--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Eric Biggers <ebiggers3@gmail.com>
+Date: Fri, 8 Dec 2017 15:13:28 +0000
+Subject: 509: fix printing uninitialized stack memory when OID is empty
+
+From: Eric Biggers <ebiggers3@gmail.com>
+
+
+[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ]
+
+Callers of sprint_oid() do not check its return value before printing
+the result. In the case where the OID is zero-length, -EBADMSG was
+being returned without anything being written to the buffer, resulting
+in uninitialized stack memory being printed. Fix this by writing
+"(bad)" to the buffer in the cases where -EBADMSG is returned.
+
+Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/oid_registry.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/lib/oid_registry.c
++++ b/lib/oid_registry.c
+@@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t
+ int count;
+
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+
+ n = *v++;
+ ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
+@@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t
+ num = n & 0x7f;
+ do {
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+ n = *v++;
+ num <<= 7;
+ num |= n & 0x7f;
+@@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t
+ }
+
+ return ret;
++
++bad:
++ snprintf(buffer, bufsize, "(bad)");
++ return -EBADMSG;
+ }
+ EXPORT_SYMBOL_GPL(sprint_oid);
+
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Keerthy <j-keerthy@ti.com>
+Date: Fri, 10 Nov 2017 16:56:52 +0530
+Subject: ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
+
+From: Keerthy <j-keerthy@ti.com>
+
+
+[ Upstream commit b6d6af7226465b6d11eac09d0be2ab78a4a9eb62 ]
+
+Referring TRM Am335X series:
+http://www.ti.com/lit/ug/spruh73p/spruh73p.pdf
+
+The LastPowerStateEntered bitfield is present only for PM_CEFUSE
+domain. This is not present in any of the other power domains. Hence
+remove the generic am33xx_pwrdm_read_prev_pwrst hook which wrongly
+reads the reserved bit fields for all the other power domains.
+
+Reading the reserved bits leads to wrongly interpreting the low
+power transitions for various power domains that do not have the
+LastPowerStateEntered field. The pm debug counters values are wrong
+currently as we are incrementing them based on the reserved bits.
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/prm33xx.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/arch/arm/mach-omap2/prm33xx.c
++++ b/arch/arm/mach-omap2/prm33xx.c
+@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struc
+ return v;
+ }
+
+-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm)
+-{
+- u32 v;
+-
+- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs);
+- v &= AM33XX_LASTPOWERSTATEENTERED_MASK;
+- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT;
+-
+- return v;
+-}
+-
+ static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm)
+ {
+ am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK,
+@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations
+ .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst,
+ .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst,
+ .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst,
+- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst,
+ .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst,
+ .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst,
+ .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst,
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 1 Nov 2017 11:03:31 +0200
+Subject: ARM: dts: am4372: Correct the interrupts_properties of McASP
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit 627395a6f8091c0aa18f49dca7df59ba3ec147ef ]
+
+Fixes the following warnings:
+
+arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property):
+interrupts size is (8), expected multiple of 12 in
+/ocp@44000000/mcasp@48038000
+
+arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property):
+interrupts size is (8), expected multiple of 12 in
+/ocp@44000000/mcasp@4803C000
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am4372.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -926,7 +926,8 @@
+ reg = <0x48038000 0x2000>,
+ <0x46000000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <80>, <81>;
++ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 8 2>,
+@@ -940,7 +941,8 @@
+ reg = <0x4803C000 0x2000>,
+ <0x46400000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <82>, <83>;
++ interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 10 2>,
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 1 Nov 2017 11:03:40 +0200
+Subject: ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit ca41e244517d6d3f1600c229ff7ca615049c1e9c ]
+
+The DMA binding for eDMA needs 2 parameters, not 1.
+The second, missing parameter is the tptc to be used for the channel.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am437x-cm-t43.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/am437x-cm-t43.dts
++++ b/arch/arm/boot/dts/am437x-cm-t43.dts
+@@ -301,8 +301,8 @@
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&spi0_pins>;
+- dmas = <&edma 16
+- &edma 17>;
++ dmas = <&edma 16 0
++ &edma 17 0>;
+ dma-names = "tx0", "rx0";
+
+ flash: w25q64cvzpig@0 {
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 4 Dec 2017 08:27:17 -0800
+Subject: ARM: dts: Fix elm interrupt compiler warning
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit d364b038bc962f494cffb8f6cb6cddbe41bcb5b6 ]
+
+Looks like the interrupt property is missing the controller and level
+information causing:
+
+Warning (interrupts_property): interrupts size is (4), expected multiple
+of 12 in /ocp/elm@48078000
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -352,7 +352,7 @@
+ elm: elm@48078000 {
+ compatible = "ti,am3352-elm";
+ reg = <0x48078000 0x2000>;
+- interrupts = <4>;
++ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "elm";
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Fri, 17 Nov 2017 08:56:58 -0800
+Subject: ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit cf87634c8b24e24bf379b8c6807c8b0fb5f23567 ]
+
+There's been a reproducable USB OHCI/EHCI cpuidle related hang on omap4
+for a while that happens after about 20 - 40 minutes on an idle system
+with some data feeding device being connected, like a USB GPS device or
+a cellular modem.
+
+This issue happens in cpuidle states C2 and C3 and does not happen if
+cpuidle is limited to C1 state only. The symptoms are that the whole
+system hangs and never wakes up from idle, and if a watchdog is
+configured the system reboots after a while.
+
+Turns out that OHCI/EHCI devices on omap4 are trying to use the GIC
+interrupt controller directly as a parent instead of the WUGEN. We
+need to pass the interrupts through WUGEN to GIC to provide the wakeup
+events for the processor.
+
+Let's fix the issue by removing the gic interrupt-parent and use the
+default interrupt-parent wakeupgen instead. Note that omap5.dtsi had
+this already fixes earlier by commit 7136d457f365 ("ARM: omap: convert
+wakeupgen to stacked domains") but we somehow missed omap4 at that
+point.
+
+Fixes: 7136d457f365 ("ARM: omap: convert wakeupgen to stacked domains")
+Cc: Dave Gerlach <d-gerlach@ti.com>
+Cc: Nishanth Menon <nm@ti.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Reviewed-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -859,14 +859,12 @@
+ usbhsohci: ohci@4a064800 {
+ compatible = "ti,ohci-omap3";
+ reg = <0x4a064800 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ usbhsehci: ehci@4a064c00 {
+ compatible = "ti,ehci-omap";
+ reg = <0x4a064c00 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 31 Oct 2017 13:42:13 -0500
+Subject: ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
+
+From: Adam Ford <aford173@gmail.com>
+
+
+[ Upstream commit 3c18bbf3d11d2005da08b57ff26f44ff1c2b12d0 ]
+
+This patch fixes and issue where the NAND and GPMC based ethernet
+controller stopped working. This also updates the GPMC settings
+to be consistent with the Logic PD Torpedo development from the
+commit listed above.
+
+Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 3 ++-
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+@@ -72,7 +72,8 @@
+ };
+
+ &gpmc {
+- ranges = <1 0 0x08000000 0x1000000>; /* CS1: 16MB for LAN9221 */
++ ranges = <0 0 0x30000000 0x1000000 /* CS0: 16MB for NAND */
++ 1 0 0x2c000000 0x1000000>; /* CS1: 16MB for LAN9221 */
+
+ ethernet@gpmc {
+ pinctrl-names = "default";
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -37,7 +37,7 @@
+ };
+
+ &gpmc {
+- ranges = <0 0 0x00000000 0x1000000>; /* CS0: 16MB for NAND */
++ ranges = <0 0 0x30000000 0x1000000>; /* CS0: 16MB for NAND */
+
+ nand@0,0 {
+ compatible = "ti,omap2-nand";
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 31 Oct 2017 13:45:59 -0500
+Subject: ARM: dts: logicpd-somlv: Fix wl127x pinmux
+
+From: Adam Ford <aford173@gmail.com>
+
+
+[ Upstream commit cd7594ac3281722cb8f10d6f6c7e4287747c7a9d ]
+
+The pin assignment for the wl127x interrupt was incorrect. I am
+not sure how this every worked. This also eliminates a conflict with
+the SMC911x ethernet driver and properly moves pinmuxes for the
+related gpio to omap3_pmx_wkup from omap3_pmx_core.
+
+Fixes: ab8dd3aed011 ("ARM: DTS: Add minimal Support for Logic PD
+DM3730 SOM-LV")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -121,7 +121,7 @@
+
+ &mmc3 {
+ interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+- pinctrl-0 = <&mmc3_pins>;
++ pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
+ pinctrl-names = "default";
+ vmmc-supply = <&wl12xx_vmmc>;
+ non-removable;
+@@ -132,8 +132,8 @@
+ wlcore: wlcore@2 {
+ compatible = "ti,wl1273";
+ reg = <2>;
+- interrupt-parent = <&gpio5>;
+- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */
++ interrupt-parent = <&gpio1>;
++ interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */
+ ref-clock-frequency = <26000000>;
+ };
+ };
+@@ -157,8 +157,6 @@
+ OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
+ OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */
+ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */
+- OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */
+- OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */
+ >;
+@@ -228,6 +226,12 @@
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */
+ >;
+ };
++ wl127x_gpio: pinmux_wl127x_gpio_pin {
++ pinctrl-single,pins = <
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 27 Nov 2017 08:57:26 -0800
+Subject: ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit d09220a887f70368afa79e850c95e74890c0a32d ]
+
+With the CMA changes from Joonsoo Kim <iamjoonsoo.kim@lge.com>, it
+was noticed that n900 stopped booting. After investigating it turned
+out that n900 save_secure_ram_context does some whacky virtual to
+physical address translation for the SRAM data address.
