--- /dev/null
+From 98be15ce48b030b5941fffef6fa206a5f5487e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 16:39:10 +0200
+Subject: ALSA: intel8x0m: Register irq handler after register initializations
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ]
+
+The interrupt handler has to be acquired after the other resource
+initialization when allocated with IRQF_SHARED. Otherwise it's
+triggered before the resource gets ready, and may lead to unpleasant
+behavior.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/intel8x0m.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 1bc98c867133d..2286dfd72ff7e 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ }
+
+ port_inited:
+- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
+- KBUILD_MODNAME, chip)) {
+- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
+- snd_intel8x0m_free(chip);
+- return -EBUSY;
+- }
+- chip->irq = pci->irq;
+- pci_set_master(pci);
+- synchronize_irq(chip->irq);
+-
+ /* initialize offsets */
+ chip->bdbars_count = 2;
+ tbl = intel_regs;
+@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ chip->int_sta_reg = ICH_REG_GLOB_STA;
+ chip->int_sta_mask = int_sta_masks;
+
++ pci_set_master(pci);
++
+ if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+ }
+
++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, chip)) {
++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
++ snd_intel8x0m_free(chip);
++ return -EBUSY;
++ }
++ chip->irq = pci->irq;
++
+ if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From c01f23f50268212405fda006ee131045bc4d5839 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 12:21:45 +0300
+Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ]
+
+The "frames" variable is unsigned so the error handling doesn't work
+properly.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/pcm_plugin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index a84a1d3d23e56..c6888d76ca5e9 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+--
+2.20.1
+
--- /dev/null
+From 41ad24e06d54558148718c033bf6e6a0af9dda1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 12:49:43 +0200
+Subject: ALSA: seq: Do error checks at creating system ports
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ]
+
+snd_seq_system_client_init() doesn't check the errors returned from
+its port creations. Let's do it properly and handle the error paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_system.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
+index 8ce1d0b40dce1..ce1f1e4727ab1 100644
+--- a/sound/core/seq/seq_system.c
++++ b/sound/core/seq/seq_system.c
+@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void)
+ {
+ struct snd_seq_port_callback pcallbacks;
+ struct snd_seq_port_info *port;
++ int err;
+
+ port = kzalloc(sizeof(*port), GFP_KERNEL);
+ if (!port)
+@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+
+ /* register announcement port */
+ strcpy(port->name, "Announce");
+@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+ announce_port = port->addr.port;
+
+ kfree(port);
+ return 0;
++
++ error_port:
++ snd_seq_system_client_done();
++ kfree(port);
++ return err;
+ }
+
+
+ /* unregister our internal client */
+-void __exit snd_seq_system_client_done(void)
++void snd_seq_system_client_done(void)
+ {
+ int oldsysclient = sysclient;
+
+--
+2.20.1
+
--- /dev/null
+From c4d2cfa3662482383bb72883cc940651035561a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 17:33:40 -0500
+Subject: ARM: dts: am335x-evm: fix number of cpsw
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ]
+
+am335x-evm has only one CPSW external port physically wired, but DT defines
+2 ext. ports. As result, PHY connection failure reported for the second
+ext. port.
+
+Update DT to reflect am335x-evm board HW configuration, and, while here,
+switch to use phy-handle instead of phy_id.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index d9d00ab863a21..2b8614e406f03 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -697,6 +697,7 @@
+ pinctrl-0 = <&cpsw_default>;
+ pinctrl-1 = <&cpsw_sleep>;
+ status = "okay";
++ slaves = <1>;
+ };
+
+ &davinci_mdio {
+@@ -704,15 +705,14 @@
+ pinctrl-0 = <&davinci_mdio_default>;
+ pinctrl-1 = <&davinci_mdio_sleep>;
+ status = "okay";
+-};
+
+-&cpsw_emac0 {
+- phy_id = <&davinci_mdio>, <0>;
+- phy-mode = "rgmii-txid";
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
+ };
+
+-&cpsw_emac1 {
+- phy_id = <&davinci_mdio>, <1>;
++&cpsw_emac0 {
++ phy-handle = <ðphy0>;
+ phy-mode = "rgmii-txid";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 8550d42583e44ce53b2b682261400dcd5bfe1273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:42:01 +0200
+Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
+
+From: Jay Foster <jayfoster@ieee.org>
+
+[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ]
+
+Fix a typo. No functional change made by this patch.
+
+Signed-off-by: Jay Foster <jayfoster@ieee.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index af8b708ac312a..53a5a0e311e9d 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -546,7 +546,7 @@
+ };
+ };
+
+- uart1 {
++ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP /* PB4 periph A with pullup */
+--
+2.20.1
+
--- /dev/null
+From c978d1b174151b6270a3d2c6e9502377b4c8108b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:41:35 +0200
+Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ]
+
+S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has
+external pull-up resistors, so disable any pull control for it in
+in controller node. This fixes support for S5M8767 interrupts and
+enables operation of wakeup from S5M8767 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index c000532c14446..b425b77f8fb65 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -170,6 +170,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s5m8767_irq>;
+
+ vinb1-supply = <&main_dc_reg>;
+ vinb2-supply = <&main_dc_reg>;
+@@ -552,6 +554,13 @@
+ cap-sd-highspeed;
+ };
+
++&pinctrl_0 {
++ s5m8767_irq: s5m8767-irq {
++ samsung,pins = "gpx3-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &rtc {
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 5e023ca24c88151fae85ca7856d23a4b7dd3cac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 12:55:32 +0200
+Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ]
+
+This patch adds missing properties to the CODEC and sound nodes, so the
+audio will work also on Snow rev5 Chromebook. This patch is an extension
+to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and
+DAI properties to the max98095 node in Snow Chromebook")
+and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow
+Chromebook"). It has been reported that such changes work fine on the
+rev5 board too.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+[krzk: Fixed typo in phandle to &max98090]
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+index f811dc8006605..0d46f754070e4 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts
++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+@@ -23,6 +23,14 @@
+
+ samsung,model = "Snow-I2S-MAX98090";
+ samsung,audio-codec = <&max98090>;
++
++ cpu {
++ sound-dai = <&i2s0 0>;
++ };
++
++ codec {
++ sound-dai = <&max98090 0>, <&hdmi>;
++ };
+ };
+ };
+
+@@ -34,6 +42,9 @@
+ interrupt-parent = <&gpx0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max98090_irq>;
++ clocks = <&pmu_system_controller 0>;
++ clock-names = "mclk";
++ #sound-dai-cells = <1>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From bb041fc62b9a168a0c2b245c6ee17e01d17c380a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:06 +0200
+Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can
+ overwrite in other DTS files
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ]
+
+needed for device variants based on GTA04 board but with
+different display panel (driver).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index e14d15e5abc89..9b9510e057f3f 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -70,7 +70,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- spi_lcd {
++ spi_lcd: spi_lcd {
+ compatible = "spi-gpio";
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 27f0704e9a816e8d3bf9ed66ac62e45b7cb294b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:14 +0200
+Subject: ARM: dts: omap3-gta04: keep vpll2 always on
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ]
+
+This is needed to make the display and venc work properly.
+Compare to omap3-beagle.dts.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 0ea793e365e45..acd0a9deb116b 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -460,6 +460,12 @@
+ regulator-max-microvolt = <3150000>;
+ };
+
++/* Needed to power the DPI pins */
++
++&vpll2 {
++ regulator-always-on;
++};
++
+ &dss {
+ pinctrl-names = "default";
+ pinctrl-0 = < &dss_dpi_pins >;
+--
+2.20.1
+
--- /dev/null
+From 3cde2350c45f77f30540316763c520e0de859f5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:12 +0200
+Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent
+ U-Boot
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ]
+
+Vendor defined U-Boot has changed the partition scheme a while ago:
+
+* kernel partition 6MB
+* file system partition uses the remainder up to end of the NAND
+* increased size of the environment partition (to get an OneNAND compatible base address)
+* shrink the U-Boot partition
+
+Let's be compatible (e.g. Debian kernel built from upstream).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 196b3f5158c90..0ea793e365e45 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -523,22 +523,22 @@
+
+ bootloaders@80000 {
+ label = "U-Boot";
+- reg = <0x80000 0x1e0000>;
++ reg = <0x80000 0x1c0000>;
+ };
+
+- bootloaders_env@260000 {
++ bootloaders_env@240000 {
+ label = "U-Boot Env";
+- reg = <0x260000 0x20000>;
++ reg = <0x240000 0x40000>;
+ };
+
+ kernel@280000 {
+ label = "Kernel";
+- reg = <0x280000 0x400000>;
++ reg = <0x280000 0x600000>;
+ };
+
+- filesystem@680000 {
++ filesystem@880000 {
+ label = "File System";
+- reg = <0x680000 0xf980000>;
++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 34b5dbd70de06e784b6bf58e74226283b17bb4ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:09 +0200
+Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ]
+
+The omap dss susbystem takes the display aliases to find
+out which displays exist. To enable tv-out we must define
+an alias.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 9b9510e057f3f..196b3f5158c90 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -28,6 +28,7 @@
+
+ aliases {
+ display0 = &lcd;
++ display1 = &tv0;
+ };
+
+ gpio-keys {
+--
+2.20.1
+
--- /dev/null
+From 9fe0761677362c513efb5810256e8483d0598ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:03:09 +0200
+Subject: ARM: dts: pxa: fix power i2c base address
+
+From: Marcel Ziswiler <marcel@ziswiler.com>
+
+[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ]
+
+There is one too many zeroes in the Power I2C base address. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 210192c38df3c..4448505e34d3b 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -63,7 +63,7 @@
+ clocks = <&clks CLK_PWM1>;
+ };
+
+- pwri2c: i2c@40f000180 {
++ pwri2c: i2c@40f00180 {
+ compatible = "mrvl,pxa-i2c";
+ reg = <0x40f00180 0x24>;
+ interrupts = <6>;
+--
+2.20.1
+
--- /dev/null
+From d8bec08dff16c9e61313b20684b6f46212373fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 23:52:49 -0500
+Subject: ARM: dts: socfpga: Fix I2C bus unit-address error
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53"
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+index 555e9caf21e16..7b8e1c4215b51 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+@@ -88,7 +88,7 @@
+ status = "okay";
+ speed-mode = <0>;
+
+- adxl345: adxl345@0 {
++ adxl345: adxl345@53 {
+ compatible = "adi,adxl345";
+ reg = <0x53>;
+
+--
+2.20.1
+
--- /dev/null
+From b6b3c75bdc24d478e3fc20f9b276361f3727e414 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:34 -0500
+Subject: ARM: dts: ste: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++--
+ arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +-
+ arch/arm/boot/dts/ste-snowball.dts | 2 +-
+ arch/arm/boot/dts/ste-u300.dts | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 86bd320057a38..b2b23ceb6d557 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -894,7 +894,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80002000 0x1000>;
+ interrupts = <0 14 IRQ_TYPE_LEVEL_HIGH>;
+@@ -908,7 +908,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80003000 {
++ spi@80003000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80003000 0x1000>;
+ interrupts = <0 52 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+index b0278f4c486ce..55a6a1ac03370 100644
+--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+@@ -57,7 +57,7 @@
+ };
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ /*
+ * On the first generation boards, this SSP/SPI port was connected
+ * to the AB8500.
