--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 8 Dec 2017 21:46:16 +0000
+Subject: agp/intel: Flush all chipset writes after updating the GGTT
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+
+[ Upstream commit 8516673a996870ea0ceb337ee4f83c33c5ec3111 ]
+
+Before accessing the GGTT we must flush the PTE writes and make them
+visible to the chipset, or else the indirect access may end up in the
+wrong page. In commit 3497971a71d8 ("agp/intel: Flush chipset writes
+after updating a single PTE"), we noticed corruption of the uploads for
+pwrite and for capturing GPU error states, but it was presumed that the
+explicit calls to intel_gtt_chipset_flush() were sufficient for the
+execbuffer path. However, we have not been flushing the chipset between
+the PTE writes and access via the GTT itself.
+
+For simplicity, do the flush after any PTE update rather than try and
+batch the flushes on a just-in-time basis.
+
+References: 3497971a71d8 ("agp/intel: Flush chipset writes after updating a single PTE")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Mika Kuoppala <mika.kuoppala@intel.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171208214616.30147-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/agp/intel-gtt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -872,6 +872,8 @@ void intel_gtt_insert_sg_entries(struct
+ }
+ }
+ wmb();
++ if (intel_private.driver->chipset_flush)
++ intel_private.driver->chipset_flush();
+ }
+ EXPORT_SYMBOL(intel_gtt_insert_sg_entries);
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 11:13:56 -0600
+Subject: ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
+
+From: "Andrew F. Davis" <afd@ti.com>
+
+
+[ Upstream commit e153db03c6b7a035c797bcdf35262586f003ee93 ]
+
+The correct DT property for specifying a GPIO used for reset
+is "reset-gpios", fix this here.
+
+Fixes: 4341881d0562 ("ARM: dts: Add devicetree for Gumstix Pepper board")
+
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am335x-pepper.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/am335x-pepper.dts
++++ b/arch/arm/boot/dts/am335x-pepper.dts
+@@ -139,7 +139,7 @@
+ &audio_codec {
+ status = "okay";
+
+- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>;
++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>;
+ AVDD-supply = <&ldo3_reg>;
+ IOVDD-supply = <&ldo3_reg>;
+ DRVDD-supply = <&ldo3_reg>;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Simon Shields <simon@lineageos.org>
+Date: Tue, 21 Nov 2017 22:24:24 +1100
+Subject: ARM: dts: exynos: Correct Trats2 panel reset line
+
+From: Simon Shields <simon@lineageos.org>
+
+
+[ Upstream commit 1b377924841df1e13ab5b225be3a83f807a92b52 ]
+
+Trats2 uses gpf2-1 as the panel reset GPIO. gpy4-5 was only used
+on early revisions of the board.
+
+Fixes: 420ae8451a22 ("ARM: dts: exynos4412-trats2: add panel node")
+Signed-off-by: Simon Shields <simon@lineageos.org>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/exynos4412-trats2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/exynos4412-trats2.dts
++++ b/arch/arm/boot/dts/exynos4412-trats2.dts
+@@ -395,7 +395,7 @@
+ reg = <0>;
+ vdd3-supply = <&lcd_vdd3_reg>;
+ vci-supply = <&ldo25_reg>;
+- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>;
+ power-on-delay= <50>;
+ reset-delay = <100>;
+ init-delay = <100>;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Simon Horman <horms+renesas@verge.net.au>
+Date: Thu, 2 Nov 2017 10:18:05 +0100
+Subject: ARM: dts: koelsch: Move cec_clock to root node
+
+From: Simon Horman <horms+renesas@verge.net.au>
+
+
+[ Upstream commit d72f4f03854d1225c72d682bf0e01377e7016419 ]
+
+cec-clock is a fixed clock generator that is not controlled by i2c5 and
+thus should not be a child of the i2c5 bus node. Rather, it should be
+a child of the root node of the DT.
+
+Fixes: 02a5ab18d366 ("ARM: dts: koelsch: Add CEC clock for HDMI transmitter")
+Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/r8a7791-koelsch.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
+@@ -278,6 +278,12 @@
+ };
+ };
+
++ cec_clock: cec-clock {
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ clock-frequency = <12000000>;
++ };
++
+ hdmi-out {
+ compatible = "hdmi-connector";
+ type = "a";
+@@ -642,12 +648,6 @@
+ };
+ };
+
+- cec_clock: cec-clock {
+- compatible = "fixed-clock";
+- #clock-cells = <0>;
+- clock-frequency = <12000000>;
+- };
+-
+ hdmi@39 {
+ compatible = "adi,adv7511w";
+ reg = <0x39>;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 11:13:59 -0600
+Subject: ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
+
+From: "Andrew F. Davis" <afd@ti.com>
+
+
+[ Upstream commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 ]
+
+The correct DT property for specifying a GPIO used for reset
+is "reset-gpios", fix this here.
+
+Fixes: 14e3e295b2b9 ("ARM: dts: omap3-n900: Add TLV320AIC3X support")
+
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap3-n900.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -558,7 +558,7 @@
+ tlv320aic3x: tlv320aic3x@18 {
+ compatible = "ti,tlv320aic3x";
+ reg = <0x18>;
+- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
+ ai3x-gpio-func = <
+ 0 /* AIC3X_GPIO1_FUNC_DISABLED */
+ 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */
+@@ -575,7 +575,7 @@
+ tlv320aic3x_aux: tlv320aic3x@19 {
+ compatible = "ti,tlv320aic3x";
+ reg = <0x19>;
+- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
+
+ AVDD-supply = <&vmmc2>;
+ DRVDD-supply = <&vmmc2>;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 4 Dec 2017 11:34:51 +0100
+Subject: arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit f5bbcd533a9d1af97b8a0862a421bb8455f1bf6d ]
+
+Describe the GPIO used to reset the Ethernet PHY for EthernetAVB.
+This allows the driver to reset the PHY during probe and after system
+resume.
+
+This fixes Ethernet operation after resume from s2ram on Salvator-XS,
+where the enable pin of the regulator providing PHY power is connected
+to PRESETn, and PSCI powers down the SoC during system suspend.
+
+On Salvator-X, the enable pin is always pulled high, but the driver may
+still need to reset the PHY if this wasn't done by the bootloader
+before.
+
+Inspired by patches in the BSP for the individual Salvator-X/XS boards
+by Kazuya Mizuguchi.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/salvator-common.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+@@ -264,6 +264,7 @@
+ reg = <0>;
+ interrupt-parent = <&gpio2>;
+ interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
++ reset-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>;
+ };
+ };
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 9 Dec 2017 14:52:28 +0300
+Subject: ASoC: nuc900: Fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ]
+
+We should be finishing the loop with timeout set to zero but because
+this is a post-op we finish with timeout == -1.
+
+Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/nuc900/nuc900-ac97.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/nuc900/nuc900-ac97.c
++++ b/sound/soc/nuc900/nuc900-ac97.c
+@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(s
+
+ /* polling the AC_R_FINISH */
+ while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH)
+- && timeout--)
++ && --timeout)
+ mdelay(1);
+
+ if (!timeout) {
+@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd
+
+ /* polling the AC_W_FINISH */
+ while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH)
+- && timeout--)
++ && --timeout)
+ mdelay(1);
+
+ if (!timeout)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Ben Greear <greearb@candelatech.com>
+Date: Sat, 2 Dec 2017 16:50:49 +0200
+Subject: ath10k: fix invalid STS_CAP_OFFSET_MASK
+
+From: Ben Greear <greearb@candelatech.com>
+
+
+[ Upstream commit 8cec57f5277ef0e354e37a0bf909dc71bc1f865b ]
+
+The 10.4 firmware defines this as a 3-bit field, as does the
+mac80211 stack. The 4th bit is defined as CONF_IMPLICIT_BF
+at least in the firmware header I have seen. This patch
+fixes the ath10k wmi header to match the firmware.
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -5235,7 +5235,8 @@ enum wmi_10_4_vdev_param {
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3)
+
+ #define WMI_TXBF_STS_CAP_OFFSET_LSB 4
+-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0
++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70
++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7)
+ #define WMI_BF_SOUND_DIM_OFFSET_LSB 8
+ #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+Date: Mon, 6 Nov 2017 13:39:31 +0530
+Subject: ath10k: update tdls teardown state to target
+
+From: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+
+
+[ Upstream commit 424ea0d174e82365f85c6770225dba098b8f1d5f ]
+
+It is required to update the teardown state of the peer when
+a tdls link with that peer is terminated. This information is
+useful for the target to perform some cleanups wrt the tdls peer.
+
+Without proper cleanup, target assumes that the peer is connected and
+blocks future connection requests, updating the teardown state of the
+peer addresses the problem.
+
+Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6183,6 +6183,16 @@ static int ath10k_sta_state(struct ieee8
+ "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
+ arvif->vdev_id, sta->addr, sta);
+
++ if (sta->tdls) {
++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
++ sta,
++ WMI_TDLS_PEER_STATE_TEARDOWN);
++ if (ret)
++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n",
++ sta->addr,
++ WMI_TDLS_PEER_STATE_TEARDOWN, ret);
++ }
++
+ ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
+ if (ret)
+ ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Wed, 6 Dec 2017 17:31:22 -0500
+Subject: bnxt_en: Don't print "Link speed -1 no longer supported" messages.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+
+[ Upstream commit a8168b6cee6e9334dfebb4b9108e8d73794f6088 ]
+
+On some dual port NICs, the 2 ports have to be configured with compatible
+link speeds. Under some conditions, a port's configured speed may no
+longer be supported. The firmware will send a message to the driver
+when this happens.
+
+Improve this logic that prints out the warning by only printing it if
+we can determine the link speed that is no longer supported. If the
+speed is unknown or it is in autoneg mode, skip the warning message.
+
+Reported-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Tested-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1698,12 +1698,16 @@ static int bnxt_async_event_process(stru
+
+ if (BNXT_VF(bp))
+ goto async_event_process_exit;
+- if (data1 & 0x20000) {
++
++ /* print unsupported speed warning in forced speed mode only */
++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED) &&
++ (data1 & 0x20000)) {
+ u16 fw_speed = link_info->force_link_speed;
+ u32 speed = bnxt_fw_to_ethtool_speed(fw_speed);
+
+- netdev_warn(bp->dev, "Link speed %d no longer supported\n",
+- speed);
++ if (speed != SPEED_UNKNOWN)
++ netdev_warn(bp->dev, "Link speed %d no longer supported\n",
++ speed);
+ }
+ set_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, &bp->sp_event);
+ /* fall thru */
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Yixun Lan <yixun.lan@amlogic.com>
+Date: Tue, 7 Nov 2017 22:12:23 +0800
+Subject: clk: meson: gxbb: fix wrong clock for SARADC/SANA
+
+From: Yixun Lan <yixun.lan@amlogic.com>
+
+
+[ Upstream commit 75eccf5ed83250c0aeaeeb76f7288254ac0a87b4 ]
+
+According to the datasheet, in Meson-GXBB/GXL series,
+The clock gate bit for SARADC is HHI_GCLK_MPEG2 bit[22],
+while clock gate bit for SANA is HHI_GCLK_MPEG0 bit[10].
+
+Test passed at gxl-s905x-p212 board.