+
+As we now only have minimal parts of omap3 idle code copied to SRAM,
+running save_secure_ram_context() in SRAM is not needed. It only gets
+called on PM init. And it seems there's no need to ever call this from
+SRAM idle code.
+
+So let's just keep save_secure_ram_context() in DDR, and pass it the
+physical address of the parameters. We can do everything else in
+omap-secure.c like we already do for other secure code.
+
+And since we don't have any documentation, I still have no clue what
+the values for 0, 1 and 1 for the parameters might be. If somebody has
+figured it out, please do send a patch to add some comments.
+
+Debugged-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap-secure.c | 19 +++++++++++++++++++
+ arch/arm/mach-omap2/omap-secure.h | 4 ++++
+ arch/arm/mach-omap2/pm.h | 4 ----
+ arch/arm/mach-omap2/pm34xx.c | 13 ++++---------
+ arch/arm/mach-omap2/sleep34xx.S | 26 ++++----------------------
+ 5 files changed, 31 insertions(+), 35 deletions(-)
+
+--- a/arch/arm/mach-omap2/omap-secure.c
++++ b/arch/arm/mach-omap2/omap-secure.c
+@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base
+ return omap_secure_memblock_base;
+ }
+
++u32 omap3_save_secure_ram(void __iomem *addr, int size)
++{
++ u32 ret;
++ u32 param[5];
++
++ if (size != OMAP3_SAVE_SECURE_RAM_SZ)
++ return OMAP3_SAVE_SECURE_RAM_SZ;
++
++ param[0] = 4; /* Number of arguments */
++ param[1] = __pa(addr); /* Physical address for saving */
++ param[2] = 0;
++ param[3] = 1;
++ param[4] = 1;
++
++ ret = save_secure_ram_context(__pa(param));
++
++ return ret;
++}
++
+ /**
+ * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
+ * @idx: The PPA API index
+--- a/arch/arm/mach-omap2/omap-secure.h
++++ b/arch/arm/mach-omap2/omap-secure.h
+@@ -31,6 +31,8 @@
+ /* Maximum Secure memory storage size */
+ #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K)
+
++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F
++
+ /* Secure low power HAL API index */
+ #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a
+ #define OMAP4_HAL_SAVEHW_INDEX 0x1b
+@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u
+ extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs);
+ extern phys_addr_t omap_secure_ram_mempool_base(void);
+ extern int omap_secure_ram_reserve_memblock(void);
++extern u32 save_secure_ram_context(u32 args_pa);
++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size);
+
+ extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs,
+ u32 arg1, u32 arg2, u32 arg3, u32 arg4);
+--- a/arch/arm/mach-omap2/pm.h
++++ b/arch/arm/mach-omap2/pm.h
+@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz;
+ /* ... and its pointer from SRAM after copy */
+ extern void (*omap3_do_wfi_sram)(void);
+
+-/* save_secure_ram_context function pointer and size, for copy to SRAM */
+-extern int save_secure_ram_context(u32 *addr);
+-extern unsigned int save_secure_ram_context_sz;
+-
+ extern void omap3_save_scratchpad_contents(void);
+
+ #define PM_RTA_ERRATUM_i608 (1 << 0)
+--- a/arch/arm/mach-omap2/pm34xx.c
++++ b/arch/arm/mach-omap2/pm34xx.c
+@@ -48,6 +48,7 @@
+ #include "prm3xxx.h"
+ #include "pm.h"
+ #include "sdrc.h"
++#include "omap-secure.h"
+ #include "sram.h"
+ #include "control.h"
+ #include "vc.h"
+@@ -66,7 +67,6 @@ struct power_state {
+
+ static LIST_HEAD(pwrst_list);
+
+-static int (*_omap_save_secure_sram)(u32 *addr);
+ void (*omap3_do_wfi_sram)(void);
+
+ static struct powerdomain *mpu_pwrdm, *neon_pwrdm;
+@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_contex
+ * will hang the system.
+ */
+ pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
+- ret = _omap_save_secure_sram((u32 *)(unsigned long)
+- __pa(omap3_secure_ram_storage));
++ ret = omap3_save_secure_ram(omap3_secure_ram_storage,
++ OMAP3_SAVE_SECURE_RAM_SZ);
+ pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
+ /* Following is for error tracking, it should not happen */
+ if (ret) {
+@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct po
+ *
+ * The minimum set of functions is pushed to SRAM for execution:
+ * - omap3_do_wfi for erratum i581 WA,
+- * - save_secure_ram_context for security extensions.
+ */
+ void omap_push_sram_idle(void)
+ {
+ omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz);
+-
+- if (omap_type() != OMAP2_DEVICE_TYPE_GP)
+- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context,
+- save_secure_ram_context_sz);
+ }
+
+ static void __init pm_errata_configure(void)
+@@ -554,7 +549,7 @@ int __init omap3_pm_init(void)
+ clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
+ if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
+ omap3_secure_ram_storage =
+- kmalloc(0x803F, GFP_KERNEL);
++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL);
+ if (!omap3_secure_ram_storage)
+ pr_err("Memory allocation failed when allocating for secure sram context\n");
+
+--- a/arch/arm/mach-omap2/sleep34xx.S
++++ b/arch/arm/mach-omap2/sleep34xx.S
+@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_resto
+ ENDPROC(enable_omap3630_toggle_l2_on_restore)
+
+ /*
+- * Function to call rom code to save secure ram context. This gets
+- * relocated to SRAM, so it can be all in .data section. Otherwise
+- * we need to initialize api_params separately.
++ * Function to call rom code to save secure ram context.
++ *
++ * r0 = physical address of the parameters
+ */
+- .data
+- .align 3
+ ENTRY(save_secure_ram_context)
+ stmfd sp!, {r4 - r11, lr} @ save registers on stack
+- adr r3, api_params @ r3 points to parameters
+- str r0, [r3,#0x4] @ r0 has sdram address
+- ldr r12, high_mask
+- and r3, r3, r12
+- ldr r12, sram_phy_addr_mask
+- orr r3, r3, r12
++ mov r3, r0 @ physical address of parameters
+ mov r0, #25 @ set service ID for PPA
+ mov r12, r0 @ copy secure service ID in r12
+ mov r1, #0 @ set task id for ROM code in r1
+@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context)
+ nop
+ nop
+ ldmfd sp!, {r4 - r11, pc}
+- .align
+-sram_phy_addr_mask:
+- .word SRAM_BASE_P
+-high_mask:
+- .word 0xffff
+-api_params:
+- .word 0x4, 0x0, 0x0, 0x1, 0x1
+ ENDPROC(save_secure_ram_context)
+-ENTRY(save_secure_ram_context_sz)
+- .word . - save_secure_ram_context
+-
+- .text
+
+ /*
+ * ======================
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Date: Wed, 6 Dec 2017 16:03:24 +0100
+Subject: ASoC: rockchip: disable clock on error
+
+From: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+
+
+[ Upstream commit c7b92172a61b91936be985cb9bc499a4ebc6489b ]
+
+Disable the clocks in rk_spdif_probe when an error occurs after one
+of the clocks has been enabled previously.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: f874b80e1571 ASoC: rockchip: Add rockchip SPDIF transceiver driver
+Signed-off-by: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/rockchip/rockchip_spdif.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/rockchip/rockchip_spdif.c
++++ b/sound/soc/rockchip/rockchip_spdif.c
+@@ -318,26 +318,30 @@ static int rk_spdif_probe(struct platfor
+ spdif->mclk = devm_clk_get(&pdev->dev, "mclk");
+ if (IS_ERR(spdif->mclk)) {
+ dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n");
+- return PTR_ERR(spdif->mclk);
++ ret = PTR_ERR(spdif->mclk);
++ goto err_disable_hclk;
+ }
+
+ ret = clk_prepare_enable(spdif->mclk);
+ if (ret) {
+ dev_err(spdif->dev, "clock enable failed %d\n", ret);
+- return ret;
++ goto err_disable_clocks;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(regs))
+- return PTR_ERR(regs);
++ if (IS_ERR(regs)) {
++ ret = PTR_ERR(regs);
++ goto err_disable_clocks;
++ }
+
+ spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs,
+ &rk_spdif_regmap_config);
+ if (IS_ERR(spdif->regmap)) {
+ dev_err(&pdev->dev,
+ "Failed to initialise managed register map\n");
+- return PTR_ERR(spdif->regmap);
++ ret = PTR_ERR(spdif->regmap);
++ goto err_disable_clocks;
+ }
+
+ spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR;
+@@ -369,6 +373,10 @@ static int rk_spdif_probe(struct platfor
+
+ err_pm_runtime:
+ pm_runtime_disable(&pdev->dev);
++err_disable_clocks:
++ clk_disable_unprepare(spdif->mclk);
++err_disable_hclk:
++ clk_disable_unprepare(spdif->hclk);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 23 Nov 2017 17:57:04 +0200
+Subject: brcmfmac: Avoid build error with make W=1
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit 51ef7925e10688c57186d438e784532e063492e4 ]
+
+When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
+the first run, all next ones are okay.
+
+ CC [M] drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
+
+Seems like something happened with W=1 and wrong kernel doc format.