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index e80e421638836..bb1b64d6ab5e8 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -311,7 +311,7 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ssp0_snowball_mode>;
+ };
+diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts
+index 82a661677e97e..fb6ca7f864176 100644
+--- a/arch/arm/boot/dts/ste-u300.dts
++++ b/arch/arm/boot/dts/ste-u300.dts
+@@ -451,7 +451,7 @@
+ dma-names = "rx";
+ };
+
+- spi: ssp@c0006000 {
++ spi: spi@c0006000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0xc0006000 0x1000>;
+ interrupt-parent = <&vica>;
+--
+2.20.1
+
--- /dev/null
+From 3142fa9674593f94263758634760aaf62e5835d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:42:33 +0200
+Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ]
+
+There was a dot instead of a comma. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
+index 313e260529a31..e8f5a55c4b954 100644
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -823,7 +823,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <1>;
+ nvidia,xcvr-lsrslew = <1>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -860,7 +860,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -896,7 +896,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+--
+2.20.1
+
--- /dev/null
+From 995e9b2407c0e3bd2c6d33dfa7188d9489e421c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jun 2018 09:50:09 +0200
+Subject: ARM: dts: ux500: Correct SCU unit address
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ]
+
+The unit address of the Cortex-A9 SCU device node contains one zero too
+many. Remove it.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 50f5e9d092038..86bd320057a38 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -186,7 +186,7 @@
+ <0xa0410100 0x100>;
+ };
+
+- scu@a04100000 {
++ scu@a0410000 {
+ compatible = "arm,cortex-a9-scu";
+ reg = <0xa0410000 0x100>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 06463b0212c3b9d6451de2ac770f7de538ded305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jul 2018 10:30:03 +0200
+Subject: ARM: dts: ux500: Fix LCDA clock line muxing
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ]
+
+The "lcdaclk_b_1" group is muxed with the function "lcd"
+but needs a separate entry to be muxed in with "lcda"
+rather than "lcd".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+index 5c5cea232743d..1ec193b0c5065 100644
+--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+@@ -607,16 +607,20 @@
+
+ mcde {
+ lcd_default_mode: lcd_default {
+- default_mux {
++ default_mux1 {
+ /* Mux in VSI0 and all the data lines */
+ function = "lcd";
+ groups =
+ "lcdvsi0_a_1", /* VSI0 for LCD */
+ "lcd_d0_d7_a_1", /* Data lines */
+ "lcd_d8_d11_a_1", /* TV-out */
+- "lcdaclk_b_1", /* Clock line for TV-out */
+ "lcdvsi1_a_1"; /* VSI1 for HDMI */
+ };
++ default_mux2 {
++ function = "lcda";
++ groups =
++ "lcdaclk_b_1"; /* Clock line for TV-out */
++ };
+ default_cfg1 {
+ pins =
+ "GPIO68_E1", /* VSI0 */
+--
+2.20.1
+
--- /dev/null
+From 5ad1723cae3e0314047daed291e44bee0625cfe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 12:34:21 +0200
+Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff"
+ is set
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ]
+
+One of the Freescale recommended sequences for power off with external
+PMIC is the following:
+...
+3. SoC is programming PMIC for power off when standby is asserted.
+4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies.
+
+See:
+http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf
+page 5083
+
+This patch implements step 4. of this sequence.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index a19d20f23e716..fff529c5f9b36 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -602,6 +602,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+ IMX6Q_GPR1_GINT);
+ }
+
++static void imx6_pm_stby_poweroff(void)
++{
++ imx6_set_lpm(STOP_POWER_OFF);
++ imx6q_suspend_finish(0);
++
++ mdelay(1000);
++
++ pr_emerg("Unable to poweroff system\n");
++}
++
++static int imx6_pm_stby_poweroff_probe(void)
++{
++ if (pm_power_off) {
++ pr_warn("%s: pm_power_off already claimed %p %pf!\n",
++ __func__, pm_power_off, pm_power_off);
++ return -EBUSY;
++ }
++
++ pm_power_off = imx6_pm_stby_poweroff;
++ return 0;
++}
++
+ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ {
+ struct device_node *np;
+@@ -618,6 +640,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ val = readl_relaxed(ccm_base + CLPCR);
+ val &= ~BM_CLPCR_LPM;
+ writel_relaxed(val, ccm_base + CLPCR);
++
++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff"))
++ imx6_pm_stby_poweroff_probe();
+ }
+
+ void __init imx6q_pm_init(void)
+--
+2.20.1
+
--- /dev/null
+From c965a5f080919c5eec9923ef896ce66b09efa87f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 18:37:43 +0200
+Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ]
+
+Fix MMC1 cmd pin pull-up causing issues on carrier boards without
+external pull-up.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index bf361277fe105..9a8c20cd06885 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -147,14 +147,14 @@
+
+ /* Apalis MMC1 */
+ sdmmc3_clk_pa6 {
+- nvidia,pins = "sdmmc3_clk_pa6",
+- "sdmmc3_cmd_pa7";
++ nvidia,pins = "sdmmc3_clk_pa6";
+ nvidia,function = "sdmmc3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+ sdmmc3_dat0_pb7 {
+- nvidia,pins = "sdmmc3_dat0_pb7",
++ nvidia,pins = "sdmmc3_cmd_pa7",
++ "sdmmc3_dat0_pb7",
+ "sdmmc3_dat1_pb6",
+ "sdmmc3_dat2_pb5",
+ "sdmmc3_dat3_pb4",
+--
+2.20.1
+
--- /dev/null
+From 738a08a1b37ce7a50d68c6e877080252315f822b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:40 -0500
+Subject: arm64: dts: amd: Fix SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ]
+
+dtc has new checks for SPI buses. Fix the warnings in node names.
+
+arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+
+Cc: Brijesh Singh <brijeshkumar.singh@amd.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+index 2874d92881fda..a3030c868be5f 100644
+--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+@@ -84,7 +84,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- spi0: ssp@e1020000 {
++ spi0: spi@e1020000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ #gpio-cells = <2>;
+@@ -95,7 +95,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- spi1: ssp@e1030000 {
++ spi1: spi@e1030000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ #gpio-cells = <2>;
+--
+2.20.1
+
--- /dev/null
+From ee2fac3f088f53331e94df47fadfe173a312d8f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 14:26:47 +0100
+Subject: ASoC: dpcm: Properly initialise hw->rate_max
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ]
+
+If the CPU DAI does not initialise rate_max, say if using
+using KNOT or CONTINUOUS, then the rate_max field will be
+initialised to 0. A value of zero in the rate_max field of
+the hardware runtime will cause the sound card to support no
+sample rates at all. Obviously this is not desired, just a
+different mechanism is being used to apply the constraints. As
+such update the setting of rate_max in dpcm_init_runtime_hw
+to be consistent with the non-DPCM cases and set rate_max to
+UINT_MAX if nothing is defined on the CPU DAI.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 1c0d44c86c018..78813057167d7 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1541,7 +1541,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
+ u64 formats)
+ {
+ runtime->hw.rate_min = stream->rate_min;
+- runtime->hw.rate_max = stream->rate_max;
++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX);
+ runtime->hw.channels_min = stream->channels_min;
+ runtime->hw.channels_max = stream->channels_max;
+ if (runtime->hw.formats)
+--
+2.20.1
+
--- /dev/null
+From 9aeede88235c35e26e39052782256d45af333f7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 11:41:52 +0100
+Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ]
+
+In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag
+is set to zero and later vol_quot is computed by dividing by
+lo_vag causing a division by zero error. Fix this by avoiding
+a zero division and set vol_quot to zero in this specific case
+so that the lowest setting for i is correctly set.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 4808b70ec12cb..a3dd7030f629c 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1415,7 +1415,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ * Searching for a suitable index solving this formula:
+ * idx = 40 * log10(vag_val / lo_cagcntrl) + 15
+ */
+- vol_quot = (vag * 100) / lo_vag;
++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0;
+ lo_vol = 0;
+ for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) {
+ if (vol_quot >= vol_quot_table[i])
+--
+2.20.1
+
--- /dev/null
+From 3d11007f7f38566175a6ac720ea9baaebcb59989 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 15:07:07 +0300
+Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx
+
+From: Erik Stromdahl <erik.stromdahl@gmail.com>
+
+[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ]
+
+This is done in order not to trig the below warning in
+ieee80211_rx_napi:
+
+WARN_ON_ONCE(softirq_count() == 0);
+
+ieee80211_rx_napi requires that softirq's are disabled during
+execution.
+
+The High latency bus drivers (SDIO and USB) sometimes call the wmi
+ep_rx_complete callback from non softirq context, resulting in a trigger
+of the above warning.
+
+Calling ieee80211_rx_ni with softirq's already disabled (e.g., from
+softirq context) should be safe as the local_bh_disable and
+local_bh_enable functions (called from ieee80211_rx_ni) are fully
+reentrant.
+
+Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index b867875aa6e66..f7ce99f67b5c5 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2294,7 +2294,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+ status->freq, status->band, status->signal,
+ status->rate_idx);
+
+- ieee80211_rx(ar->hw, skb);
++ ieee80211_rx_ni(ar->hw, skb);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1f26dc901af6c78d486ff3e7a52a636676e7ed45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 13:39:22 +0300
+Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ]
+
+If the remote is not able to fully utilize the MPS choosen recalculate
+the credits based on the actual amount it is sending that way it can
+still send packets of MTU size without credits dropping to 0.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c25f1e4846cde..302c3bacb0247 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6795,6 +6795,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ chan->sdu_len = sdu_len;
+ chan->sdu_last_frag = skb;
+
++ /* Detect if remote is not able to use the selected MPS */
++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
++
++ /* Adjust the number of credits */
++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
++ chan->mps = mps_len;
++ l2cap_chan_le_send_credits(chan);
++ }
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8df11694eb867aa0d4eff1a1f90146db59bb7119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:22:51 -0700
+Subject: bnx2x: Ignore bandwidth attention in single function mode
+
+From: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+
+[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ]
+
+This is a workaround for FW bug -
+MFW generates bandwidth attention in single function mode, which
+is only expected to be generated in multi function mode.
+This undesired attention in SF mode results in incorrect HW
+configuration and resulting into Tx timeout.
+
+Signed-off-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index d450d8b3708cd..82960603da332 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3532,6 +3532,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp)
+ */
+ static void bnx2x_config_mf_bw(struct bnx2x *bp)
+ {
++ /* Workaround for MFW bug.
++ * MFW is not supposed to generate BW attention in
++ * single function mode.
++ */
++ if (!IS_MF(bp)) {
++ DP(BNX2X_MSG_MCP,
++ "Ignoring MF BW config in single function mode\n");
++ return;
++ }
++
+ if (bp->link_vars.link_up) {
+ bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+ bnx2x_link_sync_notify(bp);
+--
+2.20.1
+
--- /dev/null
+From 752a9d3be4915e07ba8b634e0225c6e98fdbcc01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:24 -0700
+Subject: cpufeature: avoid warning when compiling with clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to warnings when building the kernel with Clang:
+ arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable
+ 'cpu_feature_match_AES' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ module_cpu_feature_match(AES, aes_init);
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h
+index 986c06c88d814..84d3c81b59781 100644
+--- a/include/linux/cpufeature.h
++++ b/include/linux/cpufeature.h
+@@ -45,7 +45,7 @@
+ * 'asm/cpufeature.h' of your favorite architecture.