+
+The following published datasheets are wrong and should be updated
+[1] GXBB v1.1.4
+[2] GXL v0.3_20170314
+
+Fixes: 738f66d3211d ("clk: gxbb: add AmLogic GXBB clk controller driver")
+Tested-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/meson/gxbb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -1139,7 +1139,7 @@ static MESON_GATE(gxbb_pl301, HHI_GCLK_M
+ static MESON_GATE(gxbb_periphs, HHI_GCLK_MPEG0, 7);
+ static MESON_GATE(gxbb_spicc, HHI_GCLK_MPEG0, 8);
+ static MESON_GATE(gxbb_i2c, HHI_GCLK_MPEG0, 9);
+-static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG0, 10);
++static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG0, 10);
+ static MESON_GATE(gxbb_smart_card, HHI_GCLK_MPEG0, 11);
+ static MESON_GATE(gxbb_rng0, HHI_GCLK_MPEG0, 12);
+ static MESON_GATE(gxbb_uart0, HHI_GCLK_MPEG0, 13);
+@@ -1190,7 +1190,7 @@ static MESON_GATE(gxbb_usb0_ddr_bridge,
+ static MESON_GATE(gxbb_mmc_pclk, HHI_GCLK_MPEG2, 11);
+ static MESON_GATE(gxbb_dvin, HHI_GCLK_MPEG2, 12);
+ static MESON_GATE(gxbb_uart2, HHI_GCLK_MPEG2, 15);
+-static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG2, 22);
++static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG2, 22);
+ static MESON_GATE(gxbb_vpu_intr, HHI_GCLK_MPEG2, 25);
+ static MESON_GATE(gxbb_sec_ahb_ahb3_bridge, HHI_GCLK_MPEG2, 26);
+ static MESON_GATE(gxbb_clk81_a53, HHI_GCLK_MPEG2, 29);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Wed, 6 Dec 2017 12:11:38 +0000
+Subject: clk: qcom: msm8916: fix mnd_width for codec_digcodec
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+
+[ Upstream commit d8e488e8242ecf129eebc440c92d800a99ca109d ]
+
+This patch fixes missing mnd_width for codec_digital clk, this is now set to
+8 inline with datasheet.
+
+Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/gcc-msm8916.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/qcom/gcc-msm8916.c
++++ b/drivers/clk/qcom/gcc-msm8916.c
+@@ -1438,6 +1438,7 @@ static const struct freq_tbl ftbl_codec_
+
+ static struct clk_rcg2 codec_digcodec_clk_src = {
+ .cmd_rcgr = 0x1c09c,
++ .mnd_width = 8,
+ .hid_width = 5,
+ .parent_map = gcc_xo_gpll1_emclk_sleep_map,
+ .freq_tbl = ftbl_codec_clk,
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Tero Kristo <t-kristo@ti.com>
+Date: Thu, 12 Oct 2017 10:55:29 +0300
+Subject: clk: ti: clkctrl: add support for retrying failed init
+
+From: Tero Kristo <t-kristo@ti.com>
+
+
+[ Upstream commit 729e13bf58e643b9accd2a14c55b555958702fb0 ]
+
+In case the clkctrl node contains assigned-clock-* entries, registering
+the provider can fail with -EPROBE_DEFER. In this case, add the
+provider to the retry_init clock list so it will be cleaned up later.
+
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Acked-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/ti/clkctrl.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -400,6 +400,12 @@ _ti_clkctrl_setup_subclks(struct omap_cl
+ }
+ }
+
++static void __init _clkctrl_add_provider(void *data,
++ struct device_node *np)
++{
++ of_clk_add_hw_provider(np, _ti_omap4_clkctrl_xlate, data);
++}
++
+ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
+ {
+ struct omap_clkctrl_provider *provider;
+@@ -411,6 +417,7 @@ static void __init _ti_omap4_clkctrl_set
+ struct omap_clkctrl_clk *clkctrl_clk;
+ const __be32 *addrp;
+ u32 addr;
++ int ret;
+
+ addrp = of_get_address(node, 0, NULL, NULL);
+ addr = (u32)of_translate_address(node, addrp);
+@@ -485,7 +492,10 @@ static void __init _ti_omap4_clkctrl_set
+ reg_data++;
+ }
+
+- of_clk_add_hw_provider(node, _ti_omap4_clkctrl_xlate, provider);
++ ret = of_clk_add_hw_provider(node, _ti_omap4_clkctrl_xlate, provider);
++ if (ret == -EPROBE_DEFER)
++ ti_clk_retry_init(node, provider, _clkctrl_add_provider);
++
+ return;
+
+ cleanup:
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 23 Nov 2017 14:27:07 +0100
+Subject: cpufreq: Fix governor module removal race
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+
+[ Upstream commit a8b149d32b663c1a4105273295184b78f53d33cf ]
+
+It is possible to remove a cpufreq governor module after
+cpufreq_parse_governor() has returned success in
+store_scaling_governor() and before cpufreq_set_policy()
+acquires a reference to it, because the governor list is
+not protected during that period and nothing prevents the
+governor from being unregistered then.
+
+Prevent that from happening by acquiring an extra reference
+to the governor module temporarily in cpufreq_parse_governor(),
+under cpufreq_governor_mutex, and dropping it in
+store_scaling_governor(), when cpufreq_set_policy() returns.
+
+Note that the second cpufreq_parse_governor() call site is fine,
+because it only cares about the policy member of new_policy.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/cpufreq.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -631,6 +631,8 @@ static int cpufreq_parse_governor(char *
+ *governor = t;
+ err = 0;
+ }
++ if (t && !try_module_get(t->owner))
++ t = NULL;
+
+ mutex_unlock(&cpufreq_governor_mutex);
+ }
+@@ -759,6 +761,10 @@ static ssize_t store_scaling_governor(st
+ return -EINVAL;
+
+ ret = cpufreq_set_policy(policy, &new_policy);
++
++ if (new_policy.governor)
++ module_put(new_policy.governor->owner);
++
+ return ret ? ret : count;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Horia Geantă" <horia.geanta@nxp.com>
+Date: Tue, 28 Nov 2017 18:48:08 +0200
+Subject: crypto: caam/qi - use correct print specifier for size_t
+
+From: "Horia Geantă" <horia.geanta@nxp.com>
+
+
+[ Upstream commit 9db09e3bad65393dc23b0279beb7f3754d77065c ]
+
+Fix below warnings on ARMv7 by using %zu for printing size_t values:
+
+drivers/crypto/caam/caamalg_qi.c: In function aead_edesc_alloc:
+drivers/crypto/caam/caamalg_qi.c:417:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
+ sizeof(struct qm_sg_entry))
+ ^
+drivers/crypto/caam/caamalg_qi.c:672:16: note: in expansion of macro CAAM_QI_MAX_AEAD_SG
+ qm_sg_ents, CAAM_QI_MAX_AEAD_SG);
+ ^
+drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_edesc_alloc:
+drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
+ sizeof(struct qm_sg_entry))
+ ^
+drivers/crypto/caam/caamalg_qi.c:909:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG
+ qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
+ ^
+drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_giv_edesc_alloc:
+drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
+ sizeof(struct qm_sg_entry))
+ ^
+drivers/crypto/caam/caamalg_qi.c:1062:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG
+ qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
+ ^
+
+Fixes: eb9ba37dc15a ("crypto: caam/qi - handle large number of S/Gs case")
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/caam/caamalg_qi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -668,7 +668,7 @@ static struct aead_edesc *aead_edesc_all
+ qm_sg_ents = 1 + !!ivsize + mapped_src_nents +
+ (mapped_dst_nents > 1 ? mapped_dst_nents : 0);
+ if (unlikely(qm_sg_ents > CAAM_QI_MAX_AEAD_SG)) {
+- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n",
++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n",
+ qm_sg_ents, CAAM_QI_MAX_AEAD_SG);
+ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents,
+ iv_dma, ivsize, op_type, 0, 0);
+@@ -905,7 +905,7 @@ static struct ablkcipher_edesc *ablkciph
+
+ qm_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0;
+ if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) {
+- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n",
++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n",
+ qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
+ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents,
+ iv_dma, ivsize, op_type, 0, 0);
+@@ -1058,7 +1058,7 @@ static struct ablkcipher_edesc *ablkciph
+ }
+
+ if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) {
+- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n",
++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n",
+ qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
+ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents,
+ iv_dma, ivsize, GIVENCRYPT, 0, 0);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 15 Nov 2017 12:37:19 +0000
+Subject: crypto: cavium - fix memory leak on info
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 87aae50af730a28dc1d8846d86dca5e9aa724a9f ]
+
+The object info is being leaked on an error return path, fix this
+by setting ret to -ENOMEM and exiting via the request_cleanup path
+that will free info.
+
+Detected by CoverityScan, CID#1408439 ("Resource Leak")
+
+Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
+@@ -459,7 +459,8 @@ int process_request(struct cpt_vf *cptvf
+ info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL);
+ if (unlikely(!info->completion_addr)) {
+ dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto request_cleanup;
+ }
+
+ result = (union cpt_res_s *)info->completion_addr;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Pierre <pinaraf@pinaraf.info>
+Date: Sun, 12 Nov 2017 15:24:32 +0100
+Subject: crypto: ecc - Fix NULL pointer deref. on no default_rng
+
+From: Pierre <pinaraf@pinaraf.info>
+
+
+[ Upstream commit 4c0e22c90510308433272d7ba281b1eb4eda8209 ]
+
+If crypto_get_default_rng returns an error, the
+function ecc_gen_privkey should return an error.
+Instead, it currently tries to use the default_rng
+nevertheless, thus creating a kernel panic with a
+NULL pointer dereference.
+Returning the error directly, as was supposedly
+intended when looking at the code, fixes this.
+
+Signed-off-by: Pierre Ducroquet <pinaraf@pinaraf.info>
+Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/ecc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/crypto/ecc.c
++++ b/crypto/ecc.c
+@@ -964,7 +964,7 @@ int ecc_gen_privkey(unsigned int curve_i
+ * DRBG with a security strength of 256.
+ */
+ if (crypto_get_default_rng())
+- err = -EFAULT;
++ return -EFAULT;
+
+ err = crypto_rng_get_bytes(crypto_default_rng, (u8 *)priv, nbytes);
+ crypto_put_default_rng();
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Heinz Mauelshagen <heinzm@redhat.com>
+Date: Sat, 2 Dec 2017 01:03:51 +0100
+Subject: dm raid: fix raid set size revalidation
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+
+[ Upstream commit 61e06e2c3ebd986050958513bfa40dceed756f8f ]
+
+The raid set size is being revalidated unconditionally before a
+reshaping conversion is started. MD requires the size to only be
+reduced in case of a stripe removing (i.e. shrinking) reshape but not
+when growing because the raid array has to stay small until after the
+growing reshape finishes.
+
+Fix by avoiding the size revalidation in preresume unless a shrinking
+reshape is requested.