+As a quick fix remove dubious /** in the code.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2049,7 +2049,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
+ return head_pad;
+ }
+
+-/**
++/*
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Fri, 1 Dec 2017 11:19:42 +0200
+Subject: btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+
+[ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ]
+
+The name char array passed to btrfs_search_path_in_tree is of size
+BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes
+are in the range of [0, 4079]. Currently the code uses the define but this
+represents an off-by-one.
+
+Implications:
+
+Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be
+written to extra space, not some padding that could be provided by the
+allocator.
+
+btrfs-progs store the arguments on stack, but kernel does own copy of
+the ioctl buffer and the off-by-one overwrite does not affect userspace,
+but the ending 0 might be lost.
+
+Kernel ioctl buffer is allocated dynamically so we're overwriting
+somebody else's memory, and the ioctl is privileged if args.objectid is
+not 256. Which is in most cases, but resolving a subvolume stored in
+another directory will trigger that path.
+
+Before this patch the buffer was one byte larger, but then the -1 was
+not added.
+
+Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls")
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ added implications ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2244,7 +2244,7 @@ static noinline int btrfs_search_path_in
+ if (!path)
+ return -ENOMEM;
+
+- ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
++ ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1];
+
+ key.objectid = tree_id;
+ key.type = BTRFS_ROOT_ITEM_KEY;
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Cai Li <cai.li@spreadtrum.com>
+Date: Tue, 21 Nov 2017 17:24:38 +0800
+Subject: clk: fix a panic error caused by accessing NULL pointer
+
+From: Cai Li <cai.li@spreadtrum.com>
+
+
+[ Upstream commit 975b820b6836b6b6c42fb84cd2e772e2b41bca67 ]
+
+In some cases the clock parent would be set NULL when doing re-parent,
+it will cause a NULL pointer accessing if clk_set trace event is
+enabled.
+
+This patch sets the parent as "none" if the input parameter is NULL.
+
+Fixes: dfc202ead312 (clk: Add tracepoints for hardware operations)
+Signed-off-by: Cai Li <cai.li@spreadtrum.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/events/clk.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/trace/events/clk.h
++++ b/include/trace/events/clk.h
+@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent,
+
+ TP_STRUCT__entry(
+ __string( name, core->name )
+- __string( pname, parent->name )
++ __string( pname, parent ? parent->name : "none" )
+ ),
+
+ TP_fast_assign(
+ __assign_str(name, core->name);
+- __assign_str(pname, parent->name);
++ __assign_str(pname, parent ? parent->name : "none");
+ ),
+
+ TP_printk("%s %s", __get_str(name), __get_str(pname))
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+Date: Mon, 20 Nov 2017 08:28:14 -0600
+Subject: dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
+
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+
+
+[ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ]
+
+_xt_ is being dereferenced before it is null checked, hence there is a
+potential null pointer dereference.
+
+Fix this by moving the pointer dereference after _xt_ has been null
+checked.
+
+This issue was detected with the help of Coccinelle.
+
+Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
+Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -709,7 +709,7 @@ atc_prep_dma_interleaved(struct dma_chan
+ unsigned long flags)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
+- struct data_chunk *first = xt->sgl;
++ struct data_chunk *first;
+ struct at_desc *desc = NULL;
+ size_t xfer_count;
+ unsigned int dwidth;
+@@ -721,6 +721,8 @@ atc_prep_dma_interleaved(struct dma_chan
+ if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
+ return NULL;
+
++ first = xt->sgl;
++
+ dev_info(chan2dev(chan),
+ "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+ __func__, &xt->src_start, &xt->dst_start, xt->numf,
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 17 Nov 2017 22:37:53 +0100
+Subject: dmaengine: ioat: Fix error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 5c9afbda911ce20b3f2181d1e440a0222e1027dd ]
+
+If the last test in 'ioat_dma_self_test()' fails, we must release all
+the allocated resources and not just part of them.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ioat/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -388,7 +388,7 @@ static int ioat_dma_self_test(struct ioa
+ if (memcmp(src, dest, IOAT_TEST_SIZE)) {
+ dev_err(dev, "Self-test copy failed compare, disabling\n");
+ err = -ENODEV;
+- goto free_resources;
++ goto unmap_dma;
+ }
+
+ unmap_dma:
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Date: Wed, 6 Dec 2017 14:28:27 +0100
+Subject: dmaengine: jz4740: disable/unprepare clk if probe fails
+
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+
+
+[ Upstream commit eb9436966fdc84cebdf222952a99898ab46d9bb0 ]
+
+in error path of jz4740_dma_probe(), call clk_disable_unprepare() to clean
+up.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 25ce6c35fea0 MIPS: jz4740: Remove custom DMA API
+Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dma-jz4740.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dma-jz4740.c
++++ b/drivers/dma/dma-jz4740.c
+@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platf
+
+ ret = dma_async_device_register(dd);
+ if (ret)
+- return ret;
++ goto err_clk;
+
+ irq = platform_get_irq(pdev, 0);
+ ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
+@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platf
+
+ err_unregister:
+ dma_async_device_unregister(dd);
++err_clk:
++ clk_disable_unprepare(dmadev->clk);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 8 Dec 2017 12:16:22 +0000
+Subject: drm/armada: fix leak of crtc structure
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 33cd3c07a976e11c3c4cc6b0b3db6760ad1590c5 ]
+
+Fix the leak of the CRTC structure in the failure paths of
+armada_drm_crtc_create().
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/armada/armada_crtc.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/armada/armada_crtc.c
++++ b/drivers/gpu/drm/armada/armada_crtc.c
+@@ -1178,17 +1178,13 @@ static int armada_drm_crtc_create(struct
+
+ ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
+ dcrtc);
+- if (ret < 0) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret < 0)
++ goto err_crtc;
+
+ if (dcrtc->variant->init) {
+ ret = dcrtc->variant->init(dcrtc, dev);
+- if (ret) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret)
++ goto err_crtc;
+ }
+
+ /* Ensure AXI pipeline is enabled */
+@@ -1199,13 +1195,15 @@ static int armada_drm_crtc_create(struct
+ dcrtc->crtc.port = port;
+
+ primary = kzalloc(sizeof(*primary), GFP_KERNEL);
+- if (!primary)
+- return -ENOMEM;
++ if (!primary) {
++ ret = -ENOMEM;
++ goto err_crtc;
++ }
+
+ ret = armada_drm_plane_init(primary);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_universal_plane_init(drm, &primary->base, 0,
+@@ -1215,7 +1213,7 @@ static int armada_drm_crtc_create(struct
+ DRM_PLANE_TYPE_PRIMARY, NULL);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL,
+@@ -1234,6 +1232,9 @@ static int armada_drm_crtc_create(struct
+
+ err_crtc_init:
+ primary->base.funcs->destroy(&primary->base);
++err_crtc:
++ kfree(dcrtc);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+Date: Thu, 7 Dec 2017 18:44:23 +0200
+Subject: gianfar: Disable EEE autoneg by default
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+
+[ Upstream commit b6b5e8a691185606dfffff3198c89e3b4fd9d4f6 ]
+
+This controller does not support EEE, but it may connect to a PHY
+which supports EEE and advertises EEE by default, while its link
+partner also advertises EEE. If this happens, the PHY enters low
+power mode when the traffic rate is low and causes packet loss.
+This patch disables EEE advertisement by default for any PHY that
+gianfar connects to, to prevent the above unwanted outcome.
+
+Signed-off-by: Shaohui Xie <Shaohui.Xie@nxp.com>
+Tested-by: Yangbo Lu <Yangbo.lu@nxp.com>
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1789,6 +1789,7 @@ static int init_phy(struct net_device *d
+ GFAR_SUPPORTED_GBIT : 0;
+ phy_interface_t interface;
+ struct phy_device *phydev;
++ struct ethtool_eee edata;
+
+ priv->oldlink = 0;
+ priv->oldspeed = 0;
+@@ -1813,6 +1814,10 @@ static int init_phy(struct net_device *d
+ /* Add support for flow control, but don't advertise it by default */
+ phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause);
+
++ /* disable EEE autoneg, EEE not supported by eTSEC */
++ memset(&edata, 0, sizeof(struct ethtool_eee));
++ phy_ethtool_set_eee(phydev, &edata);
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Zumeng Chen <zumeng.chen@gmail.com>
+Date: Mon, 4 Dec 2017 11:22:02 +0800
+Subject: gianfar: fix a flooded alignment reports because of padding issue.
+
+From: Zumeng Chen <zumeng.chen@gmail.com>
+
+
+[ Upstream commit 58117672943734715bbe7565ac9f062effa524f0 ]
+
+According to LS1021A RM, the value of PAL can be set so that the start of the
+IP header in the receive data buffer is aligned to a 32-bit boundary. Normally,
+setting PAL = 2 provides minimal padding to ensure such alignment of the IP
+header.
+
+However every incoming packet's 8-byte time stamp will be inserted into the
+packet data buffer as padding alignment bytes when hardware time stamping is
+enabled.