+ */
+ #define module_cpu_feature_match(x, __initfunc) \
+-static struct cpu_feature const cpu_feature_match_ ## x[] = \
++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \
+ { { .feature = cpu_feature(x) }, { } }; \
+ MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \
+ \
+--
+2.20.1
+
--- /dev/null
+From bde5a210b147eaf001daba6423b948779e2c9bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 14:36:27 +0530
+Subject: cxgb4: Fix endianness issue in t4_fwcache()
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ]
+
+Do not put host-endian 0 or 1 into big endian feild.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index de23f23b41de6..832ad1bd1f29b 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3482,7 +3482,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op)
+ c.param[0].mnem =
+ cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) |
+ FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE));
+- c.param[0].val = (__force __be32)op;
++ c.param[0].val = cpu_to_be32(op);
+
+ return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL);
+ }
+--
+2.20.1
+
--- /dev/null
+From 1da6285d52fda2b74930a1cc60efc53caed0c50f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:56 +0200
+Subject: dmaengine: dma-jz4780: Further residue status fix
+
+From: Daniel Silsby <dansilsby@gmail.com>
+
+[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ]
+
+Func jz4780_dma_desc_residue() expects the index to the next hw
+descriptor as its last parameter. Caller func jz4780_dma_tx_status(),
+however, applied modulus before passing it. When the current hw
+descriptor was last in the list, the index passed became zero.
+
+The resulting excess of reported residue especially caused problems
+with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which
+rely on this for determining current DMA location within buffer.
+
+Combined with the recent and related residue-reporting fixes, spurious
+ALSA audio underruns on jz4770 hardware are now fixed.
+
+Signed-off-by: Daniel Silsby <dansilsby@gmail.com>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 8344b7c91fe35..1d01e3805f9c2 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -576,7 +576,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ to_jz4780_dma_desc(vdesc), 0);
+ } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+ txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
+- (jzchan->curr_hwdesc + 1) % jzchan->desc->count);
++ jzchan->curr_hwdesc + 1);
+ } else
+ txstate->residue = 0;
+
+--
+2.20.1
+
--- /dev/null
+From fe07163ff710224b32026fd2b859f816002aa970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 09:34:49 -0500
+Subject: EDAC: Raise the maximum number of memory controllers
+
+From: Justin Ernst <justin.ernst@hpe.com>
+
+[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ]
+
+We observe an oops in the skx_edac module during boot:
+
+ EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0
+ EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ ...
+ EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1
+ Too many memory controllers: 16
+ EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0
+
+We observe there are two memory controllers per socket, with a limit
+of 16. Raise the maximum number of memory controllers from 16 to 2 *
+MAX_NUMNODES (1024).
+
+[ bp: This is just a band-aid fix until we've sorted out the whole issue
+ with the bus_type association and handling in EDAC and can get rid of
+ this arbitrary limit. ]
+
+Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Russ Anderson <russ.anderson@hpe.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/edac.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index 4fe67b853de04..9bb4f3311e137 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -17,6 +17,7 @@
+ #include <linux/completion.h>
+ #include <linux/workqueue.h>
+ #include <linux/debugfs.h>
++#include <linux/numa.h>
+
+ struct device;
+
+@@ -778,6 +779,6 @@ struct mem_ctl_info {
+ /*
+ * Maximum number of memory controllers in the coherent fabric.
+ */
+-#define EDAC_MAX_MCS 16
++#define EDAC_MAX_MCS 2 * MAX_NUMNODES
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From fc18f0bd740d91b6d68a58a157fbe572b0f60b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:29:29 +0300
+Subject: fuse: use READ_ONCE on congestion_threshold and max_background
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ]
+
+Since they are of unsigned int type, it's allowed to read them
+unlocked during reporting to userspace. Let's underline this fact
+with READ_ONCE() macroses.
+
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index 89a4b231e79cb..bb56c6a58fa76 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->max_background;
++ val = READ_ONCE(fc->max_background);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->congestion_threshold;
++ val = READ_ONCE(fc->congestion_threshold);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+--
+2.20.1
+
--- /dev/null
+From fcb415e39eaa4b3d557f051000b62d397aae4a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 10:32:13 -0500
+Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ]
+
+The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when
+a rgrp buffer is valid. It's cleared when the glock is invalidated,
+signifying that the buffer data is now invalid. But before this
+patch, function update_rgrp_lvb was setting the flag when it
+determined it had a valid lvb. But that's an invalid assumption:
+just because you have a valid lvb doesn't mean you have valid
+buffers. After all, another node may have made the lvb valid,
+and this node just fetched it from the glock via dlm.
+
+Consider this scenario:
+1. The file system is mounted with RGRPLVB option.
+2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks
+ to GL_SKIP, it skips the gfs2_rgrp_bh_get.
+3. Since loops == 0 and the allocation target (ap->target) is
+ bigger than the largest known chunk of blocks in the rgrp
+ (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses
+ the call to gfs2_rgrp_bh_get there as well.
+4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses
+ gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due
+ to this invalid assumption.
+5. The next time update_rgrp_lvb is called, it sees the bit is set
+ and just returns 0, assuming both the lvb and rgrp are both
+ uptodate. But since this is a smaller allocation, or space has
+ been freed by another node, thus adjusting the lvb values,
+ it decides to use the rgrp for allocations, with invalid rd_free
+ due to the fact it was never updated.
+
+This patch changes update_rgrp_lvb so it doesn't set the UPTODATE
+flag anymore. That way, it has no choice but to fetch the latest
+values.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 9c159e6ad1164..e632006a52df6 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1228,7 +1228,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
+ rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
+ rl_flags &= ~GFS2_RDF_MASK;
+ rgd->rd_flags &= GFS2_RDF_MASK;
+- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK);
+ if (rgd->rd_rgl->rl_unlinked == 0)
+ rgd->rd_flags &= ~GFS2_RDF_CHECK;
+ rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free);
+--
+2.20.1
+
--- /dev/null
+From 230fc545998b6ed59ac0b79734fdb7a0110b3f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:03 -0700
+Subject: i40e: hold the rtnl lock on clearing interrupt scheme
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ]
+
+Hold the rtnl lock when we're clearing interrupt scheme
+in i40e_shutdown and in i40e_remove.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 22c43a776c6cd..756c4ea176554 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -10828,6 +10828,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ mutex_destroy(&hw->aq.asq_mutex);
+
+ /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i]) {
+@@ -10836,6 +10837,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ pf->vsi[i] = NULL;
+ }
+ }
++ rtnl_unlock();
+
+ for (i = 0; i < I40E_MAX_VEB; i++) {
+ kfree(pf->veb[i]);
+@@ -10982,7 +10984,13 @@ static void i40e_shutdown(struct pci_dev *pdev)
+ wr32(hw, I40E_PFPM_WUFC,
+ (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
+
++ /* Since we're going to destroy queues during the
++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this
++ * whole section
++ */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
++ rtnl_unlock();
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ pci_wake_from_d3(pdev, pf->wol_en);
+--
+2.20.1
+
--- /dev/null
+From a10abe3a3fa05775a18d20a68906d3615009f15d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:09 -0700
+Subject: i40e: Prevent deleting MAC address from VF when set by PF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ]
+
+To prevent VF from deleting MAC address that was assigned by the
+PF we need to check for that scenario when we try to delete a MAC
+address from a VF.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index e116d9a99b8e9..cdb263875efb3 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1677,6 +1677,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
+ ret = I40E_ERR_INVALID_MAC_ADDR;
+ goto error_param;
+ }
++
++ if (vf->pf_set_mac &&
++ ether_addr_equal(al->list[i].addr,
++ vf->default_lan_addr.addr)) {
++ dev_err(&pf->pdev->dev,
++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n",
++ vf->default_lan_addr.addr, vf->vf_id);
++ ret = I40E_ERR_PARAM;
++ goto error_param;
++ }
+ }
+ vsi = pf->vsi[vf->lan_vsi_idx];
+
+--
+2.20.1
+
--- /dev/null
+From f71bdcb46fe76c4ef9d3ef52752b7cf31029239c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:30 -0700
+Subject: i40e: use correct length for strncpy
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ]
+
+Caught by GCC 8. When we provide a length for strncpy, we should not
+include the terminating null. So we must tell it one less than the size
+of the destination buffer.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+index 565ca7c835bc3..e22ebe460b131 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -605,7 +605,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf)
+ if (!IS_ERR_OR_NULL(pf->ptp_clock))
+ return 0;
+
+- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name));
++ strncpy(pf->ptp_caps.name, i40e_driver_name,
++ sizeof(pf->ptp_caps.name) - 1);
+ pf->ptp_caps.owner = THIS_MODULE;
+ pf->ptp_caps.max_adj = 999999999;
+ pf->ptp_caps.n_ext_ts = 0;
+--
+2.20.1
+
--- /dev/null
+From 3524d7a86c060e4fb2ec8a0c059b943f060f796a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 22:24:40 +0200
+Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ]
+
+Do not try to write negative values and make sure that the write goes well.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/mcp4922.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c
+index 3854d201a5d6c..68dd0be1ac076 100644
+--- a/drivers/iio/dac/mcp4922.c
++++ b/drivers/iio/dac/mcp4922.c
+@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev,
+ long mask)
+ {
+ struct mcp4922_state *state = iio_priv(indio_dev);
++ int ret;
+
+ if (val2 != 0)
+ return -EINVAL;
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val > GENMASK(chan->scan_type.realbits-1, 0))
++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0))
+ return -EINVAL;
+ val <<= chan->scan_type.shift;
+- state->value[chan->channel] = val;
+- return mcp4922_spi_write(state, chan->channel, val);
++
++ ret = mcp4922_spi_write(state, chan->channel, val);
++ if (!ret)
++ state->value[chan->channel] = val;
++ return ret;
++
+ default:
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 4cd69223246607663bc91f0c7a313f7618cfa0a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jul 2018 17:52:47 +0000
+Subject: kernfs: Fix range checks in kernfs_get_target_path
+
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+
+[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ]
+
+The terminating NUL byte is only there because the buffer is
+allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the
+range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the
+returned string may not be zero-terminated if it is exactly
+PATH_MAX characters long. Furthermore also the initial loop
+may theoretically exceed PATH_MAX and cause a fault.
+
+Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/symlink.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index b3b293e2c0990..0a379a86ff768 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (base == kn)
+ break;
+
++ if ((s - path) + 3 >= PATH_MAX)
++ return -ENAMETOOLONG;
++
+ strcpy(s, "../");
+ s += 3;
+ base = base->parent;
+@@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (len < 2)
+ return -EINVAL;
+ len--;
+- if ((s - path) + len > PATH_MAX)
++ if ((s - path) + len >= PATH_MAX)
+ return -ENAMETOOLONG;
+
+ /* reverse fillup of target string from target to base */
+--
+2.20.1
+
--- /dev/null
+From 9a4272322cac2d1c54955a70111f24f07340070d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 19:21:09 +0900
+Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ]
+
+Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe
+list, just remove it from the list and keep it on kprobe hash list
+as same as other in-use kprobes.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index fdde50d39a46d..f59f49bc2a5d5 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -514,8 +514,14 @@ static void do_free_cleaned_kprobes(void)
+ struct optimized_kprobe *op, *tmp;
+
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+- BUG_ON(!kprobe_unused(&op->kp));
+ list_del_init(&op->list);
++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) {
++ /*
++ * This must not happen, but if there is a kprobe
++ * still in use, keep it on kprobes hash list.
++ */
++ continue;
++ }
+ free_aggr_kprobe(&op->kp);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From ed27ce80397c6a3d1c5406ba5bf959a1220243d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 15:16:22 -0500
+Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ]
+
+The next update of libfdt has a new dependency on INT_MAX. Update the
+instances of libfdt_env.h in the kernel to either include the necessary
+header with the definition or define it locally.
