n",
+- id, app_prio_bitmap);
++ DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n",
++ app_prio_bitmap);
+ return false;
+ }
+
+@@ -1469,8 +1468,8 @@ static u8 qed_dcbnl_getcap(struct qed_de
+ *cap = 0x80;
+ break;
+ case DCB_CAP_ATTR_DCBX:
+- *cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE |
+- DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC);
++ *cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE |
++ DCB_CAP_DCBX_STATIC);
+ break;
+ default:
+ *cap = false;
+@@ -1538,8 +1537,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_d
+ if (!dcbx_info)
+ return 0;
+
+- if (dcbx_info->operational.enabled)
+- mode |= DCB_CAP_DCBX_LLD_MANAGED;
+ if (dcbx_info->operational.ieee)
+ mode |= DCB_CAP_DCBX_VER_IEEE;
+ if (dcbx_info->operational.cee)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 18 Jun 2018 21:58:00 -0700
+Subject: qed: Fix possible memory leak in Rx error path handling.
+
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+
+[ Upstream commit 4f9de4df901fb84709fe3a864dfa4eaf35700f68 ]
+
+Memory for packet buffers need to be freed in the error paths as there is
+no consumer (e.g., upper layer) for such packets and that memory will never
+get freed.
+The issue was uncovered when port was attacked with flood of isatap
+packets, these are multicast packets hence were directed at all the PFs.
+For foce PF, this meant they were routed to the ll2 module which in turn
+drops such packets.
+
+Fixes: 0a7fb11c ("qed: Add Light L2 support")
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *c
+
+ skb = build_skb(buffer->data, 0);
+ if (!skb) {
+- rc = -ENOMEM;
+- goto out_post;
++ DP_INFO(cdev, "Failed to build SKB\n");
++ kfree(buffer->data);
++ goto out_post1;
+ }
+
+ data->u.placement_offset += NET_SKB_PAD;
+@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *c
+ cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
+ data->opaque_data_0,
+ data->opaque_data_1);
++ } else {
++ DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
++ QED_MSG_LL2 | QED_MSG_STORAGE),
++ "Dropping the packet\n");
++ kfree(buffer->data);
+ }
+
++out_post1:
+ /* Update Buffer information and update FW producer */
+ buffer->data = new_data;
+ buffer->phys_addr = new_phys_addr;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:52:36 +0300
+Subject: qed: off by one in qed_parse_mcp_trace_buf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0df8adbb88db8283f102a2afa91610a502245cb2 ]
+
+If format_idx == s_mcp_trace_meta.formats_num then we read one element
+beyond the end of the s_mcp_trace_meta.formats[] array.
+
+Fixes: 50bc60cb155c ("qed*: Utilize FW 8.33.11.0")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+@@ -6663,7 +6663,7 @@ static enum dbg_status qed_parse_mcp_tra
+ format_idx = header & MFW_TRACE_EVENTID_MASK;
+
+ /* Skip message if its index doesn't exist in the meta data */
+- if (format_idx > s_mcp_trace_meta.formats_num) {
++ if (format_idx >= s_mcp_trace_meta.formats_num) {
+ u8 format_size =
+ (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >>
+ MFW_TRACE_PRM_SIZE_SHIFT);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 12 Jul 2018 15:23:45 +0300
+Subject: qlogic: check kstrtoul() for errors
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ]
+
+We accidentally left out the error handling for kstrtoul().
+
+Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
+ struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+
+ ret = kstrtoul(buf, 16, &data);
++ if (ret)
++ return ret;
+
+ switch (data) {
+ case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 2 Jul 2018 22:49:35 +0200
+Subject: r8169: fix mac address change
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 2d0ec5440bef4a0a8858d52d45c31725540c3e74 ]
+
+Network core refuses to change mac address because flag
+IFF_LIVE_ADDR_CHANGE isn't set. Set this missing flag.
+
+Fixes: 1f7aa2bc268e ("r8169: simplify rtl_set_mac_address")
+Reported-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Tested-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -8345,6 +8345,7 @@ static int rtl_init_one(struct pci_dev *
+ NETIF_F_HW_VLAN_CTAG_RX;
+ dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO |
+ NETIF_F_HIGHDMA;
++ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+
+ tp->cp_cmd |= RxChkSum | RxVlan;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Wed, 4 Jul 2018 11:14:50 +0300
+Subject: ravb: fix invalid context bug while calling auto-negotiation by ethtool
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+[ Upstream commit 0973a4dd79fe56a3beecfcff675ba4c01df0b0c1 ]
+
+Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
+potentially sleeping") phy_start_aneg() function utilizes a mutex
+to serialize changes to phy state, however the helper function is
+called in atomic context.
+
+The bug can be reproduced by running "ethtool -r" command, the bug
+is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1152,15 +1152,10 @@ error_exit:
+
+ static int ravb_nway_reset(struct net_device *ndev)
+ {
+- struct ravb_private *priv = netdev_priv(ndev);
+ int error = -ENODEV;
+- unsigned long flags;
+
+- if (ndev->phydev) {
+- spin_lock_irqsave(&priv->lock, flags);
++ if (ndev->phydev)
+ error = phy_start_aneg(ndev->phydev);
+- spin_unlock_irqrestore(&priv->lock, flags);
+- }
+
+ return error;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Wed, 4 Jul 2018 11:14:51 +0300
+Subject: ravb: fix invalid context bug while changing link options by ethtool
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+[ Upstream commit 05925e52a7d379192a5fdff2c33710f573190ead ]
+
+The change fixes sleep in atomic context bug, which is encountered
+every time when link settings are changed by ethtool.
+
+Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
+potentially sleeping") phy_start_aneg() function utilizes a mutex
+to serialize changes to phy state, however that helper function is
+called in atomic context under a grabbed spinlock, because
+phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
+replaced phy_ethtool_sset() helpers from phylib.
+
+Now duplex mode setting is enforced in ravb_adjust_link() only, also
+now RX/TX is disabled when link is put down or modifications to E-MAC
+registers ECMR and GECMR are expected for both cases of checked and
+ignored link status pin state from E-MAC interrupt handler.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 49 +++++++++----------------------
+ 1 file changed, 15 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_
+ struct ravb_private *priv = netdev_priv(ndev);
+ struct phy_device *phydev = ndev->phydev;
+ bool new_state = false;
++ unsigned long flags;
++
++ spin_lock_irqsave(&priv->lock, flags);
++
++ /* Disable TX and RX right over here, if E-MAC change is ignored */
++ if (priv->no_avb_link)
++ ravb_rcv_snd_disable(ndev);
+
+ if (phydev->link) {
+ if (phydev->duplex != priv->duplex) {
+@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_
+ ravb_modify(ndev, ECMR, ECMR_TXF, 0);
+ new_state = true;
+ priv->link = phydev->link;
+- if (priv->no_avb_link)
+- ravb_rcv_snd_enable(ndev);
+ }
+ } else if (priv->link) {
+ new_state = true;
+ priv->link = 0;
+ priv->speed = 0;
+ priv->duplex = -1;
+- if (priv->no_avb_link)
+- ravb_rcv_snd_disable(ndev);
+ }
+
++ /* Enable TX and RX right over here, if E-MAC change is ignored */
++ if (priv->no_avb_link && phydev->link)
++ ravb_rcv_snd_enable(ndev);
++
++ mmiowb();
++ spin_unlock_irqrestore(&priv->lock, flags);
++
+ if (new_state && netif_msg_link(priv))
+ phy_print_status(phydev);
+ }
+@@ -1115,39 +1125,10 @@ static int ravb_get_link_ksettings(struc
+ static int ravb_set_link_ksettings(struct net_device *ndev,
+ const struct ethtool_link_ksettings *cmd)
+ {
+- struct ravb_private *priv = netdev_priv(ndev);
+- unsigned long flags;
+- int error;
+-
+ if (!ndev->phydev)
+ return -ENODEV;
+
+- spin_lock_irqsave(&priv->lock, flags);
+-
+- /* Disable TX and RX */
+- ravb_rcv_snd_disable(ndev);
+-
+- error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+- if (error)
+- goto error_exit;
+-
+- if (cmd->base.duplex == DUPLEX_FULL)
+- priv->duplex = 1;
+- else
+- priv->duplex = 0;
+-
+- ravb_set_duplex(ndev);
+-
+-error_exit:
+- mdelay(1);
+-
+- /* Enable TX and RX */
+- ravb_rcv_snd_enable(ndev);
+-
+- mmiowb();
+- spin_unlock_irqrestore(&priv->lock, flags);
+-
+- return error;
++ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+
+ static int ravb_nway_reset(struct net_device *ndev)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Kamal Heib <kamalheib1@gmail.com>
+Date: Tue, 10 Jul 2018 11:56:50 +0300
+Subject: RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit d63c46734c545ad0488761059004a65c46efdde3 ]
+
+Fix memory leak in the error path of mlx5_ib_create_srq() by making sure
+to free the allocated srq.
+
+Fixes: c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Acked-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/srq.c
++++ b/drivers/infiniband/hw/mlx5/srq.c
+@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct
+
+ desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
+ srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
+- if (desc_size == 0 || srq->msrq.max_gs > desc_size)
+- return ERR_PTR(-EINVAL);
++ if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
++ err = -EINVAL;
++ goto err_srq;
++ }
+ desc_size = roundup_pow_of_two(desc_size);
+ desc_size = max_t(size_t, 32, desc_size);
+- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
+- return ERR_PTR(-EINVAL);
++ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
++ err = -EINVAL;
++ goto err_srq;
++ }
+ srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
+ sizeof(struct mlx5_wqe_data_seg);
+ srq->msrq.wqe_shift = ilog2(desc_size);
+ buf_size = srq->msrq.max * desc_size;
+- if (buf_size < desc_size)
+- return ERR_PTR(-EINVAL);
++ if (buf_size < desc_size) {
++ err = -EINVAL;
++ goto err_srq;
++ }
+ in.type = init_attr->srq_type;
+
+ if (pd->uobject)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Kalderon, Michal" <Michal.Kalderon@cavium.com>
+Date: Mon, 11 Jun 2018 10:20:20 +0300
+Subject: RDMA/qedr: Fix NULL pointer dereference when running over iWARP without RDMA-CM
+
+From: "Kalderon, Michal" <Michal.Kalderon@cavium.com>
+
+[ Upstream commit 425cf5c1350a98b81f3ddda160b99c3be613a213 ]
+
+Some RoCE specific code in qedr_modify_qp was run over an iWARP device
+when running perftest benchmarks without the -R option.
+
+The commit 3e44e0ee0893 ("IB/providers: Avoid null netdev check for RoCE")
+exposed this. Dropping the check for NULL pointer on ndev in
+qedr_modify_qp lead to a null pointer dereference when running over
+iWARP. Before the code would identify ndev as being NULL and return an
+error.
+
+Fixes: 3e44e0ee0893 ("IB/providers: Avoid null netdev check for RoCE")
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -1957,6 +1957,9 @@ int qedr_modify_qp(struct ib_qp *ibqp, s
+ }
+
+ if (attr_mask & (IB_QP_AV | IB_QP_PATH_MTU)) {
++ if (rdma_protocol_iwarp(&dev->ibdev, 1))
++ return -EINVAL;
++
+ if (attr_mask & IB_QP_PATH_MTU) {
+ if (attr->path_mtu < IB_MTU_256 ||
+ attr->path_mtu > IB_MTU_4096) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Date: Mon, 25 Jun 2018 06:41:25 -0700
+Subject: rds: clean up loopback rds_connections on netns deletion
+
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+
+[ Upstream commit c809195f5523dd4d09403bbb1c9732d548aa0d1e ]
+
+The RDS core module creates rds_connections based on callbacks
+from rds_loop_transport when sending/receiving packets to local
+addresses.
+
+These connections will need to be cleaned up when they are
+created from a netns that is not init_net, and that netns is deleted.
+
+Add the changes aligned with the changes from
+commit ebeeb1ad9b8a ("rds: tcp: use rds_destroy_pending() to synchronize
+netns/module teardown and rds connection/workq management") for
+rds_loop_transport
+
+Reported-and-tested-by: syzbot+4c20b3866171ce8441d2@syzkaller.appspotmail.com
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rds/connection.c | 11 +++++++++-
+ net/rds/loop.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ net/rds/loop.h | 2 +
+ 3 files changed, 68 insertions(+), 1 deletion(-)
+
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket
+
+ int rds_conn_init(void)
+ {
++ int ret;
++
++ ret = rds_loop_net_init(); /* register pernet callback */
++ if (ret)
++ return ret;
++
+ rds_conn_slab = kmem_cache_create("rds_connection",
+ sizeof(struct rds_connection),
+ 0, 0, NULL);
+- if (!rds_conn_slab)
++ if (!rds_conn_slab) {
++ rds_loop_net_exit();
+ return -ENOMEM;
++ }
+
+ rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info);
+ rds_info_register_func(RDS_INFO_SEND_MESSAGES,
+@@ -676,6 +684,7 @@ int rds_conn_init(void)
+
+ void rds_conn_exit(void)
+ {
++ rds_loop_net_exit(); /* unregister pernet callback */
+ rds_loop_exit();
+
+ WARN_ON(!hlist_empty(rds_conn_hash));
+--- a/net/rds/loop.c
++++ b/net/rds/loop.c
+@@ -33,6 +33,8 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/in.h>
++#include <net/net_namespace.h>
++#include <net/netns/generic.h>
+
+ #include "rds_single_path.h"
+ #include "rds.h"
+@@ -40,6 +42,17 @@
+
+ static DEFINE_SPINLOCK(loop_conns_lock);
+ static LIST_HEAD(loop_conns);
++static atomic_t rds_loop_unloading = ATOMIC_INIT(0);
++
++static void rds_loop_set_unloading(void)
++{
++ atomic_set(&rds_loop_unloading, 1);
++}
++
++static bool rds_loop_is_unloading(struct rds_connection *conn)
++{
++ return atomic_read(&rds_loop_unloading) != 0;
++}
+
+ /*
+ * This 'loopback' transport is a special case for flows that originate
+@@ -165,6 +178,8 @@ void rds_loop_exit(void)
+ struct rds_loop_connection *lc, *_lc;
+ LIST_HEAD(tmp_list);
+
++ rds_loop_set_unloading();
++ synchronize_rcu();
+ /* avoid calling conn_destroy with irqs off */
+ spin_lock_irq(&loop_conns_lock);
+ list_splice(&loop_conns, &tmp_list);
+@@ -177,6 +192,46 @@ void rds_loop_exit(void)
+ }
+ }
+
++static void rds_loop_kill_conns(struct net *net)
++{
++ struct rds_loop_connection *lc, *_lc;
++ LIST_HEAD(tmp_list);
++
++ spin_lock_irq(&loop_conns_lock);
++ list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node) {
++ struct net *c_net = read_pnet(&lc->conn->c_net);
++
++ if (net != c_net)
++ continue;
++ list_move_tail(&lc->loop_node, &tmp_list);
++ }
++ spin_unlock_irq(&loop_conns_lock);
++
++ list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) {
++ WARN_ON(lc->conn->c_passive);
++ rds_conn_destroy(lc->conn);
++ }
++}
++
++static void __net_exit rds_loop_exit_net(struct net *net)
++{
++ rds_loop_kill_conns(net);
++}
++
++static struct pernet_operations rds_loop_net_ops = {
++ .exit = rds_loop_exit_net,
++};
++
++int rds_loop_net_init(void)
++{
++ return register_pernet_device(&rds_loop_net_ops);
++}
++
++void rds_loop_net_exit(void)
++{
++ unregister_pernet_device(&rds_loop_net_ops);
++}
++
+ /*
+ * This is missing .xmit_* because loop doesn't go through generic
+ * rds_send_xmit() and doesn't call rds_recv_incoming(). .listen_stop and
+@@ -194,4 +249,5 @@ struct rds_transport rds_loop_transport
+ .inc_free = rds_loop_inc_free,
+ .t_name = "loopback",
+ .t_type = RDS_TRANS_LOOP,
++ .t_unloading = rds_loop_is_unloading,
+ };
+--- a/net/rds/loop.h
++++ b/net/rds/loop.h
+@@ -5,6 +5,8 @@
+ /* loop.c */
+ extern struct rds_transport rds_loop_transport;
+
++int rds_loop_net_init(void);
++void rds_loop_net_exit(void);
+ void rds_loop_exit(void);
+
+ #endif
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Palmer Dabbelt <palmer@sifive.com>
+Date: Fri, 22 Jun 2018 15:46:28 -0700
+Subject: RISC-V: Don't include irq-riscv-intc.h
+
+From: Palmer Dabbelt <palmer@sifive.com>
+
+[ Upstream commit 8606544890d7dc4f7a740963f70dc1e1d54f8e30 ]
+
+This file has never existed in the upstream kernel, but it's guarded by
+an #ifdef that's also never existed in the upstream kernel. As a part
+of our interrupt controller refactoring this header is no longer
+necessary, but this reference managed to sneak in anyway.
+
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/irq.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/arch/riscv/kernel/irq.c
++++ b/arch/riscv/kernel/irq.c
+@@ -16,10 +16,6 @@
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
+
+-#ifdef CONFIG_RISCV_INTC
+-#include <linux/irqchip/irq-riscv-intc.h>
+-#endif
+-
+ void __init init_IRQ(void)
+ {
+ irqchip_init();
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jim Wilson <jimw@sifive.com>
+Date: Mon, 11 Jun 2018 14:48:22 -0700
+Subject: RISC-V: Fix PTRACE_SETREGSET bug.
+
+From: Jim Wilson <jimw@sifive.com>
+
+[ Upstream commit 1db9b80980d26fe95c942e0bb8bde2ca715029ad ]
+
+In riscv_gpr_set, pass regs instead of ®s to user_regset_copyin to fix
+gdb segfault.
+
+Signed-off-by: Jim Wilson <jimw@sifive.com>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/riscv/kernel/ptrace.c
++++ b/arch/riscv/kernel/ptrace.c
+@@ -50,7 +50,7 @@ static int riscv_gpr_set(struct task_str
+ struct pt_regs *regs;
+
+ regs = task_pt_regs(target);
+- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ®s, 0, -1);
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, regs, 0, -1);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Andreas Schwab <schwab@suse.de>
+Date: Tue, 12 Jun 2018 19:26:36 +0200
+Subject: RISC-V: fix R_RISCV_ADD32/R_RISCV_SUB32 relocations
+
+From: Andreas Schwab <schwab@suse.de>
+
+[ Upstream commit 781c8fe2da3d2c7c95cd7ffddbab63b80a79da4d ]
+
+The R_RISCV_ADD32/R_RISCV_SUB32 relocations should add/subtract the
+address of the symbol (without overflow check), not its contents.
+
+Signed-off-by: Andreas Schwab <schwab@suse.de>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/module.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -252,14 +252,14 @@ static int apply_r_riscv_align_rela(stru
+ static int apply_r_riscv_add32_rela(struct module *me, u32 *location,
+ Elf_Addr v)
+ {
+- *(u32 *)location += (*(u32 *)v);
++ *(u32 *)location += (u32)v;
+ return 0;
+ }
+
+ static int apply_r_riscv_sub32_rela(struct module *me, u32 *location,
+ Elf_Addr v)
+ {
+- *(u32 *)location -= (*(u32 *)v);
++ *(u32 *)location -= (u32)v;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 12 Jul 2018 12:22:44 +0200
+Subject: rtc: fix alarm read and set offset
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit fd6792bb022e43faa0c4a45b6f25285e21206f9d ]
+
+The offset needs to be added after reading the alarm value.
+
+It also needs to be subtracted after the now < alarm test.
+
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/interface.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -265,8 +265,10 @@ int __rtc_read_alarm(struct rtc_device *
+ return err;
+
+ /* full-function RTCs won't have such missing fields */
+- if (rtc_valid_tm(&alarm->time) == 0)
++ if (rtc_valid_tm(&alarm->time) == 0) {
++ rtc_add_offset(rtc, &alarm->time);
+ return 0;
++ }
+
+ /* get the "after" timestamp, to detect wrapped fields */
+ err = rtc_read_time(rtc, &now);
+@@ -409,7 +411,6 @@ static int __rtc_set_alarm(struct rtc_de
+ if (err)
+ return err;
+
+- rtc_subtract_offset(rtc, &alarm->time);
+ scheduled = rtc_tm_to_time64(&alarm->time);
+
+ /* Make sure we're not setting alarms in the past */
+@@ -426,6 +427,8 @@ static int __rtc_set_alarm(struct rtc_de
+ * over right here, before we set the alarm.
+ */
+
++ rtc_subtract_offset(rtc, &alarm->time);
++
+ if (!rtc->ops)
+ err = -ENODEV;
+ else if (!rtc->ops->set_alarm)
+@@ -467,7 +470,6 @@ int rtc_set_alarm(struct rtc_device *rtc
+
+ mutex_unlock(&rtc->ops_lock);
+
+- rtc_add_offset(rtc, &alarm->time);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(rtc_set_alarm);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Fri, 29 Jun 2018 19:45:54 +0200
+Subject: s390/qeth: consistently re-enable device features
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit d025da9eb1e48d3e5f2a2ff13ac5ac536ba4be43 ]
+
+commit e830baa9c3f0 ("qeth: restore device features after recovery") and
+commit ce3443564145 ("s390/qeth: rely on kernel for feature recovery")
+made sure that the HW functions for device features get re-programmed
+after recovery.