+
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-raid.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -675,15 +675,11 @@ static struct raid_type *get_raid_type_b
+ return NULL;
+ }
+
+-/*
+- * Conditionally change bdev capacity of @rs
+- * in case of a disk add/remove reshape
+- */
+-static void rs_set_capacity(struct raid_set *rs)
++/* Adjust rdev sectors */
++static void rs_set_rdev_sectors(struct raid_set *rs)
+ {
+ struct mddev *mddev = &rs->md;
+ struct md_rdev *rdev;
+- struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table));
+
+ /*
+ * raid10 sets rdev->sector to the device size, which
+@@ -692,8 +688,16 @@ static void rs_set_capacity(struct raid_
+ rdev_for_each(rdev, mddev)
+ if (!test_bit(Journal, &rdev->flags))
+ rdev->sectors = mddev->dev_sectors;
++}
+
+- set_capacity(gendisk, mddev->array_sectors);
++/*
++ * Change bdev capacity of @rs in case of a disk add/remove reshape
++ */
++static void rs_set_capacity(struct raid_set *rs)
++{
++ struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table));
++
++ set_capacity(gendisk, rs->md.array_sectors);
+ revalidate_disk(gendisk);
+ }
+
+@@ -1674,8 +1678,11 @@ static void do_table_event(struct work_s
+ struct raid_set *rs = container_of(ws, struct raid_set, md.event_work);
+
+ smp_rmb(); /* Make sure we access most actual mddev properties */
+- if (!rs_is_reshaping(rs))
++ if (!rs_is_reshaping(rs)) {
++ if (rs_is_raid10(rs))
++ rs_set_rdev_sectors(rs);
+ rs_set_capacity(rs);
++ }
+ dm_table_event(rs->ti->table);
+ }
+
+@@ -3845,11 +3852,10 @@ static int raid_preresume(struct dm_targ
+ mddev->resync_min = mddev->recovery_cp;
+ }
+
+- rs_set_capacity(rs);
+-
+ /* Check for any reshape request unless new raid set */
+ if (test_and_clear_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) {
+ /* Initiate a reshape. */
++ rs_set_rdev_sectors(rs);
+ mddev_lock_nointr(mddev);
+ r = rs_start_reshape(rs);
+ mddev_unlock(mddev);
+@@ -3878,6 +3884,10 @@ static void raid_resume(struct dm_target
+ mddev->ro = 0;
+ mddev->in_sync = 0;
+
++ /* Only reduce raid set size before running a disk removing reshape. */
++ if (mddev->delta_disks < 0)
++ rs_set_capacity(rs);
++
+ /*
+ * Keep the RAID set frozen if reshape/rebuild flags are set.
+ * The RAID set is unfrozen once the next table load/resume,
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 14 Nov 2017 16:27:19 +0000
+Subject: dma-buf/fence: Fix lock inversion within dma-fence-array
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+
+[ Upstream commit 03e4e0a9e02cf703da331ff6cfd57d0be9bf5692 ]
+
+Ages ago Rob Clark noted,
+
+"Currently with fence-array, we have a potential deadlock situation. If
+we fence_add_callback() on an array-fence, the array-fence's lock is
+acquired first, and in it's ->enable_signaling() callback, it will install
+cbs on it's array-member fences, so the array-member's lock is acquired
+second.
+
+But in the signal path, the array-member's lock is acquired first, and
+the array-fence's lock acquired second."
+
+Rob proposed either extensive changes to dma-fence to unnest the
+fence-array signaling, or to defer the signaling onto a workqueue. This
+is a more refined version of the later, that should keep the latency
+of the fence signaling to a minimum by using an irq-work, which is
+executed asap.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Suggested-by: Rob Clark <robdclark@gmail.com>
+References: 1476635975-21981-1-git-send-email-robdclark@gmail.com
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Christian König <christian.koenig@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171114162719.30958-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/Kconfig | 1 +
+ drivers/dma-buf/dma-fence-array.c | 14 ++++++++++++--
+ include/linux/dma-fence-array.h | 3 +++
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/Kconfig
++++ b/drivers/base/Kconfig
+@@ -249,6 +249,7 @@ config DMA_SHARED_BUFFER
+ bool
+ default n
+ select ANON_INODES
++ select IRQ_WORK
+ help
+ This option enables the framework for buffer-sharing between
+ multiple drivers. A buffer is associated with a file using driver
+--- a/drivers/dma-buf/dma-fence-array.c
++++ b/drivers/dma-buf/dma-fence-array.c
+@@ -31,6 +31,14 @@ static const char *dma_fence_array_get_t
+ return "unbound";
+ }
+
++static void irq_dma_fence_array_work(struct irq_work *wrk)
++{
++ struct dma_fence_array *array = container_of(wrk, typeof(*array), work);
++
++ dma_fence_signal(&array->base);
++ dma_fence_put(&array->base);
++}
++
+ static void dma_fence_array_cb_func(struct dma_fence *f,
+ struct dma_fence_cb *cb)
+ {
+@@ -39,8 +47,9 @@ static void dma_fence_array_cb_func(stru
+ struct dma_fence_array *array = array_cb->array;
+
+ if (atomic_dec_and_test(&array->num_pending))
+- dma_fence_signal(&array->base);
+- dma_fence_put(&array->base);
++ irq_work_queue(&array->work);
++ else
++ dma_fence_put(&array->base);
+ }
+
+ static bool dma_fence_array_enable_signaling(struct dma_fence *fence)
+@@ -136,6 +145,7 @@ struct dma_fence_array *dma_fence_array_
+ spin_lock_init(&array->lock);
+ dma_fence_init(&array->base, &dma_fence_array_ops, &array->lock,
+ context, seqno);
++ init_irq_work(&array->work, irq_dma_fence_array_work);
+
+ array->num_fences = num_fences;
+ atomic_set(&array->num_pending, signal_on_any ? 1 : num_fences);
+--- a/include/linux/dma-fence-array.h
++++ b/include/linux/dma-fence-array.h
+@@ -21,6 +21,7 @@
+ #define __LINUX_DMA_FENCE_ARRAY_H
+
+ #include <linux/dma-fence.h>
++#include <linux/irq_work.h>
+
+ /**
+ * struct dma_fence_array_cb - callback helper for fence array
+@@ -47,6 +48,8 @@ struct dma_fence_array {
+ unsigned num_fences;
+ atomic_t num_pending;
+ struct dma_fence **fences;
++
++ struct irq_work work;
+ };
+
+ extern const struct dma_fence_ops dma_fence_array_ops;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Tue, 14 Nov 2017 16:32:09 +0200
+Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ]
+
+To avoid race with vchan_complete, use the race free way to terminate
+running transfer.
+
+Implement the device_synchronize callback to make sure that the terminated
+descriptor is freed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/amba-pl08x.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/amba-pl08x.c
++++ b/drivers/dma/amba-pl08x.c
+@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm
+ }
+ /* Dequeue jobs and free LLIs */
+ if (plchan->at) {
+- pl08x_desc_free(&plchan->at->vd);
++ vchan_terminate_vdesc(&plchan->at->vd);
+ plchan->at = NULL;
+ }
+ /* Dequeue jobs not yet fired as well */
+@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm
+ return 0;
+ }
+
++static void pl08x_synchronize(struct dma_chan *chan)
++{
++ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
++
++ vchan_synchronize(&plchan->vc);
++}
++
+ static int pl08x_pause(struct dma_chan *chan)
+ {
+ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
+@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic
+ pl08x->memcpy.device_pause = pl08x_pause;
+ pl08x->memcpy.device_resume = pl08x_resume;
+ pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
++ pl08x->memcpy.device_synchronize = pl08x_synchronize;
+ pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+ pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+ pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
+@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic
+ pl08x->slave.device_pause = pl08x_pause;
+ pl08x->slave.device_resume = pl08x_resume;
+ pl08x->slave.device_terminate_all = pl08x_terminate_all;
++ pl08x->slave.device_synchronize = pl08x_synchronize;
+ pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+ pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+ pl08x->slave.directions =
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Tue, 14 Nov 2017 16:32:07 +0200
+Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ]
+
+To avoid race with vchan_complete, use the race free way to terminate
+running transfer.
+
+Implement the device_synchronize callback to make sure that the terminated
+descriptor is freed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm2835-dma.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str
+ * c->desc is NULL and exit.)
+ */
+ if (c->desc) {
+- bcm2835_dma_desc_free(&c->desc->vd);
++ vchan_terminate_vdesc(&c->desc->vd);
+ c->desc = NULL;
+ bcm2835_dma_abort(c->chan_base);
+
+@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str
+ return 0;
+ }
+
++static void bcm2835_dma_synchronize(struct dma_chan *chan)
++{
++ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
++
++ vchan_synchronize(&c->vc);
++}
++
+ static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id,
+ int irq, unsigned int irq_flags)
+ {
+@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat
+ od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy;
+ od->ddev.device_config = bcm2835_dma_slave_config;
+ od->ddev.device_terminate_all = bcm2835_dma_terminate_all;
++ od->ddev.device_synchronize = bcm2835_dma_synchronize;
+ od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
+ od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) |
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Sinan Kaya <okaya@codeaurora.org>
+Date: Tue, 14 Nov 2017 09:55:01 -0500
+Subject: dmaengine: qcom_hidma: check pending interrupts
+
+From: Sinan Kaya <okaya@codeaurora.org>
+
+
+[ Upstream commit 38680bc6b1e3592bc9e18adc1d6e259667df27ce ]
+
+Driver is missing the interrupts if two requests are queued up at the same
+time as the interrupt handler is servicing a request that was just
+delivered.
+
+The ISR clears the interrupt at the end but it could be clearing the
+interrupt for an outstanding event. Therefore, second interrupt never
+arrives.
+
+Clear the interrupt first and then check for completions.
+
+Also, make sure that request start and interrupt clear do not overlap in
+time by using a spinlock.
+
+Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/qcom/hidma_ll.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/qcom/hidma_ll.c
++++ b/drivers/dma/qcom/hidma_ll.c
+@@ -393,6 +393,8 @@ static int hidma_ll_reset(struct hidma_l
+ */
+ static void hidma_ll_int_handler_internal(struct hidma_lldev *lldev, int cause)
+ {
++ unsigned long irqflags;
++
+ if (cause & HIDMA_ERR_INT_MASK) {
+ dev_err(lldev->dev, "error 0x%x, disabling...\n",
+ cause);
+@@ -410,6 +412,10 @@ static void hidma_ll_int_handler_interna
+ return;
+ }
+
++ spin_lock_irqsave(&lldev->lock, irqflags);
++ writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG);
++ spin_unlock_irqrestore(&lldev->lock, irqflags);
++
+ /*
+ * Fine tuned for this HW...
+ *
+@@ -421,9 +427,6 @@ static void hidma_ll_int_handler_interna
+ * Try to consume as many EVREs as possible.