+
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/libfdt_env.h | 2 ++
+ arch/powerpc/boot/libfdt_env.h | 2 ++
+ include/linux/libfdt_env.h | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index 17ae0f3efac8e..005bf4ff1b4cb 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -5,6 +5,8 @@
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index 7e3789ea396b8..0b3db6322c793 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -4,6 +4,8 @@
+ #include <types.h>
+ #include <string.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ #include "of.h"
+
+ typedef u32 uint32_t;
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index 2a663c6bb4285..8850e243c9406 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -1,6 +1,7 @@
+ #ifndef _LIBFDT_ENV_H
+ #define _LIBFDT_ENV_H
+
++#include <linux/kernel.h> /* For INT_MAX */
+ #include <linux/string.h>
+
+ #include <asm/byteorder.h>
+--
+2.20.1
+
--- /dev/null
+From a032bdf250bea5ebcb51ffc9dee8e2cee64ddb5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 11:42:06 -0700
+Subject: llc: avoid blocking in llc_sap_close()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ]
+
+llc_sap_close() is called by llc_sap_put() which
+could be called in BH context in llc_rcv(). We can't
+block in BH.
+
+There is no reason to block it here, kfree_rcu() should
+be sufficient.
+
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/llc.h | 1 +
+ net/llc/llc_core.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/llc.h b/include/net/llc.h
+index 82d989995d18a..95e5ced4c1339 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -66,6 +66,7 @@ struct llc_sap {
+ int sk_count;
+ struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+ struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
++ struct rcu_head rcu;
+ };
+
+ static inline
+diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
+index e896a2c53b120..f1e442a39db8d 100644
+--- a/net/llc/llc_core.c
++++ b/net/llc/llc_core.c
+@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap)
+ list_del_rcu(&sap->node);
+ spin_unlock_bh(&llc_sap_list_lock);
+
+- synchronize_rcu();
+-
+- kfree(sap);
++ kfree_rcu(sap, rcu);
+ }
+
+ static struct packet_type llc_packet_type __read_mostly = {
+--
+2.20.1
+
--- /dev/null
+From 2e6d71f0244ec0cf079c71b8cfc06d542a351b21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 02:16:15 -0400
+Subject: media: davinci: Fix implicit enum conversion warning
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit
+conversion from enumeration type 'enum osd_v_exp_ratio' to different
+enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion]
+ layer_info->h_exp = V_EXP_6_OVER_5;
+ ~ ^~~~~~~~~~~~~~
+1 warning generated.
+
+This appears to be a copy and paste error judging from the couple of
+lines directly above this statement and the way that height is handled
+in the if block above this one.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index 6d91422c4e4c7..a9cd8c7a7b347 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -520,7 +520,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev,
+ else if (v_scale == 4)
+ layer_info->v_zoom = ZOOM_X4;
+ if (v_exp)
+- layer_info->h_exp = V_EXP_6_OVER_5;
++ layer_info->v_exp = V_EXP_6_OVER_5;
+ } else {
+ /* no scaling, only cropping. Set display area to crop area */
+ cfg->ysize = expected_ysize;
+--
+2.20.1
+
--- /dev/null
+From c7d1999707b0aa207770b2503e3489ea4723bb03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jul 2018 08:15:53 -0400
+Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary
+ access
+
+From: Lao Wei <zrlw@qq.com>
+
+[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ]
+
+Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter
+'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying
+pass different arbitrary address.
+Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1
+
+Signed-off-by: Lao Wei <zrlw@qq.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/meye/meye.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
+index ba887e8e1b171..a85c5199ccd30 100644
+--- a/drivers/media/pci/meye/meye.c
++++ b/drivers/media/pci/meye/meye.c
+@@ -1469,7 +1469,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long page, pos;
+
+ mutex_lock(&meye.lock);
+- if (size > gbuffers * gbufsize) {
++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) {
+ mutex_unlock(&meye.lock);
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From a0c2bff069e2bda90585044fb557a6598e041418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 07:44:09 -0400
+Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in
+ ivtv_yuv_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ]
+
+The driver may sleep in a interrupt handler.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] kzalloc(GFP_KERNEL)
+drivers/media/pci/ivtv/ivtv-yuv.c, 938:
+ kzalloc in ivtv_yuv_init
+drivers/media/pci/ivtv/ivtv-yuv.c, 960:
+ ivtv_yuv_init in ivtv_yuv_next_free
+drivers/media/pci/ivtv/ivtv-yuv.c, 1126:
+ ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame
+drivers/media/pci/ivtv/ivtv-irq.c, 827:
+ ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req
+drivers/media/pci/ivtv/ivtv-irq.c, 1013:
+ ivtv_irq_dec_data_req in ivtv_irq_handler
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-yuv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
+index 9cd995f418e0f..1d67407ffbf62 100644
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -936,7 +936,7 @@ static void ivtv_yuv_init(struct ivtv *itv)
+ }
+
+ /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
+- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN);
+ if (yi->blanking_ptr) {
+ yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
+ } else {
+--
+2.20.1
+
--- /dev/null
+From c08e1c3b41632b9fce02993a8a8cb5a905bb8d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Aug 2018 22:20:23 +0300
+Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+
+[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ]
+
+Setting GPIO 21 high seems to be required to enable power to USB ports
+on the WNDR3400v3. As there is already similar code for WNR3500L,
+make the existing USB power GPIO code generic and use that.
+
+Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20259/
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/workarounds.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
+index e81ce4623070e..06fb94370c7c9 100644
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -4,9 +4,8 @@
+ #include <bcm47xx_board.h>
+ #include <bcm47xx.h>
+
+-static void __init bcm47xx_workarounds_netgear_wnr3500l(void)
++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power)
+ {
+- const int usb_power = 12;
+ int err;
+
+ err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power");
+@@ -22,7 +21,10 @@ void __init bcm47xx_workarounds(void)
+
+ switch (board) {
+ case BCM47XX_BOARD_NETGEAR_WNR3500L:
+- bcm47xx_workarounds_netgear_wnr3500l();
++ bcm47xx_workarounds_enable_usb_power(12);
++ break;
++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++ bcm47xx_workarounds_enable_usb_power(21);
+ break;
+ default:
+ /* No workaround(s) needed */
+--
+2.20.1
+
--- /dev/null
+From d84847ce5160a76172eb4e83c46a268a35668c7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:49:23 -0700
+Subject: MIPS: kexec: Relax memory restriction
+
+From: Dengcheng Zhu <dzhu@wavecomp.com>
+
+[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ]
+
+We can rely on the system kernel and the dump capture kernel themselves in
+memory usage.
+
+Being restrictive with 512MB limit may cause kexec tool failure on some
+platforms.
+
+Tested-by: Rachel Mozes <rachel.mozes@intel.com>
+Reported-by: Rachel Mozes <rachel.mozes@intel.com>
+Signed-off-by: Dengcheng Zhu <dzhu@wavecomp.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20568/
+Cc: pburton@wavecomp.com
+Cc: ralf@linux-mips.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/kexec.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h
+index ee25ebbf2a288..b6a4d4aa548f5 100644
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -12,11 +12,11 @@
+ #include <asm/stacktrace.h>
+
+ /* Maximum physical address we can use pages from */
+-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can use for the control code buffer */
+-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+ /* Reserve 3*4096 bytes for board-specific info */
+ #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+
+--
+2.20.1
+
--- /dev/null
+From 361a7654f4d03ed3c47c81a821ebec2395c5c04c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 12:19:19 +0800
+Subject: mips: txx9: fix iounmap related issue
+
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+
+[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ]
+
+if device_register return error, iounmap should be called, also iounmap
+need to call before put_device.
+
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Reviewed-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20476/
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/txx9/generic/setup.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
+index 9d9962ab7d25c..7dc97e944d5aa 100644
+--- a/arch/mips/txx9/generic/setup.c
++++ b/arch/mips/txx9/generic/setup.c
+@@ -961,12 +961,11 @@ void __init txx9_sramc_init(struct resource *r)
+ goto exit_put;
+ err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr);
+ if (err) {
+- device_unregister(&dev->dev);
+ iounmap(dev->base);
+- kfree(dev);
++ device_unregister(&dev->dev);
+ }
+ return;
+ exit_put:
++ iounmap(dev->base);
+ put_device(&dev->dev);
+- return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 69df336bdb01feaea77d35e2a203c1db409d248c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:29:13 +0800
+Subject: misc: genwqe: should return proper error value.
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ]
+
+The function should return -EFAULT when copy_from_user fails. Even
+though the caller does not distinguish them. but we should keep backward
+compatibility.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_utils.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index d4c719683a8a8..d8961f35a9ec3 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages)
+ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ void __user *user_addr, size_t user_size)
+ {
+- int rc;
++ int ret = -ENOMEM;
+ struct pci_dev *pci_dev = cd->pci_dev;
+
+ sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
+@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (get_order(sgl->sgl_size) > MAX_ORDER) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: too much memory requested!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
+@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (sgl->sgl == NULL) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: no memory available!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ /* Only use buffering on incomplete pages */
+@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+ user_addr, sgl->fpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out;
+ }
+ }
+@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out2;
+ }
+ }
+@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
+- return -ENOMEM;
++
++ return ret;
+ }
+
+ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+--
+2.20.1
+
--- /dev/null
+From e4d4d37ac84041937a1ab2df5b90902e64b6cffd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:44:03 -0700
+Subject: misc: kgdbts: Fix restrict error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ]
+
+kgdbts current fails when compiled with restrict:
+
+drivers/misc/kgdbts.c: In function ‘configure_kgdbts’:
+drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict]
+ strcpy(config, opt);
+ ^~~~~~~~~~~~~~~~~~~
+
+As the error says, config is being used in both the source and destination.