+
+But we missed that the same handling is also required when a card is
+first set offline (destroying all HW context), and then online again.
+Fix this by moving the re-enable action out of the recovery-only path.
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/net/qeth_core.h | 2 +-
+ drivers/s390/net/qeth_core_main.c | 23 +++++++++++------------
+ drivers/s390/net/qeth_l2_main.c | 5 ++---
+ drivers/s390/net/qeth_l3_main.c | 3 ++-
+ 4 files changed, 16 insertions(+), 17 deletions(-)
+
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -1003,7 +1003,7 @@ struct qeth_cmd_buffer *qeth_get_setassp
+ __u16, __u16,
+ enum qeth_prot_versions);
+ int qeth_set_features(struct net_device *, netdev_features_t);
+-void qeth_recover_features(struct net_device *dev);
++void qeth_enable_hw_features(struct net_device *dev);
+ netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
+ netdev_features_t qeth_features_check(struct sk_buff *skb,
+ struct net_device *dev,
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -6432,28 +6432,27 @@ static int qeth_set_ipa_tso(struct qeth_
+ #define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO)
+
+ /**
+- * qeth_recover_features() - Restore device features after recovery
+- * @dev: the recovering net_device
+- *
+- * Caller must hold rtnl lock.
++ * qeth_enable_hw_features() - (Re-)Enable HW functions for device features
++ * @dev: a net_device
+ */
+-void qeth_recover_features(struct net_device *dev)
++void qeth_enable_hw_features(struct net_device *dev)
+ {
+- netdev_features_t features = dev->features;
+ struct qeth_card *card = dev->ml_priv;
++ netdev_features_t features;
+
++ rtnl_lock();
++ features = dev->features;
+ /* force-off any feature that needs an IPA sequence.
+ * netdev_update_features() will restart them.
+ */
+ dev->features &= ~QETH_HW_FEATURES;
+ netdev_update_features(dev);
+-
+- if (features == dev->features)
+- return;
+- dev_warn(&card->gdev->dev,
+- "Device recovery failed to restore all offload features\n");
++ if (features != dev->features)
++ dev_warn(&card->gdev->dev,
++ "Device recovery failed to restore all offload features\n");
++ rtnl_unlock();
+ }
+-EXPORT_SYMBOL_GPL(qeth_recover_features);
++EXPORT_SYMBOL_GPL(qeth_enable_hw_features);
+
+ int qeth_set_features(struct net_device *dev, netdev_features_t features)
+ {
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1130,6 +1130,8 @@ static int __qeth_l2_set_online(struct c
+ netif_carrier_off(card->dev);
+
+ qeth_set_allowed_threads(card, 0xffffffff, 0);
++
++ qeth_enable_hw_features(card->dev);
+ if (recover_flag == CARD_STATE_RECOVER) {
+ if (recovery_mode &&
+ card->info.type != QETH_CARD_TYPE_OSN) {
+@@ -1141,9 +1143,6 @@ static int __qeth_l2_set_online(struct c
+ }
+ /* this also sets saved unicast addresses */
+ qeth_l2_set_rx_mode(card->dev);
+- rtnl_lock();
+- qeth_recover_features(card->dev);
+- rtnl_unlock();
+ }
+ /* let user_space know that device is online */
+ kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2792,6 +2792,8 @@ static int __qeth_l3_set_online(struct c
+ netif_carrier_on(card->dev);
+ else
+ netif_carrier_off(card->dev);
++
++ qeth_enable_hw_features(card->dev);
+ if (recover_flag == CARD_STATE_RECOVER) {
+ rtnl_lock();
+ if (recovery_mode)
+@@ -2799,7 +2801,6 @@ static int __qeth_l3_set_online(struct c
+ else
+ dev_open(card->dev);
+ qeth_l3_set_rx_mode(card->dev);
+- qeth_recover_features(card->dev);
+ rtnl_unlock();
+ }
+ qeth_trace_features(card);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Wed, 4 Jul 2018 22:36:36 +0900
+Subject: samples/bpf: add missing <linux/if_vlan.h>
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+[ Upstream commit 4d5d33a085335ef469c9a87792bcaaaa8e64d8c4 ]
+
+This fixes build error regarding redefinition:
+
+ CLANG-bpf samples/bpf/parse_varlen.o
+ samples/bpf/parse_varlen.c:111:8: error: redefinition of 'vlan_hdr'
+ struct vlan_hdr {
+ ^
+ ./include/linux/if_vlan.h:38:8: note: previous definition is here
+
+So remove duplicate 'struct vlan_hdr' in sample code and include if_vlan.h
+
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ samples/bpf/parse_varlen.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/samples/bpf/parse_varlen.c
++++ b/samples/bpf/parse_varlen.c
+@@ -6,6 +6,7 @@
+ */
+ #define KBUILD_MODNAME "foo"
+ #include <linux/if_ether.h>
++#include <linux/if_vlan.h>
+ #include <linux/ip.h>
+ #include <linux/ipv6.h>
+ #include <linux/in.h>
+@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64
+ return 0;
+ }
+
+-struct vlan_hdr {
+- uint16_t h_vlan_TCI;
+- uint16_t h_vlan_encapsulated_proto;
+-};
+-
+ SEC("varlen")
+ int handle_ingress(struct __sk_buff *skb)
+ {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Wed, 4 Jul 2018 22:36:38 +0900
+Subject: samples/bpf: Check the error of write() and read()
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+[ Upstream commit 02a2f000a3629274bfad60bfc4de9edec49e63e7 ]
+
+test_task_rename() and test_urandom_read()
+can be failed during write() and read(),
+So check the result of them.
+
+Reviewed-by: David Laight <David.Laight@ACULAB.COM>
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ samples/bpf/test_overhead_user.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/samples/bpf/test_overhead_user.c
++++ b/samples/bpf/test_overhead_user.c
+@@ -6,6 +6,7 @@
+ */
+ #define _GNU_SOURCE
+ #include <sched.h>
++#include <errno.h>
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <asm/unistd.h>
+@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
+ exit(1);
+ }
+ start_time = time_get_ns();
+- for (i = 0; i < MAX_CNT; i++)
+- write(fd, buf, sizeof(buf));
++ for (i = 0; i < MAX_CNT; i++) {
++ if (write(fd, buf, sizeof(buf)) < 0) {
++ printf("task rename failed: %s\n", strerror(errno));
++ close(fd);
++ return;
++ }
++ }
+ printf("task_rename:%d: %lld events per sec\n",
+ cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ close(fd);
+@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
+ exit(1);
+ }
+ start_time = time_get_ns();
+- for (i = 0; i < MAX_CNT; i++)
+- read(fd, buf, sizeof(buf));
++ for (i = 0; i < MAX_CNT; i++) {
++ if (read(fd, buf, sizeof(buf)) < 0) {
++ printf("failed to read from /dev/urandom: %s\n", strerror(errno));
++ close(fd);
++ return;
++ }
++ }
+ printf("urandom_read:%d: %lld events per sec\n",
+ cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ close(fd);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Wed, 4 Jul 2018 22:36:37 +0900
+Subject: samples/bpf: Check the result of system()
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+[ Upstream commit 492b7e894587c151be681f86d4d1d086375f7b45 ]
+
+To avoid the below build warning message,
+use new generate_load() checking the return value.
+
+ ignoring return value of ‘system’, declared with attribute warn_unused_result
+
+And it also refactors the duplicate code of both
+test_perf_event_all_cpu() and test_perf_event_task()
+
+Cc: Teng Qin <qinteng@fb.com>
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ samples/bpf/trace_event_user.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+--- a/samples/bpf/trace_event_user.c
++++ b/samples/bpf/trace_event_user.c
+@@ -121,6 +121,16 @@ static void print_stacks(void)
+ }
+ }
+
++static inline int generate_load(void)
++{
++ if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
++ printf("failed to generate some load with dd: %s\n", strerror(errno));
++ return -1;
++ }
++
++ return 0;
++}
++
+ static void test_perf_event_all_cpu(struct perf_event_attr *attr)
+ {
+ int nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
+@@ -141,7 +151,11 @@ static void test_perf_event_all_cpu(stru
+ assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
+ assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0);
+ }
+- system("dd if=/dev/zero of=/dev/null count=5000k status=none");
++
++ if (generate_load() < 0) {
++ error = 1;
++ goto all_cpu_err;
++ }
+ print_stacks();
+ all_cpu_err:
+ for (i--; i >= 0; i--) {
+@@ -155,7 +169,7 @@ all_cpu_err:
+
+ static void test_perf_event_task(struct perf_event_attr *attr)
+ {
+- int pmu_fd;
++ int pmu_fd, error = 0;
+
+ /* per task perf event, enable inherit so the "dd ..." command can be traced properly.
+ * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
+@@ -170,10 +184,17 @@ static void test_perf_event_task(struct
+ }
+ assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
+ assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0);
+- system("dd if=/dev/zero of=/dev/null count=5000k status=none");
++
++ if (generate_load() < 0) {
++ error = 1;
++ goto err;
++ }
+ print_stacks();
++err:
+ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+ close(pmu_fd);
++ if (error)
++ int_exit(0);
+ }
+
+ static void test_bpf_perf_event(void)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Tue, 10 Jul 2018 02:51:21 +0900
+Subject: samples/bpf: Fix tc and ip paths in xdp2skb_meta.sh
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+[ Upstream commit b9626f45abccd044f8048269c67720f0719f2d4e ]
+
+The below path error can occur:
+
+ # ./xdp2skb_meta.sh --dev eth0 --list
+ ./xdp2skb_meta.sh: line 61: /usr/sbin/tc: No such file or directory
+
+So just use command names instead of absolute paths of tc and ip.
+In addition, it allow callers to redefine $TC and $IP paths
+
+Fixes: 36e04a2d78d9 ("samples/bpf: xdp2skb_meta shows transferring info from XDP to SKB")
+Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ samples/bpf/xdp2skb_meta.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/samples/bpf/xdp2skb_meta.sh
++++ b/samples/bpf/xdp2skb_meta.sh
+@@ -16,8 +16,8 @@
+ BPF_FILE=xdp2skb_meta_kern.o
+ DIR=$(dirname $0)
+
+-export TC=/usr/sbin/tc
+-export IP=/usr/sbin/ip
++[ -z "$TC" ] && TC=tc
++[ -z "$IP" ] && IP=ip
+
+ function usage() {
+ echo ""
+@@ -53,7 +53,7 @@ function _call_cmd() {
+ local allow_fail="$2"
+ shift 2
+ if [[ -n "$VERBOSE" ]]; then
+- echo "$(basename $cmd) $@"
++ echo "$cmd $@"
+ fi
+ if [[ -n "$DRYRUN" ]]; then
+ return
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Juri Lelli <juri.lelli@redhat.com>
+Date: Wed, 11 Jul 2018 09:29:48 +0200
+Subject: sched/deadline: Fix switched_from_dl() warning
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit e117cb52bdb4d376b711bee34af6434c9e314b3b ]
+
+Mark noticed that syzkaller is able to reliably trigger the following warning:
+
+ dl_rq->running_bw > dl_rq->this_bw
+ WARNING: CPU: 1 PID: 153 at kernel/sched/deadline.c:124 switched_from_dl+0x454/0x608
+ Kernel panic - not syncing: panic_on_warn set ...
+
+ CPU: 1 PID: 153 Comm: syz-executor253 Not tainted 4.18.0-rc3+ #29
+ Hardware name: linux,dummy-virt (DT)
+ Call trace:
+ dump_backtrace+0x0/0x458
+ show_stack+0x20/0x30
+ dump_stack+0x180/0x250
+ panic+0x2dc/0x4ec
+ __warn_printk+0x0/0x150
+ report_bug+0x228/0x2d8
+ bug_handler+0xa0/0x1a0
+ brk_handler+0x2f0/0x568
+ do_debug_exception+0x1bc/0x5d0
+ el1_dbg+0x18/0x78
+ switched_from_dl+0x454/0x608
+ __sched_setscheduler+0x8cc/0x2018
+ sys_sched_setattr+0x340/0x758
+ el0_svc_naked+0x30/0x34
+
+syzkaller reproducer runs a bunch of threads that constantly switch
+between DEADLINE and NORMAL classes while interacting through futexes.
+
+The splat above is caused by the fact that if a DEADLINE task is setattr
+back to NORMAL while in non_contending state (blocked on a futex -
+inactive timer armed), its contribution to running_bw is not removed
+before sub_rq_bw() gets called (!task_on_rq_queued() branch) and the
+latter sees running_bw > this_bw.
+
+Fix it by removing a task contribution from running_bw if the task is
+not queued and in non_contending state while switched to a different
+class.
+
+Reported-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Reviewed-by: Luca Abeni <luca.abeni@santannapisa.it>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: claudio@evidence.eu.com
+Cc: rostedt@goodmis.org
+Link: http://lkml.kernel.org/r/20180711072948.27061-1-juri.lelli@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/deadline.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2296,8 +2296,17 @@ static void switched_from_dl(struct rq *
+ if (task_on_rq_queued(p) && p->dl.dl_runtime)
+ task_non_contending(p);
+
+- if (!task_on_rq_queued(p))
++ if (!task_on_rq_queued(p)) {
++ /*
++ * Inactive timer is armed. However, p is leaving DEADLINE and
++ * might migrate away from this rq while continuing to run on
++ * some other class. We need to remove its contribution from
++ * this rq running_bw now, or sub_rq_bw (below) will complain.
++ */
++ if (p->dl.dl_non_contending)
++ sub_running_bw(&p->dl, &rq->dl);
+ sub_rq_bw(&p->dl, &rq->dl);
++ }
+
+ /*
+ * We cannot use inactive_task_timer() to invoke sub_running_bw()
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Xunlei Pang <xlpang@linux.alibaba.com>
+Date: Wed, 20 Jun 2018 18:18:33 +0800
+Subject: sched/fair: Fix bandwidth timer clock drift condition
+
+From: Xunlei Pang <xlpang@linux.alibaba.com>
+
+[ Upstream commit 512ac999d2755d2b7109e996a76b6fb8b888631d ]
+
+I noticed that cgroup task groups constantly get throttled even
+if they have low CPU usage, this causes some jitters on the response
+time to some of our business containers when enabling CPU quotas.
+
+It's very simple to reproduce:
+
+ mkdir /sys/fs/cgroup/cpu/test
+ cd /sys/fs/cgroup/cpu/test
+ echo 100000 > cpu.cfs_quota_us
+ echo $$ > tasks
+
+then repeat:
+
+ cat cpu.stat | grep nr_throttled # nr_throttled will increase steadily
+
+After some analysis, we found that cfs_rq::runtime_remaining will
+be cleared by expire_cfs_rq_runtime() due to two equal but stale
+"cfs_{b|q}->runtime_expires" after period timer is re-armed.
+
+The current condition to judge clock drift in expire_cfs_rq_runtime()
+is wrong, the two runtime_expires are actually the same when clock
+drift happens, so this condtion can never hit. The orginal design was
+correctly done by this commit:
+
+ a9cf55b28610 ("sched: Expire invalid runtime")
+
+... but was changed to be the current implementation due to its locking bug.
+
+This patch introduces another way, it adds a new field in both structures
+cfs_rq and cfs_bandwidth to record the expiration update sequence, and
+uses them to figure out if clock drift happens (true if they are equal).
+
+Signed-off-by: Xunlei Pang <xlpang@linux.alibaba.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Ben Segall <bsegall@google.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 51f2176d74ac ("sched/fair: Fix unlocked reads of some cfs_b->quota/period")
+Link: http://lkml.kernel.org/r/20180620101834.24455-1-xlpang@linux.alibaba.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/fair.c | 14 ++++++++------
+ kernel/sched/sched.h | 6 ++++--
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4549,6 +4549,7 @@ void __refill_cfs_bandwidth_runtime(stru
+ now = sched_clock_cpu(smp_processor_id());
+ cfs_b->runtime = cfs_b->quota;
+ cfs_b->runtime_expires = now + ktime_to_ns(cfs_b->period);
++ cfs_b->expires_seq++;
+ }
+
+ static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg)
+@@ -4571,6 +4572,7 @@ static int assign_cfs_rq_runtime(struct
+ struct task_group *tg = cfs_rq->tg;
+ struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(tg);
+ u64 amount = 0, min_amount, expires;
++ int expires_seq;
+
+ /* note: this is a positive sum as runtime_remaining <= 0 */
+ min_amount = sched_cfs_bandwidth_slice() - cfs_rq->runtime_remaining;
+@@ -4587,6 +4589,7 @@ static int assign_cfs_rq_runtime(struct
+ cfs_b->idle = 0;
+ }
+ }
++ expires_seq = cfs_b->expires_seq;
+ expires = cfs_b->runtime_expires;
+ raw_spin_unlock(&cfs_b->lock);
+
+@@ -4596,8 +4599,10 @@ static int assign_cfs_rq_runtime(struct
+ * spread between our sched_clock and the one on which runtime was
+ * issued.
+ */
+- if ((s64)(expires - cfs_rq->runtime_expires) > 0)
++ if (cfs_rq->expires_seq != expires_seq) {
++ cfs_rq->expires_seq = expires_seq;
+ cfs_rq->runtime_expires = expires;
++ }
+
+ return cfs_rq->runtime_remaining > 0;
+ }
+@@ -4623,12 +4628,9 @@ static void expire_cfs_rq_runtime(struct
+ * has not truly expired.
+ *
+ * Fortunately we can check determine whether this the case by checking
+- * whether the global deadline has advanced. It is valid to compare
+- * cfs_b->runtime_expires without any locks since we only care about
+- * exact equality, so a partial write will still work.
++ * whether the global deadline(cfs_b->expires_seq) has advanced.
+ */
+-
+- if (cfs_rq->runtime_expires != cfs_b->runtime_expires) {
++ if (cfs_rq->expires_seq == cfs_b->expires_seq) {
+ /* extend local deadline, drift is bounded above by 2 ticks */
+ cfs_rq->runtime_expires += TICK_NSEC;
+ } else {
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -334,9 +334,10 @@ struct cfs_bandwidth {
+ u64 runtime;
+ s64 hierarchical_quota;
+ u64 runtime_expires;
++ int expires_seq;
+
+- int idle;
+- int period_active;
++ short idle;
++ short period_active;
+ struct hrtimer period_timer;
+ struct hrtimer slack_timer;
+ struct list_head throttled_cfs_rq;
+@@ -551,6 +552,7 @@ struct cfs_rq {
+
+ #ifdef CONFIG_CFS_BANDWIDTH
+ int runtime_enabled;
++ int expires_seq;
+ u64 runtime_expires;
+ s64 runtime_remaining;
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Frederic Weisbecker <frederic@kernel.org>
+Date: Thu, 28 Jun 2018 18:29:41 +0200
+Subject: sched/nohz: Skip remote tick on idle task entirely
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit d9c0ffcabd6aae7ff1e34e8078354c13bb9f1183 ]
+
+Some people have reported that the warning in sched_tick_remote()
+occasionally triggers, especially in favour of some RCU-Torture
+pressure:
+
+ WARNING: CPU: 11 PID: 906 at kernel/sched/core.c:3138 sched_tick_remote+0xb6/0xc0
+ Modules linked in:
+ CPU: 11 PID: 906 Comm: kworker/u32:3 Not tainted 4.18.0-rc2+ #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+ Workqueue: events_unbound sched_tick_remote
+ RIP: 0010:sched_tick_remote+0xb6/0xc0
+ Code: e8 0f 06 b8 00 c6 03 00 fb eb 9d 8b 43 04 85 c0 75 8d 48 8b 83 e0 0a 00 00 48 85 c0 75 81 eb 88 48 89 df e8 bc fe ff ff eb aa <0f> 0b eb
+ +c5 66 0f 1f 44 00 00 bf 17 00 00 00 e8 b6 2e fe ff 0f b6
+ Call Trace:
+ process_one_work+0x1df/0x3b0
+ worker_thread+0x44/0x3d0
+ kthread+0xf3/0x130
+ ? set_worker_desc+0xb0/0xb0
+ ? kthread_create_worker_on_cpu+0x70/0x70
+ ret_from_fork+0x35/0x40
+
+This happens when the remote tick applies on an idle task. Usually the
+idle_cpu() check avoids that, but it is performed before we lock the
+runqueue and it is therefore racy. It was intended to be that way in
+order to prevent from useless runqueue locks since idle task tick
+callback is a no-op.
+
+Now if the racy check slips out of our hands and we end up remotely
+ticking an idle task, the empty task_tick_idle() is harmless. Still
+it won't pass the WARN_ON_ONCE() test that ensures rq_clock_task() is
+not too far from curr->se.exec_start because update_curr_idle() doesn't
+update the exec_start value like other scheduler policies. Hence the
+reported false positive.
+
+So let's have another check, while the rq is locked, to make sure we
+don't remote tick on an idle task. The lockless idle_cpu() still applies
+to avoid unecessary rq lock contention.