+
+So we set the padding 8+2 here to avoid the flooded alignment faults:
+
+root@128:~# cat /proc/cpu/alignment
+User: 0
+System: 17539 (inet_gro_receive+0x114/0x2c0)
+Skipped: 0
+Half: 0
+Word: 0
+DWord: 0
+Multi: 17539
+User faults: 2 (fixup)
+
+Also shown when exception report enablement
+
+CPU: 0 PID: 161 Comm: irq/66-eth1_g0_ Not tainted 4.1.21-rt13-WR8.0.0.0_preempt-rt #16
+Hardware name: Freescale LS1021A
+[<8001b420>] (unwind_backtrace) from [<8001476c>] (show_stack+0x20/0x24)
+[<8001476c>] (show_stack) from [<807cfb48>] (dump_stack+0x94/0xac)
+[<807cfb48>] (dump_stack) from [<80025d70>] (do_alignment+0x720/0x958)
+[<80025d70>] (do_alignment) from [<80009224>] (do_DataAbort+0x40/0xbc)
+[<80009224>] (do_DataAbort) from [<80015398>] (__dabt_svc+0x38/0x60)
+Exception stack(0x86ad1cc0 to 0x86ad1d08)
+1cc0: f9b3e080 86b3d072 2d78d287 00000000 866816c0 86b3d05e 86e785d0 00000000
+1ce0: 00000011 0000000e 80840ab0 86ad1d3c 86ad1d08 86ad1d08 806d7fc0 806d806c
+1d00: 40070013 ffffffff
+[<80015398>] (__dabt_svc) from [<806d806c>] (inet_gro_receive+0x114/0x2c0)
+[<806d806c>] (inet_gro_receive) from [<80660eec>] (dev_gro_receive+0x21c/0x3c0)
+[<80660eec>] (dev_gro_receive) from [<8066133c>] (napi_gro_receive+0x44/0x17c)
+[<8066133c>] (napi_gro_receive) from [<804f0538>] (gfar_clean_rx_ring+0x39c/0x7d4)
+[<804f0538>] (gfar_clean_rx_ring) from [<804f0bf4>] (gfar_poll_rx_sq+0x58/0xe0)
+[<804f0bf4>] (gfar_poll_rx_sq) from [<80660b10>] (net_rx_action+0x27c/0x43c)
+[<80660b10>] (net_rx_action) from [<80033638>] (do_current_softirqs+0x1e0/0x3dc)
+[<80033638>] (do_current_softirqs) from [<800338c4>] (__local_bh_enable+0x90/0xa8)
+[<800338c4>] (__local_bh_enable) from [<8008025c>] (irq_forced_thread_fn+0x70/0x84)
+[<8008025c>] (irq_forced_thread_fn) from [<800805e8>] (irq_thread+0x16c/0x244)
+[<800805e8>] (irq_thread) from [<8004e490>] (kthread+0xe8/0x104)
+[<8004e490>] (kthread) from [<8000fda8>] (ret_from_fork+0x14/0x2c)
+
+Signed-off-by: Zumeng Chen <zumeng.chen@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1375,9 +1375,11 @@ static int gfar_probe(struct platform_de
+
+ gfar_init_addr_hash_table(priv);
+
+- /* Insert receive time stamps into padding alignment bytes */
++ /* Insert receive time stamps into padding alignment bytes, and
++ * plus 2 bytes padding to ensure the cpu alignment.
++ */
+ if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+- priv->padding = 8;
++ priv->padding = 8 + DEFAULT_PADDING;
+
+ if (dev->features & NETIF_F_IP_CSUM ||
+ priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Jia-Ju Bai <baijiaju1990@163.com>
+Date: Tue, 12 Dec 2017 16:49:52 +0800
+Subject: hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
+
+From: Jia-Ju Bai <baijiaju1990@163.com>
+
+
+[ Upstream commit 6e266610eb6553cfb7e7eb5d11914bd01509c406 ]
+
+The driver may sleep under a spinlock.
+The function call path is:
+rr_close (acquire the spinlock)
+ free_irq --> may sleep
+
+To fix it, free_irq is moved to the place without holding the spinlock.
+
+This bug is found by my static analysis tool(DSAC) and checked by my code review.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hippi/rrunner.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *d
+ rrpriv->info_dma);
+ rrpriv->info = NULL;
+
+- free_irq(pdev->irq, dev);
+ spin_unlock_irqrestore(&rrpriv->lock, flags);
++ free_irq(pdev->irq, dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+Date: Tue, 21 Nov 2017 16:18:32 -0600
+Subject: i40iw: Correct ARP index mask
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+
+[ Upstream commit a283cdc4d3670700182c820b59078387f9a01a30 ]
+
+The ARP table entry indexes are aliased to 12bits
+instead of the intended 16bits when uploaded to
+the QP Context. This will present an issue when the
+number of connections exceeds 4096 as ARP entries are
+reused. Fix this by adjusting the mask to account for
+the full 16bits.
+
+Fixes: 4e9042e647ff ("i40iw: add hw and utils files")
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_d.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
+@@ -1102,7 +1102,7 @@
+ #define I40IWQPC_VLANTAG_MASK (0xffffULL << I40IWQPC_VLANTAG_SHIFT)
+
+ #define I40IWQPC_ARPIDX_SHIFT 48
+-#define I40IWQPC_ARPIDX_MASK (0xfffULL << I40IWQPC_ARPIDX_SHIFT)
++#define I40IWQPC_ARPIDX_MASK (0xffffULL << I40IWQPC_ARPIDX_SHIFT)
+
+ #define I40IWQPC_FLOWLABEL_SHIFT 0
+ #define I40IWQPC_FLOWLABEL_MASK (0xfffffUL << I40IWQPC_FLOWLABEL_SHIFT)
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Gao Feng <gfree.wind@vip.163.com>
+Date: Fri, 1 Dec 2017 09:58:42 +0800
+Subject: ipvlan: Add the skb->mark as flow4's member to lookup route
+
+From: Gao Feng <gfree.wind@vip.163.com>
+
+
+[ Upstream commit a98a4ebc8c61d20f0150d6be66e0e65223a347af ]
+
+Current codes don't use skb->mark to assign flowi4_mark, it would
+make the policy route rule with fwmark doesn't work as expected.
+
+Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -370,6 +370,7 @@ static int ipvlan_process_v4_outbound(st
+ .flowi4_oif = dev->ifindex,
+ .flowi4_tos = RT_TOS(ip4h->tos),
+ .flowi4_flags = FLOWI_FLAG_ANYSRC,
++ .flowi4_mark = skb->mark,
+ .daddr = ip4h->daddr,
+ .saddr = ip4h->saddr,
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Greg Ungerer <gerg@linux-m68k.org>
+Date: Tue, 14 Nov 2017 11:50:07 +1000
+Subject: m68k: add missing SOFTIRQENTRY_TEXT linker section
+
+From: Greg Ungerer <gerg@linux-m68k.org>
+
+
+[ Upstream commit 969de0988b77e5a57aac2f7270191a3c50540c52 ]
+
+Commit be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries
+into separate sections") added a new linker section, SOFTIRQENTRY_TEXT,
+to the linker scripts for most architectures. It didn't add it to any of
+the linker scripts for the m68k architecture. This was not really a problem
+because it is only defined if either of CONFIG_FUNCTION_GRAPH_TRACER or
+CONFIG_KASAN are enabled - which can never be true for m68k.
+
+However commit 229a71860547 ("irq: Make the irqentry text section
+unconditional") means that SOFTIRQENTRY_TEXT is now always defined. So on
+m68k we now end up with a separate ELF section for .softirqentry.text
+instead of it being part of the .text section. On some m68k targets in some
+configurations this can also cause a fatal link error:
+
+ LD vmlinux
+/usr/local/bin/../m68k-uclinux/bin/ld.real: section .softirqentry.text loaded at [0000000010de10c0,0000000010de12dd] overlaps section .rodata loaded at [0000000010de10c0,0000000010e0fd67]
+
+To fix add in the missing SOFTIRQENTRY_TEXT section into the m68k linker
+scripts. I noticed that m68k is also missing the IRQENTRY_TEXT section,
+so this patch also adds an entry for that too.
+
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/kernel/vmlinux-nommu.lds | 2 ++
+ arch/m68k/kernel/vmlinux-std.lds | 2 ++
+ arch/m68k/kernel/vmlinux-sun3.lds | 2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/arch/m68k/kernel/vmlinux-nommu.lds
++++ b/arch/m68k/kernel/vmlinux-nommu.lds
+@@ -44,6 +44,8 @@ SECTIONS {
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+--- a/arch/m68k/kernel/vmlinux-std.lds
++++ b/arch/m68k/kernel/vmlinux-std.lds
+@@ -15,6 +15,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+--- a/arch/m68k/kernel/vmlinux-sun3.lds
++++ b/arch/m68k/kernel/vmlinux-sun3.lds
+@@ -15,6 +15,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Wed, 29 Nov 2017 08:44:41 -0500
+Subject: media: s5k6aa: describe some function parameters
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+
+[ Upstream commit 070250a1715cee2297de0d9e7e2cea58be999d37 ]
+
+as warned:
+ drivers/media/i2c/s5k6aa.c:429: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:679: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 'preset'
+ drivers/media/i2c/s5k6aa.c:787: warning: No description found for parameter 'sd'
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/s5k6aa.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/media/i2c/s5k6aa.c
++++ b/drivers/media/i2c/s5k6aa.c
+@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct
+
+ /**
+ * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ *
+ * Configure the internal ISP PLL for the required output frequency.
+ * Locking: called with s5k6aa.lock mutex held.