+Refactor the code to avoid the extra copy and put the parsing closer to
+the actual location.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index bb3a76ad80da2..fc8cb855c6e66 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -979,6 +979,12 @@ static void kgdbts_run_tests(void)
+ int nmi_sleep = 0;
+ int i;
+
++ verbose = 0;
++ if (strstr(config, "V1"))
++ verbose = 1;
++ if (strstr(config, "V2"))
++ verbose = 2;
++
+ ptr = strchr(config, 'F');
+ if (ptr)
+ fork_test = simple_strtol(ptr + 1, NULL, 10);
+@@ -1062,13 +1068,6 @@ static int kgdbts_option_setup(char *opt)
+ return -ENOSPC;
+ }
+ strcpy(config, opt);
+-
+- verbose = 0;
+- if (strstr(config, "V1"))
+- verbose = 1;
+- if (strstr(config, "V2"))
+- verbose = 2;
+-
+ return 0;
+ }
+
+@@ -1080,9 +1079,6 @@ static int configure_kgdbts(void)
+
+ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+- err = kgdbts_option_setup(config);
+- if (err)
+- goto noconfig;
+
+ final_ack = 0;
+ run_plant_and_detach_test(1);
+--
+2.20.1
+
--- /dev/null
+From 6ecfffc1d03d7f67424c199cd10f1363e7614d4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:50:17 +0800
+Subject: net: amd: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/am79c961a.c | 2 +-
+ drivers/net/ethernet/amd/atarilance.c | 6 ++++--
+ drivers/net/ethernet/amd/declance.c | 2 +-
+ drivers/net/ethernet/amd/sun3lance.c | 6 ++++--
+ drivers/net/ethernet/amd/sunlance.c | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++--
+ 6 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
+index 87e727b921dc0..1ad401fed4698 100644
+--- a/drivers/net/ethernet/amd/am79c961a.c
++++ b/drivers/net/ethernet/amd/am79c961a.c
+@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev)
+ /*
+ * Transmit a packet
+ */
+-static int
++static netdev_tx_t
+ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dev_priv *priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index b10964e8cb546..a1dc65136d9fa 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -770,7 +771,8 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index b584b78237dfd..5e994f981feae 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 3d8c6b2cdea4c..09271665712da 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -235,7 +235,8 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 8914170fccfff..babb0a5fb8de4 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 64034ff081a0c..23fc244eb8a4d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1390,7 +1390,7 @@ static int xgbe_close(struct net_device *netdev)
+ return 0;
+ }
+
+-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct xgbe_prv_data *pdata = netdev_priv(netdev);
+ struct xgbe_hw_if *hw_if = &pdata->hw_if;
+@@ -1399,7 +1399,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ struct xgbe_ring *ring;
+ struct xgbe_packet_data *packet;
+ struct netdev_queue *txq;
+- int ret;
++ netdev_tx_t ret;
+
+ DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len);
+
+--
+2.20.1
+
--- /dev/null
+From 456fdc14a250fc8008026ca95d4ad3e30bcb8aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:45:12 +0800
+Subject: net: broadcom: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++--
+ drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index ec5834087e4b4..c01ab06863b3d 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
+ u32 len_stat;
+- int ret;
++ netdev_tx_t ret;
+
+ priv = netdev_priv(dev);
+
+diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
+index f557a2aaec231..73a7c8a504702 100644
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -300,7 +300,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *,
+ static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff);
+ static uint64_t sbmac_addr2reg(unsigned char *ptr);
+ static irqreturn_t sbmac_intr(int irq, void *dev_instance);
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
+ static void sbmac_setmulti(struct sbmac_softc *sc);
+ static int sbmac_init(struct platform_device *pldev, long long base);
+ static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed);
+@@ -2033,7 +2033,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance)
+ * Return value:
+ * nothing
+ ********************************************************************* */
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sbmac_softc *sc = netdev_priv(dev);
+ unsigned long flags;
+--
+2.20.1
+
--- /dev/null
+From 64d66652e45fd1951fd1d5121305461b4e699b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 19:29:09 +0200
+Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ]
+
+We need to bail out if lan78xx_get_endpoints() fails, otherwise the
+result is overwritten.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Raghuram Chary Jallipalli <raghuramchary.jallipalli@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 45a6a7cae4bfc..fc922f8122801 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2246,6 +2246,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ int i;
+
+ ret = lan78xx_get_endpoints(dev, intf);
++ if (ret) {
++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
++ ret);
++ return ret;
++ }
+
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+--
+2.20.1
+
--- /dev/null
+From cf471ae8fc35d03ac3618a30ee4db529424d0cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:42:15 +0800
+Subject: net: micrel: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8695net.c | 2 +-
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index a8522d8af95d3..2126286b72e9b 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 2fc5cd56c0a84..8dc1f0277117d 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ * spin_lock_irqsave is required because tx and rx should be mutual exclusive.
+ * So while tx is in-progress, prevent IRQ interrupt from happenning.
+ */
+-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+- int retv = NETDEV_TX_OK;
++ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
+
+ disable_irq(netdev->irq);
+--
+2.20.1
+
--- /dev/null
+From d7864f4a3e0dc031b875635841bb33c5f1b8c80c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:06:29 +0800
+Subject: net: smsc: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc911x.c | 3 ++-
+ drivers/net/ethernet/smsc/smc91x.c | 3 ++-
+ drivers/net/ethernet/smsc/smsc911x.c | 3 ++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index bd64eb982e527..37fb6dfc10875 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -511,7 +511,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 23a0388100834..7405f537beca7 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -637,7 +637,8 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 219a99b7a631d..b62bf77a64f43 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1677,7 +1677,8 @@ static int smsc911x_stop(struct net_device *dev)
+ }
+
+ /* Entry point for transmitting a packet */
+-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
+ unsigned int freespace;
+--
+2.20.1
+
--- /dev/null
+From 228a23ccf89315715ddc586a767c9b78805f6370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:23:39 +0800
+Subject: net: toshiba: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +-
+ drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/tc35815.c | 6 ++++--
+ 4 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 79f0ec4e51ace..964df98b54ea1 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card,
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, <0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct gelic_card *card = netdev_card(netdev);
+ struct gelic_descr *descr;
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index 8505196be9f52..d123644bd720b 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card);
+ void gelic_card_down(struct gelic_card *card);
+ int gelic_net_open(struct net_device *netdev);
+ int gelic_net_stop(struct net_device *netdev);
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+ void gelic_net_set_multi(struct net_device *netdev);
+ void gelic_net_tx_timeout(struct net_device *netdev);
+ int gelic_net_change_mtu(struct net_device *netdev, int new_mtu);
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index 3c54a2cae5dfd..8e53211aedd82 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -881,9 +881,9 @@ out:
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, !0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-static int
++static netdev_tx_t
+ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int cnt;
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index 868fb6306df02..3e33c165a4278 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -475,7 +475,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_
+ /* Index to functions, as function prototypes. */
+
+ static int tc35815_open(struct net_device *dev);
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t tc35815_interrupt(int irq, void *dev_id);
+ static int tc35815_rx(struct net_device *dev, int limit);
+ static int tc35815_poll(struct napi_struct *napi, int budget);
+@@ -1279,7 +1280,8 @@ tc35815_open(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tc35815_local *lp = netdev_priv(dev);
+ struct TxFD *txfd;
+--
+2.20.1
+
--- /dev/null
+From 33f3e52e381c12b88aad42a7e236884f5b91e008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:32:40 +0800
+Subject: net: xilinx: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 5a1068df7038c..ed6a88cf3281c 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -673,7 +673,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index f1e969128a4ee..7f1a57bb2ab10 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -656,7 +656,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 4cb8b85cbf2c2..909a008f99276 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1008,9 +1008,10 @@ static int xemaclite_close(struct net_device *dev)
+ * deferred and the Tx queue is stopped so that the deferred socket buffer can
+ * be transmitted when the Emaclite device is free to transmit data.
+ *
+- * Return: 0, always.
++ * Return: NETDEV_TX_OK, always.
+ */
+-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
++static netdev_tx_t
++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ {
+ struct net_local *lp = netdev_priv(dev);
+ struct sk_buff *new_skb;
+@@ -1031,7 +1032,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ /* Take the time stamp now, since we can't do this in an ISR. */
+ skb_tx_timestamp(new_skb);
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+- return 0;
++ return NETDEV_TX_OK;
+ }
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+
+@@ -1040,7 +1041,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ dev->stats.tx_bytes += len;
+ dev_consume_skb_any(new_skb);
+
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From eb138f835007a0619b4f143bed8b212b14701796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:19:35 +0100
+Subject: nvmem: core: return error code instead of NULL from nvmem_device_get
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ]
+
+nvmem_device_get() should return ERR_PTR() on error or valid pointer
+on success, but one of the code path seems to return NULL, so fix it.
+
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 931cc33e46f02..5d6d1bb4f1106 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -457,7 +457,7 @@ static struct nvmem_device *nvmem_find(const char *name)
+ d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match);
+
+ if (!d)
+- return NULL;
++ return ERR_PTR(-ENOENT);
+
+ return to_nvmem_device(d);
+ }
+--
+2.20.1
+
--- /dev/null
+From b2ad3bfcd6dd92003842c1affb26260eccde31b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 09:50:09 -0500
+Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ]
+
+Cache nodes under the cpu node(s) is PowerMac specific according to the
+comment above, so make the code enforce that.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index c6e019208d171..27783223ca5cd 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2125,7 +2125,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
+ /* OF on pmac has nodes instead of properties named "l2-cache"
+ * beneath CPU nodes.
+ */
+- if (!strcmp(np->type, "cpu"))
++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu"))
+ for_each_child_of_node(np, child)
+ if (!strcmp(child->type, "cache"))
+ return child;
+--
+2.20.1
+
--- /dev/null
+From 0d3261c145d6373a12f04ca4a4cc89fa3e848269 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 04:32:11 +0000
+Subject: PCI/ACPI: Correct error message for ASPM disabling
+
+From: Sinan Kaya <okaya@kernel.org>
+
+[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ]
+
+If _OSC execution fails today for platforms without an _OSC entry, code is
+printing a misleading message saying disabling ASPM as follows:
+
+ acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
+
+We need to ensure that platform supports ASPM to begin with.
+
+Reported-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_root.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 3b0b4bd67b71b..4031ec8024cee 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ decode_osc_support(root, "OS supports", support);
+ status = acpi_pci_osc_support(root, support);
+ if (ACPI_FAILURE(status)) {
+- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n",
+- acpi_format_exception(status));
++ dev_info(&device->dev, "_OSC failed (%s)%s\n",
++ acpi_format_exception(status),
++ pcie_aspm_support_enabled() ? "; disabling ASPM" : "");
+ *no_aspm = 1;
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 96d8d017debe2b071a931a2ee0267b83a0e11002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 14:42:13 +0200
+Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ]
+
+Sharing the same irqchip with multiple gpiochips is not a good
+practice. For instance, when installing hooks, we change the state
+of the irqchip. The initial state of the irqchip for the second
+gpiochip to register is then disrupted.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 0d2fc0cff35ee..52bbd34f7d0d9 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1556,16 +1556,6 @@ void at91_pinctrl_gpio_resume(void)
+ #define gpio_irq_set_wake NULL
+ #endif /* CONFIG_PM */
+
+-static struct irq_chip gpio_irqchip = {
+- .name = "GPIO",
+- .irq_ack = gpio_irq_ack,
+- .irq_disable = gpio_irq_mask,
+- .irq_mask = gpio_irq_mask,
+- .irq_unmask = gpio_irq_unmask,
+- /* .irq_set_type is set dynamically */
+- .irq_set_wake = gpio_irq_set_wake,
+-};
+-
+ static void gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+@@ -1608,12 +1598,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
++ struct irq_chip *gpio_irqchip;
+ int ret, i;
+
++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL);
++ if (!gpio_irqchip)
++ return -ENOMEM;
++
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+- /* Setup proper .irq_set_type function */
+- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++ gpio_irqchip->name = "GPIO";
++ gpio_irqchip->irq_ack = gpio_irq_ack;
++ gpio_irqchip->irq_disable = gpio_irq_mask;
++ gpio_irqchip->irq_mask = gpio_irq_mask;
++ gpio_irqchip->irq_unmask = gpio_irq_unmask;
++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake,
++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type;
+
+ /* Disable irqs of this PIO controller */
+ writel_relaxed(~0, at91_gpio->regbase + PIO_IDR);
+@@ -1624,7 +1624,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ * interrupt.
+ */
+ ret = gpiochip_irqchip_add(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ 0,
+ handle_edge_irq,
+ IRQ_TYPE_EDGE_BOTH);
+@@ -1642,7 +1642,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ if (!gpiochip_prev) {
+ /* Then register the chain on the parent IRQ */
+ gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ at91_gpio->pioc_virq,
+ gpio_irq_handler);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From b181c7765189ff88d80ea45f2dae766756bd279b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:37:45 +0300
+Subject: pinctrl: at91-pio4: fix has_config check in
+ atmel_pctl_dt_subnode_to_map()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ]
+
+Smatch complains about this condition:
+
+ if (has_config && num_pins >= 1)
+
+The "has_config" variable is either uninitialized or true. The
+"num_pins" variable is unsigned and we verified that it is non-zero on
+the lines before so we know "num_pines >= 1" is true. Really, we could
+just check "num_configs" directly and remove the "has_config" variable.