+
+Reported-by: Jacek Tomaka <jacekt@dug.com>
+Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Reported-by: Anna-Maria Gleixner <anna-maria@linutronix.de>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/1530203381-31234-1-git-send-email-frederic@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/core.c | 40 +++++++++++++++++++++++-----------------
+ 1 file changed, 23 insertions(+), 17 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3127,7 +3127,9 @@ static void sched_tick_remote(struct wor
+ struct tick_work *twork = container_of(dwork, struct tick_work, work);
+ int cpu = twork->cpu;
+ struct rq *rq = cpu_rq(cpu);
++ struct task_struct *curr;
+ struct rq_flags rf;
++ u64 delta;
+
+ /*
+ * Handle the tick only if it appears the remote CPU is running in full
+@@ -3136,24 +3138,28 @@ static void sched_tick_remote(struct wor
+ * statistics and checks timeslices in a time-independent way, regardless
+ * of when exactly it is running.
+ */
+- if (!idle_cpu(cpu) && tick_nohz_tick_stopped_cpu(cpu)) {
+- struct task_struct *curr;
+- u64 delta;
+-
+- rq_lock_irq(rq, &rf);
+- update_rq_clock(rq);
+- curr = rq->curr;
+- delta = rq_clock_task(rq) - curr->se.exec_start;
+-
+- /*
+- * Make sure the next tick runs within a reasonable
+- * amount of time.
+- */
+- WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3);
+- curr->sched_class->task_tick(rq, curr, 0);
+- rq_unlock_irq(rq, &rf);
+- }
++ if (idle_cpu(cpu) || !tick_nohz_tick_stopped_cpu(cpu))
++ goto out_requeue;
+
++ rq_lock_irq(rq, &rf);
++ curr = rq->curr;
++ if (is_idle_task(curr))
++ goto out_unlock;
++
++ update_rq_clock(rq);
++ delta = rq_clock_task(rq) - curr->se.exec_start;
++
++ /*
++ * Make sure the next tick runs within a reasonable
++ * amount of time.
++ */
++ WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3);
++ curr->sched_class->task_tick(rq, curr, 0);
++
++out_unlock:
++ rq_unlock_irq(rq, &rf);
++
++out_requeue:
+ /*
+ * Run the remote tick once per second (1Hz). This arbitrary
+ * frequency is large enough to avoid overload but short enough
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vincent Guittot <vincent.guittot@linaro.org>
+Date: Thu, 14 Jun 2018 12:33:00 +0200
+Subject: sched/util_est: Fix util_est_dequeue() for throttled cfs_rq
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 3482d98bbc730758b63a5d1cf41d05ea17481412 ]
+
+When a cfs_rq is throttled, parent cfs_rq->nr_running is decreased and
+everything happens at cfs_rq level. Currently util_est stays unchanged
+in such case and it keeps accounting the utilization of throttled tasks.
+This can somewhat make sense as we don't dequeue tasks but only throttled
+cfs_rq.
+
+If a task of another group is enqueued/dequeued and root cfs_rq becomes
+idle during the dequeue, util_est will be cleared whereas it was
+accounting util_est of throttled tasks before. So the behavior of util_est
+is not always the same regarding throttled tasks and depends of side
+activity. Furthermore, util_est will not be updated when the cfs_rq is
+unthrottled as everything happens at cfs_rq level. Main results is that
+util_est will stay null whereas we now have running tasks. We have to wait
+for the next dequeue/enqueue of the previously throttled tasks to get an
+up to date util_est.
+
+Remove the assumption that cfs_rq's estimated utilization of a CPU is 0
+if there is no running task so the util_est of a task remains until the
+latter is dequeued even if its cfs_rq has been throttled.
+
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Patrick Bellasi <patrick.bellasi@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 7f65ea42eb00 ("sched/fair: Add util_est on top of PELT")
+Link: http://lkml.kernel.org/r/1528972380-16268-1-git-send-email-vincent.guittot@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/fair.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3941,18 +3941,10 @@ util_est_dequeue(struct cfs_rq *cfs_rq,
+ if (!sched_feat(UTIL_EST))
+ return;
+
+- /*
+- * Update root cfs_rq's estimated utilization
+- *
+- * If *p is the last task then the root cfs_rq's estimated utilization
+- * of a CPU is 0 by definition.
+- */
+- ue.enqueued = 0;
+- if (cfs_rq->nr_running) {
+- ue.enqueued = cfs_rq->avg.util_est.enqueued;
+- ue.enqueued -= min_t(unsigned int, ue.enqueued,
+- (_task_util_est(p) | UTIL_AVG_UNCHANGED));
+- }
++ /* Update root cfs_rq's estimated utilization */
++ ue.enqueued = cfs_rq->avg.util_est.enqueued;
++ ue.enqueued -= min_t(unsigned int, ue.enqueued,
++ (_task_util_est(p) | UTIL_AVG_UNCHANGED));
+ WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued);
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 3 Jul 2018 17:34:48 -0500
+Subject: scsi: hpsa: correct enclosure sas address
+
+From: Don Brace <don.brace@microsemi.com>
+
+[ Upstream commit 01d0e789a14aa735ddcfddd468ef06d4f917e06d ]
+
+The original complaint was the lsscsi -t showed the same SAS address of the
+two enclosures (SEP devices). In fact the SAS address was being set to the
+Enclosure Logical Identifier (ELI).
+
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/hpsa.c | 25 +++++++++++++++++++++----
+ drivers/scsi/hpsa.h | 1 +
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3438,11 +3438,11 @@ static void hpsa_get_enclosure_info(stru
+ struct ext_report_lun_entry *rle = &rlep->LUN[rle_index];
+ u16 bmic_device_index = 0;
+
+- bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
+-
+- encl_dev->sas_address =
++ encl_dev->eli =
+ hpsa_get_enclosure_logical_identifier(h, scsi3addr);
+
++ bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
++
+ if (encl_dev->target == -1 || encl_dev->lun == -1) {
+ rc = IO_OK;
+ goto out;
+@@ -9695,7 +9695,24 @@ hpsa_sas_get_linkerrors(struct sas_phy *
+ static int
+ hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier)
+ {
+- *identifier = rphy->identify.sas_address;
++ struct Scsi_Host *shost = phy_to_shost(rphy);
++ struct ctlr_info *h;
++ struct hpsa_scsi_dev_t *sd;
++
++ if (!shost)
++ return -ENXIO;
++
++ h = shost_to_hba(shost);
++
++ if (!h)
++ return -ENXIO;
++
++ sd = hpsa_find_device_by_sas_rphy(h, rphy);
++ if (!sd)
++ return -ENXIO;
++
++ *identifier = sd->eli;
++
+ return 0;
+ }
+
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t {
+ #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0"
+ unsigned char device_id[16]; /* from inquiry pg. 0x83 */
+ u64 sas_address;
++ u64 eli; /* from report diags. */
+ unsigned char vendor[8]; /* bytes 8-15 of inquiry data */
+ unsigned char model[16]; /* bytes 16-31 of inquiry data */
+ unsigned char rev; /* byte 2 of inquiry data */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Saurav Kashyap <saurav.kashyap@cavium.com>
+Date: Thu, 5 Jul 2018 07:01:33 -0700
+Subject: scsi: qedf: Send the driver state to MFW
+
+From: Saurav Kashyap <saurav.kashyap@cavium.com>
+
+[ Upstream commit 6ac174756dfc9884f08b23af840ca911155f5578 ]
+
+Need to notify firmware when driver is loaded and unloaded.
+
+Signed-off-by: Saurav Kashyap <saurav.kashyap@cavium.com>
+Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3241,6 +3241,11 @@ static int __qedf_probe(struct pci_dev *
+
+ init_completion(&qedf->flogi_compl);
+
++ status = qed_ops->common->update_drv_state(qedf->cdev, true);
++ if (status)
++ QEDF_ERR(&(qedf->dbg_ctx),
++ "Failed to send drv state to MFW.\n");
++
+ memset(&link_params, 0, sizeof(struct qed_link_params));
+ link_params.link_up = true;
+ status = qed_ops->common->set_link(qedf->cdev, &link_params);
+@@ -3289,6 +3294,7 @@ static int qedf_probe(struct pci_dev *pd
+ static void __qedf_remove(struct pci_dev *pdev, int mode)
+ {
+ struct qedf_ctx *qedf;
++ int rc;
+
+ if (!pdev) {
+ QEDF_ERR(NULL, "pdev is NULL.\n");
+@@ -3383,6 +3389,12 @@ static void __qedf_remove(struct pci_dev
+ qed_ops->common->set_power_state(qedf->cdev, PCI_D0);
+ pci_set_drvdata(pdev, NULL);
+ }
++
++ rc = qed_ops->common->update_drv_state(qedf->cdev, false);
++ if (rc)
++ QEDF_ERR(&(qedf->dbg_ctx),
++ "Failed to send drv state to MFW.\n");
++
+ qed_ops->common->slowpath_stop(qedf->cdev);
+ qed_ops->common->remove(qedf->cdev);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Manish Rangankar <manish.rangankar@cavium.com>
+Date: Mon, 2 Jul 2018 23:52:31 -0700
+Subject: scsi: qedi: Send driver state to MFW
+
+From: Manish Rangankar <manish.rangankar@cavium.com>
+
+[ Upstream commit a3440d0d2f57f7ba102fc332086961cf261180af ]
+
+In case of iSCSI offload BFS environment, MFW requires to mark virtual
+link based upon qedi load status.
+
+Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2075,6 +2075,7 @@ kset_free:
+ static void __qedi_remove(struct pci_dev *pdev, int mode)
+ {
+ struct qedi_ctx *qedi = pci_get_drvdata(pdev);
++ int rval;
+
+ if (qedi->tmf_thread) {
+ flush_workqueue(qedi->tmf_thread);
+@@ -2104,6 +2105,10 @@ static void __qedi_remove(struct pci_dev
+ if (mode == QEDI_MODE_NORMAL)
+ qedi_free_iscsi_pf_param(qedi);
+
++ rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
++ if (rval)
++ QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n");
++
+ if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) {
+ qedi_ops->common->slowpath_stop(qedi->cdev);
+ qedi_ops->common->remove(qedi->cdev);
+@@ -2378,6 +2383,12 @@ static int __qedi_probe(struct pci_dev *
+ if (qedi_setup_boot_info(qedi))
+ QEDI_ERR(&qedi->dbg_ctx,
+ "No iSCSI boot target configured\n");
++
++ rc = qedi_ops->common->update_drv_state(qedi->cdev, true);
++ if (rc)
++ QEDI_ERR(&qedi->dbg_ctx,
++ "Failed to send drv state to MFW\n");
++
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Sat, 16 Jun 2018 01:05:01 +0800
+Subject: scsi: xen-scsifront: add error handling for xenbus_printf
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit 93efbd39870474cc536b9caf4a6efeb03b0bc56f ]
+
+When xenbus_printf fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling xenbus_printf.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/xen-scsifront.c | 33 ++++++++++++++++++++++++++-------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/xen-scsifront.c
++++ b/drivers/scsi/xen-scsifront.c
+@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(s
+ static int scsifront_sdev_configure(struct scsi_device *sdev)
+ {
+ struct vscsifrnt_info *info = shost_priv(sdev->host);
++ int err;
+
+- if (info && current == info->curr)
+- xenbus_printf(XBT_NIL, info->dev->nodename,
++ if (info && current == info->curr) {
++ err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ info->dev_state_path, "%d", XenbusStateConnected);
++ if (err) {
++ xenbus_dev_error(info->dev, err,
++ "%s: writing dev_state_path", __func__);
++ return err;
++ }
++ }
+
+ return 0;
+ }
+@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(stru
+ static void scsifront_sdev_destroy(struct scsi_device *sdev)
+ {
+ struct vscsifrnt_info *info = shost_priv(sdev->host);
++ int err;
+
+- if (info && current == info->curr)
+- xenbus_printf(XBT_NIL, info->dev->nodename,
++ if (info && current == info->curr) {
++ err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ info->dev_state_path, "%d", XenbusStateClosed);
++ if (err)
++ xenbus_dev_error(info->dev, err,
++ "%s: writing dev_state_path", __func__);
++ }
+ }
+
+ static struct scsi_host_template scsifront_sht = {
+@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(str
+
+ if (scsi_add_device(info->host, chn, tgt, lun)) {
+ dev_err(&dev->dev, "scsi_add_device\n");
+- xenbus_printf(XBT_NIL, dev->nodename,
++ err = xenbus_printf(XBT_NIL, dev->nodename,
+ info->dev_state_path,
+ "%d", XenbusStateClosed);
++ if (err)
++ xenbus_dev_error(dev, err,
++ "%s: writing dev_state_path", __func__);
+ }
+ break;
+ case VSCSIFRONT_OP_DEL_LUN:
+@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(str
+ }
+ break;
+ case VSCSIFRONT_OP_READD_LUN:
+- if (device_state == XenbusStateConnected)
+- xenbus_printf(XBT_NIL, dev->nodename,
++ if (device_state == XenbusStateConnected) {
++ err = xenbus_printf(XBT_NIL, dev->nodename,
+ info->dev_state_path,
+ "%d", XenbusStateConnected);
++ if (err)
++ xenbus_dev_error(dev, err,
++ "%s: writing dev_state_path", __func__);
++ }
+ break;
+ default:
+ break;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Wed, 20 Jun 2018 12:47:52 -0300
+Subject: sctp: fix erroneous inc of snmp SctpFragUsrMsgs
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+[ Upstream commit fedb1bd3d274b33c432cb83c80c6b3cf54d509c8 ]
+
+Currently it is incrementing SctpFragUsrMsgs when the user message size
+is of the exactly same size as the maximum fragment size, which is wrong.
+
+The fix is to increment it only when user message is bigger than the
+maximum fragment size.
+
+Fixes: bfd2e4b8734d ("sctp: refactor sctp_datamsg_from_user")
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Neil Horman <nhorman@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/chunk.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sctp/chunk.c
++++ b/net/sctp/chunk.c
+@@ -247,7 +247,9 @@ struct sctp_datamsg *sctp_datamsg_from_u
+ /* Account for a different sized first fragment */
+ if (msg_len >= first_len) {
+ msg->can_delay = 0;
+- SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
++ if (msg_len > first_len)
++ SCTP_INC_STATS(sock_net(asoc->base.sk),
++ SCTP_MIB_FRAGUSRMSGS);
+ } else {
+ /* Which may be the only one... */
+ first_len = msg_len;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jeffrin Jose T <ahiliation@gmail.com>
+Date: Thu, 21 Jun 2018 22:30:20 +0530
+Subject: selftests: bpf: notification about privilege required to run test_kmod.sh testing script
+
+From: Jeffrin Jose T <ahiliation@gmail.com>
+
+[ Upstream commit 81e167c2a216e7b54e6add9d2badcda267fe33b1 ]
+
+The test_kmod.sh script require root privilege for the successful
+execution of the test.
+
+This patch is to notify the user about the privilege the script
+demands for the successful execution of the test.
+
+Signed-off-by: Jeffrin Jose T (Rajagiri SET) <ahiliation@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/test_kmod.sh | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/tools/testing/selftests/bpf/test_kmod.sh
++++ b/tools/testing/selftests/bpf/test_kmod.sh
+@@ -1,6 +1,15 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++msg="skip all tests:"
++if [ "$(id -u)" != "0" ]; then
++ echo $msg please run this as root >&2
++ exit $ksft_skip
++fi
++
+ SRC_TREE=../../../../
+
+ test_run()
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Thu, 14 Jun 2018 11:06:56 -0700
+Subject: selftests/bpf: test offloads even with BPF programs present
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 47cf52a246e526e2092d60ac01c54af9bd45dcc9 ]
+
+Modern distroes increasingly make use of BPF programs. Default
+Ubuntu 18.04 installation boots with a number of cgroup_skb
+programs loaded.
+
+test_offloads.py tries to check if programs and maps are not
+leaked on error paths by confirming the list of programs on the
+system is empty between tests.
+
+Since we can no longer expect the system to have no BPF objects
+at boot try to remember the programs and maps present at the start,
+and skip those when scanning the system.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/test_offload.py | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/bpf/test_offload.py
++++ b/tools/testing/selftests/bpf/test_offload.py
+@@ -163,6 +163,10 @@ def bpftool(args, JSON=True, ns="", fail
+
+ def bpftool_prog_list(expected=None, ns=""):
+ _, progs = bpftool("prog show", JSON=True, ns=ns, fail=True)
++ # Remove the base progs
++ for p in base_progs:
++ if p in progs:
++ progs.remove(p)
+ if expected is not None:
+ if len(progs) != expected:
+ fail(True, "%d BPF programs loaded, expected %d" %
+@@ -171,6 +175,10 @@ def bpftool_prog_list(expected=None, ns=
+
+ def bpftool_map_list(expected=None, ns=""):
+ _, maps = bpftool("map show", JSON=True, ns=ns, fail=True)
++ # Remove the base maps
++ for m in base_maps:
++ if m in maps:
++ maps.remove(m)
+ if expected is not None:
+ if len(maps) != expected:
+ fail(True, "%d BPF maps loaded, expected %d" %
+@@ -585,8 +593,8 @@ skip(os.getuid() != 0, "test must be run
+ # Check tools
+ ret, progs = bpftool("prog", fail=False)
+ skip(ret != 0, "bpftool not installed")
+-# Check no BPF programs are loaded
+-skip(len(progs) != 0, "BPF programs already loaded on the system")
++base_progs = progs
++_, base_maps = bpftool("map")
+
+ # Check netdevsim
+ ret, out = cmd("modprobe netdevsim", fail=False)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Tue, 19 Jun 2018 18:41:11 +0200
+Subject: selftests: net: add config fragments
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 73f9c33beb9e85850a11a1597b35a13650352509 ]
+
+Add fragments to pass bridge and vlan tests.
+
+Fixes: 33b01b7b4f19 ("selftests: add rtnetlink test script")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/config | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/testing/selftests/net/config
++++ b/tools/testing/selftests/net/config
+@@ -12,3 +12,5 @@ CONFIG_NET_IPVTI=y
+ CONFIG_INET6_XFRM_MODE_TUNNEL=y
+ CONFIG_IPV6_VTI=y
+ CONFIG_DUMMY=y
++CONFIG_BRIDGE=y
++CONFIG_VLAN_8021Q=y
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Tue, 12 Jun 2018 16:46:03 -0600
+Subject: selftests: pstore: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 856e7c4b619af622d56b3b454f7bec32a170ac99 ]
+
+When pstore_post_reboot test gets skipped because of unmet dependencies
+and/or unsupported configuration, it returns 0 which is treated as a pass
+by the Kselftest framework. This leads to false positive result even when
+the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to clearly
+report that the test could not be run.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/pstore/pstore_post_reboot_tests | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
+@@ -7,13 +7,16 @@
+ #
+ # Released under the terms of the GPL v2.
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./common_tests
+
+ if [ -e $REBOOT_FLAG ]; then
+ rm $REBOOT_FLAG
+ else
+ prlog "pstore_crash_test has not been executed yet. we skip further tests."
+- exit 0
++ exit $ksft_skip
+ fi
+
+ prlog -n "Mounting pstore filesystem ... "
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Tue, 12 Jun 2018 17:40:31 -0600
+Subject: selftests: static_keys: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 8781578087b8fb8829558bac96c3c24e5ba26f82 ]
+
+When static_keys test is skipped because of unmet dependencies and/or
+unsupported configuration, it exits with error which is treated as a fail
+by the Kselftest framework. This leads to false negative result even when
+the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to clearly
+report that the test could not be run.
+
+Added an explicit searches for test_static_key_base and test_static_keys
+modules and return skip code if they aren't found to differentiate between
+the failure to load the module condition and module not found condition.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/static_keys/test_static_keys.sh | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/tools/testing/selftests/static_keys/test_static_keys.sh
++++ b/tools/testing/selftests/static_keys/test_static_keys.sh
+@@ -2,6 +2,19 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Runs static keys kernel module tests
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_static_key_base; then
++ echo "static_key: module test_static_key_base is not found [SKIP]"
++ exit $ksft_skip
++fi
++
++if ! /sbin/modprobe -q -n test_static_keys; then
++ echo "static_key: module test_static_keys is not found [SKIP]"
++ exit $ksft_skip
++fi
++
+ if /sbin/modprobe -q test_static_key_base; then
+ if /sbin/modprobe -q test_static_keys; then
+ echo "static_key: ok"
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Fathi Boudra <fathi.boudra@linaro.org>
+Date: Thu, 14 Jun 2018 11:57:08 +0200
+Subject: selftests: sync: add config fragment for testing sync framework
+
+From: Fathi Boudra <fathi.boudra@linaro.org>
+
+[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ]
+
+Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled,
+the sync test will be skipped:
+
+TAP version 13
+1..0 # Skipped: Sync framework not supported by kernel
+
+Add a config fragment file to be able to run "make kselftest-merge" to
+enable relevant configuration required in order to run the sync test.