+@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struc
+
+ /**
+ * s5k6aa_configure_video_bus - configure the video output interface
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ * @bus_type: video bus type: parallel or MIPI-CSI
+ * @nlanes: number of MIPI lanes to be used (MIPI-CSI only)
+ *
+@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct
+
+ /**
+ * s5k6aa_set_prev_config - write user preview register set
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
++ * @preset: s5kaa preset to be applied
+ *
+ * Configure output resolution and color fromat, pixel clock
+ * frequency range, device frame rate type and frame period range.
+@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct
+
+ /**
+ * s5k6aa_initialize_isp - basic ISP MCU initialization
++ * @sd: pointer to V4L2 sub-device descriptor
+ *
+ * Configure AHB addresses for registers read/write; configure PLLs for
+ * required output pixel clock. The ISP power supply needs to be already
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Dave Young <dyoung@redhat.com>
+Date: Sat, 9 Dec 2017 12:16:10 +0800
+Subject: mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
+
+From: Dave Young <dyoung@redhat.com>
+
+
+[ Upstream commit 7f6f60a1ba52538c16f26930bfbcfe193d9d746a ]
+
+earlyprintk=efi,keep does not work any more with a warning
+in mm/early_ioremap.c: WARN_ON(system_state != SYSTEM_BOOTING):
+Boot just hangs because of the earlyprintk within the earlyprintk
+implementation code itself.
+
+This is caused by a new introduced middle state in:
+
+ 69a78ff226fe ("init: Introduce SYSTEM_SCHEDULING state")
+
+early_ioremap() is fine in both SYSTEM_BOOTING and SYSTEM_SCHEDULING
+states, original condition should be updated accordingly.
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: bp@suse.de
+Cc: linux-efi@vger.kernel.org
+Cc: linux-mm@kvack.org
+Link: http://lkml.kernel.org/r/20171209041610.GA3249@dhcp-128-65.nay.redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/early_ioremap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/early_ioremap.c
++++ b/mm/early_ioremap.c
+@@ -103,7 +103,7 @@ __early_ioremap(resource_size_t phys_add
+ enum fixed_addresses idx;
+ int i, slot;
+
+- WARN_ON(system_state != SYSTEM_BOOTING);
++ WARN_ON(system_state >= SYSTEM_RUNNING);
+
+ slot = -1;
+ for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Branislav Radocaj <branislav@radocaj.org>
+Date: Thu, 7 Dec 2017 00:07:38 +0100
+Subject: net: ethernet: arc: fix error handling in emac_rockchip_probe
+
+From: Branislav Radocaj <branislav@radocaj.org>
+
+
+[ Upstream commit e46772a6946a7d1f3fbbc1415871851d6651f1d4 ]
+
+If clk_set_rate() fails, we should disable clk before return.
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Branislav Radocaj <branislav@radocaj.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/arc/emac_rockchip.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/arc/emac_rockchip.c
++++ b/drivers/net/ethernet/arc/emac_rockchip.c
+@@ -220,9 +220,11 @@ static int emac_rockchip_probe(struct pl
+
+ /* RMII TX/RX needs always a rate of 25MHz */
+ err = clk_set_rate(priv->macclk, 25000000);
+- if (err)
++ if (err) {
+ dev_err(dev,
+ "failed to change mac clock rate (%d)\n", err);
++ goto out_clk_disable_macclk;
++ }
+ }
+
+ err = arc_emac_probe(ndev, interface);
+@@ -232,7 +234,8 @@ static int emac_rockchip_probe(struct pl
+ }
+
+ return 0;
+-
++out_clk_disable_macclk:
++ clk_disable_unprepare(priv->macclk);
+ out_regulator_disable:
+ if (priv->regulator)
+ regulator_disable(priv->regulator);
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Nogah Frankel <nogahf@mellanox.com>
+Date: Mon, 4 Dec 2017 13:31:10 +0200
+Subject: net_sched: red: Avoid devision by zero
+
+From: Nogah Frankel <nogahf@mellanox.com>
+
+
+[ Upstream commit 5c472203421ab4f928aa1ae9e1dbcfdd80324148 ]
+
+Do not allow delta value to be zero since it is used as a divisor.
+
+Fixes: 8af2a218de38 ("sch_red: Adaptative RED AQM")
+Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -178,7 +178,7 @@ static inline void red_set_parms(struct
+ p->qth_max = qth_max << Wlog;
+ p->Wlog = Wlog;
+ p->Plog = Plog;
+- if (delta < 0)
++ if (delta <= 0)
+ delta = 1;
+ p->qth_delta = delta;
+ if (!max_P) {
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Nogah Frankel <nogahf@mellanox.com>
+Date: Mon, 4 Dec 2017 13:31:11 +0200
+Subject: net_sched: red: Avoid illegal values
+
+From: Nogah Frankel <nogahf@mellanox.com>
+
+
+[ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ]
+
+Check the qmin & qmax values doesn't overflow for the given Wlog value.
+Check that qmin <= qmax.
+
+Fixes: a783474591f2 ("[PKT_SCHED]: Generic RED layer")
+Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 11 +++++++++++
+ net/sched/sch_choke.c | 3 +++
+ net/sched/sch_gred.c | 3 +++
+ net/sched/sch_red.c | 2 ++
+ net/sched/sch_sfq.c | 3 +++
+ 5 files changed, 22 insertions(+)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -167,6 +167,17 @@ static inline void red_set_vars(struct r
+ v->qcount = -1;
+ }
+
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++{
++ if (fls(qth_min) + Wlog > 32)
++ return false;
++ if (fls(qth_max) + Wlog > 32)
++ return false;
++ if (qth_max < qth_min)
++ return false;
++ return true;
++}
++
+ static inline void red_set_parms(struct red_parms *p,
+ u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog,
+ u8 Scell_log, u8 *stab, u32 max_P)
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -424,6 +424,9 @@ static int choke_change(struct Qdisc *sc
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+ return -EINVAL;
+
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (!q) {
+ table->tab[dp] = q = *prealloc;
+ *prealloc = NULL;
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -184,6 +184,8 @@ static int red_change(struct Qdisc *sch,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
+
+ if (ctl->limit > 0) {
+ child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit);
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -633,6 +633,9 @@ static int sfq_change(struct Qdisc *sch,
+ if (ctl->divisor &&
+ (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
+ return -EINVAL;
++ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
++ ctl_v1->Wlog))
++ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Date: Wed, 22 Nov 2017 22:13:53 +0530
+Subject: perf bench numa: Fixup discontiguous/sparse numa nodes
+
+From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+
+
+[ Upstream commit 321a7c35c90cc834851ceda18a8ee18f1d032b92 ]
+
+Certain systems are designed to have sparse/discontiguous nodes. On
+such systems, 'perf bench numa' hangs, shows wrong number of nodes and
+shows values for non-existent nodes. Handle this by only taking nodes
+that are exposed by kernel to userspace.
+
+Signed-off-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/1edbcd353c009e109e93d78f2f46381930c340fe.1511368645.git.sathnaga@linux.vnet.ibm.com
+Signed-off-by: Balamuruhan S <bala24@linux.vnet.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/bench/numa.c | 56 +++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 51 insertions(+), 5 deletions(-)
+
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -211,6 +211,47 @@ static const char * const numa_usage[] =
+ NULL
+ };
+
++/*
++ * To get number of numa nodes present.
++ */
++static int nr_numa_nodes(void)
++{
++ int i, nr_nodes = 0;
++
++ for (i = 0; i < g->p.nr_nodes; i++) {
++ if (numa_bitmask_isbitset(numa_nodes_ptr, i))
++ nr_nodes++;
++ }
++
++ return nr_nodes;
++}
++
++/*
++ * To check if given numa node is present.
++ */
++static int is_node_present(int node)
++{
++ return numa_bitmask_isbitset(numa_nodes_ptr, node);
++}
++
++/*
++ * To check given numa node has cpus.
++ */
++static bool node_has_cpus(int node)
++{
++ struct bitmask *cpu = numa_allocate_cpumask();
++ unsigned int i;
++
++ if (cpu && !numa_node_to_cpus(node, cpu)) {
++ for (i = 0; i < cpu->size; i++) {
++ if (numa_bitmask_isbitset(cpu, i))
++ return true;
++ }
++ }
++
++ return false; /* lets fall back to nocpus safely */
++}
++
+ static cpu_set_t bind_to_cpu(int target_cpu)
+ {
+ cpu_set_t orig_mask, mask;
+@@ -239,12 +280,12 @@ static cpu_set_t bind_to_cpu(int target_
+
+ static cpu_set_t bind_to_node(int target_node)
+ {
+- int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes;
++ int cpus_per_node = g->p.nr_cpus / nr_numa_nodes();
+ cpu_set_t orig_mask, mask;
+ int cpu;
+ int ret;
+
+- BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus);
++ BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus);
+ BUG_ON(!cpus_per_node);
+
+ ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask);
+@@ -644,7 +685,7 @@ static int parse_setup_node_list(void)
+ int i;
+
+ for (i = 0; i < mul; i++) {
+- if (t >= g->p.nr_tasks) {
++ if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) {
+ printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node);
+ goto out;
+ }
+@@ -959,6 +1000,8 @@ static void calc_convergence(double runt
+ sum = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
++ if (!is_node_present(node))
++ continue;
+ nr = nodes[node];
+ nr_min = min(nr, nr_min);
+ nr_max = max(nr, nr_max);
+@@ -979,8 +1022,11 @@ static void calc_convergence(double runt
+ process_groups = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
+- int processes = count_node_processes(node);
++ int processes;
+
++ if (!is_node_present(node))
++ continue;
++ processes = count_node_processes(node);
+ nr = nodes[node];
+ tprintf(" %2d/%-2d", nr, processes);
+
+@@ -1286,7 +1332,7 @@ static void print_summary(void)
+
+ printf("\n ###\n");
+ printf(" # %d %s will execute (on %d nodes, %d CPUs):\n",
+- g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus);
++ g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus);
+ printf(" # %5dx %5ldMB global shared mem operations\n",
+ g->p.nr_loops, g->p.bytes_global/1024/1024);
+ printf(" # %5dx %5ldMB process shared mem operations\n",
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 14 Nov 2017 10:23:39 +0100
+Subject: perf top: Fix window dimensions change handling
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+
+[ Upstream commit 89d0aeab4252adc2a7ea693637dd21c588bfa2d1 ]
+
+The stdio perf top crashes when we change the terminal
+window size. The reason is that we assumed we get the
+perf_top pointer as a signal handler argument which is
+not the case.