+
+Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 9aa82a4e9e254..b4420a0bf7d66 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -477,7 +477,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned num_pins, num_configs, reserve;
+ unsigned long *configs;
+ struct property *pins;
+- bool has_config;
+ u32 pinfunc;
+ int ret, i;
+
+@@ -493,9 +492,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ return ret;
+ }
+
+- if (num_configs)
+- has_config = true;
+-
+ num_pins = pins->length / sizeof(u32);
+ if (!num_pins) {
+ dev_err(pctldev->dev, "no pins found in node %s\n",
+@@ -508,7 +504,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ * map for each pin.
+ */
+ reserve = 1;
+- if (has_config && num_pins >= 1)
++ if (num_configs)
+ reserve++;
+ reserve *= num_pins;
+ ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps,
+@@ -531,7 +527,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps,
+ group, func);
+
+- if (has_config) {
++ if (num_configs) {
+ ret = pinctrl_utils_add_map_configs(pctldev, map,
+ reserved_maps, num_maps, group,
+ configs, num_configs,
+--
+2.20.1
+
--- /dev/null
+From f51910fa62c88377457b6507aae79890ab2998ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:39:04 +0300
+Subject: power: supply: ab8500_fg: silence uninitialized variable warnings
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ]
+
+If kstrtoul() fails then we print "charge_full" when it's uninitialized.
+The debug printk doesn't add anything so I deleted it and cleaned these
+two functions up a bit.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/ab8500_fg.c | 31 ++++++++++++-------------------
+ 1 file changed, 12 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c
+index 3830dade5d69d..d91111200dde2 100644
+--- a/drivers/power/ab8500_fg.c
++++ b/drivers/power/ab8500_fg.c
+@@ -2447,17 +2447,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_full;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_full);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full);
+-
+- if (!ret) {
+- di->bat_cap.max_mah = (int) charge_full;
+- ret = count;
+- }
+- return ret;
++ di->bat_cap.max_mah = (int) charge_full;
++ return count;
+ }
+
+ static ssize_t charge_now_show(struct ab8500_fg *di, char *buf)
+@@ -2469,20 +2466,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_now;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_now);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d",
+- ret, charge_now, di->bat_cap.prev_mah);
+-
+- if (!ret) {
+- di->bat_cap.user_mah = (int) charge_now;
+- di->flags.user_cap = true;
+- ret = count;
+- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
+- }
+- return ret;
++ di->bat_cap.user_mah = (int) charge_now;
++ di->flags.user_cap = true;
++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
++ return count;
+ }
+
+ static struct ab8500_fg_sysfs_entry charge_full_attr =
+--
+2.20.1
+
--- /dev/null
+From 231ffdbc6939eddd51d254b34688abff473890b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jul 2018 18:05:07 +0200
+Subject: power: supply: max8998-charger: Fix platform data retrieval
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Figa <tomasz.figa@gmail.com>
+
+[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ]
+
+Since the max8998 MFD driver supports instantiation by DT, platform data
+retrieval is handled in MFD probe and cell drivers should get use
+the pdata field of max8998_dev struct to obtain them.
+
+Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree")
+Signed-off-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/max8998_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/max8998_charger.c b/drivers/power/max8998_charger.c
+index b64cf0f141425..66438029bdd0c 100644
+--- a/drivers/power/max8998_charger.c
++++ b/drivers/power/max8998_charger.c
+@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = {
+ static int max8998_battery_probe(struct platform_device *pdev)
+ {
+ struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev);
++ struct max8998_platform_data *pdata = iodev->pdata;
+ struct power_supply_config psy_cfg = {};
+ struct max8998_battery_data *max8998;
+ struct i2c_client *i2c;
+--
+2.20.1
+
--- /dev/null
+From 1d12d9ee84fc0308b81352ce41d706e29e5f22d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:00:07 +0200
+Subject: power: supply: twl4030_charger: disable eoc interrupt on linear
+ charge
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ]
+
+This avoids getting woken up from suspend after power interruptions
+when the bci wrongly thinks the battery is full just because
+of input current going low because of low input power
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/twl4030_charger.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c
+index 14fed11e8f6e3..5b1f147b11cb0 100644
+--- a/drivers/power/twl4030_charger.c
++++ b/drivers/power/twl4030_charger.c
+@@ -469,6 +469,7 @@ static void twl4030_current_worker(struct work_struct *data)
+ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ {
+ int ret;
++ u32 reg;
+
+ if (bci->usb_mode == CHARGE_OFF)
+ enable = false;
+@@ -482,14 +483,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ bci->usb_enabled = 1;
+ }
+
+- if (bci->usb_mode == CHARGE_AUTO)
++ if (bci->usb_mode == CHARGE_AUTO) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC |
++ TWL4030_TBATOR2 | TWL4030_TBATOR1 |
++ TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */
+ ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB);
++ }
+
+ /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */
+ ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0,
+ TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4);
+ if (bci->usb_mode == CHARGE_LINEAR) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 |
++ TWL4030_TBATOR1 | TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0);
+ /* Watch dog key: WOVF acknowledge */
+ ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33,
+--
+2.20.1
+
--- /dev/null
+From ea0784b4566cb933746d27d53dfe65657e9a1735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:20:35 +0200
+Subject: power: supply: twl4030_charger: fix charging current out-of-bounds
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ]
+
+the charging current uses unsigned int variables, if we step back
+if the current is still low, we would run into negative which
+means setting the target to a huge value.
+Better add checks here.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/twl4030_charger.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c
+index bcd4dc304f270..14fed11e8f6e3 100644
+--- a/drivers/power/twl4030_charger.c
++++ b/drivers/power/twl4030_charger.c
+@@ -449,7 +449,8 @@ static void twl4030_current_worker(struct work_struct *data)
+
+ if (v < USB_MIN_VOLT) {
+ /* Back up and stop adjusting. */
+- bci->usb_cur -= USB_CUR_STEP;
++ if (bci->usb_cur >= USB_CUR_STEP)
++ bci->usb_cur -= USB_CUR_STEP;
+ bci->usb_cur_target = bci->usb_cur;
+ } else if (bci->usb_cur >= bci->usb_cur_target ||
+ bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
+--
+2.20.1
+
--- /dev/null
+From dcd923743a74319df31c0b0f58c2220745adae59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 01:30:45 +1000
+Subject: powerpc/64s/hash: Fix stab_rr off by one initialization
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ]
+
+This causes SLB alloation to start 1 beyond the start of the SLB.
+There is no real problem because after it wraps it stats behaving
+properly, it's just surprisig to see when looking at SLB traces.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/slb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 309027208f7c0..27f00a7c1085f 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -322,7 +322,7 @@ void slb_initialize(void)
+ #endif
+ }
+
+- get_paca()->stab_rr = SLB_NUM_BOLTED;
++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1;
+
+ lflags = SLB_VSID_KERNEL | linear_llp;
+ vflags = SLB_VSID_KERNEL | vmalloc_llp;
+--
+2.20.1
+
--- /dev/null
+From 1a830ee67343e77f61137c0dafec4a7213c91722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 15:44:48 -0300
+Subject: powerpc/iommu: Avoid derefence before pointer check
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ]
+
+The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check
+if it is not NULL.
+
+Just moving the dereference code to after the check, where there will
+be guarantee that 'tbl' will not be NULL.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index a8e3490b54e3b..4c9b5970af371 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -764,9 +764,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl,
+
+ vaddr = page_address(page) + offset;
+ uaddr = (unsigned long)vaddr;
+- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+
+ if (tbl) {
++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+ align = 0;
+ if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE &&
+ ((unsigned long)vaddr & ~PAGE_MASK) == 0)
+--
+2.20.1
+
--- /dev/null
+From 91489f93b6729d62feaacb2c84837a4ac56a71a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 14:14:02 -0500
+Subject: powerpc/pseries: Disable CPU hotplug across migrations
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ]
+
+When performing partition migrations all present CPUs must be online
+as all present CPUs must make the H_JOIN call as part of the migration
+process. Once all present CPUs make the H_JOIN call, one CPU is returned
+to make the rtas call to perform the migration to the destination system.
+
+During testing of migration and changing the SMT state we have found
+instances where CPUs are offlined, as part of the SMT state change,
+before they make the H_JOIN call. This results in a hung system where
+every CPU is either in H_JOIN or offline.
+
+To prevent this this patch disables CPU hotplug during the migration
+process.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 0c42e872d548b..4fcaa7d3d544f 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -967,6 +967,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ goto out;
+ }
+
++ cpu_hotplug_disable();
+ stop_topology_update();
+
+ /* Call function on all CPUs. One of us will make the
+@@ -981,6 +982,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ printk(KERN_ERR "Error doing global join\n");
+
+ start_topology_update();
++ cpu_hotplug_enable();
+
+ /* Take down CPUs not online prior to suspend */
+ cpuret = rtas_offline_cpus_mask(offline_mask);
+--
+2.20.1
+
--- /dev/null
+From fe4e406fc915a66e2763dddd4c674a733973e249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:10:04 +0930
+Subject: powerpc/vdso: Correct call frame information
+
+From: Alan Modra <amodra@gmail.com>
+
+[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ]
+
+Call Frame Information is used by gdb for back-traces and inserting
+breakpoints on function return for the "finish" command. This failed
+when inside __kernel_clock_gettime. More concerning than difficulty
+debugging is that CFI is also used by stack frame unwinding code to
+implement exceptions. If you have an app that needs to handle
+asynchronous exceptions for some reason, and you are unlucky enough to
+get one inside the VDSO time functions, your app will crash.
+
+What's wrong: There is control flow in __kernel_clock_gettime that
+reaches label 99 without saving lr in r12. CFI info however is
+interpreted by the unwinder without reference to control flow: It's a
+simple matter of "Execute all the CFI opcodes up to the current
+address". That means the unwinder thinks r12 contains the return
+address at label 99. Disabuse it of that notion by resetting CFI for
+the return address at label 99.
+
+Note that the ".cfi_restore lr" could have gone anywhere from the
+"mtlr r12" a few instructions earlier to the instruction at label 99.
+I put the CFI as late as possible, because in general that's best
+practice (and if possible grouped with other CFI in order to reduce
+the number of CFI opcodes executed when unwinding). Using r12 as the
+return address is perfectly fine after the "mtlr r12" since r12 on
+that code path still contains the return address.
+
+__get_datapage also has a CFI error. That function temporarily saves
+lr in r0, and reflects that fact with ".cfi_register lr,r0". A later
+use of r0 means the CFI at that point isn't correct, as r0 no longer
+contains the return address. Fix that too.
+
+Signed-off-by: Alan Modra <amodra@gmail.com>
+Tested-by: Reza Arbab <arbab@linux.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso32/datapage.S | 1 +
+ arch/powerpc/kernel/vdso32/gettimeofday.S | 1 +
+ arch/powerpc/kernel/vdso64/datapage.S | 1 +
+ arch/powerpc/kernel/vdso64/gettimeofday.S | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S
+index 59cf5f452879b..9d112e1b31b8b 100644
+--- a/arch/powerpc/kernel/vdso32/datapage.S
++++ b/arch/powerpc/kernel/vdso32/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 6b2b69616e776..7b341b86216c2 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index 7612eeb31da14..6832e41c372b0 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index 3820213248836..09b2a49f6dd53 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+--
+2.20.1
+
--- /dev/null
+From b3dff42850217444c211daa6f4859f655187eff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 13:48:31 -0500
+Subject: rtl8187: Fix warning generated when strncpy() destination length
+ matches the sixe argument
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ]
+
+In gcc8, when the 3rd argument (size) of a call to strncpy() matches the
+length of the first argument, the compiler warns of the possibility of an
+unterminated string. Using strlcpy() forces a null at the end.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+index c2d5b495c179a..c089540116fa7 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
+ led->dev = dev;
+ led->ledpin = ledpin;
+ led->is_radio = is_radio;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
+--
+2.20.1
+
--- /dev/null
+From 41ddc2826355b94d3dd7cb092c8add88d7294793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:36:06 +0200
+Subject: s390/qeth: invoke softirqs after napi_schedule()
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ]
+
+Calling napi_schedule() from process context does not ensure that the
+NET_RX softirq is run in a timely fashion. So trigger it manually.