+
+Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
+Link: https://lkml.org/lkml/2017/5/5/14
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/sync/config | 4 ++++
+ 1 file changed, 4 insertions(+)
+ create mode 100644 tools/testing/selftests/sync/config
+
+--- /dev/null
++++ b/tools/testing/selftests/sync/config
+@@ -0,0 +1,4 @@
++CONFIG_STAGING=y
++CONFIG_ANDROID=y
++CONFIG_SYNC=y
++CONFIG_SW_SYNC=y
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Tue, 12 Jun 2018 18:11:37 -0600
+Subject: selftests: sysctl: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit c7db6ffb831fd36a03485a0d88b1e505378975ad ]
+
+When sysctl test is skipped because of unmet dependencies and/or
+unsupported configuration, it exits with error which is treated as
+a fail by the Kselftest framework. This leads to false negative result
+even when the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run.
+
+Changed return code to kselftest skip code in skip error legs that check
+requirements and module probe test error leg.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/sysctl/sysctl.sh | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/tools/testing/selftests/sysctl/sysctl.sh
++++ b/tools/testing/selftests/sysctl/sysctl.sh
+@@ -14,6 +14,9 @@
+
+ # This performs a series tests against the proc sysctl interface.
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ TEST_NAME="sysctl"
+ TEST_DRIVER="test_${TEST_NAME}"
+ TEST_DIR=$(dirname $0)
+@@ -41,7 +44,7 @@ test_modprobe()
+ echo "$0: $DIR not present" >&2
+ echo "You must have the following enabled in your kernel:" >&2
+ cat $TEST_DIR/config >&2
+- exit 1
++ exit $ksft_skip
+ fi
+ }
+
+@@ -98,28 +101,30 @@ test_reqs()
+ uid=$(id -u)
+ if [ $uid -ne 0 ]; then
+ echo $msg must be run as root >&2
+- exit 0
++ exit $ksft_skip
+ fi
+
+ if ! which perl 2> /dev/null > /dev/null; then
+ echo "$0: You need perl installed"
+- exit 1
++ exit $ksft_skip
+ fi
+ if ! which getconf 2> /dev/null > /dev/null; then
+ echo "$0: You need getconf installed"
+- exit 1
++ exit $ksft_skip
+ fi
+ if ! which diff 2> /dev/null > /dev/null; then
+ echo "$0: You need diff installed"
+- exit 1
++ exit $ksft_skip
+ fi
+ }
+
+ function load_req_mod()
+ {
+- trap "test_modprobe" EXIT
+-
+ if [ ! -d $DIR ]; then
++ if ! modprobe -q -n $TEST_DRIVER; then
++ echo "$0: module $TEST_DRIVER not found [SKIP]"
++ exit $ksft_skip
++ fi
+ modprobe $TEST_DRIVER
+ if [ $? -ne 0 ]; then
+ exit
+@@ -765,6 +770,7 @@ function parse_args()
+ test_reqs
+ allow_user_defaults
+ check_production_sysctl_writes_strict
++test_modprobe
+ load_req_mod
+
+ trap "test_finish" EXIT
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Wed, 13 Jun 2018 21:10:48 -0600
+Subject: selftests: user: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit d7d5311d4aa9611fe1a5a851e6f75733237a668a ]
+
+When user test is skipped because of unmet dependencies and/or
+unsupported configuration, it exits with error which is treated as
+a fail by the Kselftest framework. This leads to false negative result
+even when the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run. Add an explicit check
+for module presence and return skip code if module isn't present.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/user/test_user_copy.sh | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/tools/testing/selftests/user/test_user_copy.sh
++++ b/tools/testing/selftests/user/test_user_copy.sh
+@@ -2,6 +2,13 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Runs copy_to/from_user infrastructure using test_user_copy kernel module
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_user_copy; then
++ echo "user: module test_user_copy is not found [SKIP]"
++ exit $ksft_skip
++fi
+ if /sbin/modprobe -q test_user_copy; then
+ /sbin/modprobe -q -r test_user_copy
+ echo "user_copy: ok"
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Wed, 13 Jun 2018 21:31:43 -0600
+Subject: selftests: vm: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit a4d7537789724985cafbc9260a31ca4f2b7cf123 ]
+
+When vm test is skipped because of unmet dependencies and/or unsupported
+configuration, it exits with error which is treated as a fail by the
+Kselftest framework. This leads to false negative result even when the
+test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Acked-by: Mike Rapoport <rppt@linux.vnet.ibm.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/vm/compaction_test.c | 4 +++-
+ tools/testing/selftests/vm/mlock2-tests.c | 12 +++++++-----
+ tools/testing/selftests/vm/run_vmtests | 5 ++++-
+ tools/testing/selftests/vm/userfaultfd.c | 4 +++-
+ 4 files changed, 17 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/vm/compaction_test.c
++++ b/tools/testing/selftests/vm/compaction_test.c
+@@ -16,6 +16,8 @@
+ #include <unistd.h>
+ #include <string.h>
+
++#include "../kselftest.h"
++
+ #define MAP_SIZE 1048576
+
+ struct map_list {
+@@ -169,7 +171,7 @@ int main(int argc, char **argv)
+ printf("Either the sysctl compact_unevictable_allowed is not\n"
+ "set to 1 or couldn't read the proc file.\n"
+ "Skipping the test\n");
+- return 0;
++ return KSFT_SKIP;
+ }
+
+ lim.rlim_cur = RLIM_INFINITY;
+--- a/tools/testing/selftests/vm/mlock2-tests.c
++++ b/tools/testing/selftests/vm/mlock2-tests.c
+@@ -9,6 +9,8 @@
+ #include <stdbool.h>
+ #include "mlock2.h"
+
++#include "../kselftest.h"
++
+ struct vm_boundaries {
+ unsigned long start;
+ unsigned long end;
+@@ -303,7 +305,7 @@ static int test_mlock_lock()
+ if (mlock2_(map, 2 * page_size, 0)) {
+ if (errno == ENOSYS) {
+ printf("Cannot call new mlock family, skipping test\n");
+- _exit(0);
++ _exit(KSFT_SKIP);
+ }
+ perror("mlock2(0)");
+ goto unmap;
+@@ -412,7 +414,7 @@ static int test_mlock_onfault()
+ if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
+ if (errno == ENOSYS) {
+ printf("Cannot call new mlock family, skipping test\n");
+- _exit(0);
++ _exit(KSFT_SKIP);
+ }
+ perror("mlock2(MLOCK_ONFAULT)");
+ goto unmap;
+@@ -425,7 +427,7 @@ static int test_mlock_onfault()
+ if (munlock(map, 2 * page_size)) {
+ if (errno == ENOSYS) {
+ printf("Cannot call new mlock family, skipping test\n");
+- _exit(0);
++ _exit(KSFT_SKIP);
+ }
+ perror("munlock()");
+ goto unmap;
+@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present(
+ if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
+ if (errno == ENOSYS) {
+ printf("Cannot call new mlock family, skipping test\n");
+- _exit(0);
++ _exit(KSFT_SKIP);
+ }
+ perror("mlock2(MLOCK_ONFAULT)");
+ goto unmap;
+@@ -583,7 +585,7 @@ static int test_vma_management(bool call
+ if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) {
+ if (errno == ENOSYS) {
+ printf("Cannot call new mlock family, skipping test\n");
+- _exit(0);
++ _exit(KSFT_SKIP);
+ }
+ perror("mlock(ONFAULT)\n");
+ goto out;
+--- a/tools/testing/selftests/vm/run_vmtests
++++ b/tools/testing/selftests/vm/run_vmtests
+@@ -2,6 +2,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ #please run as root
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ mnt=./huge
+ exitcode=0
+
+@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_K
+ echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
+ if [ $? -ne 0 ]; then
+ echo "Please run this test as root"
+- exit 1
++ exit $ksft_skip
+ fi
+ while read name size unit; do
+ if [ "$name" = "HugePages_Free:" ]; then
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -69,6 +69,8 @@
+ #include <setjmp.h>
+ #include <stdbool.h>
+
++#include "../kselftest.h"
++
+ #ifdef __NR_userfaultfd
+
+ static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size;
+@@ -1322,7 +1324,7 @@ int main(int argc, char **argv)
+ int main(void)
+ {
+ printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n");
+- return 0;
++ return KSFT_SKIP;
+ }
+
+ #endif /* __NR_userfaultfd */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Andy Lutomirski <luto@kernel.org>
+Date: Tue, 26 Jun 2018 22:17:17 -0700
+Subject: selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
+
+From: Andy Lutomirski <luto@kernel.org>
+
+[ Upstream commit ec348020566009d3da9b99f07c05814d13969c78 ]
+
+When I wrote the sigreturn test, I didn't realize that AMD's busted
+IRET behavior was different from Intel's busted IRET behavior:
+
+On AMD CPUs, the CPU leaks the high 32 bits of the kernel stack pointer
+to certain userspace contexts. Gee, thanks. There's very little
+the kernel can do about it. Modify the test so it passes.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/86e7fd3564497f657de30a36da4505799eebef01.1530076529.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/x86/sigreturn.c | 46 ++++++++++++++++++++------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+--- a/tools/testing/selftests/x86/sigreturn.c
++++ b/tools/testing/selftests/x86/sigreturn.c
+@@ -612,19 +612,38 @@ static int test_valid_sigreturn(int cs_b
+ greg_t req = requested_regs[i], res = resulting_regs[i];
+ if (i == REG_TRAPNO || i == REG_IP)
+ continue; /* don't care */
+- if (i == REG_SP) {
+- printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
+- (unsigned long long)res);
+
++ if (i == REG_SP) {
+ /*
+- * In many circumstances, the high 32 bits of rsp
+- * are zeroed. For example, we could be a real
+- * 32-bit program, or we could hit any of a number
+- * of poorly-documented IRET or segmented ESP
+- * oddities. If this happens, it's okay.
++ * If we were using a 16-bit stack segment, then
++ * the kernel is a bit stuck: IRET only restores
++ * the low 16 bits of ESP/RSP if SS is 16-bit.
++ * The kernel uses a hack to restore bits 31:16,
++ * but that hack doesn't help with bits 63:32.
++ * On Intel CPUs, bits 63:32 end up zeroed, and, on
++ * AMD CPUs, they leak the high bits of the kernel
++ * espfix64 stack pointer. There's very little that
++ * the kernel can do about it.
++ *
++ * Similarly, if we are returning to a 32-bit context,
++ * the CPU will often lose the high 32 bits of RSP.
+ */
+- if (res == (req & 0xFFFFFFFF))
+- continue; /* OK; not expected to work */
++
++ if (res == req)
++ continue;
++
++ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
++ printf("[NOTE]\tSP: %llx -> %llx\n",
++ (unsigned long long)req,
++ (unsigned long long)res);
++ continue;
++ }
++
++ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
++ (unsigned long long)requested_regs[i],
++ (unsigned long long)resulting_regs[i]);
++ nerrs++;
++ continue;
+ }
+
+ bool ignore_reg = false;
+@@ -663,13 +682,6 @@ static int test_valid_sigreturn(int cs_b
+ }
+
+ if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+- /*
+- * SP is particularly interesting here. The
+- * usual cause of failures is that we hit the
+- * nasty IRET case of returning to a 16-bit SS,
+- * in which case bits 16:31 of the *kernel*
+- * stack pointer persist in ESP.
+- */
+ printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
+ i, (unsigned long long)requested_regs[i],
+ (unsigned long long)resulting_regs[i]);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Andy Lutomirski <luto@kernel.org>
+Date: Tue, 26 Jun 2018 22:17:18 -0700
+Subject: selftests/x86/sigreturn: Do minor cleanups
+
+From: Andy Lutomirski <luto@kernel.org>
+
+[ Upstream commit e8a445dea219c32727016af14f847d2e8f7ebec8 ]
+
+We have short names for the requested and resulting register values.
+Use them instead of spelling out the whole register entry for each
+case.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/bb3bc1f923a2f6fe7912d22a1068fe29d6033d38.1530076529.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/x86/sigreturn.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/tools/testing/selftests/x86/sigreturn.c
++++ b/tools/testing/selftests/x86/sigreturn.c
+@@ -610,6 +610,7 @@ static int test_valid_sigreturn(int cs_b
+ */
+ for (int i = 0; i < NGREG; i++) {
+ greg_t req = requested_regs[i], res = resulting_regs[i];
++
+ if (i == REG_TRAPNO || i == REG_IP)
+ continue; /* don't care */
+
+@@ -673,18 +674,18 @@ static int test_valid_sigreturn(int cs_b
+ #endif
+
+ /* Sanity check on the kernel */
+- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
++ if (i == REG_CX && req != res) {
+ printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
+- (unsigned long long)requested_regs[i],
+- (unsigned long long)resulting_regs[i]);
++ (unsigned long long)req,
++ (unsigned long long)res);
+ nerrs++;
+ continue;
+ }
+
+- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
++ if (req != res && !ignore_reg) {
+ printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
+- i, (unsigned long long)requested_regs[i],
+- (unsigned long long)resulting_regs[i]);
++ i, (unsigned long long)req,
++ (unsigned long long)res);
+ nerrs++;
+ }
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Thu, 14 Jun 2018 16:56:13 -0600
+Subject: selftests: zram: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 685814466bf8398192cf855415a0bb2cefc1930e ]
+
+When zram test is skipped because of unmet dependencies and/or
+unsupported configuration, it exits with error which is treated as
+a fail by the Kselftest framework. This leads to false negative result
+even when the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/zram/zram.sh | 5 ++++-
+ tools/testing/selftests/zram/zram_lib.sh | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/zram/zram.sh
++++ b/tools/testing/selftests/zram/zram.sh
+@@ -2,6 +2,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ TCID="zram.sh"
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./zram_lib.sh
+
+ run_zram () {
+@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then
+ else
+ echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
+ echo "$TCID : CONFIG_ZRAM is not set"
+- exit 1
++ exit $ksft_skip
+ fi
+--- a/tools/testing/selftests/zram/zram_lib.sh
++++ b/tools/testing/selftests/zram/zram_lib.sh
+@@ -18,6 +18,9 @@ MODULE=0
+ dev_makeswap=-1
+ dev_mounted=-1
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ trap INT
+
+ check_prereqs()
+@@ -27,7 +30,7 @@ check_prereqs()
+
+ if [ $uid -ne 0 ]; then
+ echo $msg must be run as root >&2
+- exit 0
++ exit $ksft_skip
+ fi
+ }
+
--- /dev/null
+arm-dts-armada-fix-cooling-cells-property-s-name.patch
+vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch
+perf-tools-fix-error-index-for-pmu-event-parser.patch
+hid-google-add-support-for-whiskers.patch
+ib-rxe-avoid-double-kfree-skb.patch
+rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch
+input-synaptics-rmi4-fix-axis-swap-behavior.patch
+ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch
+clocksource-drivers-stm32-fix-error-return-code.patch
+drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch
+drm-bridge-sii8620-fix-display-modes-validation.patch
+drm-bridge-sii8620-fix-potential-buffer-overflow.patch
+arc-explicitly-add-mmedium-calls-to-cflags.patch
+selftests-bpf-test-offloads-even-with-bpf-programs-present.patch
+smb3-increase-initial-number-of-credits-requested-to-allow-write.patch
+hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch
+hwmon-nct6775-fix-loop-limit.patch
+soc-imx-gpcv2-correct-pgc-offset.patch
+usb-dwc3-pci-add-support-for-intel-icelake.patch
+usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch
+usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch
+usb-dwc3-of-simple-fix-use-after-free-on-remove.patch
+acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch
+netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch
+netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch
+selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-user-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-sync-add-config-fragment-for-testing-sync-framework.patch
+arm-dts-nsp-fix-i2c-controller-interrupt-type.patch
+arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch
+arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch
+arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch
+arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch
+arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch
+arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch
+arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch
+arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch
+arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch
+arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch
+drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch
+drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch
+drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch
+drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch
+drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch
+ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch
+libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch
+dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch
+posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch
+usb-dwc2-fix-host-exit-from-hibernation-flow.patch
+usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch
+usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch
+usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch
+usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch
+dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch
+powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch
+xen-add-error-handling-for-xenbus_printf.patch
+pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch
+scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch
+xen-scsiback-add-error-handling-for-xenbus_printf.patch
+arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch
+arm64-make-secondary_start_kernel-notrace.patch
+qed-fix-possible-memory-leak-in-rx-error-path-handling.patch
+qed-add-sanity-check-for-simd-fastpath-handler.patch
+qed-do-not-advertise-dcbx_lld_managed-capability.patch
+enic-initialize-enic-rfs_h.lock-in-enic_probe.patch
+net-hamradio-use-eth_broadcast_addr.patch
+net-propagate-dev_get_valid_name-return-code.patch
+net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch
+nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch
+nvme-rdma-fix-command-completion-race-at-error-recovery.patch
+nvmet-reset-keep-alive-timer-in-controller-enable.patch
+blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch
+block-sed-opal-fix-a-couple-off-by-one-bugs.patch
+arc-enable-machine_desc-init_per_cpu-for-config_smp.patch
+selftests-net-add-config-fragments.patch
+nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch
+net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch
+sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch
+kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch
+drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch
+nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch
+clk-sunxi-ng-replace-lib-y-with-obj-y.patch
+locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch
+selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch
+mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch
+irqchip-gic-v2m-fix-spi-release-on-error-path.patch
+irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch
+x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch
+ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch
+smack-mark-inode-instant-in-smack_task_to_inode.patch
+arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch
+batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch
+batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch
+batman-adv-fix-debugfs-path-for-renamed-hardif.patch
+batman-adv-fix-debugfs-path-for-renamed-softif.patch
+batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch
+batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch
+cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch
+iio-pressure-bmp280-fix-relative-humidity-unit.patch
+brcmfmac-stop-watchdog-before-detach-and-free-everything.patch
+ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch
+arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch
+alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch
+nfp-bpf-don-t-stop-offload-if-replace-failed.patch
+usb-xhci-remove-the-code-build-warning.patch
+usb-xhci-increase-crs-timeout-value.patch
+nfc-pn533-fix-wrong-gfp-flag-usage.patch
+typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch
+kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch
+perf-record-support-s390-random-socket_id-assignment.patch
+perf-test-session-topology-fix-test-on-s390.patch
+perf-report-powerpc-fix-crash-if-callchain-is-empty.patch
+perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch
+tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch
+perf-tools-fix-a-clang-7.0-compilation-error.patch
+perf-bench-fix-numa-report-output-code.patch
+perf-script-fix-crash-because-of-missing-evsel-priv.patch
+perf-tools-fix-crash-caused-by-accessing-feat_ops.patch
+clk-davinci-cfgchip-testing-the-wrong-variable.patch
+usb-chipidea-host-fix-disconnection-detect-issue.patch
+arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch
+netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch
+ceph-fix-dentry-leak-in-splice_dentry.patch
+net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch
+rds-clean-up-loopback-rds_connections-on-netns-deletion.patch
+nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch
+selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch
+selftests-x86-sigreturn-do-minor-cleanups.patch
+arm-dts-da850-fix-interrups-property-for-gpio.patch
+arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch
+arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch
+arm64-dts-meson-axg-fix-ethernet-stability-issue.patch
+arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch
+dmaengine-pl330-report-burst-residue-granularity.patch
+dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch
+ath10k-update-the-phymode-along-with-bandwidth-change-request.patch
+drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch
+md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch
+dev-dax-check_vma-ratelimit-dev_info-s.patch
+mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch
+nl80211-relax-ht-operation-checks-for-mesh.patch
+nl80211-check-nla_parse_nested-return-values.patch
+drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch
+drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch
+drm-exynos-decon5433-fix-winconx-reset-value.patch
+blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch
+drbd-fix-drbd_request_prepare-discard-handling.patch
+bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch
+pci-xilinx-add-missing-of_node_put.patch
+pci-xilinx-nwl-add-missing-of_node_put.patch
+pci-faraday-add-missing-of_node_put.patch
+bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch
+fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch
+dpaa_eth-dpaa-sgt-needs-to-be-256b.patch
+s390-qeth-consistently-re-enable-device-features.patch
+acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch
+tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch
+openrisc-entry-fix-delay-slot-exception-detection.patch
+crypto-arm-speck-fix-building-in-thumb2-mode.patch
+m68k-fix-bad-page-state-oops-on-coldfire-boot.patch
+objtool-support-gcc-8-fnoreorder-functions.patch
+ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch
+usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch
+drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch
+nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch
+sched-nohz-skip-remote-tick-on-idle-task-entirely.patch
+sched-fair-fix-bandwidth-timer-clock-drift-condition.patch
+sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch
+kthread-sched-core-fix-kthread_parkme-again.patch
+x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch
+hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch
+arm-imx_v6_v7_defconfig-select-ulpi-support.patch
+arm-imx_v4_v5_defconfig-select-ulpi-support.patch
+tls-fix-skb_to_sgvec-returning-unhandled-error.patch
+r8169-fix-mac-address-change.patch
+bpf-hash-map-decrement-counter-on-error.patch
+tracing-use-__printf-markup-to-silence-compiler.patch
+kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch
+net-phy-marvell-change-default-m88e1510-led-configuration.patch
+smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch
+drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch
+risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch
+risc-v-don-t-include-irq-riscv-intc.h.patch
+risc-v-fix-ptrace_setregset-bug.patch
+samples-bpf-add-missing-linux-if_vlan.h.patch
+samples-bpf-check-the-result-of-system.patch
+samples-bpf-check-the-error-of-write-and-read.patch
+ieee802154-mcr20a-add-missing-includes.patch
+ieee802154-6lowpan-set-ifla_link.patch
+netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch
+qed-off-by-one-in-qed_parse_mcp_trace_buf.patch
+ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch
+net-qrtr-broadcast-messages-only-from-control-port.patch
+net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch
+sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch
+sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch
+ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch
+ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch
+tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch
+tipc-correct-discovery-message-handling-during-address-trial-period.patch
+tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch
+tipc-make-function-tipc_net_finalize-thread-safe.patch
+cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch
+arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch
+net-macb-free-rx-ring-for-all-queues.patch
+net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch
+net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch
+nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch
+bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch
+ipfrag-really-prevent-allocation-on-netns-exit.patch
+drm-sun4i-link-in-front-end-code-if-needed.patch
+ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch
+ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch
+ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch
+gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch
+gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch
+drm-tegra-fix-comparison-operator-for-buffer-size.patch
+net-ieee802154-adf7242-fix-erroneous-rx-enable.patch
+net-ieee802154-adf7242-fix-ocl-calibration-runs.patch
+drm-armada-fix-colorkey-mode-property.patch
+drm-armada-fix-irq-handling.patch
+netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch
+netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch
+arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch
+arc-improve-cmpxchg-syscall-implementation.patch
+bnxt_en-fix-the-vlan_tci-exact-match-check.patch
+bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch
+bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch
+bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch
+bnxt_en-fix-for-system-hang-if-request_irq-fails.patch
+samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch
+scsi-hpsa-correct-enclosure-sas-address.patch
+scsi-qedf-send-the-driver-state-to-mfw.patch
+scsi-qedi-send-driver-state-to-mfw.patch
+perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch
+perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch
+perf-tools-fix-compilation-errors-on-gcc8.patch
+perf-script-python-fix-dict-reference-counting.patch
+perf-tools-use-python-config-includes-rather-than-cflags.patch
+nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch
+rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch
+arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch
+sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch
+sfp-fix-module-initialisation-with-netdev-already-up.patch
+arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch
+arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch
+ixgbe-be-more-careful-when-modifying-mac-filters.patch
+amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch
+ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch
+tools-build-fixup-host-c-flags.patch
+tools-build-use-hostldflags-with-fixdep.patch
+kbuild-suppress-warnings-from-getconf-lfs_.patch
+sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch
+sfc-hold-filter_sem-consistently-during-reset.patch
+packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch
+rtc-fix-alarm-read-and-set-offset.patch
+qlogic-check-kstrtoul-for-errors.patch
+tcp-remove-delayed-ack-events-in-dctcp.patch
+pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch
+pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch
+pinctrl-nsp-fix-potential-null-dereference.patch
+net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch
+kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch
+sched-deadline-fix-switched_from_dl-warning.patch
+drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch
+of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch
+ibmvnic-revise-rx-tx-queue-error-messages.patch
+hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch
+net-ethernet-freescale-fman-fix-cross-build-error.patch
+ibmvnic-fix-error-recovery-on-login-failure.patch
+arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch
+btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch
+nvme-ensure-forward-progress-during-admin-passthru.patch
+octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch
+net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch
+kvmclock-fix-tsc-calibration-for-nested-guests.patch
+net-smc-reset-recv-timeout-after-clc-handshake.patch
+pci-of-fix-i-o-space-page-leak.patch
+pci-xgene-fix-i-o-space-page-leak.patch
+pci-versatile-fix-i-o-space-page-leak.patch
+pci-designware-fix-i-o-space-page-leak.patch
+pci-aardvark-fix-i-o-space-page-leak.patch
+pci-faraday-fix-i-o-space-page-leak.patch
+pci-mediatek-fix-i-o-space-page-leak.patch
+pci-v3-semi-fix-i-o-space-page-leak.patch
+net-qca_spi-avoid-packet-drop-during-initial-sync.patch
+net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch
+net-qca_spi-fix-log-level-if-probe-fails.patch
+net-cavium-add-fine-granular-dependencies-on-pci.patch
+tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch
+soc-imx-gpc-restrict-register-range-for-regmap-access.patch
+acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch
+arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch
+platform-x86-dell-laptop-fix-backlight-detection.patch
+nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch
+mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch
+mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch
+mm-make-vm_area_alloc-initialize-core-fields.patch
+edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch
+pty-fix-o_cloexec-for-tiocgptpeer.patch
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Bert Kenward <bkenward@solarflare.com>
+Date: Wed, 11 Jul 2018 11:44:25 +0100
+Subject: sfc: avoid hang from nested use of the filter_sem
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit 1c56c0994a533ce564843a0d17af7a3e6e68f269 ]
+
+In some situations we may end up calling down_read while already
+holding the semaphore for write, thus hanging. This has been seen
+when setting the MAC address for the interface. The hung task log
+in this situation includes this stack:
+ down_read
+ efx_ef10_filter_insert
+ efx_ef10_filter_insert_addr_list
+ efx_ef10_filter_vlan_sync_rx_mode
+ efx_ef10_filter_add_vlan
+ efx_ef10_filter_table_probe
+ efx_ef10_set_mac_address
+ efx_set_mac_address
+ dev_set_mac_address
+
+In addition, lockdep rightly points out that nested calling of
+down_read is incorrect.