+ */
+ hidma_handle_tre_completion(lldev);
+-
+- /* We consumed TREs or there are pending TREs or EVREs. */
+- writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG);
+ }
+
+ irqreturn_t hidma_ll_inthandler(int chirq, void *arg)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Mon, 27 Nov 2017 18:29:43 -0500
+Subject: drm/amdgpu: fix get_max_engine_clock_in_mhz
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+
+[ Upstream commit a9efcc19161e20623c285fac967a32842972cebe ]
+
+Use proper powerplay function. This fixes OpenCL initialization
+problems.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Acked-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -265,6 +265,9 @@ uint32_t get_max_engine_clock_in_mhz(str
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
+
+- /* The sclk is in quantas of 10kHz */
+- return adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk / 100;
++ /* the sclk is in quantas of 10kHz */
++ if (amdgpu_sriov_vf(adev))
++ return adev->clock.default_sclk / 100;
++
++ return amdgpu_dpm_get_sclk(adev, false) / 100;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Monk Liu <Monk.Liu@amd.com>
+Date: Tue, 24 Oct 2017 15:10:11 +0800
+Subject: drm/amdgpu:fix random missing of FLR NOTIFY
+
+From: Monk Liu <Monk.Liu@amd.com>
+
+
+[ Upstream commit 34a4d2bf06b3ab92024b8e26d6049411369d1f1a ]
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+@@ -276,9 +276,17 @@ static int xgpu_ai_mailbox_rcv_irq(struc
+ /* see what event we get */
+ r = xgpu_ai_mailbox_rcv_msg(adev, IDH_FLR_NOTIFICATION);
+
+- /* only handle FLR_NOTIFY now */
+- if (!r)
+- schedule_work(&adev->virt.flr_work);
++ /* sometimes the interrupt is delayed to inject to VM, so under such case
++ * the IDH_FLR_NOTIFICATION is overwritten by VF FLR from GIM side, thus
++ * above recieve message could be failed, we should schedule the flr_work
++ * anyway
++ */
++ if (r) {
++ DRM_ERROR("FLR_NOTIFICATION is missed\n");
++ xgpu_ai_mailbox_send_ack(adev);
++ }
++
++ schedule_work(&adev->virt.flr_work);
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Monk Liu <Monk.Liu@amd.com>
+Date: Wed, 15 Nov 2017 17:10:13 +0800
+Subject: drm/amdgpu:fix virtual dce bug
+
+From: Monk Liu <Monk.Liu@amd.com>
+
+
+[ Upstream commit 129d65c18ecfb249aceb540c31fdaf79bd5a11ff ]
+
+this fix the issue that access memory after freed
+after driver unloaded.
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/dce_virtual.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c
+@@ -437,6 +437,8 @@ static int dce_virtual_sw_fini(void *han
+ drm_kms_helper_poll_fini(adev->ddev);
+
+ drm_mode_config_cleanup(adev->ddev);
++ /* clear crtcs pointer to avoid dce irq finish routine access freed data */
++ memset(adev->mode_info.crtcs, 0, sizeof(adev->mode_info.crtcs[0]) * AMDGPU_MAX_CRTCS);
+ adev->mode_info.mode_config_initialized = false;
+ return 0;
+ }
+@@ -723,7 +725,7 @@ static void dce_virtual_set_crtc_vblank_
+ int crtc,
+ enum amdgpu_interrupt_state state)
+ {
+- if (crtc >= adev->mode_info.num_crtc) {
++ if (crtc >= adev->mode_info.num_crtc || !adev->mode_info.crtcs[crtc]) {
+ DRM_DEBUG("invalid crtc %d\n", crtc);
+ return;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Yong Zhao <yong.zhao@amd.com>
+Date: Fri, 8 Dec 2017 23:08:48 -0500
+Subject: drm/amdkfd: Fix memory leaks in kfd topology
+
+From: Yong Zhao <yong.zhao@amd.com>
+
+
+[ Upstream commit 5108d768408abc80e4e8d99f5b406a73cb04056b ]
+
+Kobject created using kobject_create_and_add() can be freed using
+kobject_put() when there is no referenece any more. However,
+kobject memory allocated with kzalloc() has to set up a release
+callback in order to free it when the counter decreases to 0.
+Otherwise it causes memory leak.
+
+Signed-off-by: Yong Zhao <yong.zhao@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -501,11 +501,17 @@ static ssize_t sysprops_show(struct kobj
+ return ret;
+ }
+
++static void kfd_topology_kobj_release(struct kobject *kobj)
++{
++ kfree(kobj);
++}
++
+ static const struct sysfs_ops sysprops_ops = {
+ .show = sysprops_show,
+ };
+
+ static struct kobj_type sysprops_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &sysprops_ops,
+ };
+
+@@ -541,6 +547,7 @@ static const struct sysfs_ops iolink_ops
+ };
+
+ static struct kobj_type iolink_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &iolink_ops,
+ };
+
+@@ -568,6 +575,7 @@ static const struct sysfs_ops mem_ops =
+ };
+
+ static struct kobj_type mem_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &mem_ops,
+ };
+
+@@ -607,6 +615,7 @@ static const struct sysfs_ops cache_ops
+ };
+
+ static struct kobj_type cache_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &cache_ops,
+ };
+
+@@ -729,6 +738,7 @@ static const struct sysfs_ops node_ops =
+ };
+
+ static struct kobj_type node_type = {
++ .release = kfd_topology_kobj_release,
+ .sysfs_ops = &node_ops,
+ };
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 1 Nov 2017 16:20:58 +0200
+Subject: drm/edid: set ELD connector type in drm_edid_to_eld()
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+
+[ Upstream commit 1d1c36650752b7fb81cee515a9bba4131cac4b7c ]
+
+Since drm_edid_to_eld() knows the connector type, we can set the type in
+ELD while at it. Most connectors this gets called on are not DP
+encoders, and with the HDMI type being 0, this does not change behaviour
+for non-DP.
+
+For i915 having this in place earlier would have saved a considerable
+amount of debugging that lead to the fix 2d8f63297b9f ("drm/i915: always
+update ELD connector type after get modes"). I don't see other drivers,
+even the ones calling drm_edid_to_eld() on DP connectors, setting the
+connector type in ELD.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Archit Taneja <architt@codeaurora.org>
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Mark Yao <mark.yao@rock-chips.com>
+Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Cc: Vincent Abriou <vincent.abriou@st.com>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: Eric Anholt <eric@anholt.net>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/d527b31619528c477c2c136f25cdf118bc0cfc1d.1509545641.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_edid.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -3823,8 +3823,7 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name)
+ * @edid: EDID to parse
+ *
+ * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The
+- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to
+- * fill in.
++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in.
+ */
+ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid)
+ {
+@@ -3905,6 +3904,12 @@ void drm_edid_to_eld(struct drm_connecto
+ }
+ eld[5] |= total_sad_count << 4;
+
++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
++ connector->connector_type == DRM_MODE_CONNECTOR_eDP)
++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP;
++ else
++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI;
++
+ eld[DRM_ELD_BASELINE_ELD_LEN] =
+ DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4);
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Fri, 1 Dec 2017 16:00:41 +0100
+Subject: drm/etnaviv: make THERMAL selectable
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+
+[ Upstream commit 49b82c389d2a40eaef1355aaa35868b367aec9d1 ]
+
+The etnaviv driver causes a link failure if it is built-in but THERMAL
+is built as a module:
+
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_bind':
+ etnaviv_gpu.c:(.text+0x4c4): undefined reference to `thermal_of_cooling_device_register'
+ etnaviv_gpu.c:(.text+0x600): undefined reference to `thermal_cooling_device_unregister'
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_unbind':
+ etnaviv_gpu.c:(.text+0x2aac): undefined reference to `thermal_cooling_device_unregister'
+
+Adding a Kconfig dependency on THERMAL || !THERMAL to avoid this causes
+a dependency loop on x86_64:
+
+ drivers/gpu/drm/tve200/Kconfig:1:error: recursive dependency detected!
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/gpu/drm/tve200/Kconfig:1: symbol DRM_TVE200 depends on CMA
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ mm/Kconfig:489: symbol CMA is selected by DRM_ETNAVIV
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/gpu/drm/etnaviv/Kconfig:2: symbol DRM_ETNAVIV depends on THERMAL
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/thermal/Kconfig:5: symbol THERMAL is selected by ACPI_VIDEO
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/acpi/Kconfig:189: symbol ACPI_VIDEO is selected by BACKLIGHT_CLASS_DEVICE
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/video/backlight/Kconfig:158: symbol BACKLIGHT_CLASS_DEVICE is selected by DRM_PARADE_PS8622
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/gpu/drm/bridge/Kconfig:62: symbol DRM_PARADE_PS8622 depends on DRM_BRIDGE
+ For a resolution refer to Documentation/kbuild/kconfig-language.txt
+ subsection "Kconfig recursive dependency limitations"
+ drivers/gpu/drm/bridge/Kconfig:1: symbol DRM_BRIDGE is selected by DRM_TVE200
+
+To work around this, add a new option DRM_ETNAVIV_THERMAL to optionally
+enable thermal throttling support and make DRM_ETNAVIV select THERMAL
+at the same time.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/etnaviv/Kconfig | 9 +++++++++
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 8 +++++---
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/etnaviv/Kconfig
++++ b/drivers/gpu/drm/etnaviv/Kconfig
+@@ -6,6 +6,7 @@ config DRM_ETNAVIV
+ depends on MMU
+ select SHMEM
+ select SYNC_FILE
++ select THERMAL if DRM_ETNAVIV_THERMAL
+ select TMPFS
+ select IOMMU_API
+ select IOMMU_SUPPORT
+@@ -15,6 +16,14 @@ config DRM_ETNAVIV
+ help
+ DRM driver for Vivante GPUs.
+
++config DRM_ETNAVIV_THERMAL
++ bool "enable ETNAVIV thermal throttling"
++ depends on DRM_ETNAVIV
++ default y
++ help
++ Compile in support for thermal throttling.
++ Say Y unless you want to risk burning your SoC.
++
+ config DRM_ETNAVIV_REGISTER_LOGGING
+ bool "enable ETNAVIV register logging"
+ depends on DRM_ETNAVIV
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -1622,7 +1622,7 @@ static int etnaviv_gpu_bind(struct devic
+ struct etnaviv_gpu *gpu = dev_get_drvdata(dev);
+ int ret;
+
+- if (IS_ENABLED(CONFIG_THERMAL)) {
++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) {
+ gpu->cooling = thermal_of_cooling_device_register(dev->of_node,
+ (char *)dev_name(dev), gpu, &cooling_ops);
+ if (IS_ERR(gpu->cooling))
+@@ -1635,7 +1635,8 @@ static int etnaviv_gpu_bind(struct devic
+ ret = etnaviv_gpu_clk_enable(gpu);
+ #endif
+ if (ret < 0) {
+- thermal_cooling_device_unregister(gpu->cooling);
++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL))
++ thermal_cooling_device_unregister(gpu->cooling);
+ return ret;
+ }
+
+@@ -1692,7 +1693,8 @@ static void etnaviv_gpu_unbind(struct de
+
+ gpu->drm = NULL;
+
+- thermal_cooling_device_unregister(gpu->cooling);
++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL))
++ thermal_cooling_device_unregister(gpu->cooling);
+ gpu->cooling = NULL;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Fri, 1 Dec 2017 07:05:24 +0100
+Subject: drm/sun4i: Fix format mask in DE2 driver
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+
+[ Upstream commit a2407f4bd1f3001d6b46f6d32eb1cc98a60f5a43 ]
+
+Format mask is one bit too short. Fix it.