+
+This is no big issue with current code. A call to ndo_open() is usually
+followed by a ndo_set_rx_mode() call, and for qeth this contains a
+spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out
+early.
+Nevertheless it's best to not depend on this behaviour, and just fix
+the issue at its source like all other drivers do. For instance see
+commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule").
+
+Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 3 +++
+ drivers/s390/net/qeth_l3_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 22045e7d78ac3..97211f7f0cf02 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -996,7 +996,10 @@ static int __qeth_l2_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 2cc9bc1ef1e38..0d71d2e6419af 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3031,7 +3031,10 @@ static int __qeth_l3_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 85d46aa9c8684ebd64f59de7cf5f587ed1488528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 10:56:52 +0800
+Subject: scsi: libsas: always unregister the old device if going to discover
+ new
+
+From: Jason Yan <yanaijie@huawei.com>
+
+[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ]
+
+If we went into sas_rediscover_dev() the attached_sas_addr was already insured
+not to be zero. So it's unnecessary to check if the attached_sas_addr is zero.
+
+And although if the sas address is not changed, we always have to unregister
+the old device when we are going to register a new one. We cannot just leave
+the device there and bring up the new.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+CC: John Garry <john.garry@huawei.com>
+CC: Johannes Thumshirn <jthumshirn@suse.de>
+CC: Ewan Milne <emilne@redhat.com>
+CC: Christoph Hellwig <hch@lst.de>
+CC: Tomas Henzl <thenzl@redhat.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 400eee9d77832..d44f18f773c0f 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2049,14 +2049,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ return res;
+ }
+
+- /* delete the old link */
+- if (SAS_ADDR(phy->attached_sas_addr) &&
+- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) {
+- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
+- SAS_ADDR(dev->sas_addr), phy_id,
+- SAS_ADDR(phy->attached_sas_addr));
+- sas_unregister_devs_sas_addr(dev, phy_id, last);
+- }
++ /* we always have to delete the old device when we went here */
++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
++ SAS_ADDR(dev->sas_addr), phy_id,
++ SAS_ADDR(phy->attached_sas_addr));
++ sas_unregister_devs_sas_addr(dev, phy_id, last);
+
+ return sas_discover_new(dev, phy_id);
+ }
+--
+2.20.1
+
--- /dev/null
+From 4a1e03aa68fcfd672dc6ac48dfd70514e251c331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:03 +0530
+Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ]
+
+For the function dma_unmap_sg(), the <nents> parameter should be number of
+elements in the scatter list prior to the mapping, not after the mapping.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 949198c01ced6..ef1687f798cc1 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -463,7 +463,7 @@ err_out:
+ dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+ if (!sas_protocol_ata(t->task_proto))
+ if (n_elem)
+- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter,
+ t->data_dir);
+ out_done:
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From a637121d7935382aea10f5d233444efd7f16f7c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:04 +0530
+Subject: scsi: pm80xx: Fixed system hang issue during kexec boot
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ]
+
+When the firmware is not responding, execution of kexec boot causes a system
+hang. When firmware assertion happened, driver get notified with interrupt
+vector updated in MPI configuration table. Then, the driver will read
+scratchpad register and set controller_fatal_error flag to true.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 6 +++
+ drivers/scsi/pm8001/pm8001_sas.c | 7 +++
+ drivers/scsi/pm8001/pm8001_sas.h | 1 +
+ drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++---
+ drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++
+ 5 files changed, 91 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 04e67a190652e..b3490b4a046a2 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+ } else {
+ u32 producer_index;
+ void *pi_virt = circularQ->pi_virt;
++ /* spurious interrupt during setup if
++ * kexec-ing and driver doing a doorbell access
++ * with the pre-kexec oq interrupt setup
++ */
++ if (!pi_virt)
++ break;
+ /* Update the producer index from SPC */
+ producer_index = pm8001_read_32(pi_virt);
+ circularQ->producer_index = cpu_to_le32(producer_index);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index ef1687f798cc1..3862d8b1defe3 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -371,6 +371,13 @@ static int pm8001_task_exec(struct sas_task *task,
+ return 0;
+ }
+ pm8001_ha = pm8001_find_ha_by_dev(task->dev);
++ if (pm8001_ha->controller_fatal_error) {
++ struct task_status_struct *ts = &t->task_status;
++
++ ts->resp = SAS_TASK_UNDELIVERED;
++ t->task_done(t);
++ return 0;
++ }
+ PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ do {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 6628cc38316c2..d8768ac41ebbf 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -531,6 +531,7 @@ struct pm8001_hba_info {
+ u32 logging_level;
+ u32 fw_status;
+ u32 smp_exp_mode;
++ bool controller_fatal_error;
+ const struct firmware *fw_image;
+ struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
+ };
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index eb4fee61df729..9edd61c063a1a 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size);
+ pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity);
++ /* Update Fatal error interrupt vector */
++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=
++ ((pm8001_ha->number_of_intr - 1) << 8);
+ pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt);
+ pm8001_mw32(address, MAIN_EVENT_CRC_CHECK,
+@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha)
+ return -EBUSY;
+ }
+
++ /* Initialize the controller fatal error flag */
++ pm8001_ha->controller_fatal_error = false;
++
+ /* Initialize pci space address eg: mpi offset */
+ init_pci_device_addresses(pm8001_ha);
+ init_default_table_values(pm8001_ha);
+@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha)
+ u32 bootloader_state;
+ u32 ibutton0, ibutton1;
+
+- /* Check if MPI is in ready state to reset */
+- if (mpi_uninit_check(pm8001_ha) != 0) {
+- PM8001_FAIL_DBG(pm8001_ha,
+- pm8001_printk("MPI state is not ready\n"));
+- return -1;
++ /* Process MPI table uninitialization only if FW is ready */
++ if (!pm8001_ha->controller_fatal_error) {
++ /* Check if MPI is in ready state to reset */
++ if (mpi_uninit_check(pm8001_ha) != 0) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "MPI state is not ready scratch1 :0x%x\n",
++ regval));
++ return -1;
++ }
+ }
+-
+ /* checked for reset register normal state; 0x0 */
+ regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET);
+ PM8001_INIT_DBG(pm8001_ha,
+@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ }
+ }
+
++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha)
++{
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7)));
++}
++
+ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ u8 uninitialized_var(bc);
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
++ u32 regval;
+
++ if (vec == (pm8001_ha->number_of_intr - 1)) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ if ((regval & SCRATCH_PAD_MIPSALL_READY) !=
++ SCRATCH_PAD_MIPSALL_READY) {
++ pm8001_ha->controller_fatal_error = true;
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "Firmware Fatal error! Regval:0x%x\n", regval));
++ print_scratchpad_registers(pm8001_ha);
++ return ret;
++ }
++ }
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ circularQ = &pm8001_ha->outbnd_q_tbl[vec];
+ do {
++ /* spurious interrupt during setup if kexec-ing and
++ * driver doing a doorbell access w/ the pre-kexec oq
++ * interrupt setup.
++ */
++ if (!circularQ->pi_virt)
++ break;
+ ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+ if (MPI_IO_STATUS_SUCCESS == ret) {
+ /* process the outbound message */
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 7a443bad61634..411b414a9a0ef 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
+ #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0
+ #define SCRATCH_PAD_IOP0_READY 0xC00
+ #define SCRATCH_PAD_IOP1_READY 0x3000
++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \
++ SCRATCH_PAD_IOP0_READY | \
++ SCRATCH_PAD_RAAE_READY)
+
+ /* boot loader state */
+ #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */
+--
+2.20.1
+
--- /dev/null
+From 6c218d98e35191a9535bebe777e7233a8ba842f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 11:38:16 -0400
+Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ]
+
+sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before
+using it in debug message prints.
+
+Suggested-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Acked-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index c6425e3df5a04..f1c7714377524 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym
+ OUTB(np, HS_PRT, HS_BUSY);
+ }
+
++#define sym_printk(lvl, tp, cp, fmt, v...) do { \
++ if (cp) \
++ scmd_printk(lvl, cp->cmd, fmt, ##v); \
++ else \
++ starget_printk(lvl, tp->starget, fmt, ##v); \
++} while (0)
++
+ /*
+ * chip exception handler for programmed interrupts.
+ */
+@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * been selected with ATN. We do not want to handle that.
+ */
+ case SIR_SEL_ATN_NO_MSG_OUT:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG OUT phase after selection with ATN\n");
+ goto out_stuck;
+ /*
+@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * having reselected the initiator.
+ */
+ case SIR_RESEL_NO_MSG_IN:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG IN phase after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * an IDENTIFY.
+ */
+ case SIR_RESEL_NO_IDENTIFY:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No IDENTIFY after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ case SIR_RESEL_ABORTED:
+ np->lastmsg = np->msgout[0];
+ np->msgout[0] = M_NOOP;
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ goto out;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 298e2da76539c18c8172ca92bad83a5b7748cdc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:59:05 +0300
+Subject: serial: mxs-auart: Fix potential infinite loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anton Vasilyev <vasilyev@ispras.ru>
+
+[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ]
+
+On the error path of mxs_auart_request_gpio_irq() is performed
+backward iterating with index i of enum type. Underline enum type
+may be unsigned char. In this case check (--i >= 0) will be always
+true and error handling goes into infinite loop.
+
+The patch changes the check so that it is valid for signed and unsigned
+types.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/mxs-auart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index daa4a65ef6ffc..fe870170db74a 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1248,8 +1248,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)
+
+ /*
+ * If something went wrong, rollback.
++ * Be careful: i may be unsigned.