+
+Fixes: c2bebe37c6b6 ("sfc: give ef10 its own rwsem in the filter table instead of filter_lock")
+Tested-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct ef
+ return -EPROTONOSUPPORT;
+ }
+
+-static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+- struct efx_filter_spec *spec,
+- bool replace_equal)
++static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx,
++ struct efx_filter_spec *spec,
++ bool replace_equal)
+ {
+ DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
+ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct
+ bool is_mc_recip;
+ s32 rc;
+
+- down_read(&efx->filter_sem);
++ WARN_ON(!rwsem_is_locked(&efx->filter_sem));
+ table = efx->filter_state;
+ down_write(&table->lock);
+
+@@ -4498,10 +4498,22 @@ out_unlock:
+ if (rss_locked)
+ mutex_unlock(&efx->rss_lock);
+ up_write(&table->lock);
+- up_read(&efx->filter_sem);
+ return rc;
+ }
+
++static s32 efx_ef10_filter_insert(struct efx_nic *efx,
++ struct efx_filter_spec *spec,
++ bool replace_equal)
++{
++ s32 ret;
++
++ down_read(&efx->filter_sem);
++ ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal);
++ up_read(&efx->filter_sem);
++
++ return ret;
++}
++
+ static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
+ {
+ /* no need to do anything here on EF10 */
+@@ -5284,7 +5296,7 @@ static int efx_ef10_filter_insert_addr_l
+ EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
+ efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
+ efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
+- rc = efx_ef10_filter_insert(efx, &spec, true);
++ rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ if (rc < 0) {
+ if (rollback) {
+ netif_info(efx, drv, efx->net_dev,
+@@ -5313,7 +5325,7 @@ static int efx_ef10_filter_insert_addr_l
+ efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
+ eth_broadcast_addr(baddr);
+ efx_filter_set_eth_local(&spec, vlan->vid, baddr);
+- rc = efx_ef10_filter_insert(efx, &spec, true);
++ rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ if (rc < 0) {
+ netif_warn(efx, drv, efx->net_dev,
+ "Broadcast filter insert failed rc=%d\n", rc);
+@@ -5369,7 +5381,7 @@ static int efx_ef10_filter_insert_def(st
+ if (vlan->vid != EFX_FILTER_VID_UNSPEC)
+ efx_filter_set_eth_local(&spec, vlan->vid, NULL);
+
+- rc = efx_ef10_filter_insert(efx, &spec, true);
++ rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ if (rc < 0) {
+ const char *um = multicast ? "Multicast" : "Unicast";
+ const char *encap_name = "";
+@@ -5429,7 +5441,7 @@ static int efx_ef10_filter_insert_def(st
+ filter_flags, 0);
+ eth_broadcast_addr(baddr);
+ efx_filter_set_eth_local(&spec, vlan->vid, baddr);
+- rc = efx_ef10_filter_insert(efx, &spec, true);
++ rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ if (rc < 0) {
+ netif_warn(efx, drv, efx->net_dev,
+ "Broadcast filter insert failed rc=%d\n",
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Bert Kenward <bkenward@solarflare.com>
+Date: Wed, 11 Jul 2018 11:45:10 +0100
+Subject: sfc: hold filter_sem consistently during reset
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit 193f20033c54db0dc9563f722fbafbcd5fa0e80d ]
+
+We should take and release the filter_sem consistently during the
+reset process, in the same manner as the mac_lock and reset_lock.
+
+For lockdep consistency we also take the filter_sem for write around
+other calls to efx->type->init().
+
+Fixes: c2bebe37c6b6 ("sfc: give ef10 its own rwsem in the filter table instead of filter_lock")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/efx.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1840,12 +1840,6 @@ static void efx_remove_filters(struct ef
+ up_write(&efx->filter_sem);
+ }
+
+-static void efx_restore_filters(struct efx_nic *efx)
+-{
+- down_read(&efx->filter_sem);
+- efx->type->filter_table_restore(efx);
+- up_read(&efx->filter_sem);
+-}
+
+ /**************************************************************************
+ *
+@@ -2657,6 +2651,7 @@ void efx_reset_down(struct efx_nic *efx,
+ efx_disable_interrupts(efx);
+
+ mutex_lock(&efx->mac_lock);
++ down_write(&efx->filter_sem);
+ mutex_lock(&efx->rss_lock);
+ if (efx->port_initialized && method != RESET_TYPE_INVISIBLE &&
+ method != RESET_TYPE_DATAPATH)
+@@ -2714,9 +2709,8 @@ int efx_reset_up(struct efx_nic *efx, en
+ if (efx->type->rx_restore_rss_contexts)
+ efx->type->rx_restore_rss_contexts(efx);
+ mutex_unlock(&efx->rss_lock);
+- down_read(&efx->filter_sem);
+- efx_restore_filters(efx);
+- up_read(&efx->filter_sem);
++ efx->type->filter_table_restore(efx);
++ up_write(&efx->filter_sem);
+ if (efx->type->sriov_reset)
+ efx->type->sriov_reset(efx);
+
+@@ -2733,6 +2727,7 @@ fail:
+ efx->port_initialized = false;
+
+ mutex_unlock(&efx->rss_lock);
++ up_write(&efx->filter_sem);
+ mutex_unlock(&efx->mac_lock);
+
+ return rc;
+@@ -3440,7 +3435,9 @@ static int efx_pci_probe_main(struct efx
+
+ efx_init_napi(efx);
+
++ down_write(&efx->filter_sem);
+ rc = efx->type->init(efx);
++ up_write(&efx->filter_sem);
+ if (rc) {
+ netif_err(efx, probe, efx->net_dev,
+ "failed to initialise NIC\n");
+@@ -3729,7 +3726,9 @@ static int efx_pm_resume(struct device *
+ rc = efx->type->reset(efx, RESET_TYPE_ALL);
+ if (rc)
+ return rc;
++ down_write(&efx->filter_sem);
+ rc = efx->type->init(efx);
++ up_write(&efx->filter_sem);
+ if (rc)
+ return rc;
+ rc = efx_pm_thaw(dev);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 10 Jul 2018 12:05:31 +0100
+Subject: sfp: ensure we clean up properly on bus registration failure
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit f20a4c46b984331a509528fa2b84125c617ef98b ]
+
+We fail to correctly clean up after a bus registration failure, which
+can lead to an incorrect assumption about the registration state of
+the upstream or sfp cage.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/sfp-bus.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -436,6 +436,13 @@ void sfp_upstream_stop(struct sfp_bus *b
+ }
+ EXPORT_SYMBOL_GPL(sfp_upstream_stop);
+
++static void sfp_upstream_clear(struct sfp_bus *bus)
++{
++ bus->upstream_ops = NULL;
++ bus->upstream = NULL;
++ bus->netdev = NULL;
++}
++
+ /**
+ * sfp_register_upstream() - Register the neighbouring device
+ * @fwnode: firmware node for the SFP bus
+@@ -462,8 +469,11 @@ struct sfp_bus *sfp_register_upstream(st
+ bus->upstream = upstream;
+ bus->netdev = ndev;
+
+- if (bus->sfp)
++ if (bus->sfp) {
+ ret = sfp_register_bus(bus);
++ if (ret)
++ sfp_upstream_clear(bus);
++ }
+ rtnl_unlock();
+ }
+
+@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_
+ rtnl_lock();
+ if (bus->sfp)
+ sfp_unregister_bus(bus);
+- bus->upstream = NULL;
+- bus->netdev = NULL;
++ sfp_upstream_clear(bus);
+ rtnl_unlock();
+
+ sfp_bus_put(bus);
+@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *b
+ }
+ EXPORT_SYMBOL_GPL(sfp_module_remove);
+
++static void sfp_socket_clear(struct sfp_bus *bus)
++{
++ bus->sfp_dev = NULL;
++ bus->sfp = NULL;
++ bus->socket_ops = NULL;
++}
++
+ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
+ const struct sfp_socket_ops *ops)
+ {
+@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(stru
+ bus->sfp = sfp;
+ bus->socket_ops = ops;
+
+- if (bus->netdev)
++ if (bus->netdev) {
+ ret = sfp_register_bus(bus);
++ if (ret)
++ sfp_socket_clear(bus);
++ }
+ rtnl_unlock();
+ }
+
+@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bu
+ rtnl_lock();
+ if (bus->netdev)
+ sfp_unregister_bus(bus);
+- bus->sfp_dev = NULL;
+- bus->sfp = NULL;
+- bus->socket_ops = NULL;
++ sfp_socket_clear(bus);
+ rtnl_unlock();
+
+ sfp_bus_put(bus);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 10 Jul 2018 12:05:36 +0100
+Subject: sfp: fix module initialisation with netdev already up
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 576cd32082351620a4e76b8babc4d5ae9b4bbb98 ]
+
+It was been observed that with a particular order of initialisation,
+the netdev can be up, but the SFP module still has its TX_DISABLE
+signal asserted. This occurs when the network device brought up before
+the SFP kernel module has been inserted by userspace.
+
+This occurs because sfp-bus layer does not hear about the change in
+network device state, and so assumes that it is still down. Set
+netdev->sfp when the upstream is registered to work around this problem.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/sfp-bus.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_b
+ }
+ if (bus->started)
+ bus->socket_ops->start(bus->sfp);
+- bus->netdev->sfp_bus = bus;
+ bus->registered = true;
+ return 0;
+ }
+@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sf
+ if (bus->phydev && ops && ops->disconnect_phy)
+ ops->disconnect_phy(bus->upstream);
+ }
+- bus->netdev->sfp_bus = NULL;
+ bus->registered = false;
+ }
+
+@@ -440,6 +438,7 @@ static void sfp_upstream_clear(struct sf
+ {
+ bus->upstream_ops = NULL;
+ bus->upstream = NULL;
++ bus->netdev->sfp_bus = NULL;
+ bus->netdev = NULL;
+ }
+
+@@ -468,6 +467,7 @@ struct sfp_bus *sfp_register_upstream(st
+ bus->upstream_ops = ops;
+ bus->upstream = upstream;
+ bus->netdev = ndev;
++ ndev->sfp_bus = bus;
+
+ if (bus->sfp) {
+ ret = sfp_register_bus(bus);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Wed, 4 Jul 2018 11:12:39 +0300
+Subject: sh_eth: fix invalid context bug while calling auto-negotiation by ethtool
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+[ Upstream commit 53a710b5044d8475faa6813000b6dd659400ef7b ]
+
+Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
+potentially sleeping") phy_start_aneg() function utilizes a mutex
+to serialize changes to phy state, however the helper function is
+called in atomic context.
+
+The bug can be reproduced by running "ethtool -r" command, the bug
+is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
+
+Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2193,18 +2193,10 @@ static void sh_eth_get_regs(struct net_d
+
+ static int sh_eth_nway_reset(struct net_device *ndev)
+ {
+- struct sh_eth_private *mdp = netdev_priv(ndev);
+- unsigned long flags;
+- int ret;
+-
+ if (!ndev->phydev)
+ return -ENODEV;
+
+- spin_lock_irqsave(&mdp->lock, flags);
+- ret = phy_start_aneg(ndev->phydev);
+- spin_unlock_irqrestore(&mdp->lock, flags);
+-
+- return ret;
++ return phy_start_aneg(ndev->phydev);
+ }
+
+ static u32 sh_eth_get_msglevel(struct net_device *ndev)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Wed, 4 Jul 2018 11:12:40 +0300
+Subject: sh_eth: fix invalid context bug while changing link options by ethtool
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+[ Upstream commit 5cb3f52a11e18628fc4bee76dd14b1f0b76349de ]
+
+The change fixes sleep in atomic context bug, which is encountered
+every time when link settings are changed by ethtool.
+
+Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
+potentially sleeping") phy_start_aneg() function utilizes a mutex
+to serialize changes to phy state, however that helper function is
+called in atomic context under a grabbed spinlock, because
+phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
+replaced phy_ethtool_sset() helpers from phylib.
+
+Now duplex mode setting is enforced in sh_eth_adjust_link() only,
+also now RX/TX is disabled when link is put down or modifications
+to E-MAC registers ECMR and GECMR are expected for both cases of
+checked and ignored link status pin state from E-MAC interrupt handler.
+
+For reference the change is a partial rework of commit 1e1b812bbe10
+("sh_eth: fix handling of no LINK signal").
+
+Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 49 ++++++++++------------------------
+ 1 file changed, 15 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1855,8 +1855,15 @@ static void sh_eth_adjust_link(struct ne
+ {
+ struct sh_eth_private *mdp = netdev_priv(ndev);
+ struct phy_device *phydev = ndev->phydev;
++ unsigned long flags;
+ int new_state = 0;
+
++ spin_lock_irqsave(&mdp->lock, flags);
++
++ /* Disable TX and RX right over here, if E-MAC change is ignored */
++ if (mdp->cd->no_psr || mdp->no_ether_link)
++ sh_eth_rcv_snd_disable(ndev);
++
+ if (phydev->link) {
+ if (phydev->duplex != mdp->duplex) {
+ new_state = 1;
+@@ -1875,18 +1882,21 @@ static void sh_eth_adjust_link(struct ne
+ sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
+ new_state = 1;
+ mdp->link = phydev->link;
+- if (mdp->cd->no_psr || mdp->no_ether_link)
+- sh_eth_rcv_snd_enable(ndev);
+ }
+ } else if (mdp->link) {
+ new_state = 1;
+ mdp->link = 0;
+ mdp->speed = 0;
+ mdp->duplex = -1;
+- if (mdp->cd->no_psr || mdp->no_ether_link)
+- sh_eth_rcv_snd_disable(ndev);
+ }
+
++ /* Enable TX and RX right over here, if E-MAC change is ignored */
++ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
++ sh_eth_rcv_snd_enable(ndev);
++
++ mmiowb();
++ spin_unlock_irqrestore(&mdp->lock, flags);
++
+ if (new_state && netif_msg_link(mdp))
+ phy_print_status(phydev);
+ }
+@@ -1977,39 +1987,10 @@ static int sh_eth_get_link_ksettings(str
+ static int sh_eth_set_link_ksettings(struct net_device *ndev,
+ const struct ethtool_link_ksettings *cmd)
+ {
+- struct sh_eth_private *mdp = netdev_priv(ndev);
+- unsigned long flags;
+- int ret;
+-
+ if (!ndev->phydev)
+ return -ENODEV;
+
+- spin_lock_irqsave(&mdp->lock, flags);
+-
+- /* disable tx and rx */
+- sh_eth_rcv_snd_disable(ndev);
+-
+- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+- if (ret)
+- goto error_exit;
+-
+- if (cmd->base.duplex == DUPLEX_FULL)
+- mdp->duplex = 1;
+- else
+- mdp->duplex = 0;
+-
+- if (mdp->cd->set_duplex)
+- mdp->cd->set_duplex(ndev);
+-
+-error_exit:
+- mdelay(1);
+-
+- /* enable tx and rx */
+- sh_eth_rcv_snd_enable(ndev);
+-
+- spin_unlock_irqrestore(&mdp->lock, flags);
+-
+- return ret;
++ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+
+ /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Fri, 22 Jun 2018 10:54:45 -0700
+Subject: Smack: Mark inode instant in smack_task_to_inode
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ]
+
+Smack: Mark inode instant in smack_task_to_inode
+
+/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188
+resulted in smack_task_to_inode() being called before smack_d_instantiate.