+
+Fixes: 9d75b8c0b999 (drm/sun4i: add support for Allwinner DE2 mixers)
+
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171201060550.10392-2-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h
+@@ -80,7 +80,7 @@
+
+ #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_EN BIT(0)
+ #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_MASK GENMASK(2, 1)
+-#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(11, 8)
++#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(12, 8)
+ #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MASK GENMASK(31, 24)
+ #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_DEF (1 << 1)
+ #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_ARGB8888 (0 << 8)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Sat, 9 Dec 2017 17:24:24 +0100
+Subject: Fix misannotated out-of-line _copy_to_user()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+
+[ Upstream commit a0e94598e6b6c0d1df6a5fa14eb7c767ca817a20 ]
+
+Destination is a kernel pointer and source - a userland one
+in _copy_from_user(); _copy_to_user() is the other way round.
+
+Fixes: d597580d37377 ("generic ...copy_..._user primitives")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/usercopy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/usercopy.c
++++ b/lib/usercopy.c
+@@ -20,7 +20,7 @@ EXPORT_SYMBOL(_copy_from_user);
+ #endif
+
+ #ifndef INLINE_COPY_TO_USER
+-unsigned long _copy_to_user(void *to, const void __user *from, unsigned long n)
++unsigned long _copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+ might_fault();
+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Wed, 22 Nov 2017 11:19:51 +0100
+Subject: HID: elo: clear BTN_LEFT mapping
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+
+[ Upstream commit 9abd04af951e5734c9d5cfee9b49790844b734cf ]
+
+ELO devices have one Button usage in GenDesk field, which makes hid-input map
+it to BTN_LEFT; that confuses userspace, which then considers the device to be
+a mouse/touchpad instead of touchscreen.
+
+Fix that by unmapping BTN_LEFT and keeping only BTN_TOUCH in place.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-elo.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hid/hid-elo.c
++++ b/drivers/hid/hid-elo.c
+@@ -42,6 +42,12 @@ static int elo_input_configured(struct h
+ {
+ struct input_dev *input = hidinput->input;
+
++ /*
++ * ELO devices have one Button usage in GenDesk field, which makes
++ * hid-input map it to BTN_LEFT; that confuses userspace, which then
++ * considers the device to be a mouse/touchpad instead of touchscreen.
++ */
++ clear_bit(BTN_LEFT, input->keybit);
+ set_bit(BTN_TOUCH, input->keybit);
+ set_bit(ABS_PRESSURE, input->absbit);
+ input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 22 Nov 2017 12:57:09 +0100
+Subject: HID: multitouch: Only look at non touch fields in first packet of a frame
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+
+[ Upstream commit 55746d28d66860bccaae20a67b55b9d5db7c14af ]
+
+Devices in "single finger hybrid mode" will send one report per finger,
+on some devices only the first report of such a multi-packet frame will
+contain a value for BTN_LEFT, in subsequent reports (if multiple fingers
+are down) the value is always 0, causing hid-mt to report BTN_LEFT going
+1 - 0 - 1 - 0 when pressing a clickpad and putting down a second finger.
+This happens for example on USB 0603:0002 mt touchpads.
+
+This commit fixes this by only reporting non touch fields for the first
+packet of a (possibly) multi-packet frame.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-multitouch.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -738,9 +738,11 @@ static int mt_touch_event(struct hid_dev
+ }
+
+ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
+- struct hid_usage *usage, __s32 value)
++ struct hid_usage *usage, __s32 value,
++ bool first_packet)
+ {
+ struct mt_device *td = hid_get_drvdata(hid);
++ __s32 cls = td->mtclass.name;
+ __s32 quirks = td->mtclass.quirks;
+ struct input_dev *input = field->hidinput->input;
+
+@@ -794,6 +796,15 @@ static void mt_process_mt_event(struct h
+ break;
+
+ default:
++ /*
++ * For Win8 PTP touchpads we should only look at
++ * non finger/touch events in the first_packet of
++ * a (possible) multi-packet frame.
++ */
++ if ((cls == MT_CLS_WIN_8 || cls == MT_CLS_WIN_8_DUAL) &&
++ !first_packet)
++ return;
++
+ if (usage->type)
+ input_event(input, usage->type, usage->code,
+ value);
+@@ -813,6 +824,7 @@ static void mt_touch_report(struct hid_d
+ {
+ struct mt_device *td = hid_get_drvdata(hid);
+ struct hid_field *field;
++ bool first_packet;
+ unsigned count;
+ int r, n;
+
+@@ -831,6 +843,7 @@ static void mt_touch_report(struct hid_d
+ td->num_expected = value;
+ }
+
++ first_packet = td->num_received == 0;
+ for (r = 0; r < report->maxfield; r++) {
+ field = report->field[r];
+ count = field->report_count;
+@@ -840,7 +853,7 @@ static void mt_touch_report(struct hid_d
+
+ for (n = 0; n < count; n++)
+ mt_process_mt_event(hid, field, &field->usage[n],
+- field->value[n]);
++ field->value[n], first_packet);
+ }
+
+ if (td->num_received >= td->num_expected)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 11 Dec 2017 12:45:44 +0100
+Subject: IB/mlx5: revisit -Wmaybe-uninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 1b19b95169cd52fe82cd442fec0b279fe25cc838 ]
+
+A warning that I thought I had fixed before occasionally comes
+back in rare randconfig builds (I found 7 instances in the last
+100000 builds, originally it was much more frequent):
+
+drivers/infiniband/hw/mlx5/mr.c: In function 'mlx5_ib_reg_user_mr':
+drivers/infiniband/hw/mlx5/mr.c:1229:5: error: 'order' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ if (order <= mr_cache_max_order(dev)) {
+ ^
+drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'ncont' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'page_shift' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+drivers/infiniband/hw/mlx5/mr.c:1260:2: error: 'npages' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+I've looked at all those findings again and noticed that they are all
+with CONFIG_INFINIBAND_USER_MEM=n, which means ib_umem_get() returns
+an error unconditionally and we never initialize or use those variables.
+This triggers a condition in gcc iff mr_umem_get() is partially but not
+entirely inlined, which in turn depends on the exact combination of
+optimization settings. This is a known problem with gcc, with no
+easy solution in the compiler, so this adds another workaround that
+should be more reliable than my previous attempt.
+
+Returning an error from mlx5_ib_reg_user_mr() earlier means that we
+can completely bypass the logic that caused the warning, the compiler
+can now see that the variable is never accessed.
+
+Fixes: 14ab8896f5d9 ("IB/mlx5: avoid bogus -Wmaybe-uninitialized warning")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1206,6 +1206,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct
+ int err;
+ bool use_umr = true;
+
++ if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM))
++ return ERR_PTR(-EINVAL);
++
+ mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
+ start, virt_addr, length, access_flags);
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Stefan Brüns" <stefan.bruens@rwth-aachen.de>
+Date: Sat, 28 Oct 2017 23:12:46 +0200
+Subject: iio: adc: ina2xx: Shift bus voltage register to mask flag bits
+
+From: "Stefan Brüns" <stefan.bruens@rwth-aachen.de>
+
+
+[ Upstream commit 2e64438487697f3f099946edc8acd4ceea6b1ab2 ]
+
+Lower bits of the INA219/220 bus voltage register are conversion
+status flags, properly shift the value.
+
+When reading via IIO buffer, the value is passed on unaltered,
+shifting is the responsibility of the user.
+
+Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ina2xx-adc.c | 26 +++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+--- a/drivers/iio/adc/ina2xx-adc.c
++++ b/drivers/iio/adc/ina2xx-adc.c
+@@ -44,7 +44,6 @@
+
+ #define INA226_MASK_ENABLE 0x06
+ #define INA226_CVRF BIT(3)
+-#define INA219_CNVR BIT(1)
+
+ #define INA2XX_MAX_REGISTERS 8
+
+@@ -79,6 +78,11 @@
+ #define INA226_ITS_MASK GENMASK(5, 3)
+ #define INA226_SHIFT_ITS(val) ((val) << 3)
+
++/* INA219 Bus voltage register, low bits are flags */
++#define INA219_OVF BIT(0)
++#define INA219_CNVR BIT(1)
++#define INA219_BUS_VOLTAGE_SHIFT 3
++
+ /* Cosmetic macro giving the sampling period for a full P=UxI cycle */
+ #define SAMPLING_PERIOD(c) ((c->int_time_vbus + c->int_time_vshunt) \
+ * c->avg)
+@@ -112,7 +116,7 @@ struct ina2xx_config {
+ u16 config_default;
+ int calibration_factor;
+ int shunt_div;
+- int bus_voltage_shift;
++ int bus_voltage_shift; /* position of lsb */
+ int bus_voltage_lsb; /* uV */
+ int power_lsb; /* uW */
+ enum ina2xx_ids chip_id;
+@@ -135,7 +139,7 @@ static const struct ina2xx_config ina2xx
+ .config_default = INA219_CONFIG_DEFAULT,
+ .calibration_factor = 40960000,
+ .shunt_div = 100,
+- .bus_voltage_shift = 3,
++ .bus_voltage_shift = INA219_BUS_VOLTAGE_SHIFT,
+ .bus_voltage_lsb = 4000,
+ .power_lsb = 20000,
+ .chip_id = ina219,
+@@ -170,6 +174,9 @@ static int ina2xx_read_raw(struct iio_de
+ else
+ *val = regval;
+
++ if (chan->address == INA2XX_BUS_VOLTAGE)
++ *val >>= chip->config->bus_voltage_shift;
++
+ return IIO_VAL_INT;
+
+ case IIO_CHAN_INFO_OVERSAMPLING_RATIO:
+@@ -203,9 +210,9 @@ static int ina2xx_read_raw(struct iio_de
+ return IIO_VAL_FRACTIONAL;
+
+ case INA2XX_BUS_VOLTAGE:
+- /* processed (mV) = raw*lsb (uV) / (1000 << shift) */
++ /* processed (mV) = raw * lsb (uV) / 1000 */
+ *val = chip->config->bus_voltage_lsb;
+- *val2 = 1000 << chip->config->bus_voltage_shift;
++ *val2 = 1000;
+ return IIO_VAL_FRACTIONAL;
+
+ case INA2XX_POWER:
+@@ -532,7 +539,7 @@ static ssize_t ina2xx_shunt_resistor_sto
+ * Sampling Freq is a consequence of the integration times of
+ * the Voltage channels.