+ */
+- while (err && (--i >= 0))
++ while (err && (i-- > 0))
+ if (irq[i] >= 0)
+ free_irq(irq[i], s);
+
+--
+2.20.1
+
mm-memcg-switch-to-css_tryget-in-get_mem_cgroup_from_mm.patch
mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch
mmc-sdhci-of-at91-fix-quirk2-overwrite.patch
+iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch
+alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch
+arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch
+alsa-seq-do-error-checks-at-creating-system-ports.patch
+gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch
+asoc-dpcm-properly-initialise-hw-rate_max.patch
+mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch
+arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch
+i40e-use-correct-length-for-strncpy.patch
+i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch
+i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch
+arm-dts-pxa-fix-power-i2c-base-address.patch
+rtl8187-fix-warning-generated-when-strncpy-destinati.patch
+net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch
+asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch
+arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch
+ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch
+mips-txx9-fix-iounmap-related-issue.patch
+of-make-powermac-cache-node-search-conditional-on-co.patch
+arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch
+arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch
+arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch
+arm-dts-omap3-gta04-keep-vpll2-always-on.patch
+dmaengine-dma-jz4780-further-residue-status-fix.patch
+signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch
+signal-properly-deliver-sigill-from-uprobes.patch
+signal-properly-deliver-sigsegv-from-x86-uprobes.patch
+scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch
+arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch
+scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch
+scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch
+kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch
+nvmem-core-return-error-code-instead-of-null-from-nv.patch
+media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch
+alsa-intel8x0m-register-irq-handler-after-register-i.patch
+pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch
+llc-avoid-blocking-in-llc_sap_close.patch
+powerpc-vdso-correct-call-frame-information.patch
+arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch
+pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch
+cxgb4-fix-endianness-issue-in-t4_fwcache.patch
+power-supply-ab8500_fg-silence-uninitialized-variabl.patch
+power-supply-max8998-charger-fix-platform-data-retri.patch
+kernfs-fix-range-checks-in-kernfs_get_target_path.patch
+s390-qeth-invoke-softirqs-after-napi_schedule.patch
+pci-acpi-correct-error-message-for-aspm-disabling.patch
+serial-mxs-auart-fix-potential-infinite-loop.patch
+powerpc-iommu-avoid-derefence-before-pointer-check.patch
+powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch
+powerpc-pseries-disable-cpu-hotplug-across-migration.patch
+libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch
+power-supply-twl4030_charger-fix-charging-current-ou.patch
+power-supply-twl4030_charger-disable-eoc-interrupt-o.patch
+net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch
+net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch
+net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch
+net-amd-fix-return-type-of-ndo_start_xmit-function.patch
+usb-chipidea-fix-otg-event-handler.patch
+arm-dts-am335x-evm-fix-number-of-cpsw.patch
+arm-dts-ux500-correct-scu-unit-address.patch
+arm-dts-ux500-fix-lcda-clock-line-muxing.patch
+arm-dts-ste-fix-spi-controller-node-names.patch
+cpufeature-avoid-warning-when-compiling-with-clang.patch
+bnx2x-ignore-bandwidth-attention-in-single-function-.patch
+net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch
+x86-cpu-use-correct-macros-for-cyrix-calls.patch
+mips-kexec-relax-memory-restriction.patch
+media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch
+media-davinci-fix-implicit-enum-conversion-warning.patch
+usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch
+usb-gadget-uvc-configfs-prevent-format-changes-after.patch
+usb-gadget-uvc-factor-out-video-usb-request-queueing.patch
+usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch
+misc-kgdbts-fix-restrict-error.patch
+misc-genwqe-should-return-proper-error-value.patch
+vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch
+scsi-libsas-always-unregister-the-old-device-if-goin.patch
+arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch
+arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch
+net-smsc-fix-return-type-of-ndo_start_xmit-function.patch
+edac-raise-the-maximum-number-of-memory-controllers.patch
+bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch
+arm64-dts-amd-fix-spi-bus-warnings.patch
+fuse-use-read_once-on-congestion_threshold-and-max_b.patch
--- /dev/null
+From 677405236fe32f244dad5d0963eaa584cd84326f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 19:47:27 -0500
+Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ]
+
+If the first process started (aka /sbin/init) receives a SIGKILL it
+will panic the system if it is delivered. Making the system unusable
+and undebugable. It isn't much better if the first process started
+receives SIGSTOP.
+
+So always ignore SIGSTOP and SIGKILL sent to init.
+
+This is done in a separate clause in sig_task_ignored as force_sig_info
+can clear SIG_UNKILLABLE and this protection should work even then.
+
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 072fd152ab01e..3095b2309876d 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -71,6 +71,10 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+
+ handler = sig_handler(t, sig);
+
++ /* SIGKILL and SIGSTOP may not be sent to the global init */
++ if (unlikely(is_global_init(t) && sig_kernel_only(sig)))
++ return true;
++
+ if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From eaa55c5ede9ee9d38d939b657cd6fc15df1d05c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:33:53 -0500
+Subject: signal: Properly deliver SIGILL from uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ]
+
+For userspace to tell the difference between a random signal and an
+exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result
+in userspace seeing si_code == SI_USER (like a random signal) instead
+of si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current)
+with force_sig(SIG_ILL, current) which gets this right and is
+shorter and easier to type.
+
+Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails")
+Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index aad43c88a6685..8cad3cd92e23e 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1836,7 +1836,7 @@ static void handle_trampoline(struct pt_regs *regs)
+
+ sigill:
+ uprobe_warn(current, "handle uretprobe, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+
+ }
+
+@@ -1952,7 +1952,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
+
+ if (unlikely(err)) {
+ uprobe_warn(current, "execute the probed insn, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 55239b75d6298b59900bfe1008a99e98a264e245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:48:30 -0500
+Subject: signal: Properly deliver SIGSEGV from x86 uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ]
+
+For userspace to tell the difference between an random signal
+and an exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in
+userspace seeing si_code == SI_USER (like a random signal) instead of
+si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current)
+with force_sig(SIG_SEGV, current) which gets this right and is shorter
+and easier to type.
+
+Fixes: 791eca10107f ("uretprobes/x86: Hijack return address")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 178d63cac321b..60b12c14cf6fb 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -983,7 +983,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
+ pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
+ "%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
+
+- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
++ force_sig(SIGSEGV, current);
+ }
+
+ return -1;
+--
+2.20.1
+
--- /dev/null
+From d2156ae6710a90985bcc81df7b15273518583e80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 17:18:58 +0200
+Subject: usb: chipidea: Fix otg event handler
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ]
+
+At OTG work running time, it's possible that several events need to be
+addressed (e.g. ID and VBUS events). The current implementation handles
+only one event at a time which leads to ignoring the other one. Fix it.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/otg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index f36a1ac3bfbdf..b8650210be0f7 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work)
+ }
+
+ pm_runtime_get_sync(ci->dev);
++
+ if (ci->id_event) {
+ ci->id_event = false;
+ ci_handle_id_switch(ci);
+- } else if (ci->b_sess_valid_event) {
++ }
++
++ if (ci->b_sess_valid_event) {
+ ci->b_sess_valid_event = false;
+ ci_handle_vbus_change(ci);
+- } else
+- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__);
++ }
++
+ pm_runtime_put_sync(ci->dev);
+
+ enable_irq(ci->irq);
+--
+2.20.1
+
--- /dev/null
+From ab4d9b083d8d50ac120719fba60c959bf7aaea22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 00:14:00 +0300
+Subject: usb: gadget: uvc: configfs: Drop leaked references to config items
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ]
+
+Some of the .allow_link() and .drop_link() operations implementations
+call config_group_find_item() and then leak the reference to the
+returned item. Fix this by dropping those references where needed.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index 01656f1c6d650..74df80a25b469 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -564,6 +564,7 @@ static int uvcg_control_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -605,6 +606,7 @@ static int uvcg_control_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2087,6 +2089,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2131,6 +2134,7 @@ static int uvcg_streaming_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From ffb5ef096d08c04362ac5927778193cecea93de9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 21:02:12 +0200
+Subject: usb: gadget: uvc: configfs: Prevent format changes after linking
+ header
+
+From: Joel Pepper <joel.pepper@rwth-aachen.de>
+
+[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ]
+
+While checks are in place to avoid attributes and children of a format
+being manipulated after the format is linked into the streaming header,
+the linked flag was never actually set, invalidating the protections.
+Update the flag as appropriate in the header link calls.
+
+Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index 74df80a25b469..a49ff1f5c0f93 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -807,6 +807,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src,
+ format_ptr->fmt = target_fmt;
+ list_add_tail(&format_ptr->entry, &src_hdr->formats);
+ ++src_hdr->num_fmt;
++ ++target_fmt->linked;
+
+ out:
+ mutex_unlock(&opts->lock);
+@@ -845,6 +846,8 @@ static int uvcg_streaming_header_drop_link(struct config_item *src,
+ break;
+ }
+
++ --target_fmt->linked;
++
+ out:
+ mutex_unlock(&opts->lock);
+ mutex_unlock(su_mutex);
+--
+2.20.1
+
--- /dev/null
+From 1cfb8255334c17911897fb31e2ee114f89466f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:42:03 +0300
+Subject: usb: gadget: uvc: Factor out video USB request queueing
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ]
+
+USB requests for video data are queued from two different locations in
+the driver, with the same code block occurring twice. Factor it out to a
+function.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 0f01c04d7cbd8..540917f54506a 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -129,6 +129,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
+ * Request handling
+ */
+
++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
++{
++ int ret;
++
++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ if (ret < 0) {
++ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
++ usb_ep_set_halt(video->ep);
++ }
++
++ return ret;
++}
++
+ /*
+ * I somehow feel that synchronisation won't be easy to achieve here. We have
+ * three events that control USB requests submission:
+@@ -193,14 +206,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+
+ video->encode(req, video, buf);
+
+- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) {
+- printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(ep);
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&video->queue.irqlock, flags);
++
++ if (ret < 0) {
+ uvcg_queue_cancel(queue, 0);
+ goto requeue;
+ }
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
+
+ return;
+
+@@ -320,15 +332,13 @@ int uvcg_video_pump(struct uvc_video *video)
+ video->encode(req, video, buf);
+
+ /* Queue the USB request */
+- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&queue->irqlock, flags);
++
+ if (ret < 0) {
+- printk(KERN_INFO "Failed to queue request (%d)\n", ret);
+- usb_ep_set_halt(video->ep);
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ uvcg_queue_cancel(queue, 0);
+ break;
+ }
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ }
+
+ spin_lock_irqsave(&video->req_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From f0cb00592528e85a2364835ce08ac4033ae7f5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:44:57 +0300
+Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ]
+
+When USB requests for video data fail to be submitted, the driver
+signals a problem to the host by halting the video streaming endpoint.
+This is only valid in bulk mode, as isochronous transfers have no
+handshake phase and can't thus report a stall. The usb_ep_set_halt()
+call returns an error when using isochronous endpoints, which we happily
+ignore, but some UDCs complain in the kernel log. Fix this by only
+trying to halt the endpoint in bulk mode.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 540917f54506a..d6bab12b0b47d 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -136,7 +136,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
+ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
+ if (ret < 0) {
+ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(video->ep);
++ /* Isochronous endpoints can't be halted. */
++ if (usb_endpoint_xfer_bulk(video->ep->desc))
++ usb_ep_set_halt(video->ep);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 7dd5d4e60e8a06487b3870c4e4994668475d7f21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len
+
+From: Li Qiang <liq3ea@gmail.com>
+
+[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ]
+
+Free allocated vdev->msi_perm in error path.
+
+Signed-off-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index c55c632a3b249..ad5929fbceb16 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1130,8 +1130,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
+ return -ENOMEM;
+
+ ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
+- if (ret)
++ if (ret) {
++ kfree(vdev->msi_perm);
+ return ret;
++ }
+
+ return len;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1ff2f218e37531ff9ebb2ec1e3854f104961ecb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:40 -0400
+Subject: x86/CPU: Use correct macros for Cyrix calls
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ]
+
+There are comments in processor-cyrix.h advising you to _not_ make calls
+using the deprecated macros in this style:
+
+ setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
+
+This is because it expands the macro into a non-functioning calling
+sequence. The calling order must be:
+
+ outb(CX86_CCR2, 0x22);
+ inb(0x23);
+
+From the comments:
+
+ * When using the old macros a line like
+ * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+ * gets expanded to:
+ * do {
+ * outb((CX86_CCR2), 0x22);
+ * outb((({
+ * outb((CX86_CCR2), 0x22);
+ * inb(0x23);
+ * }) | 0x88), 0x23);
+ * } while (0);
+
+The new macros fix this problem, so use them instead.
+
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jia Zhang <qianyue.zj@alibaba-inc.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/cyrix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index 6e4e4191abb56..151625a83d9e2 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -433,7 +433,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c)
+ /* enable MAPEN */
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);
+ /* enable cpuid */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80);
+ /* disable MAPEN */
+ setCx86(CX86_CCR3, ccr3);
+ local_irq_restore(flags);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