+This resulted in the smk_inode value being ignored, even while present
+for files in /proc/self. Marking the inode as instant here fixes that.
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/smack/smack_lsm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2296,6 +2296,7 @@ static void smack_task_to_inode(struct t
+ struct smack_known *skp = smk_of_task_struct(p);
+
+ isp->smk_inode = skp;
++ isp->smk_flags |= SMK_INODE_INSTANT;
+ }
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Steve French <stfrench@microsoft.com>
+Date: Wed, 13 Jun 2018 17:05:58 -0500
+Subject: smb3: increase initial number of credits requested to allow write
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit d409014e4feeab486fb36b350abfc4c94de8be37 ]
+
+Compared to other clients the Linux smb3 client ramps up
+credits very slowly, taking more than 128 operations before a
+maximum size write could be sent (since the number of credits
+requested is only 2 per small operation, causing the credit
+limit to grow very slowly).
+
+This lack of credits initially would impact large i/o performance,
+when large i/o is tried early before enough credits are built up.
+
+Signed-off-by: Steve French <stfrench@gmail.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -923,8 +923,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_
+ req->PreviousSessionId = sess_data->previous_session;
+
+ req->Flags = 0; /* MBZ */
+- /* to enable echos and oplocks */
+- req->sync_hdr.CreditRequest = cpu_to_le16(3);
++
++ /* enough to enable echos and oplocks and one max size write */
++ req->sync_hdr.CreditRequest = cpu_to_le16(130);
+
+ /* only one of SMB2 signing flags may be set in SMB2 request */
+ if (server->sign)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Yuiko Oshino <yuiko.oshino@microchip.com>
+Date: Tue, 3 Jul 2018 11:21:46 -0400
+Subject: smsc75xx: Add workaround for gigabit link up hardware errata.
+
+From: Yuiko Oshino <yuiko.oshino@microchip.com>
+
+[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ]
+
+In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state.
+
+Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices")
+Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -82,6 +82,9 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+
++static int smsc75xx_link_ok_nopm(struct usbnet *dev);
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
++
+ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
+ u32 *data, int in_pm)
+ {
+@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struc
+ return -EIO;
+ }
+
++ /* phy workaround for gig link */
++ smsc75xx_phy_gig_workaround(dev);
++
+ smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+ ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
+ ADVERTISE_PAUSE_ASYM);
+@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct us
+ return -EIO;
+ }
+
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
++{
++ struct mii_if_info *mii = &dev->mii;
++ int ret = 0, timeout = 0;
++ u32 buf, link_up = 0;
++
++ /* Set the phy in Gig loopback */
++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
++
++ /* Wait for the link up */
++ do {
++ link_up = smsc75xx_link_ok_nopm(dev);
++ usleep_range(10000, 20000);
++ timeout++;
++ } while ((!link_up) && (timeout < 1000));
++
++ if (timeout >= 1000) {
++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
++ return -EIO;
++ }
++
++ /* phy reset */
++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
++ return ret;
++ }
++
++ buf |= PMT_CTL_PHY_RST;
++
++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
++ return ret;
++ }
++
++ timeout = 0;
++ do {
++ usleep_range(10000, 20000);
++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
++ ret);
++ return ret;
++ }
++ timeout++;
++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
++
++ if (timeout >= 100) {
++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
++ return -EIO;
++ }
++
++ return 0;
++}
++
+ static int smsc75xx_reset(struct usbnet *dev)
+ {
+ struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Tue, 17 Jul 2018 11:28:46 +0800
+Subject: soc: imx: gpc: restrict register range for regmap access
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit de2d9b5284bcb5c159c5882ac69f6bfd4dec7c67 ]
+
+GPC registers are NOT continuous, some registers are
+reserved and accessing them from userspace will trigger
+external abort, add regmap register access table to
+avoid below abort:
+
+root@imx6slevk:~# cat /sys/kernel/debug/regmap/20dc000.gpc/registers
+[ 108.480477] Unhandled fault: imprecise external abort (0x1406) at 0xb6db5004
+[ 108.487985] pgd = 42b54bfd
+[ 108.490741] [b6db5004] *pgd=ba1b7831
+[ 108.494386] Internal error: : 1406 [#1] SMP ARM
+[ 108.498943] Modules linked in:
+[ 108.502043] CPU: 0 PID: 389 Comm: cat Not tainted 4.18.0-rc1-00074-gc9f1f60-dirty #482
+[ 108.509982] Hardware name: Freescale i.MX6 SoloLite (Device Tree)
+[ 108.516123] PC is at regmap_mmio_read32le+0x20/0x24
+[ 108.521031] LR is at regmap_mmio_read+0x40/0x60
+[ 108.525586] pc : [<c059cf74>] lr : [<c059d1ac>] psr: 20060093
+[ 108.531875] sp : eccf1d98 ip : eccf1da8 fp : eccf1da4
+[ 108.537122] r10: ec2d3800 r9 : eccf1f60 r8 : ecfc0000
+[ 108.542370] r7 : eccf1e2c r6 : eccf1e2c r5 : 00000028 r4 : ec338e00
+[ 108.548920] r3 : 00000000 r2 : eccf1e2c r1 : f0980028 r0 : 00000000
+[ 108.555474] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
+[ 108.562720] Control: 10c5387d Table: acf4004a DAC: 00000051
+[ 108.568491] Process cat (pid: 389, stack limit = 0xd4318a65)
+[ 108.574174] Stack: (0xeccf1d98 to 0xeccf2000)
+
+Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/imx/gpc.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -27,9 +27,16 @@
+ #define GPC_PGC_SW2ISO_SHIFT 0x8
+ #define GPC_PGC_SW_SHIFT 0x0
+
++#define GPC_PGC_PCI_PDN 0x200
++#define GPC_PGC_PCI_SR 0x20c
++
+ #define GPC_PGC_GPU_PDN 0x260
+ #define GPC_PGC_GPU_PUPSCR 0x264
+ #define GPC_PGC_GPU_PDNSCR 0x268
++#define GPC_PGC_GPU_SR 0x26c
++
++#define GPC_PGC_DISP_PDN 0x240
++#define GPC_PGC_DISP_SR 0x24c
+
+ #define GPU_VPU_PUP_REQ BIT(1)
+ #define GPU_VPU_PDN_REQ BIT(0)
+@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc
+ { }
+ };
+
++static const struct regmap_range yes_ranges[] = {
++ regmap_reg_range(GPC_CNTR, GPC_CNTR),
++ regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR),
++ regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR),
++ regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR),
++};
++
++static const struct regmap_access_table access_table = {
++ .yes_ranges = yes_ranges,
++ .n_yes_ranges = ARRAY_SIZE(yes_ranges),
++};
++
+ static const struct regmap_config imx_gpc_regmap_config = {
+ .reg_bits = 32,
+ .val_bits = 32,
+ .reg_stride = 4,
++ .rd_table = &access_table,
++ .wr_table = &access_table,
+ .max_register = 0x2ac,
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Wed, 30 May 2018 09:30:42 +0800
+Subject: soc: imx: gpcv2: correct PGC offset
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 3637f12faf507b0a4b8ac1e7115fc99583ab1db3 ]
+
+Correct MIPI/PCIe/USB_HSIC's PGC offset based on
+design RTL, the values in the Reference Manual
+(Rev. 1, 01/2018 and the older ones) are incorrect.
+
+The correct offset values should be as below:
+
+0x800 ~ 0x83F: PGC for core0 of A7 platform;
+0x840 ~ 0x87F: PGC for core1 of A7 platform;
+0x880 ~ 0x8BF: PGC for SCU of A7 platform;
+0xA00 ~ 0xA3F: PGC for fastmix/megamix;
+0xC00 ~ 0xC3F: PGC for MIPI PHY;
+0xC40 ~ 0xC7F: PGC for PCIe_PHY;
+0xC80 ~ 0xCBF: PGC for USB OTG1 PHY;
+0xCC0 ~ 0xCFF: PGC for USB OTG2 PHY;
+0xD00 ~ 0xD3F: PGC for USB HSIC PHY;
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Fixes: 03aa12629fc4 ("soc: imx: Add GPCv2 power gating driver")
+Acked-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/imx/gpcv2.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/soc/imx/gpcv2.c
++++ b/drivers/soc/imx/gpcv2.c
+@@ -39,10 +39,15 @@
+
+ #define GPC_M4_PU_PDN_FLG 0x1bc
+
+-
+-#define PGC_MIPI 4
+-#define PGC_PCIE 5
+-#define PGC_USB_HSIC 8
++/*
++ * The PGC offset values in Reference Manual
++ * (Rev. 1, 01/2018 and the older ones) GPC chapter's
++ * GPC_PGC memory map are incorrect, below offset
++ * values are from design RTL.
++ */
++#define PGC_MIPI 16
++#define PGC_PCIE 17
++#define PGC_USB_HSIC 20
+ #define GPC_PGC_CTRL(n) (0x800 + (n) * 0x40)
+ #define GPC_PGC_SR(n) (GPC_PGC_CTRL(n) + 0xc)
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 17 Jul 2018 18:27:45 -0700
+Subject: tcp: identify cryptic messages as TCP seq # bugs
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 ]
+
+Attempt to make cryptic TCP seq number error messages clearer by
+(1) identifying the source of the message as "TCP", (2) identifying the
+errors as "seq # bug", and (3) grouping the field identifiers and values
+by separating them with commas.
+
+E.g., the following message is changed from:
+
+recvmsg bug 2: copied 73BCB6CD seq 70F17CBE rcvnxt 73BCB9AA fl 0
+WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:1881 tcp_recvmsg+0x649/0xb90
+
+to:
+
+TCP recvmsg seq # bug 2: copied 73BCB6CD, seq 70F17CBE, rcvnxt 73BCB9AA, fl 0
+WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:2011 tcp_recvmsg+0x694/0xba0
+
+Suggested-by: 積丹尼 Dan Jacobson <jidanni@jidanni.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1845,7 +1845,7 @@ int tcp_recvmsg(struct sock *sk, struct
+ * shouldn't happen.
+ */
+ if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+ flags))
+ break;
+@@ -1860,7 +1860,7 @@ int tcp_recvmsg(struct sock *sk, struct
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ goto found_fin_ok;
+ WARN(!(flags & MSG_PEEK),
+- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Yuchung Cheng <ycheng@google.com>
+Date: Thu, 12 Jul 2018 06:04:53 -0700
+Subject: tcp: remove DELAYED ACK events in DCTCP
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit a69258f7aa2623e0930212f09c586fd06674ad79 ]
+
+After fixing the way DCTCP tracking delayed ACKs, the delayed-ACK
+related callbacks are no longer needed
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/tcp.h | 2 --
+ net/ipv4/tcp_dctcp.c | 25 -------------------------
+ net/ipv4/tcp_output.c | 4 ----
+ 3 files changed, 31 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -907,8 +907,6 @@ enum tcp_ca_event {
+ CA_EVENT_LOSS, /* loss timeout */
+ CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */
+ CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */
+- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */
+- CA_EVENT_NON_DELAYED_ACK,
+ };
+
+ /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
+--- a/net/ipv4/tcp_dctcp.c
++++ b/net/ipv4/tcp_dctcp.c
+@@ -55,7 +55,6 @@ struct dctcp {
+ u32 dctcp_alpha;
+ u32 next_seq;
+ u32 ce_state;
+- u32 delayed_ack_reserved;
+ u32 loss_cwnd;
+ };
+
+@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
+
+ ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
+
+- ca->delayed_ack_reserved = 0;
+ ca->loss_cwnd = 0;
+ ca->ce_state = 0;
+
+@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk,
+ }
+ }
+
+-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
+-{
+- struct dctcp *ca = inet_csk_ca(sk);
+-
+- switch (ev) {
+- case CA_EVENT_DELAYED_ACK:
+- if (!ca->delayed_ack_reserved)
+- ca->delayed_ack_reserved = 1;
+- break;
+- case CA_EVENT_NON_DELAYED_ACK:
+- if (ca->delayed_ack_reserved)
+- ca->delayed_ack_reserved = 0;
+- break;
+- default:
+- /* Don't care for the rest. */
+- break;
+- }
+-}
+-
+ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ {
+ switch (ev) {
+@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock
+ case CA_EVENT_ECN_NO_CE:
+ dctcp_ce_state_1_to_0(sk);
+ break;
+- case CA_EVENT_DELAYED_ACK:
+- case CA_EVENT_NON_DELAYED_ACK:
+- dctcp_update_ack_reserved(sk, ev);
+- break;
+ default:
+ /* Don't care for the rest. */
+ break;
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3545,8 +3545,6 @@ void tcp_send_delayed_ack(struct sock *s
+ int ato = icsk->icsk_ack.ato;
+ unsigned long timeout;
+
+- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
+-
+ if (ato > TCP_DELACK_MIN) {
+ const struct tcp_sock *tp = tcp_sk(sk);
+ int max_ato = HZ / 2;
+@@ -3603,8 +3601,6 @@ void __tcp_send_ack(struct sock *sk, u32
+ if (sk->sk_state == TCP_CLOSE)
+ return;
+
+- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
+-
+ /* We are not putting this on the write queue, so
+ * tcp_transmit_skb() will set the ownership to this
+ * sock.
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jon Maloy <jon.maloy@ericsson.com>
+Date: Fri, 6 Jul 2018 20:10:04 +0200
+Subject: tipc: correct discovery message handling during address trial period
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit e415577f57f4452150642500364cbe5fa6112813 ]
+
+With the duplicate address discovery protocol for tipc nodes addresses
+we introduced a one second trial period before a node is allocated a
+hash number to use as address.
+
+Unfortunately, we miss to handle the case when a regular LINK REQUEST/
+RESPONSE arrives from a cluster node during the trial period. Such
+messages are not ignored as they should be, leading to links setup
+attempts while the node still has no address.
+
+Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/discover.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_
+ }
+
+ /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer
++ * Returns true if message should be dropped by caller, i.e., if it is a
++ * trial message or we are inside trial period. Otherwise false.
+ */
+ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
+ struct tipc_media_addr *maddr,
+@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(str
+ msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+ }
+
++ /* Accept regular link requests/responses only after trial period */
+ if (mtyp != DSC_TRIAL_MSG)
+- return false;
++ return trial;
+
+ sugg_addr = tipc_node_try_addr(net, peer_id, src);
+ if (sugg_addr)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jon Maloy <jon.maloy@ericsson.com>
+Date: Fri, 6 Jul 2018 20:10:05 +0200
+Subject: tipc: fix correct setting of message type in second discoverer
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 92018c7ca959ccd346d6235dac03cf7fc1ba51f7 ]
+
+The duplicate address discovery protocol is not safe against two
+discoverers running in parallel. The one executing first after the
+trial period is over will set the node address and change its own
+message type to DSC_REQ_MSG. The one executing last may find that the
+node address is already set, and never change message type, with the
+result that its links may never be established.
+
+In this commmit we ensure that the message type always is set correctly
+after the trial period is over.
+
+Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/discover.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -287,7 +287,6 @@ static void tipc_disc_timeout(struct tim
+ {
+ struct tipc_discoverer *d = from_timer(d, t, timer);
+ struct tipc_net *tn = tipc_net(d->net);
+- u32 self = tipc_own_addr(d->net);
+ struct tipc_media_addr maddr;
+ struct sk_buff *skb = NULL;
+ struct net *net = d->net;
+@@ -301,12 +300,14 @@ static void tipc_disc_timeout(struct tim
+ goto exit;
+ }
+
+- /* Did we just leave the address trial period ? */
+- if (!self && !time_before(jiffies, tn->addr_trial_end)) {
+- self = tn->trial_addr;
+- tipc_net_finalize(net, self);
+- msg_set_prevnode(buf_msg(d->skb), self);
++ /* Trial period over ? */
++ if (!time_before(jiffies, tn->addr_trial_end)) {
++ /* Did we just leave it ? */
++ if (!tipc_own_addr(net))
++ tipc_net_finalize(net, tn->trial_addr);
++
+ msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
++ msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
+ }
+
+ /* Adjust timeout interval according to discovery phase */
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jon Maloy <jon.maloy@ericsson.com>
+Date: Fri, 6 Jul 2018 20:10:03 +0200
+Subject: tipc: fix wrong return value from function tipc_node_try_addr()
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 2a57f182420174c7fd4b19db979a2d135231a963 ]
+
+The function for checking if there is an node address conflict is
+supposed to return a suggestion for a new address if it finds a
+conflict, and zero otherwise. But in case the peer being checked
+is previously unknown it does instead return a "suggestion" for
+the checked address itself. This results in a DSC_TRIAL_FAIL_MSG
+being sent unecessarily to the peer, and sometimes makes the trial
+period starting over again.
+
+Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/node.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -776,6 +776,7 @@ static u32 tipc_node_suggest_addr(struct
+ }
+
+ /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not
++ * Returns suggested address if any, otherwise 0
+ */
+ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
+ {
+@@ -798,12 +799,14 @@ u32 tipc_node_try_addr(struct net *net,
+ if (n) {
+ addr = n->addr;
+ tipc_node_put(n);
++ return addr;
+ }
+- /* Even this node may be in trial phase */
++
++ /* Even this node may be in conflict */
+ if (tn->trial_addr == addr)
+ return tipc_node_suggest_addr(net, addr);
+
+- return addr;
++ return 0;
+ }
+
+ void tipc_node_check_dest(struct net *net, u32 addr,
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Jon Maloy <jon.maloy@ericsson.com>
+Date: Fri, 6 Jul 2018 20:10:06 +0200
+Subject: tipc: make function tipc_net_finalize() thread safe
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 9faa89d4ed9d7d326f4763d262842270450f9b1f ]
+
+The setting of the node address is not thread safe, meaning that
+two discoverers may decide to set it simultanously, with a duplicate
+entry in the name table as result. We fix that with this commit.
+
+Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/net.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *n
+
+ void tipc_net_finalize(struct net *net, u32 addr)
+ {
+- tipc_set_node_addr(net, addr);
+- smp_mb();
+- tipc_named_reinit(net);
+- tipc_sk_reinit(net);
+- tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+- TIPC_CLUSTER_SCOPE, 0, addr);
++ struct tipc_net *tn = tipc_net(net);
++
++ spin_lock_bh(&tn->node_list_lock);
++ if (!tipc_own_addr(net)) {
++ tipc_set_node_addr(net, addr);
++ tipc_named_reinit(net);
++ tipc_sk_reinit(net);
++ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
++ TIPC_CLUSTER_SCOPE, 0, addr);
++ }
++ spin_unlock_bh(&tn->node_list_lock);
+ }
+
+ void tipc_net_stop(struct net *net)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Doron Roberts-Kedes <doronrk@fb.com>
+Date: Mon, 2 Jul 2018 10:25:05 -0700
+Subject: tls: fix skb_to_sgvec returning unhandled error.
+
+From: Doron Roberts-Kedes <doronrk@fb.com>
+
+[ Upstream commit 52ee6ef36ee10dd493cf2067311e56ca8015eb8d ]
+
+The current code does not inspect the return value of skb_to_sgvec. This
+can cause a nullptr kernel panic when the malformed sgvec is passed into
+the crypto request.
+
+Checking the return value of skb_to_sgvec and skipping decryption if it
+is negative fixes this problem.
+
+Fixes: c46234ebb4d1 ("tls: RX path for ktls")
+Acked-by: Dave Watson <davejwatson@fb.com>
+Signed-off-by: Doron Roberts-Kedes <doronrk@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tls/tls_sw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -705,6 +705,10 @@ static int decrypt_skb(struct sock *sk,
+ nsg = skb_to_sgvec(skb, &sgin[1],
+ rxm->offset + tls_ctx->rx.prepend_size,
+ rxm->full_len - tls_ctx->rx.prepend_size);
++ if (nsg < 0) {
++ ret = nsg;
++ goto out;
++ }
+
+ tls_make_aad(ctx->rx_aad_ciphertext,
+ rxm->full_len - tls_ctx->rx.overhead_size,
+@@ -716,6 +720,7 @@ static int decrypt_skb(struct sock *sk,
+ rxm->full_len - tls_ctx->rx.overhead_size,
+ skb, sk->sk_allocation);
+
++out:
+ if (sgin != &sgin_arr[0])
+ kfree(sgin);
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Laura Abbott <labbott@redhat.com>
+Date: Mon, 9 Jul 2018 17:45:56 -0700
+Subject: tools: build: Fixup host c flags
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit 6fdbd824fd7a3876aac43d32fdf1f30b9ef72ce4 ]
+
+Commit 0c3b7e42616f ("tools build: Add support for host programs format")
+introduced host_c_flags which referenced CHOSTFLAGS. The actual name of the
+variable is HOSTCFLAGS. Fix this up.