+ */
+-#define INA219_CHAN_VOLTAGE(_index, _address) { \
++#define INA219_CHAN_VOLTAGE(_index, _address, _shift) { \
+ .type = IIO_VOLTAGE, \
+ .address = (_address), \
+ .indexed = 1, \
+@@ -544,7 +551,8 @@ static ssize_t ina2xx_shunt_resistor_sto
+ .scan_index = (_index), \
+ .scan_type = { \
+ .sign = 'u', \
+- .realbits = 16, \
++ .shift = _shift, \
++ .realbits = 16 - _shift, \
+ .storagebits = 16, \
+ .endianness = IIO_LE, \
+ } \
+@@ -579,8 +587,8 @@ static const struct iio_chan_spec ina226
+ };
+
+ static const struct iio_chan_spec ina219_channels[] = {
+- INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE),
+- INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE),
++ INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE, 0),
++ INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE, INA219_BUS_VOLTAGE_SHIFT),
+ INA219_CHAN(IIO_POWER, 2, INA2XX_POWER),
+ INA219_CHAN(IIO_CURRENT, 3, INA2XX_CURRENT),
+ IIO_CHAN_SOFT_TIMESTAMP(4),
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
+Date: Fri, 27 Oct 2017 21:45:38 +0200
+Subject: iio: health: max30102: Add power enable parameter to get_temp function
+
+From: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
+
+
+[ Upstream commit a9c47abbdd71dceeaf1b923e5ce10e700e036905 ]
+
+Chip must not be in shutdown for reading temperature, so briefly leave
+shutdown if buffer is not already running
+
+Signed-off-by: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/health/max30102.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+--- a/drivers/iio/health/max30102.c
++++ b/drivers/iio/health/max30102.c
+@@ -329,20 +329,31 @@ static int max30102_read_temp(struct max
+ return 0;
+ }
+
+-static int max30102_get_temp(struct max30102_data *data, int *val)
++static int max30102_get_temp(struct max30102_data *data, int *val, bool en)
+ {
+ int ret;
+
++ if (en) {
++ ret = max30102_set_powermode(data, true);
++ if (ret)
++ return ret;
++ }
++
+ /* start acquisition */
+ ret = regmap_update_bits(data->regmap, MAX30102_REG_TEMP_CONFIG,
+ MAX30102_REG_TEMP_CONFIG_TEMP_EN,
+ MAX30102_REG_TEMP_CONFIG_TEMP_EN);
+ if (ret)
+- return ret;
++ goto out;
+
+ msleep(35);
++ ret = max30102_read_temp(data, val);
++
++out:
++ if (en)
++ max30102_set_powermode(data, false);
+
+- return max30102_read_temp(data, val);
++ return ret;
+ }
+
+ static int max30102_read_raw(struct iio_dev *indio_dev,
+@@ -355,20 +366,19 @@ static int max30102_read_raw(struct iio_
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+ /*
+- * Temperature reading can only be acquired while engine
+- * is running
++ * Temperature reading can only be acquired when not in
++ * shutdown; leave shutdown briefly when buffer not running
+ */
+ mutex_lock(&indio_dev->mlock);
+-
+ if (!iio_buffer_enabled(indio_dev))
+- ret = -EBUSY;
+- else {
+- ret = max30102_get_temp(data, val);
+- if (!ret)
+- ret = IIO_VAL_INT;
+- }
+-
++ ret = max30102_get_temp(data, val, true);
++ else
++ ret = max30102_get_temp(data, val, false);
+ mutex_unlock(&indio_dev->mlock);
++ if (ret)
++ return ret;
++
++ ret = IIO_VAL_INT;
+ break;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 1000; /* 62.5 */
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Date: Wed, 8 Nov 2017 07:38:28 -0500
+Subject: ima: relax requiring a file signature for new files with zero length
+
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+
+[ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ]
+
+Custom policies can require file signatures based on LSM labels. These
+files are normally created and only afterwards labeled, requiring them
+to be signed.
+
+Instead of requiring file signatures based on LSM labels, entire
+filesystems could require file signatures. In this case, we need the
+ability of writing new files without requiring file signatures.
+
+The definition of a "new" file was originally defined as any file with
+a length of zero. Subsequent patches redefined a "new" file to be based
+on the FILE_CREATE open flag. By combining the open flag with a file
+size of zero, this patch relaxes the file signature requirement.
+
+Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/ima_appraise.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -223,7 +223,8 @@ int ima_appraise_measurement(enum ima_ho
+ if (opened & FILE_CREATED)
+ iint->flags |= IMA_NEW_FILE;
+ if ((iint->flags & IMA_NEW_FILE) &&
+- !(iint->flags & IMA_DIGSIG_REQUIRED))
++ (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
++ (inode->i_size == 0)))
+ status = INTEGRITY_PASS;
+ goto out;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Mahesh Bandewar <maheshb@google.com>
+Date: Thu, 7 Dec 2017 15:15:43 -0800
+Subject: ipvlan: add L2 check for packets arriving via virtual devices
+
+From: Mahesh Bandewar <maheshb@google.com>
+
+
+[ Upstream commit 92ff42645028fa6f9b8aa767718457b9264316b4 ]
+
+Packets that don't have dest mac as the mac of the master device should
+not be entertained by the IPvlan rx-handler. This is mostly true as the
+packet path mostly takes care of that, except when the master device is
+a virtual device. As demonstrated in the following case -
+
+ ip netns add ns1
+ ip link add ve1 type veth peer name ve2
+ ip link add link ve2 name iv1 type ipvlan mode l2
+ ip link set dev iv1 netns ns1
+ ip link set ve1 up
+ ip link set ve2 up
+ ip -n ns1 link set iv1 up
+ ip addr add 192.168.10.1/24 dev ve1
+ ip -n ns1 addr 192.168.10.2/24 dev iv1
+ ping -c2 192.168.10.2
+ <Works!>
+ ip neigh show dev ve1
+ ip neigh show 192.168.10.2 lladdr <random> dev ve1
+ ping -c2 192.168.10.2
+ <Still works! Wrong!!>
+
+This patch adds that missing check in the IPvlan rx-handler.
+
+Reported-by: Amit Sikka <amit.sikka@ericsson.com>
+Signed-off-by: Mahesh Bandewar <maheshb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -304,6 +304,10 @@ static int ipvlan_rcv_frame(struct ipvl_
+ if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS)
+ success = true;
+ } else {
++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest,
++ ipvlan->phy_dev->dev_addr))
++ skb->pkt_type = PACKET_OTHERHOST;
++
+ ret = RX_HANDLER_ANOTHER;
+ success = true;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Mon, 20 Nov 2017 18:02:05 +0200
+Subject: iwlwifi: mvm: avoid dumping assert log when device is stopped
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+
+[ Upstream commit 6362ab721ef5c4ecfa01f53ad4137d3d984f0c6c ]
+
+We might erroneously get to error dumping code when the
+device is already stopped.
+
+In that case the driver will detect a defective value and will try to
+reset the HW, assuming it is only a bus issue. The driver than
+proceeds with the dumping.
+
+The result has two side effects:
+
+1. The device won't be stopped again, since the transport status is
+already stopped, so the device remains powered on while it actually
+should be stopped.
+
+2. The dump in that case is completely garbaged and useless.
+
+Detect and avoid this. It will also make debugging such issues
+easier.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -603,6 +603,12 @@ static void iwl_mvm_dump_lmac_error_log(
+
+ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
+ {
++ if (!test_bit(STATUS_DEVICE_ENABLED, &mvm->trans->status)) {
++ IWL_ERR(mvm,
++ "DEVICE_ENABLED bit is not set. Aborting dump.\n");
++ return;
++ }
++
+ iwl_mvm_dump_lmac_error_log(mvm, mvm->error_event_table[0]);
+
+ if (mvm->error_event_table[1])
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 19 Oct 2017 21:36:04 +0300
+Subject: iwlwifi: mvm: rs: don't override the rate history in the search cycle
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+
+[ Upstream commit 992172e3aec19e5b0ea5b757ba40a146b9282d1e ]
+
+When we are in a search cycle, we try different combinations
+of parameters. Those combinations are called 'columns'.
+When we switch to a new column, we first need to check if
+this column has a suitable rate, if not, we can't try it.
+This means we must not erase the statistics we gathered
+for the previous column until we are sure that we are
+indeed switching column.
+
+The code that tries to switch to a new column first sets
+a whole bunch of things for the new column, and only then
+checks that we can find suitable rates in that column.
+While doing that, the code mistakenly erased the rate
+statistics. This code was right until
+struct iwl_scale_tbl_info grew up for TPC.
+
+Fix this to make sure we don't erase the rate statistics
+until we are sure that we can indeed switch to the new
+column.
+
+Note that this bug is really harmless since it causes a
+change in the behavior only when we can't find any rate
+in the new column which should really not happen. In the
+case we do find a suitable we reset the rate statistics
+a few lines later anyway.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1881,12 +1881,10 @@ static int rs_switch_to_column(struct iw
+ struct rs_rate *rate = &search_tbl->rate;
+ const struct rs_tx_column *column = &rs_tx_columns[col_id];
+ const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
+- u32 sz = (sizeof(struct iwl_scale_tbl_info) -
+- (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
+ unsigned long rate_mask = 0;
+ u32 rate_idx = 0;
+
+- memcpy(search_tbl, tbl, sz);
++ memcpy(search_tbl, tbl, offsetof(struct iwl_scale_tbl_info, win));
+
+ rate->sgi = column->sgi;
+ rate->ant = column->ant;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 30 Nov 2017 21:16:56 -0800
+Subject: leds: pm8058: Silence pointer to integer size warning
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+
+[ Upstream commit 8f52df50d9366f770a894d14ef724e5e04574e98 ]
+
+The pointer returned by of_device_get_match_data() doesn't have the same
+size as u32 on 64-bit architectures, causing a compile warning when
+compile-testing the driver on such platform.
+
+Cast the return value of of_device_get_match_data() to unsigned long and
+then to u32 to silence this warning.
+
+Fixes: 7f866986e705 ("leds: add PM8058 LEDs driver")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/leds-pm8058.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/leds-pm8058.c
++++ b/drivers/leds/leds-pm8058.c
+@@ -106,7 +106,7 @@ static int pm8058_led_probe(struct platf
+ if (!led)
+ return -ENOMEM;
+
+- led->ledtype = (u32)of_device_get_match_data(&pdev->dev);
++ led->ledtype = (u32)(unsigned long)of_device_get_match_data(&pdev->dev);
+
+ map = dev_get_regmap(pdev->dev.parent, NULL);
+ if (!map) {
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 15 May 2017 02:07:23 -0700
+Subject: locking/locktorture: Fix num reader/writer corner cases
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+
+[ Upstream commit 2ce77d16db4240dd2e422fc0a5c26d3e2ec03446 ]
+
+Things can explode for locktorture if the user does combinations
+of nwriters_stress=0 nreaders_stress=0. Fix this by not assuming
+we always want to torture writer threads.
+
+Reported-by: Jeremy Linton <jeremy.linton@arm.com>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
+Tested-by: Jeremy Linton <jeremy.linton@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/locktorture.c | 76 ++++++++++++++++++++++++-------------------
+ 1 file changed, 44 insertions(+), 32 deletions(-)
+
+--- a/kernel/locking/locktorture.c
++++ b/kernel/locking/locktorture.c
+@@ -715,8 +715,7 @@ static void __torture_print_stats(char *
+ {
+ bool fail = 0;
+ int i, n_stress;
+- long max = 0;
+- long min = statp[0].n_lock_acquired;
++ long max = 0, min = statp ? statp[0].n_lock_acquired : 0;
+ long long sum = 0;
+
+ n_stress = write ? cxt.nrealwriters_stress : cxt.nrealreaders_stress;
+@@ -823,7 +822,7 @@ static void lock_torture_cleanup(void)
+ * such, only perform the underlying torture-specific cleanups,
+ * and avoid anything related to locktorture.