+
+Changing the SIGWINCH handler logic to change global
+resize variable, which is checked in the main thread
+loop.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/n/tip-ysuzwz77oev1ftgvdscn9bpu@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-top.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -73,6 +73,7 @@
+ #include <linux/types.h>
+
+ static volatile int done;
++static volatile int resize;
+
+ #define HEADER_LINE_NR 5
+
+@@ -82,10 +83,13 @@ static void perf_top__update_print_entri
+ }
+
+ static void perf_top__sig_winch(int sig __maybe_unused,
+- siginfo_t *info __maybe_unused, void *arg)
++ siginfo_t *info __maybe_unused, void *arg __maybe_unused)
+ {
+- struct perf_top *top = arg;
++ resize = 1;
++}
+
++static void perf_top__resize(struct perf_top *top)
++{
+ get_term_dimensions(&top->winsize);
+ perf_top__update_print_entries(top);
+ }
+@@ -472,7 +476,7 @@ static bool perf_top__handle_keypress(st
+ .sa_sigaction = perf_top__sig_winch,
+ .sa_flags = SA_SIGINFO,
+ };
+- perf_top__sig_winch(SIGWINCH, NULL, top);
++ perf_top__resize(top);
+ sigaction(SIGWINCH, &act, NULL);
+ } else {
+ signal(SIGWINCH, SIG_DFL);
+@@ -1003,6 +1007,11 @@ static int __cmd_top(struct perf_top *to
+
+ if (hits == top->samples)
+ ret = perf_evlist__poll(top->evlist, 100);
++
++ if (resize) {
++ perf_top__resize(top);
++ resize = 0;
++ }
+ }
+
+ ret = 0;
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Andre Przywara <andre.przywara@arm.com>
+Date: Sat, 25 Nov 2017 12:12:30 +0000
+Subject: pinctrl: sunxi: Fix A64 UART mux value
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+
+[ Upstream commit 7c5c2c2d18d778e51fd8b899965097168306031c ]
+
+To use pin PF4 as the RX signal of UART0, we have to write 0b011 into
+the respective pin controller register.
+Fix the wrong value we had in our table so far.
+
+Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
+@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_p
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x2, "mmc0"), /* D3 */
+- SUNXI_FUNCTION(0x4, "uart0")), /* RX */
++ SUNXI_FUNCTION(0x3, "uart0")), /* RX */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Andre Przywara <andre.przywara@arm.com>
+Date: Sat, 25 Nov 2017 12:19:48 +0000
+Subject: pinctrl: sunxi: Fix A80 interrupt pin bank
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+
+[ Upstream commit 6ad4cc8d1ac483e0fd33f605fb2788b0ecf51ed4 ]
+
+On the A80 the pins on port B can trigger interrupts, and those are
+assigned to the second interrupt bank.
+Having two pins assigned to the same interrupt bank/pin combination does
+not look healthy (instead more like a copy&paste bug from pins PA14-PA16),
+so fix the interrupt bank for pins PB14-PB16, which is actually 1.
+
+I don't have any A80 board, so could not test this.
+
+Fixes: d5e9fb31baa2 ("pinctrl: sunxi: Add A80 pinctrl muxing options")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
+@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */
+
+ /* Hole */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0),
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: "Pali Rohár" <pali.rohar@gmail.com>
+Date: Thu, 2 Nov 2017 21:25:24 +0100
+Subject: platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
+
+From: "Pali Rohár" <pali.rohar@gmail.com>
+
+
+[ Upstream commit 68a213d325c23d39f109f4c7c824b906a7d209de ]
+
+This machine reports number of keyboard backlight led levels, instead of
+value of the last led level index. Therefore max_brightness properly needs
+to be subtracted by 1 to match led max_brightness API.
+
+Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
+Reported-by: Gabriel M. Elder <gabriel@tekgnowsys.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=196913
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell-laptop.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -45,6 +45,7 @@
+
+ struct quirk_entry {
+ u8 touchpad_led;
++ u8 kbd_led_levels_off_1;
+
+ int needs_kbd_timeouts;
+ /*
+@@ -75,6 +76,10 @@ static struct quirk_entry quirk_dell_xps
+ .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
+ };
+
++static struct quirk_entry quirk_dell_latitude_e6410 = {
++ .kbd_led_levels_off_1 = 1,
++};
++
+ static struct platform_driver platform_driver = {
+ .driver = {
+ .name = "dell-laptop",
+@@ -270,6 +275,15 @@ static const struct dmi_system_id dell_q
+ },
+ .driver_data = &quirk_dell_xps13_9333,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Latitude E6410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
++ },
++ .driver_data = &quirk_dell_latitude_e6410,
++ },
+ { }
+ };
+
+@@ -1170,6 +1184,9 @@ static int kbd_get_info(struct kbd_info
+ units = (buffer->output[2] >> 8) & 0xFF;
+ info->levels = (buffer->output[2] >> 16) & 0xFF;
+
++ if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
++ info->levels--;
++
+ if (units & BIT(0))
+ info->seconds = (buffer->output[3] >> 0) & 0xFF;
+ if (units & BIT(1))
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Thu, 30 Nov 2017 14:03:22 +0530
+Subject: powerpc/perf: Fix oops when grouping different pmu events
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+
+[ Upstream commit 5aa04b3eb6fca63d2e9827be656dcadc26d54e11 ]
+
+When user tries to group imc (In-Memory Collections) event with
+normal event, (sometime) kernel crashes with following log:
+
+ Faulting instruction address: 0x00000000
+ [link register ] c00000000010ce88 power_check_constraints+0x128/0x980
+ ...
+ c00000000010e238 power_pmu_event_init+0x268/0x6f0
+ c0000000002dc60c perf_try_init_event+0xdc/0x1a0
+ c0000000002dce88 perf_event_alloc+0x7b8/0xac0
+ c0000000002e92e0 SyS_perf_event_open+0x530/0xda0
+ c00000000000b004 system_call+0x38/0xe0
+
+'event_base' field of 'struct hw_perf_event' is used as flags for
+normal hw events and used as memory address for imc events. While
+grouping these two types of events, collect_events() tries to
+interpret imc 'event_base' as a flag, which causes a corruption
+resulting in a crash.
+
+Consider only those events which belongs to 'perf_hw_context' in
+collect_events().
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Reviewed-By: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/perf/core-book3s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -1381,7 +1381,7 @@ static int collect_events(struct perf_ev
+ int n = 0;
+ struct perf_event *event;
+
+- if (!is_software_event(group)) {
++ if (group->pmu->task_ctx_nr == perf_hw_context) {
+ if (n >= max_count)
+ return -1;
+ ctrs[n] = group;
+@@ -1389,7 +1389,7 @@ static int collect_events(struct perf_ev
+ events[n++] = group->hw.config;
+ }
+ list_for_each_entry(event, &group->sibling_list, group_entry) {
+- if (!is_software_event(event) &&
++ if (event->pmu->task_ctx_nr == perf_hw_context &&
+ event->state != PERF_EVENT_STATE_OFF) {
+ if (n >= max_count)
+ return -1;
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Moni Shoua <monis@mellanox.com>
+Date: Sun, 26 Nov 2017 20:23:54 +0200
+Subject: RDMA/cma: Make sure that PSN is not over max allowed
+
+From: Moni Shoua <monis@mellanox.com>
+
+
+[ Upstream commit 23a9cd2ad90543e9da3786878d2b2729c095439d ]
+
+This patch limits the initial value for PSN to 24 bits as
+spec requires.
+
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Mukesh Kacker <mukesh.kacker@oracle.com>
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/cma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -744,6 +744,7 @@ struct rdma_cm_id *rdma_create_id(struct
+ INIT_LIST_HEAD(&id_priv->mc_list);
+ get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num);
+ id_priv->id.route.addr.dev_addr.net = get_net(net);
++ id_priv->seq_num &= 0x00ffffff;
+
+ return &id_priv->id;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Thu, 26 Oct 2017 14:37:35 +0200
+Subject: s390/dasd: prevent prefix I/O error
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit da340f921d3454f1521671c7a5a43ad3331fbe50 ]
+
+Prevent that a prefix flag is set based on invalid configuration data.
+The validity.verify_base flag should only be set for alias devices.
+Usually the unit address type is either one of base, PAV alias or
+HyperPAV alias. But in cases where the unit address type is not set or
+any other value the validity.verify_base flag might be set as well.
+This would lead to follow on errors.