+
+Fixes: 0c3b7e42616f ("tools build: Add support for host programs format")
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/build/Build.include | 2 +-
+ tools/perf/pmu-events/Build | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -98,4 +98,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$
+ ###
+ ## HOSTCC C flags
+
+-host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CHOSTFLAGS) -D"BUILD_STR(s)=\#s" $(CHOSTFLAGS_$(basetarget).o) $(CHOSTFLAGS_$(obj))
++host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(HOSTCFLAGS) -D"BUILD_STR(s)=\#s" $(HOSTCFLAGS_$(basetarget).o) $(HOSTCFLAGS_$(obj))
+--- a/tools/perf/pmu-events/Build
++++ b/tools/perf/pmu-events/Build
+@@ -1,7 +1,7 @@
+ hostprogs := jevents
+
+ jevents-y += json.o jsmn.o jevents.o
+-CHOSTFLAGS_jevents.o = -I$(srctree)/tools/include
++HOSTCFLAGS_jevents.o = -I$(srctree)/tools/include
+ pmu-events-y += pmu-events.o
+ JDIR = pmu-events/arch/$(SRCARCH)
+ JSON = $(shell [ -d $(JDIR) ] && \
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Laura Abbott <labbott@redhat.com>
+Date: Mon, 9 Jul 2018 17:45:57 -0700
+Subject: tools: build: Use HOSTLDFLAGS with fixdep
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit 8b247a92ebd0cda7dec49a6f771d9c4950f3d3ad ]
+
+The final link of fixdep uses LDFLAGS but not the existing HOSTLDFLAGS.
+Fix this.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/build/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -43,7 +43,7 @@ $(OUTPUT)fixdep-in.o: FORCE
+ $(Q)$(MAKE) $(build)=fixdep
+
+ $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o
+- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $<
++ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $<
+
+ FORCE:
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Fri, 15 Jun 2018 16:46:57 -0300
+Subject: tools include uapi: Update if_link.h to pick IFLA_{BRPORT_ISOLATED,VXLAN_TTL_INHERIT}
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit bb9a33cb8a807e5ae9906563f5c1533904651b8b ]
+
+The IFLA_BRPORT_ISOLATED and IFLA_VXLAN_TTL_INHERIT defines were added in:
+
+ 7d850abd5f4e ("net: bridge: add support for port isolation")
+ 72f6d71e491e ("vxlan: add ttl inherit support")
+
+Pick them, silencing this build warning:
+
+ Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'
+
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Eric Leblond <eric@regit.org>
+Cc: Hangbin Liu <liuhangbin@gmail.com>
+Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Link: https://lkml.kernel.org/n/tip-ezi5u0mmdqm0wfm0y2y8176r@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/include/uapi/linux/if_link.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/include/uapi/linux/if_link.h
++++ b/tools/include/uapi/linux/if_link.h
+@@ -333,6 +333,7 @@ enum {
+ IFLA_BRPORT_BCAST_FLOOD,
+ IFLA_BRPORT_GROUP_FWD_MASK,
+ IFLA_BRPORT_NEIGH_SUPPRESS,
++ IFLA_BRPORT_ISOLATED,
+ __IFLA_BRPORT_MAX
+ };
+ #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
+@@ -516,6 +517,7 @@ enum {
+ IFLA_VXLAN_COLLECT_METADATA,
+ IFLA_VXLAN_LABEL,
+ IFLA_VXLAN_GPE,
++ IFLA_VXLAN_TTL_INHERIT,
+ __IFLA_VXLAN_MAX
+ };
+ #define IFLA_VXLAN_MAX (__IFLA_VXLAN_MAX - 1)
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Vishal Verma <vishal.l.verma@intel.com>
+Date: Mon, 18 Jun 2018 17:17:02 -0600
+Subject: tools/testing/nvdimm: advertise a write cache for nfit_test
+
+From: Vishal Verma <vishal.l.verma@intel.com>
+
+[ Upstream commit 1273c253c32b9a073a4d8921ed079177ccc7c8af ]
+
+Commit 546eb0317cfa "libnvdimm, pmem: Do not flush power-fail protected CPU caches"
+fixed the write_cache detection to correctly show the lack of a write
+cache based on the platform capabilities described in the ACPI NFIT. The
+nfit_test unit tests expected a write cache to be present, so change the
+nfit test namespaces to only advertise a persistence domain limited to
+the memory controller. This allows the kernel to show a write_cache
+attribute, and the test behaviour remains unchanged.
+
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/nvdimm/test/nfit.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -1989,8 +1989,7 @@ static void nfit_test0_setup(struct nfit
+ pcap->header.type = ACPI_NFIT_TYPE_CAPABILITIES;
+ pcap->header.length = sizeof(*pcap);
+ pcap->highest_capability = 1;
+- pcap->capabilities = ACPI_NFIT_CAPABILITY_CACHE_FLUSH |
+- ACPI_NFIT_CAPABILITY_MEM_FLUSH;
++ pcap->capabilities = ACPI_NFIT_CAPABILITY_MEM_FLUSH;
+ offset += pcap->header.length;
+
+ if (t->setup_hotplug) {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 8 Mar 2018 21:58:43 +0100
+Subject: tracing: Use __printf markup to silence compiler
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit 26b68dd2f48fe7699a89f0cfbb9f4a650dc1c837 ]
+
+Silence warnings (triggered at W=1) by adding relevant __printf attributes.
+
+ CC kernel/trace/trace.o
+kernel/trace/trace.c: In function ‘__trace_array_vprintk’:
+kernel/trace/trace.c:2979:2: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]
+ len = vscnprintf(tbuffer, TRACE_BUF_SIZE, fmt, args);
+ ^~~
+ AR kernel/trace/built-in.o
+
+Link: http://lkml.kernel.org/r/20180308205843.27447-1-malat@debian.org
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2962,6 +2962,7 @@ out_nobuffer:
+ }
+ EXPORT_SYMBOL_GPL(trace_vbprintk);
+
++__printf(3, 0)
+ static int
+ __trace_array_vprintk(struct ring_buffer *buffer,
+ unsigned long ip, const char *fmt, va_list args)
+@@ -3016,12 +3017,14 @@ out_nobuffer:
+ return len;
+ }
+
++__printf(3, 0)
+ int trace_array_vprintk(struct trace_array *tr,
+ unsigned long ip, const char *fmt, va_list args)
+ {
+ return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args);
+ }
+
++__printf(3, 0)
+ int trace_array_printk(struct trace_array *tr,
+ unsigned long ip, const char *fmt, ...)
+ {
+@@ -3037,6 +3040,7 @@ int trace_array_printk(struct trace_arra
+ return ret;
+ }
+
++__printf(3, 4)
+ int trace_array_printk_buf(struct ring_buffer *buffer,
+ unsigned long ip, const char *fmt, ...)
+ {
+@@ -3052,6 +3056,7 @@ int trace_array_printk_buf(struct ring_b
+ return ret;
+ }
+
++__printf(2, 0)
+ int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
+ {
+ return trace_array_vprintk(&global_trace, ip, fmt, args);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 7 Jun 2018 16:17:14 +0300
+Subject: typec: tcpm: Fix a msecs vs jiffies bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9578bcd0bb487b8ecef4b7eee799aafb678aa441 ]
+
+The tcpm_set_state() function take msecs not jiffies.
+
+Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -2543,7 +2543,8 @@ static void run_state_machine(struct tcp
+ tcpm_port_is_sink(port) &&
+ time_is_after_jiffies(port->delayed_runtime)) {
+ tcpm_set_state(port, SNK_DISCOVERY,
+- port->delayed_runtime - jiffies);
++ jiffies_to_msecs(port->delayed_runtime -
++ jiffies));
+ break;
+ }
+ tcpm_set_state(port, unattached_state(port), 0);
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Peter Chen <peter.chen@nxp.com>
+Date: Wed, 6 Jun 2018 09:43:27 +0800
+Subject: usb: chipidea: host: fix disconnection detect issue
+
+From: Peter Chen <peter.chen@nxp.com>
+
+[ Upstream commit 90f26cc6bb90b35040f4da0347f480ea9df6e2fc ]
+
+The commit 4e88d4c08301 ("usb: add a flag to skip PHY
+initialization to struct usb_hcd") delete the assignment
+for hcd->usb_phy, it causes usb_phy_notify_connect{disconnect)
+are not called, the USB PHY driver is not notified of hot plug
+event, then the disconnection will not be detected by hardware.
+
+Fixes: 4e88d4c08301 ("usb: add a flag to skip PHY initialization
+ to struct usb_hcd")
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reported-by: Mats Karrman <mats.dev.list@gmail.com>
+Tested-by: Mats Karrman <mats.dev.list@gmail.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/host.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -124,8 +124,11 @@ static int host_start(struct ci_hdrc *ci
+
+ hcd->power_budget = ci->platdata->power_budget;
+ hcd->tpl_support = ci->platdata->tpl_support;
+- if (ci->phy || ci->usb_phy)
++ if (ci->phy || ci->usb_phy) {
+ hcd->skip_phy_initialization = 1;
++ if (ci->usb_phy)
++ hcd->usb_phy = ci->usb_phy;
++ }
+
+ ehci = hcd_to_ehci(hcd);
+ ehci->caps = ci->hw_bank.cap;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: William Wu <william.wu@rock-chips.com>
+Date: Fri, 11 May 2018 17:46:31 +0800
+Subject: usb: dwc2: alloc dma aligned buffer for isoc split in
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit af424a410749ed7e0c2bffd3cedbc7c274d0ff6f ]
+
+The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in
+a more supported way") rips out a lot of code to simply the
+allocation of aligned DMA. However, it also introduces a new
+issue when use isoc split in transfer.
+
+In my test case, I connect the dwc2 controller with an usb hs
+Hub (GL852G-12), and plug an usb fs audio device (Plantronics
+headset) into the downstream port of Hub. Then use the usb mic
+to record, we can find noise when playback.
+
+It's because that the usb Hub uses an MDATA for the first
+transaction and a DATA0 for the second transaction for the isoc
+split in transaction. An typical isoc split in transaction sequence
+like this:
+
+- SSPLIT IN transaction
+- CSPLIT IN transaction
+ - MDATA packet
+- CSPLIT IN transaction
+ - DATA0 packet
+
+The DMA address of MDATA (urb->dma) is always DWORD-aligned, but
+the DMA address of DATA0 (urb->dma + qtd->isoc_split_offset) may
+not be DWORD-aligned, it depends on the qtd->isoc_split_offset (the
+length of MDATA). In my test case, the length of MDATA is usually
+unaligned, this cause DATA0 packet transmission error.
+
+This patch use kmem_cache to allocate aligned DMA buf for isoc
+split in transaction. Note that according to usb 2.0 spec, the
+maximum data payload size is 1023 bytes for each fs isoc ep,
+and the maximum allowable interrupt data payload size is 64 bytes
+or less for fs interrupt ep. So we set the size of object to be
+1024 bytes in the kmem cache.
+
+Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Minas Harutyunyan hminas@synopsys.com>
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/core.h | 3 +
+ drivers/usb/dwc2/hcd.c | 89 ++++++++++++++++++++++++++++++++++++++++---
+ drivers/usb/dwc2/hcd.h | 8 +++
+ drivers/usb/dwc2/hcd_intr.c | 8 +++
+ drivers/usb/dwc2/hcd_queue.c | 3 +
+ 5 files changed, 106 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/dwc2/core.h
++++ b/drivers/usb/dwc2/core.h
+@@ -915,6 +915,7 @@ struct dwc2_hregs_backup {
+ * @frame_list_sz: Frame list size
+ * @desc_gen_cache: Kmem cache for generic descriptors
+ * @desc_hsisoc_cache: Kmem cache for hs isochronous descriptors
++ * @unaligned_cache: Kmem cache for DMA mode to handle non-aligned buf
+ *
+ * These are for peripheral mode:
+ *
+@@ -1061,6 +1062,8 @@ struct dwc2_hsotg {
+ u32 frame_list_sz;
+ struct kmem_cache *desc_gen_cache;
+ struct kmem_cache *desc_hsisoc_cache;
++ struct kmem_cache *unaligned_cache;
++#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024
+
+ #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1567,11 +1567,20 @@ static void dwc2_hc_start_transfer(struc
+ }
+
+ if (hsotg->params.host_dma) {
+- dwc2_writel((u32)chan->xfer_dma,
+- hsotg->regs + HCDMA(chan->hc_num));
++ dma_addr_t dma_addr;
++
++ if (chan->align_buf) {
++ if (dbg_hc(chan))
++ dev_vdbg(hsotg->dev, "align_buf\n");
++ dma_addr = chan->align_buf;
++ } else {
++ dma_addr = chan->xfer_dma;
++ }
++ dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num));
++
+ if (dbg_hc(chan))
+ dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n",
+- (unsigned long)chan->xfer_dma, chan->hc_num);
++ (unsigned long)dma_addr, chan->hc_num);
+ }
+
+ /* Start the split */
+@@ -2625,6 +2634,35 @@ static void dwc2_hc_init_xfer(struct dwc
+ }
+ }
+
++static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
++ struct dwc2_qh *qh,
++ struct dwc2_host_chan *chan)
++{
++ if (!hsotg->unaligned_cache ||
++ chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE)
++ return -ENOMEM;
++
++ if (!qh->dw_align_buf) {
++ qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache,
++ GFP_ATOMIC | GFP_DMA);
++ if (!qh->dw_align_buf)
++ return -ENOMEM;
++ }
++
++ qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf,
++ DWC2_KMEM_UNALIGNED_BUF_SIZE,
++ DMA_FROM_DEVICE);
++
++ if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) {
++ dev_err(hsotg->dev, "can't map align_buf\n");
++ chan->align_buf = 0;
++ return -EINVAL;
++ }
++
++ chan->align_buf = qh->dw_align_buf_dma;
++ return 0;
++}
++
+ #define DWC2_USB_DMA_ALIGN 4
+
+ static void dwc2_free_dma_aligned_buffer(struct urb *urb)
+@@ -2804,6 +2842,32 @@ static int dwc2_assign_and_init_hc(struc
+ /* Set the transfer attributes */
+ dwc2_hc_init_xfer(hsotg, chan, qtd);
+
++ /* For non-dword aligned buffers */
++ if (hsotg->params.host_dma && qh->do_split &&
++ chan->ep_is_in && (chan->xfer_dma & 0x3)) {
++ dev_vdbg(hsotg->dev, "Non-aligned buffer\n");
++ if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) {
++ dev_err(hsotg->dev,
++ "Failed to allocate memory to handle non-aligned buffer\n");
++ /* Add channel back to free list */
++ chan->align_buf = 0;
++ chan->multi_count = 0;
++ list_add_tail(&chan->hc_list_entry,
++ &hsotg->free_hc_list);
++ qtd->in_process = 0;
++ qh->channel = NULL;
++ return -ENOMEM;
++ }
++ } else {
++ /*
++ * We assume that DMA is always aligned in non-split
++ * case or split out case. Warn if not.
++ */
++ WARN_ON_ONCE(hsotg->params.host_dma &&
++ (chan->xfer_dma & 0x3));
++ chan->align_buf = 0;
++ }
++
+ if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
+ chan->ep_type == USB_ENDPOINT_XFER_ISOC)
+ /*
+@@ -5248,6 +5312,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso
+ }
+ }
+
++ if (hsotg->params.host_dma) {
++ /*
++ * Create kmem caches to handle non-aligned buffer
++ * in Buffer DMA mode.
++ */
++ hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma",
++ DWC2_KMEM_UNALIGNED_BUF_SIZE, 4,
++ SLAB_CACHE_DMA, NULL);
++ if (!hsotg->unaligned_cache)
++ dev_err(hsotg->dev,
++ "unable to create dwc2 unaligned cache\n");
++ }
++
+ hsotg->otg_port = 1;
+ hsotg->frame_list = NULL;
+ hsotg->frame_list_dma = 0;
+@@ -5282,8 +5359,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso
+ return 0;
+
+ error4:
+- kmem_cache_destroy(hsotg->desc_gen_cache);
++ kmem_cache_destroy(hsotg->unaligned_cache);
+ kmem_cache_destroy(hsotg->desc_hsisoc_cache);
++ kmem_cache_destroy(hsotg->desc_gen_cache);
+ error3:
+ dwc2_hcd_release(hsotg);
+ error2:
+@@ -5324,8 +5402,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg *
+ usb_remove_hcd(hcd);
+ hsotg->priv = NULL;
+
+- kmem_cache_destroy(hsotg->desc_gen_cache);
++ kmem_cache_destroy(hsotg->unaligned_cache);
+ kmem_cache_destroy(hsotg->desc_hsisoc_cache);
++ kmem_cache_destroy(hsotg->desc_gen_cache);
+
+ dwc2_hcd_release(hsotg);
+ usb_put_hcd(hcd);
+--- a/drivers/usb/dwc2/hcd.h
++++ b/drivers/usb/dwc2/hcd.h
+@@ -76,6 +76,8 @@ struct dwc2_qh;
+ * (micro)frame
+ * @xfer_buf: Pointer to current transfer buffer position
+ * @xfer_dma: DMA address of xfer_buf
++ * @align_buf: In Buffer DMA mode this will be used if xfer_buf is not
++ * DWORD aligned
+ * @xfer_len: Total number of bytes to transfer
+ * @xfer_count: Number of bytes transferred so far
+ * @start_pkt_count: Packet count at start of transfer
+@@ -133,6 +135,7 @@ struct dwc2_host_chan {
+
+ u8 *xfer_buf;
+ dma_addr_t xfer_dma;
++ dma_addr_t align_buf;
+ u32 xfer_len;
+ u32 xfer_count;
+ u16 start_pkt_count;
+@@ -303,6 +306,9 @@ struct dwc2_hs_transfer_time {
+ * is tightly packed.
+ * @ls_duration_us: Duration on the low speed bus schedule.
+ * @ntd: Actual number of transfer descriptors in a list
++ * @dw_align_buf: Used instead of original buffer if its physical address
++ * is not dword-aligned
++ * @dw_align_buf_dma: DMA address for dw_align_buf
+ * @qtd_list: List of QTDs for this QH
+ * @channel: Host channel currently processing transfers for this QH
+ * @qh_list_entry: Entry for QH in either the periodic or non-periodic
+@@ -350,6 +356,8 @@ struct dwc2_qh {
+ struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES];
+ u32 ls_start_schedule_slice;
+ u16 ntd;
++ u8 *dw_align_buf;
++ dma_addr_t dw_align_buf_dma;
+ struct list_head qtd_list;
+ struct dwc2_host_chan *channel;
+ struct list_head qh_list_entry;
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -938,6 +938,14 @@ static int dwc2_xfercomp_isoc_split_in(s
+
+ frame_desc->actual_length += len;
+
++ if (chan->align_buf) {
++ dev_vdbg(hsotg->dev, "non-aligned buffer\n");
++ dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma,
++ DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE);
++ memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma),
++ chan->qh->dw_align_buf, len);
++ }
++
+ qtd->isoc_split_offset += len;
+
+ hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum));
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -1695,6 +1695,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg
+
+ if (qh->desc_list)
+ dwc2_hcd_qh_free_ddma(hsotg, qh);
++ else if (hsotg->unaligned_cache && qh->dw_align_buf)
++ kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf);
++
+ kfree(qh);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Date: Wed, 23 May 2018 09:26:08 -0400
+Subject: usb: dwc2: Fix host exit from hibernation flow.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+[ Upstream commit 22bb5cfdf13ae70c6a34508a16cfeee48f162443 ]
+
+In case when a hub is connected to DWC2 host
+auto suspend occurs and host goes to
+hibernation. When any device connected to hub
+host hibernation exiting incorrectly.
+
+- Added dwc2_hcd_rem_wakeup() function call to
+ exit from suspend state by remote wakeup.
+
+- Increase timeout value for port suspend bit to be set.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Artur Petrosyan <arturp@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5437,7 +5437,7 @@ int dwc2_host_enter_hibernation(struct d
+ dwc2_writel(hprt0, hsotg->regs + HPRT0);
+
+ /* Wait for the HPRT0.PrtSusp register field to be set */
+- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 300))
++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000))
+ dev_warn(hsotg->dev, "Suspend wasn't generated\n");
+
+ /*
+@@ -5618,6 +5618,8 @@ int dwc2_host_exit_hibernation(struct dw
+ return ret;
+ }
+
++ dwc2_hcd_rem_wakeup(hsotg);
++
+ hsotg->hibernated = 0;
+ hsotg->bus_suspended = 0;
+ hsotg->lx_state = DWC2_L0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: William Wu <william.wu@rock-chips.com>
+Date: Fri, 11 May 2018 17:46:32 +0800
+Subject: usb: dwc2: fix isoc split in transfer with no data
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ]
+
+If isoc split in transfer with no data (the length of DATA0
+packet is zero), we can't simply return immediately. Because
+the DATA0 can be the first transaction or the second transaction
+for the isoc split in transaction. If the DATA0 packet with no
+data is in the first transaction, we can return immediately.
+But if the DATA0 packet with no data is in the second transaction
+of isoc split in transaction sequence, we need to increase the
+qtd->isoc_frame_index and giveback urb to device driver if needed,
+otherwise, the MDATA packet will be lost.
+
+A typical test case is that connect the dwc2 controller with an
+usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics
+headset) into the downstream port of Hub. Then use the usb mic
+to record, we can find noise when playback.
+
+In the case, the isoc split in transaction sequence like this:
+
+- SSPLIT IN transaction
+- CSPLIT IN transaction
+ - MDATA packet (176 bytes)
+- CSPLIT IN transaction
+ - DATA0 packet (0 byte)
+
+This patch use both the length of DATA0 and qtd->isoc_split_offset
+to check if the DATA0 is in the second transaction.