+ */
+- if (!cxt.lwsa)
++ if (!cxt.lwsa && !cxt.lrsa)
+ goto end;
+
+ if (writer_tasks) {
+@@ -898,6 +897,13 @@ static int __init lock_torture_init(void
+ firsterr = -EINVAL;
+ goto unwind;
+ }
++
++ if (nwriters_stress == 0 && nreaders_stress == 0) {
++ pr_alert("lock-torture: must run at least one locking thread\n");
++ firsterr = -EINVAL;
++ goto unwind;
++ }
++
+ if (cxt.cur_ops->init)
+ cxt.cur_ops->init();
+
+@@ -921,17 +927,19 @@ static int __init lock_torture_init(void
+ #endif
+
+ /* Initialize the statistics so that each run gets its own numbers. */
++ if (nwriters_stress) {
++ lock_is_write_held = 0;
++ cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
++ if (cxt.lwsa == NULL) {
++ VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
++ firsterr = -ENOMEM;
++ goto unwind;
++ }
+
+- lock_is_write_held = 0;
+- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
+- if (cxt.lwsa == NULL) {
+- VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
+- firsterr = -ENOMEM;
+- goto unwind;
+- }
+- for (i = 0; i < cxt.nrealwriters_stress; i++) {
+- cxt.lwsa[i].n_lock_fail = 0;
+- cxt.lwsa[i].n_lock_acquired = 0;
++ for (i = 0; i < cxt.nrealwriters_stress; i++) {
++ cxt.lwsa[i].n_lock_fail = 0;
++ cxt.lwsa[i].n_lock_acquired = 0;
++ }
+ }
+
+ if (cxt.cur_ops->readlock) {
+@@ -948,19 +956,21 @@ static int __init lock_torture_init(void
+ cxt.nrealreaders_stress = cxt.nrealwriters_stress;
+ }
+
+- lock_is_read_held = 0;
+- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
+- if (cxt.lrsa == NULL) {
+- VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
+- firsterr = -ENOMEM;
+- kfree(cxt.lwsa);
+- cxt.lwsa = NULL;
+- goto unwind;
+- }
+-
+- for (i = 0; i < cxt.nrealreaders_stress; i++) {
+- cxt.lrsa[i].n_lock_fail = 0;
+- cxt.lrsa[i].n_lock_acquired = 0;
++ if (nreaders_stress) {
++ lock_is_read_held = 0;
++ cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
++ if (cxt.lrsa == NULL) {
++ VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
++ firsterr = -ENOMEM;
++ kfree(cxt.lwsa);
++ cxt.lwsa = NULL;
++ goto unwind;
++ }
++
++ for (i = 0; i < cxt.nrealreaders_stress; i++) {
++ cxt.lrsa[i].n_lock_fail = 0;
++ cxt.lrsa[i].n_lock_acquired = 0;
++ }
+ }
+ }
+
+@@ -990,12 +1000,14 @@ static int __init lock_torture_init(void
+ goto unwind;
+ }
+
+- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
+- GFP_KERNEL);
+- if (writer_tasks == NULL) {
+- VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
+- firsterr = -ENOMEM;
+- goto unwind;
++ if (nwriters_stress) {
++ writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
++ GFP_KERNEL);
++ if (writer_tasks == NULL) {
++ VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
++ firsterr = -ENOMEM;
++ goto unwind;
++ }
+ }
+
+ if (cxt.cur_ops->readlock) {
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Sun, 29 Oct 2017 11:51:10 +0200
+Subject: mac80211: remove BUG() when interface type is invalid
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+
+[ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ]
+
+In the ieee80211_setup_sdata() we check if the interface type is valid
+and, if not, call BUG(). This should never happen, but if there is
+something wrong with the code, it will not be caught until the bug
+happens when an interface is being set up. Calling BUG() is too
+extreme for this and a WARN_ON() would be better used instead. Change
+that.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/iface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1493,7 +1493,7 @@ static void ieee80211_setup_sdata(struct
+ break;
+ case NL80211_IFTYPE_UNSPECIFIED:
+ case NUM_NL80211_IFTYPES:
+- BUG();
++ WARN_ON(1);
+ break;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Adiel Aloni <adiel.aloni@intel.com>
+Date: Fri, 1 Dec 2017 13:50:53 +0200
+Subject: mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
+
+From: Adiel Aloni <adiel.aloni@intel.com>
+
+
+[ Upstream commit e16ea4bb516bc21ea2202f2107718b29218bea59 ]
+
+Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll,
+only if PS_ENABLED was set before.
+This is required due to commit c9491367b759 ("mac80211: always update the
+PM state of a peer on MGMT / DATA frames") that enforces the ap to
+check only mgmt/data frames ps bit, and then update station's power save
+accordingly.
+When sending only ps-poll (control frame) the ap will not be aware that
+the station entered power save.
+Setting ps enable before triggering ps_poll, will send NDP with PM bit
+enabled first.
+
+Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -727,16 +727,21 @@ static int hwsim_fops_ps_write(void *dat
+ val != PS_MANUAL_POLL)
+ return -EINVAL;
+
+- old_ps = data->ps;
+- data->ps = val;
+-
+- local_bh_disable();
+ if (val == PS_MANUAL_POLL) {
++ if (data->ps != PS_ENABLED)
++ return -EINVAL;
++ local_bh_disable();
+ ieee80211_iterate_active_interfaces_atomic(
+ data->hw, IEEE80211_IFACE_ITER_NORMAL,
+ hwsim_send_ps_poll, data);
+- data->ps_poll_pending = true;
+- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
++ local_bh_enable();
++ return 0;
++ }
++ old_ps = data->ps;
++ data->ps = val;
++
++ local_bh_disable();
++ if (old_ps == PS_DISABLED && val != PS_DISABLED) {
+ ieee80211_iterate_active_interfaces_atomic(
+ data->hw, IEEE80211_IFACE_ITER_NORMAL,
+ hwsim_send_nullfunc_ps, data);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 9 Nov 2017 16:28:14 -0500
+Subject: media: cpia2: Fix a couple off by one bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ]
+
+The cam->buffers[] array has cam->num_frames elements so the > needs to
+be changed to >= to avoid going beyond the end of the array. The
+->buffers[] array is allocated in cpia2_allocate_buffers() if you want
+to confirm.
+
+Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/cpia2/cpia2_v4l.c
++++ b/drivers/media/usb/cpia2/cpia2_v4l.c
+@@ -808,7 +808,7 @@ static int cpia2_querybuf(struct file *f
+ struct camera_data *cam = video_drvdata(file);
+
+ if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE ||
+- buf->index > cam->num_frames)
++ buf->index >= cam->num_frames)
+ return -EINVAL;
+
+ buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer;
+@@ -859,7 +859,7 @@ static int cpia2_qbuf(struct file *file,
+
+ if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE ||
+ buf->memory != V4L2_MEMORY_MMAP ||
+- buf->index > cam->num_frames)
++ buf->index >= cam->num_frames)
+ return -EINVAL;
+
+ DBG("QBUF #%d\n", buf->index);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+Date: Wed, 22 Nov 2017 22:34:44 -0500
+Subject: media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
+
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+
+
+[ Upstream commit 5a18c2434f8bfc8bc2fb0f8af3e44f7408d63e4f ]
+
+Check return value from call to devm_kzalloc() in order to prevent
+a NULL pointer dereference.
+
+This issue was detected with the help of Coccinelle.
+
+Fixes: 4a5f8ae50b66 ("[media] davinci: vpif_capture: get subdevs from DT when available")
+
+Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/davinci/vpif_capture.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/platform/davinci/vpif_capture.c
++++ b/drivers/media/platform/davinci/vpif_capture.c
+@@ -1545,6 +1545,8 @@ vpif_capture_get_pdata(struct platform_d
+ sizeof(*chan->inputs) *
+ VPIF_CAPTURE_NUM_CHANNELS,
+ GFP_KERNEL);
++ if (!chan->inputs)
++ return NULL;
+
+ chan->input_count++;
+ chan->inputs[i].input.type = V4L2_INPUT_TYPE_CAMERA;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Date: Mon, 4 Dec 2017 06:01:11 -0500
+Subject: media: vsp1: Prevent suspending and resuming DRM pipelines
+
+From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+
+
+[ Upstream commit a17d2d6cd9985ca09a9e384f1bc71d710f7e5203 ]
+
+When used as part of a display pipeline, the VSP is stopped and
+restarted explicitly by the DU from its suspend and resume handlers.
+There is thus no need to stop or restart pipelines in the VSP suspend
+and resume handlers, and doing so would cause the hardware to be
+left in a misconfigured state.
+
+Ensure that the VSP suspend and resume handlers do not affect DRM-based
+pipelines.
+
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vsp1/vsp1_drv.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -571,7 +571,13 @@ static int __maybe_unused vsp1_pm_suspen
+ {
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+
+- vsp1_pipelines_suspend(vsp1);
++ /*
++ * When used as part of a display pipeline, the VSP is stopped and
++ * restarted explicitly by the DU.
++ */
++ if (!vsp1->drm)
++ vsp1_pipelines_suspend(vsp1);
++
+ pm_runtime_force_suspend(vsp1->dev);
+
+ return 0;
+@@ -582,7 +588,13 @@ static int __maybe_unused vsp1_pm_resume
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+
+ pm_runtime_force_resume(vsp1->dev);
+- vsp1_pipelines_resume(vsp1);
++
++ /*
++ * When used as part of a display pipeline, the VSP is stopped and
++ * restarted explicitly by the DU.
++ */
++ if (!vsp1->drm)
++ vsp1_pipelines_resume(vsp1);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 1 Dec 2017 14:55:31 +0200
+Subject: mmc: mmc_test: Ensure command queue is disabled for testing
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+
+[ Upstream commit 23a185254ace8e63dc4ca36e0315aed9440ae749 ]
+
+mmc_test disables the command queue because none of the tests use the
+command queue. However the Reset Test will re-enable it, so disable it in
+that case too.
+
+Fixes: 9d4579a85c84 ("mmc: mmc_test: Disable Command Queue while mmc_test is used")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/mmc_test.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/core/mmc_test.c
++++ b/drivers/mmc/core/mmc_test.c
+@@ -2328,10 +2328,17 @@ static int mmc_test_reset(struct mmc_tes
+ int err;
+
+ err = mmc_hw_reset(host);
+- if (!err)
++ if (!err) {
++ /*
++ * Reset will re-enable the card's command queue, but tests
++ * expect it to be disabled.
++ */
++ if (card->ext_csd.cmdq_en)
++ mmc_cmdq_disable(card);
+ return RESULT_OK;
+- else if (err == -EOPNOTSUPP)
++ } else if (err == -EOPNOTSUPP) {
+ return RESULT_UNSUP_HOST;
++ }
+
+ return RESULT_FAIL;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Wed, 8 Nov 2017 17:00:27 +0100
+Subject: mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
+
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+
+
+[ Upstream commit df467899da0b71465760b4e35127bce837244eee ]
+
+Some drivers (like nand_hynix.c) call ->cmdfunc() with NAND_CMD_NONE
+and a column address and expect the controller to only send address
+cycles. Right now, the default ->cmdfunc() implementations provided by
+the core do not filter out the command cycle in this case and forwards
+the request to the controller driver through the ->cmd_ctrl() method.
+The thing is, NAND controller drivers can get this wrong and send a
+command cycle with a NAND_CMD_NONE opcode and since NAND_CMD_NONE is
+-1, and the command field is usually casted to an u8, we end up sending
+the 0xFF command which is actually a RESET operation.