+Explicitly check for alias devices and set the validity flag only for
+them.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_eckd.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -521,10 +521,12 @@ static int prefix_LRE(struct ccw1 *ccw,
+ pfxdata->validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
+ pfxdata->validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata->validity.hyper_pav = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
++ pfxdata->validity.verify_base = 1;
++ pfxdata->validity.hyper_pav = 1;
+ }
+
+ /* define extend data (mostly)*/
+@@ -3471,10 +3473,12 @@ static int prepare_itcw(struct itcw *itc
+ pfxdata.validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
++ pfxdata.validity.verify_base = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
+ pfxdata.validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata.validity.hyper_pav = 1;
++ pfxdata.validity.hyper_pav = 1;
+ }
+
+ switch (cmd) {
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 29 Nov 2017 15:20:03 +0000
+Subject: scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
+
+From: Will Deacon <will.deacon@arm.com>
+
+
+[ Upstream commit e814bccbafece52a24e152d2395b5d49eef55841 ]
+
+My bisect scripts starting running into build failures when trying to
+compile 4.15-rc1 with the builds failing with things like:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+
+The line in question is actually just a #define, but after some digging
+it turns out that my scripts pass W=1 and since commit 3a025e1d1c2ea
+("Add optional check for bad kernel-doc comments") that results in
+kernel-doc running on each source file. The file in question has a
+badly formatted comment immediately before the #define:
+
+/**
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
+
+which causes the regex in dump_struct to fail (lack of braces following
+struct declaration) and kernel-doc returns 1, which causes the build
+to fail.
+
+Fix the issue by always returning 0 from kernel-doc when invoked with
+-none. It successfully generates no documentation, and prints out any
+issues.
+
+Cc: Matthew Wilcox <mawilcox@microsoft.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/kernel-doc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -3139,4 +3139,4 @@ if ($verbose && $warnings) {
+ print STDERR "$warnings warnings\n";
+ }
+
+-exit($errors);
++exit($output_mode eq "none" ? 0 : $errors);
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 25 Nov 2017 21:18:34 +0800
+Subject: sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ]
+
+Now outstanding_bytes is only increased when appending chunks into one
+packet and sending it at 1st time, while decreased when it is about to
+move into retransmit queue. It means outstanding_bytes value is already
+decreased for all chunks in retransmit queue.
+
+However sctp_prsctp_prune_sent is a common function to check the chunks
+in both transmitted and retransmit queue, it decrease outstanding_bytes
+when moving a chunk into abandoned queue from either of them.
+
+It could cause outstanding_bytes underflow, as it also decreases it's
+value for the chunks in retransmit queue.
+
+This patch fixes it by only updating outstanding_bytes for transmitted
+queue when pruning queues for prsctp prio policy, the same fix is also
+needed in sctp_check_transmitted.
+
+Fixes: 8dbdf1f5b09c ("sctp: implement prsctp PRIO policy")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/outqueue.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -364,7 +364,8 @@ static int sctp_prsctp_prune_sent(struct
+ asoc->sent_cnt_removable--;
+ asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+
+- if (!chk->tsn_gap_acked) {
++ if (queue != &asoc->outqueue.retransmit &&
++ !chk->tsn_gap_acked) {
+ if (chk->transport)
+ chk->transport->flight_size -=
+ sctp_data_size(chk);
+@@ -1409,7 +1410,8 @@ static void sctp_check_transmitted(struc
+ /* If this chunk has not been acked, stop
+ * considering it as 'outstanding'.
+ */
+- if (!tchunk->tsn_gap_acked) {
++ if (transmitted_queue != &q->retransmit &&
++ !tchunk->tsn_gap_acked) {
+ if (tchunk->transport)
+ tchunk->transport->flight_size -=
+ sctp_data_size(tchunk);
staging-iio-adc-ad7192-fix-external-frequency-setting.patch
staging-iio-ad5933-switch-buffer-mode-to-software.patch
usbip-keep-usbip_device-sockfd-state-in-sync-with-tcp_socket.patch
+usb-build-drivers-usb-common-when-usb_support-is-set.patch
+arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch
+arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch
+arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch
+arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch
+arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch
+arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch
+arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch
+perf-top-fix-window-dimensions-change-handling.patch
+perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch
+media-s5k6aa-describe-some-function-parameters.patch
+pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch
+pinctrl-sunxi-fix-a64-uart-mux-value.patch
+i40iw-correct-arp-index-mask.patch
+rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch
+sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch
+scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch
+ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch
+m68k-add-missing-softirqentry_text-linker-section.patch
+powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch
+s390-dasd-prevent-prefix-i-o-error.patch
+arm-dts-fix-elm-interrupt-compiler-warning.patch
+gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch
+net_sched-red-avoid-devision-by-zero.patch
+net_sched-red-avoid-illegal-values.patch
+btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch
+brcmfmac-avoid-build-error-with-make-w-1.patch
+net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch
+509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch
+gianfar-disable-eee-autoneg-by-default.patch
+dmaengine-ioat-fix-error-handling-path.patch
+dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch
+clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch
+asoc-rockchip-disable-clock-on-error.patch
+spi-sun4i-disable-clocks-in-the-remove-function.patch
+xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch
+drm-armada-fix-leak-of-crtc-structure.patch
+dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch
+usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch
+usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch
+mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch
+x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch
+platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch
+xen-xen_acpi_processor-is-dom0-only.patch
+hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Takuo Koguchi <takuo.koguchi@gmail.com>
+Date: Thu, 7 Dec 2017 16:20:14 +0900
+Subject: spi: sun4i: disable clocks in the remove function
+
+From: Takuo Koguchi <takuo.koguchi@gmail.com>
+
+
+[ Upstream commit c810daba0ab5226084a56893a789af427a801146 ]
+
+mclk and hclk need to be disabled. Since pm_runtime_disable does
+not disable the clocks, use pm_runtime_force_suspend instead.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Takuo Koguchi <takuo.koguchi.sw@hitachi.com>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-sun4i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sun4i.c
++++ b/drivers/spi/spi-sun4i.c
+@@ -466,7 +466,7 @@ err_free_master:
+
+ static int sun4i_spi_remove(struct platform_device *pdev)
+ {
+- pm_runtime_disable(&pdev->dev);
++ pm_runtime_force_suspend(&pdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 17 Nov 2017 11:00:45 -0800
+Subject: usb: build drivers/usb/common/ when USB_SUPPORT is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+
+[ Upstream commit c9d24f78268be444e803fb2bb138a2f598de9c23 ]
+
+PHY drivers can use ULPI interfaces when CONFIG_USB (which is host side
+support) is not enabled, so also build drivers/usb/ when CONFIG_USB_SUPPORT
+is enabled so that drivers/usb/common/ is built.
+
+ERROR: "ulpi_unregister_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "__ulpi_register_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_read" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_write" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_unregister_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+ERROR: "__ulpi_register_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+ERROR: "ulpi_write" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -99,6 +99,7 @@ obj-$(CONFIG_TC) += tc/
+ obj-$(CONFIG_UWB) += uwb/
+ obj-$(CONFIG_USB_PHY) += usb/
+ obj-$(CONFIG_USB) += usb/
++obj-$(CONFIG_USB_SUPPORT) += usb/
+ obj-$(CONFIG_PCI) += usb/
+ obj-$(CONFIG_USB_GADGET) += usb/
+ obj-$(CONFIG_OF) += usb/
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Vincent Pelletier <plr.vincent@gmail.com>
+Date: Thu, 30 Nov 2017 15:31:06 +0000
+Subject: usb: dwc3: gadget: Wait longer for controller to end command processing
+
+From: Vincent Pelletier <plr.vincent@gmail.com>
+
+
+[ Upstream commit 8722e095f5a44d0e409e45c5ddc2ee9cf589c777 ]
+
+DWC3_DEPCMD_ENDTRANSFER has been witnessed to require around 600 iterations
+before controller would become idle again after unplugging the USB cable
+with AIO reads submitted.