+
+Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Minas Harutyunyan hminas@synopsys.com>
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -930,9 +930,8 @@ static int dwc2_xfercomp_isoc_split_in(s
+ frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+ len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
+ DWC2_HC_XFER_COMPLETE, NULL);
+- if (!len) {
++ if (!len && !qtd->isoc_split_offset) {
+ qtd->complete_split = 0;
+- qtd->isoc_split_offset = 0;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Tue, 12 Jun 2018 12:37:29 +0400
+Subject: usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc()
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+[ Upstream commit 1ffba9058737af2ddeebc813faa8ea9b16bc892a ]
+
+In case of requests queue is empty reset EP target_frame to
+initial value.
+
+This allow restarting ISOC traffic in case when function
+driver queued requests with interruptions.
+
+Tested-by: Zeng Tao <prime.zeng@hisilicon.com>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -892,6 +892,7 @@ static void dwc2_gadget_start_isoc_ddma(
+ u32 ctrl;
+
+ if (list_empty(&hs_ep->queue)) {
++ hs_ep->target_frame = TARGET_FRAME_INITIAL;
+ dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__);
+ return;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 31 May 2018 16:45:52 +0200
+Subject: usb: dwc3: of-simple: fix use-after-free on remove
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 896e518883f18e601335908192e33426c1f599a4 ]
+
+The clocks have already been explicitly disabled and put as part of
+remove() so the runtime suspend callback must not be run when balancing
+the runtime PM usage count before returning.
+
+Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-of-simple.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct
+
+ reset_control_put(simple->resets);
+
+- pm_runtime_put_sync(dev);
+ pm_runtime_disable(dev);
++ pm_runtime_put_noidle(dev);
++ pm_runtime_set_suspended(dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Thu, 15 Jun 2017 12:57:30 +0300
+Subject: usb: dwc3: pci: add support for Intel IceLake
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 00908693c481f7298adf8cf4d2ff3dfbea8c375f ]
+
+PCI IDs for Intel IceLake.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -34,6 +34,7 @@
+ #define PCI_DEVICE_ID_INTEL_GLK 0x31aa
+ #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
+ #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
++#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -289,6 +290,7 @@ static const struct pci_device_id dwc3_p
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
+ { } /* Terminating Entry */
+ };
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 25 May 2018 17:24:57 +0800
+Subject: usb: gadget: composite: fix delayed_status race condition when set_interface
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ]
+
+It happens when enable debug log, if set_alt() returns
+USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
+is called before increasing count of @delayed_status,
+so fix it by using spinlock of @cdev->lock.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Tested-by: Jay Hsu <shih-chieh.hsu@mediatek.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/composite.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadge
+ */
+ if (w_value && !f->get_alt)
+ break;
++
++ spin_lock(&cdev->lock);
+ value = f->set_alt(f, w_index, w_value);
+ if (value == USB_GADGET_DELAYED_STATUS) {
+ DBG(cdev,
+@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadge
+ DBG(cdev, "delayed_status count %d\n",
+ cdev->delayed_status);
+ }
++ spin_unlock(&cdev->lock);
+ break;
+ case USB_REQ_GET_INTERFACE:
+ if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
+Date: Thu, 24 May 2018 18:22:30 +0400
+Subject: usb: gadget: dwc2: fix memory leak in gadget_init()
+
+From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
+
+[ Upstream commit 9bb073a053f0464ea74a4d4c331fdb7da58568d6 ]
+
+Freed allocated request for ep0 to prevent memory leak in case when
+dwc2_driver_probe() failed.
+
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4721,9 +4721,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *
+ }
+
+ ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+- if (ret)
++ if (ret) {
++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
++ hsotg->ctrl_req);
+ return ret;
+-
++ }
+ dwc2_hsotg_dump(hsotg);
+
+ return 0;
+@@ -4736,6 +4738,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *
+ int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
+ {
+ usb_del_gadget_udc(&hsotg->gadget);
++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Vincent Pelletier <plr.vincent@gmail.com>
+Date: Wed, 13 Jun 2018 11:05:06 +0000
+Subject: usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers
+
+From: Vincent Pelletier <plr.vincent@gmail.com>
+
+[ Upstream commit d52e4d0c0c428bf2ba35074a7495cdb28e2efbae ]
+
+This bug happens only when the UDC needs to sleep during usb_ep_dequeue,
+as is the case for (at least) dwc3.
+
+[ 382.200896] BUG: scheduling while atomic: screen/1808/0x00000100
+[ 382.207124] 4 locks held by screen/1808:
+[ 382.211266] #0: (rcu_callback){....}, at: [<c10b4ff0>] rcu_process_callbacks+0x260/0x440
+[ 382.219949] #1: (rcu_read_lock_sched){....}, at: [<c1358ba0>] percpu_ref_switch_to_atomic_rcu+0xb0/0x130
+[ 382.230034] #2: (&(&ctx->ctx_lock)->rlock){....}, at: [<c11f0c73>] free_ioctx_users+0x23/0xd0
+[ 382.230096] #3: (&(&ffs->eps_lock)->rlock){....}, at: [<f81e7710>] ffs_aio_cancel+0x20/0x60 [usb_f_fs]
+[ 382.230160] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil intel_powerclamp coretemp dwc3 kvm_intel ulpi udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd gpio_keys usbcore basincove_gpadc industrialio usb_common
+[ 382.230407] CPU: 1 PID: 1808 Comm: screen Not tainted 4.14.0-edison+ #117
+[ 382.230416] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
+[ 382.230425] Call Trace:
+[ 382.230438] <SOFTIRQ>
+[ 382.230466] dump_stack+0x47/0x62
+[ 382.230498] __schedule_bug+0x61/0x80
+[ 382.230522] __schedule+0x43/0x7a0
+[ 382.230587] schedule+0x5f/0x70
+[ 382.230625] dwc3_gadget_ep_dequeue+0x14c/0x270 [dwc3]
+[ 382.230669] ? do_wait_intr_irq+0x70/0x70
+[ 382.230724] usb_ep_dequeue+0x19/0x90 [udc_core]
+[ 382.230770] ffs_aio_cancel+0x37/0x60 [usb_f_fs]
+[ 382.230798] kiocb_cancel+0x31/0x40
+[ 382.230822] free_ioctx_users+0x4d/0xd0
+[ 382.230858] percpu_ref_switch_to_atomic_rcu+0x10a/0x130
+[ 382.230881] ? percpu_ref_exit+0x40/0x40
+[ 382.230904] rcu_process_callbacks+0x2b3/0x440
+[ 382.230965] __do_softirq+0xf8/0x26b
+[ 382.231011] ? __softirqentry_text_start+0x8/0x8
+[ 382.231033] do_softirq_own_stack+0x22/0x30
+[ 382.231042] </SOFTIRQ>
+[ 382.231071] irq_exit+0x45/0xc0
+[ 382.231089] smp_apic_timer_interrupt+0x13c/0x150
+[ 382.231118] apic_timer_interrupt+0x35/0x3c
+[ 382.231132] EIP: __copy_user_ll+0xe2/0xf0
+[ 382.231142] EFLAGS: 00210293 CPU: 1
+[ 382.231154] EAX: bfd4508c EBX: 00000004 ECX: 00000003 EDX: f3d8fe50
+[ 382.231165] ESI: f3d8fe51 EDI: bfd4508d EBP: f3d8fe14 ESP: f3d8fe08
+[ 382.231176] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+[ 382.231265] core_sys_select+0x25f/0x320
+[ 382.231346] ? __wake_up_common_lock+0x62/0x80
+[ 382.231399] ? tty_ldisc_deref+0x13/0x20
+[ 382.231438] ? ldsem_up_read+0x1b/0x40
+[ 382.231459] ? tty_ldisc_deref+0x13/0x20
+[ 382.231479] ? tty_write+0x29f/0x2e0
+[ 382.231514] ? n_tty_ioctl+0xe0/0xe0
+[ 382.231541] ? tty_write_unlock+0x30/0x30
+[ 382.231566] ? __vfs_write+0x22/0x110
+[ 382.231604] ? security_file_permission+0x2f/0xd0
+[ 382.231635] ? rw_verify_area+0xac/0x120
+[ 382.231677] ? vfs_write+0x103/0x180
+[ 382.231711] SyS_select+0x87/0xc0
+[ 382.231739] ? SyS_write+0x42/0x90
+[ 382.231781] do_fast_syscall_32+0xd6/0x1a0
+[ 382.231836] entry_SYSENTER_32+0x47/0x71
+[ 382.231848] EIP: 0xb7f75b05
+[ 382.231857] EFLAGS: 00000246 CPU: 1
+[ 382.231868] EAX: ffffffda EBX: 00000400 ECX: bfd4508c EDX: bfd4510c
+[ 382.231878] ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: bfd45020
+[ 382.231889] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
+[ 382.232281] softirq: huh, entered softirq 9 RCU c10b4d90 with preempt_count 00000100, exited with 00000000?
+
+Tested-by: Sam Protsenko <semen.protsenko@linaro.org>
+Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -215,6 +215,7 @@ struct ffs_io_data {
+
+ struct mm_struct *mm;
+ struct work_struct work;
++ struct work_struct cancellation_work;
+
+ struct usb_ep *ep;
+ struct usb_request *req;
+@@ -1072,22 +1073,31 @@ ffs_epfile_open(struct inode *inode, str
+ return 0;
+ }
+
++static void ffs_aio_cancel_worker(struct work_struct *work)
++{
++ struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
++ cancellation_work);
++
++ ENTER();
++
++ usb_ep_dequeue(io_data->ep, io_data->req);
++}
++
+ static int ffs_aio_cancel(struct kiocb *kiocb)
+ {
+ struct ffs_io_data *io_data = kiocb->private;
+- struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
++ struct ffs_data *ffs = io_data->ffs;
+ int value;
+
+ ENTER();
+
+- spin_lock_irq(&epfile->ffs->eps_lock);
+-
+- if (likely(io_data && io_data->ep && io_data->req))
+- value = usb_ep_dequeue(io_data->ep, io_data->req);
+- else
++ if (likely(io_data && io_data->ep && io_data->req)) {
++ INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
++ queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
++ value = -EINPROGRESS;
++ } else {
+ value = -EINVAL;
+-
+- spin_unlock_irq(&epfile->ffs->eps_lock);
++ }
+
+ return value;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 2 Jul 2018 17:13:31 +0300
+Subject: usb: xhci: dbc: Don't decrement runtime PM counter if DBC is not started
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 74cb319bd97dd62881f97ea5a3228f7c2546bf56 ]
+
+pm_runtime_put_sync() gets called everytime in xhci_dbc_stop().
+
+If dbc is not started, this makes the runtime PM counter incorrectly
+becomes 0, and calls autosuspend function. Then we'll keep seeing this:
+[54664.762220] xhci_hcd 0000:00:14.0: Root hub is not suspended
+
+So only calls pm_runtime_put_sync() when dbc was started.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -507,16 +507,18 @@ static int xhci_do_dbc_start(struct xhci
+ return 0;
+ }
+
+-static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
++static int xhci_do_dbc_stop(struct xhci_hcd *xhci)
+ {
+ struct xhci_dbc *dbc = xhci->dbc;
+
+ if (dbc->state == DS_DISABLED)
+- return;
++ return -1;
+
+ writel(0, &dbc->regs->control);
+ xhci_dbc_mem_cleanup(xhci);
+ dbc->state = DS_DISABLED;
++
++ return 0;
+ }
+
+ static int xhci_dbc_start(struct xhci_hcd *xhci)
+@@ -543,6 +545,7 @@ static int xhci_dbc_start(struct xhci_hc
+
+ static void xhci_dbc_stop(struct xhci_hcd *xhci)
+ {
++ int ret;
+ unsigned long flags;
+ struct xhci_dbc *dbc = xhci->dbc;
+ struct dbc_port *port = &dbc->port;
+@@ -555,10 +558,11 @@ static void xhci_dbc_stop(struct xhci_hc
+ xhci_dbc_tty_unregister_device(xhci);
+
+ spin_lock_irqsave(&dbc->lock, flags);
+- xhci_do_dbc_stop(xhci);
++ ret = xhci_do_dbc_stop(xhci);
+ spin_unlock_irqrestore(&dbc->lock, flags);
+
+- pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
++ if (!ret)
++ pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
+ }
+
+ static void
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Ajay Gupta <ajaykuee@gmail.com>
+Date: Thu, 21 Jun 2018 16:19:45 +0300
+Subject: usb: xhci: increase CRS timeout value
+
+From: Ajay Gupta <ajaykuee@gmail.com>
+
+[ Upstream commit 305886ca87be480ae159908c2affd135c04215cf ]
+
+Some controllers take almost 55ms to complete controller
+restore state (CRS).
+There is no timeout limit mentioned in xhci specification so
+fixing the issue by increasing the timeout limit to 100ms
+
+[reformat code comment -Mathias]
+Signed-off-by: Ajay Gupta <ajaykuee@gmail.com>
+Signed-off-by: Nagaraj Annaiah <naga.annaiah@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1014,8 +1014,13 @@ int xhci_resume(struct xhci_hcd *xhci, b
+ command = readl(&xhci->op_regs->command);
+ command |= CMD_CRS;
+ writel(command, &xhci->op_regs->command);
++ /*
++ * Some controllers take up to 55+ ms to complete the controller
++ * restore so setting the timeout to 100ms. Xhci specification
++ * doesn't mention any timeout value.
++ */
+ if (xhci_handshake(&xhci->op_regs->status,
+- STS_RESTORE, 0, 10 * 1000)) {
++ STS_RESTORE, 0, 100 * 1000)) {
+ xhci_warn(xhci, "WARN: xHC restore state timeout\n");
+ spin_unlock_irq(&xhci->lock);
+ return -ETIMEDOUT;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Dongjiu Geng <gengdongjiu@huawei.com>
+Date: Thu, 21 Jun 2018 16:19:43 +0300
+Subject: usb: xhci: remove the code build warning
+
+From: Dongjiu Geng <gengdongjiu@huawei.com>
+
+[ Upstream commit 36eb93509c45d0bdbd8d09a01ab9d857972f5963 ]
+
+Initialize the 'err' variate to remove the build warning,
+the warning is shown as below:
+
+drivers/usb/host/xhci-tegra.c: In function 'tegra_xusb_mbox_thread':
+drivers/usb/host/xhci-tegra.c:552:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized]
+drivers/usb/host/xhci-tegra.c:482:6: note: 'err' was declared here
+
+Fixes: e84fce0f8837 ("usb: xhci: Add NVIDIA Tegra XUSB controller driver")
+Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -479,7 +479,7 @@ static void tegra_xusb_mbox_handle(struc
+ unsigned long mask;
+ unsigned int port;
+ bool idle, enable;
+- int err;
++ int err = 0;
+
+ memset(&rsp, 0, sizeof(rsp));
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+Date: Wed, 2 May 2018 09:25:59 +0200
+Subject: vfio: ccw: fix error return in vfio_ccw_sch_event
+
+From: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+
+[ Upstream commit 2c861d89ccda2fbcea9358eff9cc5f8fae548be5 ]
+
+If the device has not been registered, or there is work pending,
+we should reschedule a sch_event call again.
+
+Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+Message-Id: <20180502072559.50691-1-bjsdjshi@linux.vnet.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/cio/vfio_ccw_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -177,6 +177,7 @@ static int vfio_ccw_sch_event(struct sub
+ {
+ struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev);
+ unsigned long flags;
++ int rc = -EAGAIN;
+
+ spin_lock_irqsave(sch->lock, flags);
+ if (!device_is_registered(&sch->dev))
+@@ -187,6 +188,7 @@ static int vfio_ccw_sch_event(struct sub
+
+ if (cio_update_schib(sch)) {
+ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
++ rc = 0;
+ goto out_unlock;
+ }
+
+@@ -195,11 +197,12 @@ static int vfio_ccw_sch_event(struct sub
+ private->state = private->mdev ? VFIO_CCW_STATE_IDLE :
+ VFIO_CCW_STATE_STANDBY;
+ }
++ rc = 0;
+
+ out_unlock:
+ spin_unlock_irqrestore(sch->lock, flags);
+
+- return 0;
++ return rc;
+ }
+
+ static struct css_device_id vfio_ccw_sch_ids[] = {
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Fri, 22 Jun 2018 13:51:26 +0200
+Subject: x86/microcode/intel: Fix memleak in save_microcode_patch()
+
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+
+[ Upstream commit 0218c766263e70795c5eaa17d75ed54bca350950 ]
+
+Free useless ucode_patch entry when it's replaced.
+
+[ bp: Drop the memfree_patch() two-liner. ]
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Srinivas REDDY Eeda <srinivas.eeda@oracle.com>
+Link: http://lkml.kernel.org/r/888102f0-fd22-459d-b090-a1bd8a00cb2b@default
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/microcode/intel.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -190,8 +190,11 @@ static void save_microcode_patch(void *d
+ p = memdup_patch(data, size);
+ if (!p)
+ pr_err("Error allocating buffer %p\n", data);
+- else
++ else {
+ list_replace(&iter->plist, &p->plist);
++ kfree(iter->data);
++ kfree(iter);
++ }
+ }
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 09:16:56 CEST 2018
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Mon, 2 Jul 2018 23:49:54 -0700
+Subject: x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all()
+
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+
+[ Upstream commit 4fb5f58e8d191f7c81637ad81284e4848afb4244 ]
+
+On 32-bit kernels, __flush_tlb_all() may have read the CR4 shadow before the
+initialization of CR4 shadow in cpu_init().
+
+Fix it by adding an explicit cr4_init_shadow() call into start_secondary()
+which is the first function called on non-boot SMP CPUs - ahead of the
+__flush_tlb_all() call.
+
+( This is somewhat of a layering violation, but start_secondary() does
+ CR4 bootstrap in the PCID case anyway. )
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Link: http://lkml.kernel.org/r/b07b6ae9-4b57-4b40-b9bc-50c2c67f1d91@default
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/smpboot.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -222,6 +222,11 @@ static void notrace start_secondary(void
+ #ifdef CONFIG_X86_32
+ /* switch away from the initial page table */
+ load_cr3(swapper_pg_dir);
++ /*
++ * Initialize the CR4 shadow before doing anything that could
++ * try to read it.
++ */
++ cr4_init_shadow();
+ __flush_tlb_all();
+ #endif
+ load_current_idt();
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Fri, 15 Jun 2018 07:34:52 +0800
+Subject: xen: add error handling for xenbus_printf
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit 84c029a73327cef571eaa61c7d6e67e8031b52ec ]
+
+When xenbus_printf fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling xenbus_printf.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/manage.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -289,8 +289,15 @@ static void sysrq_handler(struct xenbus_
+ return;
+ }
+
+- if (sysrq_key != '\0')
+- xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++ if (sysrq_key != '\0') {
++ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++ if (err) {
++ pr_err("%s: Error %d writing sysrq in control/sysrq\n",
++ __func__, err);
++ xenbus_transaction_end(xbt, 1);
++ return;
++ }
++ }
+
+ err = xenbus_transaction_end(xbt, 0);
+ if (err == -EAGAIN)
+@@ -342,7 +349,12 @@ static int setup_shutdown_watcher(void)
+ continue;
+ snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
+ shutdown_handlers[idx].command);
+- xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++ if (err) {
++ pr_err("%s: Error %d writing %s\n", __func__,
++ err, node);
++ return err;
++ }
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Wed Aug 22 09:16:55 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Sat, 16 Jun 2018 08:14:37 +0800
+Subject: xen/scsiback: add error handling for xenbus_printf
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit 7c63ca24c878e0051c91904b72174029320ef4bd ]
+
+When xenbus_printf fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling xenbus_printf.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/xen-scsiback.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct v
+ {
+ struct v2p_entry *entry;
+ unsigned long flags;
++ int err;
+
+ if (try) {
+ spin_lock_irqsave(&info->v2p_lock, flags);
+@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct v
+ scsiback_del_translation_entry(info, vir);
+ }
+ } else if (!try) {
+- xenbus_printf(XBT_NIL, info->dev->nodename, state,
++ err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
+ "%d", XenbusStateClosed);
++ if (err)
++ xenbus_dev_error(info->dev, err,
++ "%s: writing %s", __func__, state);
+ }
+ }
+
+@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(str
+ snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
+ val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
+ if (IS_ERR(val)) {
+- xenbus_printf(XBT_NIL, dev->nodename, state,
++ err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ "%d", XenbusStateClosed);
++ if (err)
++ xenbus_dev_error(info->dev, err,
++ "%s: writing %s", __func__, state);
+ return;
+ }
+ strlcpy(phy, val, VSCSI_NAMELEN);
+@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(str
+ err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
+ &vir.hst, &vir.chn, &vir.tgt, &vir.lun);
+ if (XENBUS_EXIST_ERR(err)) {
+- xenbus_printf(XBT_NIL, dev->nodename, state,
++ err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ "%d", XenbusStateClosed);
++ if (err)
++ xenbus_dev_error(info->dev, err,
++ "%s: writing %s", __func__, state);
+ return;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