+Bump timeout from 500 iterations to 1000 so dwc3_stop_active_transfer does
+not receive -ETIMEDOUT and does not WARN:
+
+[ 81.326273] ------------[ cut here ]------------
+[ 81.335341] WARNING: CPU: 0 PID: 1874 at drivers/usb/dwc3/gadget.c:2627 dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3]
+[ 81.347094] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil dwc3 intel_powerclamp coretemp ulpi kvm_intel udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd basincove_gpadc industrialio gpio_keys usbcore usb_common
+[ 81.378142] CPU: 0 PID: 1874 Comm: irq/34-dwc3 Not tainted 4.14.0-edison+ #119
+[ 81.385545] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
+[ 81.394548] task: f5b1be00 task.stack: f420a000
+[ 81.399219] EIP: dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3]
+[ 81.406086] EFLAGS: 00010086 CPU: 0
+[ 81.409672] EAX: 0000001f EBX: f5729800 ECX: c132a2a2 EDX: 00000000
+[ 81.416096] ESI: f4054014 EDI: f41cf400 EBP: f420be10 ESP: f420bdf4
+[ 81.422521] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+[ 81.428061] CR0: 80050033 CR2: b7a3f000 CR3: 01d94000 CR4: 001006d0
+[ 81.434483] Call Trace:
+[ 81.437063] __dwc3_gadget_ep_disable+0xa3/0x2b0 [dwc3]
+[ 81.442438] ? _raw_spin_lock_irqsave+0x32/0x40
+[ 81.447135] dwc3_gadget_ep_disable+0xbf/0xe0 [dwc3]
+[ 81.452269] usb_ep_disable+0x1c/0xd0 [udc_core]
+[ 81.457048] ffs_func_eps_disable.isra.15+0x3b/0x90 [usb_f_fs]
+[ 81.463070] ffs_func_set_alt+0x7d/0x310 [usb_f_fs]
+[ 81.468132] ffs_func_disable+0x14/0x20 [usb_f_fs]
+[ 81.473075] reset_config+0x5b/0x90 [libcomposite]
+[ 81.478023] composite_disconnect+0x2b/0x50 [libcomposite]
+[ 81.483685] dwc3_disconnect_gadget+0x39/0x50 [dwc3]
+[ 81.488808] dwc3_gadget_disconnect_interrupt+0x21b/0x250 [dwc3]
+[ 81.495014] dwc3_thread_interrupt+0x2a8/0xf70 [dwc3]
+[ 81.500219] ? __schedule+0x78c/0x7e0
+[ 81.504027] irq_thread_fn+0x18/0x30
+[ 81.507715] ? irq_thread+0xb7/0x180
+[ 81.511400] irq_thread+0x111/0x180
+[ 81.515000] ? irq_finalize_oneshot+0xe0/0xe0
+[ 81.519490] ? wake_threads_waitq+0x30/0x30
+[ 81.523806] kthread+0x107/0x110
+[ 81.527131] ? disable_percpu_irq+0x50/0x50
+[ 81.531439] ? kthread_stop+0x150/0x150
+[ 81.535397] ret_from_fork+0x19/0x24
+[ 81.539136] Code: 89 d8 c7 45 ec 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 f4 00 00 00 00 e8 56 ef ff ff 85 c0 74 12 50 68 b9 1c 14 f8 e8 64 0f f7 c8 <0f> ff 58 5a 8d 76 00 8b 83 98 00 00 00 c6 83 a0 00 00 00 00 83
+[ 81.559295] ---[ end trace f3133eec81a473b8 ]---
+
+Number of iterations measured on 4 consecutive unplugs:
+[ 1088.799777] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 605 times
+[ 1222.024986] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 580 times
+[ 1317.590452] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 598 times
+[ 1453.218314] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 594 times
+
+Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -247,7 +247,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
+ struct dwc3_gadget_ep_cmd_params *params)
+ {
+ struct dwc3 *dwc = dep->dwc;
+- u32 timeout = 500;
++ u32 timeout = 1000;
+ u32 reg;
+
+ int cmd_status = 0;
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Andreas Platschek <andreas.platschek@opentech.at>
+Date: Thu, 7 Dec 2017 11:32:20 +0100
+Subject: usb: dwc3: of-simple: fix missing clk_disable_unprepare
+
+From: Andreas Platschek <andreas.platschek@opentech.at>
+
+
+[ Upstream commit ded600ea9fb51a495d2fcd21e90351df876488e8 ]
+
+If of_clk_get() fails, the clean-up of already initialized clocks should be
+the same as when clk_prepare_enable() fails. Thus a clk_disable_unprepare()
+for each clock should be called before the clk_put().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 16adc674d0d6 ("usb: dwc3: ep0: fix setup_packet_pending initialization")
+
+Signed-off-by: Andreas Platschek <andreas.platschek@opentech.at>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-of-simple.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -58,8 +58,10 @@ static int dwc3_of_simple_clk_init(struc
+
+ clk = of_clk_get(np, i);
+ if (IS_ERR(clk)) {
+- while (--i >= 0)
++ while (--i >= 0) {
++ clk_disable_unprepare(simple->clks[i]);
+ clk_put(simple->clks[i]);
++ }
+ return PTR_ERR(clk);
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Karol Herbst <kherbst@redhat.com>
+Date: Mon, 27 Nov 2017 08:51:39 +0100
+Subject: x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
+
+From: Karol Herbst <kherbst@redhat.com>
+
+
+[ Upstream commit 6d60ce384d1d5ca32b595244db4077a419acc687 ]
+
+If something calls ioremap() with an address not aligned to PAGE_SIZE, the
+returned address might be not aligned as well. This led to a probe
+registered on exactly the returned address, but the entire page was armed
+for mmiotracing.
+
+On calling iounmap() the address passed to unregister_kmmio_probe() was
+PAGE_SIZE aligned by the caller leading to a complete freeze of the
+machine.
+
+We should always page align addresses while (un)registerung mappings,
+because the mmiotracer works on top of pages, not mappings. We still keep
+track of the probes based on their real addresses and lengths though,
+because the mmiotrace still needs to know what are mapped memory regions.
+
+Also move the call to mmiotrace_iounmap() prior page aligning the address,
+so that all probes are unregistered properly, otherwise the kernel ends up
+failing memory allocations randomly after disabling the mmiotracer.
+
+Tested-by: Lyude <lyude@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Acked-by: Pekka Paalanen <ppaalanen@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: nouveau@lists.freedesktop.org
+Link: http://lkml.kernel.org/r/20171127075139.4928-1-kherbst@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/ioremap.c | 4 ++--
+ arch/x86/mm/kmmio.c | 12 +++++++-----
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -347,11 +347,11 @@ void iounmap(volatile void __iomem *addr
+ (void __force *)addr < phys_to_virt(ISA_END_ADDRESS))
+ return;
+
++ mmiotrace_iounmap(addr);
++
+ addr = (volatile void __iomem *)
+ (PAGE_MASK & (unsigned long __force)addr);
+
+- mmiotrace_iounmap(addr);
+-
+ /* Use the vm area unlocked, assuming the caller
+ ensures there isn't another iounmap for the same address
+ in parallel. Reuse of the virtual address is prevented by
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -434,17 +434,18 @@ int register_kmmio_probe(struct kmmio_pr
+ unsigned long flags;
+ int ret = 0;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ unsigned int l;
+ pte_t *pte;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+- if (get_kmmio_probe(p->addr)) {
++ if (get_kmmio_probe(addr)) {
+ ret = -EEXIST;
+ goto out;
+ }
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte) {
+ ret = -EINVAL;
+ goto out;
+@@ -453,7 +454,7 @@ int register_kmmio_probe(struct kmmio_pr
+ kmmio_count++;
+ list_add_rcu(&p->list, &kmmio_probes);
+ while (size < size_lim) {
+- if (add_kmmio_fault_page(p->addr + size))
++ if (add_kmmio_fault_page(addr + size))
+ pr_err("Unable to set page fault.\n");
+ size += page_level_size(l);
+ }
+@@ -527,19 +528,20 @@ void unregister_kmmio_probe(struct kmmio
+ {
+ unsigned long flags;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ struct kmmio_fault_page *release_list = NULL;
+ struct kmmio_delayed_release *drelease;
+ unsigned int l;
+ pte_t *pte;
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte)
+ return;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+ while (size < size_lim) {
+- release_kmmio_fault_page(p->addr + size, &release_list);
++ release_kmmio_fault_page(addr + size, &release_list);
+ size += page_level_size(l);
+ }
+ list_del_rcu(&p->list);
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Jan Beulich <JBeulich@suse.com>
+Date: Tue, 12 Dec 2017 03:18:11 -0700
+Subject: xen: XEN_ACPI_PROCESSOR is Dom0-only
+
+From: Jan Beulich <JBeulich@suse.com>
+
+
+[ Upstream commit c4f9d9cb2c29ff04c6b4bb09b72802d8aedfc7cb ]
+
+Add a respective dependency.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -246,7 +246,7 @@ config XEN_ACPI_HOTPLUG_CPU
+
+ config XEN_ACPI_PROCESSOR
+ tristate "Xen ACPI processor"
+- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
++ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
+ default m
+ help
+ This ACPI processor uploads Power Management information to the Xen
--- /dev/null
+From foo@baz Fri Feb 23 11:48:40 CET 2018
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Fri, 8 Dec 2017 08:07:25 +0100
+Subject: xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+
+[ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ]
+
+On policies with a transport mode template, we pass the addresses
+from the flowi to xfrm_state_find(), assuming that the IP addresses
+(and address family) don't change during transformation.
+
+Unfortunately our policy template validation is not strict enough.
+It is possible to configure policies with transport mode template
+where the address family of the template does not match the selectors
+address family. This lead to stack-out-of-bound reads because
+we compare arddesses of the wrong family. Fix this by refusing
+such a configuration, address family can not change on transport
+mode.
+
+We use the assumption that, on transport mode, the first templates
+address family must match the address family of the policy selector.
+Subsequent transport mode templates must mach the address family of
+the previous template.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_user.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1380,11 +1380,14 @@ static void copy_templates(struct xfrm_p
+
+ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ {
++ u16 prev_family;
+ int i;
+
+ if (nr > XFRM_MAX_DEPTH)
+ return -EINVAL;
+
++ prev_family = family;
++
+ for (i = 0; i < nr; i++) {
+ /* We never validated the ut->family value, so many
+ * applications simply leave it at zero. The check was
+@@ -1396,6 +1399,12 @@ static int validate_tmpl(int nr, struct
+ if (!ut[i].family)
+ ut[i].family = family;
+
++ if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
++ (ut[i].family != prev_family))
++ return -EINVAL;
++
++ prev_family = ut[i].family;
++
+ switch (ut[i].family) {
+ case AF_INET:
+ break;
projects / thirdparty / kernel / stable-queue.git / commitdiff