+
+Add conditions in nand_command[_lp]() functions to sending the initial
+command cycle when command == NAND_CMD_NONE.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/nand_base.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -710,7 +710,8 @@ static void nand_command(struct mtd_info
+ chip->cmd_ctrl(mtd, readcmd, ctrl);
+ ctrl &= ~NAND_CTRL_CHANGE;
+ }
+- chip->cmd_ctrl(mtd, command, ctrl);
++ if (command != NAND_CMD_NONE)
++ chip->cmd_ctrl(mtd, command, ctrl);
+
+ /* Address cycle, when necessary */
+ ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE;
+@@ -739,6 +740,7 @@ static void nand_command(struct mtd_info
+ */
+ switch (command) {
+
++ case NAND_CMD_NONE:
+ case NAND_CMD_PAGEPROG:
+ case NAND_CMD_ERASE1:
+ case NAND_CMD_ERASE2:
+@@ -832,7 +834,9 @@ static void nand_command_lp(struct mtd_i
+ }
+
+ /* Command latch cycle */
+- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
++ if (command != NAND_CMD_NONE)
++ chip->cmd_ctrl(mtd, command,
++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
+
+ if (column != -1 || page_addr != -1) {
+ int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE;
+@@ -868,6 +872,7 @@ static void nand_command_lp(struct mtd_i
+ */
+ switch (command) {
+
++ case NAND_CMD_NONE:
+ case NAND_CMD_CACHEDPROG:
+ case NAND_CMD_PAGEPROG:
+ case NAND_CMD_ERASE1:
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Jagdish Gediya <jagdish.gediya@nxp.com>
+Date: Thu, 23 Nov 2017 17:04:31 +0530
+Subject: mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
+
+From: Jagdish Gediya <jagdish.gediya@nxp.com>
+
+
+[ Upstream commit bccb06c353af3764ca86d9da47652458e6c2eb41 ]
+
+Bufnum mask is used to calculate page position in the internal SRAM.
+
+As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
+versions which had 8KB. Hence bufnum mask needs to be updated.
+
+Signed-off-by: Jagdish Gediya <jagdish.gediya@nxp.com>
+Signed-off-by: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/fsl_ifc_nand.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mtd/nand/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/fsl_ifc_nand.c
+@@ -916,6 +916,13 @@ static int fsl_ifc_chip_init(struct fsl_
+ if (ctrl->version >= FSL_IFC_VERSION_1_1_0)
+ fsl_ifc_sram_init(priv);
+
++ /*
++ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
++ * versions which had 8KB. Hence bufnum mask needs to be updated.
++ */
++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
++ priv->bufnum_mask = (priv->bufnum_mask * 2) + 1;
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Limin Zhu <liminzhu@marvell.com>
+Date: Thu, 30 Nov 2017 14:22:34 +0800
+Subject: mwifiex: cfg80211: do not change virtual interface during scan processing
+
+From: Limin Zhu <liminzhu@marvell.com>
+
+
+[ Upstream commit c61cfe49f0f0f0d1f8b56d0b045838d597e8c3a3 ]
+
+(1) Change virtual interface operation in cfg80211 process reset and
+reinitilize private data structure.
+(2) Scan result event processed in main process will dereference private
+data structure concurrently, ocassionly crash the kernel.
+
+The cornel case could be trigger by below steps:
+(1) wpa_cli mlan0 scan
+(2) ./hostapd mlan0.conf
+
+Cfg80211 asynchronous scan procedure is not all the time operated
+under rtnl lock, here we add the protect to serialize the cfg80211
+scan and change_virtual interface operation.
+
+Signed-off-by: Limin Zhu <liminzhu@marvell.com>
+Signed-off-by: Xinming Hu <huxm@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -1116,6 +1116,12 @@ mwifiex_cfg80211_change_virtual_intf(str
+ struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+ enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype;
+
++ if (priv->scan_request) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "change virtual interface: scan in process\n");
++ return -EBUSY;
++ }
++
+ switch (curr_iftype) {
+ case NL80211_IFTYPE_ADHOC:
+ switch (type) {
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Tue, 28 Nov 2017 13:53:12 +0100
+Subject: net: ieee802154: adf7242: Fix bug if defined DEBUG
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+
+[ Upstream commit 388b3b2b03701f3b3c10975c272892d7f78080df ]
+
+This fixes undefined reference to struct adf7242_local *lp in
+case DEBUG is defined.
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/adf7242.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -888,7 +888,7 @@ static const struct ieee802154_ops adf72
+ .set_cca_ed_level = adf7242_set_cca_ed_level,
+ };
+
+-static void adf7242_debug(u8 irq1)
++static void adf7242_debug(struct adf7242_local *lp, u8 irq1)
+ {
+ #ifdef DEBUG
+ u8 stat;
+@@ -932,7 +932,7 @@ static irqreturn_t adf7242_isr(int irq,
+ dev_err(&lp->spi->dev, "%s :ERROR IRQ1 = 0x%X\n",
+ __func__, irq1);
+
+- adf7242_debug(irq1);
++ adf7242_debug(lp, irq1);
+
+ xmit = test_bit(FLAG_XMIT, &lp->flags);
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Thu, 7 Dec 2017 09:56:04 -0800
+Subject: net: sched: drop qdisc_reset from dev_graft_qdisc
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+
+[ Upstream commit 7bbde83b1860c28a1cc35516352c4e7e5172c29a ]
+
+In qdisc_graft_qdisc a "new" qdisc is attached and the 'qdisc_destroy'
+operation is called on the old qdisc. The destroy operation will wait
+a rcu grace period and call qdisc_rcu_free(). At which point
+gso_cpu_skb is free'd along with all stats so no need to zero stats
+and gso_cpu_skb from the graft operation itself.
+
+Further after dropping the qdisc locks we can not continue to call
+qdisc_reset before waiting an rcu grace period so that the qdisc is
+detached from all cpus. By removing the qdisc_reset() here we get
+the correct property of waiting an rcu grace period and letting the
+qdisc_destroy operation clean up the qdisc correctly.
+
+Note, a refcnt greater than 1 would cause the destroy operation to
+be aborted however if this ever happened the reference to the qdisc
+would be lost and we would have a memory leak.
+
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_generic.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -743,10 +743,6 @@ struct Qdisc *dev_graft_qdisc(struct net
+ root_lock = qdisc_lock(oqdisc);
+ spin_lock_bh(root_lock);
+
+- /* Prune old scheduler */
+- if (oqdisc && refcount_read(&oqdisc->refcnt) <= 1)
+- qdisc_reset(oqdisc);
+-
+ /* ... and graft new one */
+ if (qdisc == NULL)
+ qdisc = &noop_qdisc;
+@@ -897,6 +893,16 @@ static bool some_qdisc_is_busy(struct ne
+ return false;
+ }
+
++static void dev_qdisc_reset(struct net_device *dev,
++ struct netdev_queue *dev_queue,
++ void *none)
++{
++ struct Qdisc *qdisc = dev_queue->qdisc_sleeping;
++
++ if (qdisc)
++ qdisc_reset(qdisc);
++}
++
+ /**
+ * dev_deactivate_many - deactivate transmissions on several devices
+ * @head: list of devices to deactivate
+@@ -907,7 +913,6 @@ static bool some_qdisc_is_busy(struct ne
+ void dev_deactivate_many(struct list_head *head)
+ {
+ struct net_device *dev;
+- bool sync_needed = false;
+
+ list_for_each_entry(dev, head, close_list) {
+ netdev_for_each_tx_queue(dev, dev_deactivate_queue,
+@@ -917,20 +922,25 @@ void dev_deactivate_many(struct list_hea
+ &noop_qdisc);
+
+ dev_watchdog_down(dev);
+- sync_needed |= !dev->dismantle;
+ }
+
+ /* Wait for outstanding qdisc-less dev_queue_xmit calls.
+ * This is avoided if all devices are in dismantle phase :
+ * Caller will call synchronize_net() for us
+ */
+- if (sync_needed)
+- synchronize_net();
++ synchronize_net();
+
+ /* Wait for outstanding qdisc_run calls. */
+- list_for_each_entry(dev, head, close_list)
++ list_for_each_entry(dev, head, close_list) {
+ while (some_qdisc_is_busy(dev))
+ yield();
++ /* The new qdisc is assigned at this point so we can safely
++ * unwind stale skb lists and qdisc statistics
++ */
++ netdev_for_each_tx_queue(dev, dev_qdisc_reset, NULL);
++ if (dev_ingress_queue(dev))
++ dev_qdisc_reset(dev, dev_ingress_queue(dev), NULL);
++ }
+ }
+
+ void dev_deactivate(struct net_device *dev)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Sunil Goutham <sgoutham@cavium.com>
+Date: Fri, 24 Nov 2017 15:04:03 +0300
+Subject: net: thunderx: Set max queue count taking XDP_TX into account
+
+From: Sunil Goutham <sgoutham@cavium.com>
+
+
+[ Upstream commit 87de083857aa269fb171ef0b39696b2888361c58 ]
+
+on T81 there are only 4 cores, hence setting max queue count to 4
+would leave nothing for XDP_TX. This patch fixes this by doubling
+max queue count in above scenarios.
+
+Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
+Signed-off-by: cjacob <cjacob@caviumnetworks.com>
+Signed-off-by: Aleksey Makarov <aleksey.makarov@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -1832,6 +1832,11 @@ static int nicvf_probe(struct pci_dev *p
+ nic->pdev = pdev;
+ nic->pnicvf = nic;
+ nic->max_queues = qcount;
++ /* If no of CPUs are too low, there won't be any queues left
++ * for XDP_TX, hence double it.
++ */
++ if (!nic->t88)
++ nic->max_queues *= 2;
+
+ /* MAP VF's configuration registers */
+ nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Lorenzo Colitti <lorenzo@google.com>
+Date: Mon, 20 Nov 2017 19:26:02 +0900
+Subject: net: xfrm: allow clearing socket xfrm policies.
+
+From: Lorenzo Colitti <lorenzo@google.com>
+
+
+[ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ]
+
+Currently it is possible to add or update socket policies, but
+not clear them. Therefore, once a socket policy has been applied,
+the socket cannot be used for unencrypted traffic.
+
+This patch allows (privileged) users to clear socket policies by
+passing in a NULL pointer and zero length argument to the
+{IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both
+the incoming and outgoing policies being cleared.
+
+The simple approach taken in this patch cannot clear socket
+policies in only one direction. If desired this could be added
+in the future, for example by continuing to pass in a length of
+zero (which currently is guaranteed to return EMSGSIZE) and
+making the policy be a pointer to an integer that contains one
+of the XFRM_POLICY_{IN,OUT} enum values.
+
+An alternative would have been to interpret the length as a
+signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the
+input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output
+policy.
+
+Tested: https://android-review.googlesource.com/539816
+Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_policy.c | 2 +-
+ net/xfrm/xfrm_state.c | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1257,7 +1257,7 @@ EXPORT_SYMBOL(xfrm_policy_delete);
+
+ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
+ {
+- struct net *net = xp_net(pol);
++ struct net *net = sock_net(sk);
+ struct xfrm_policy *old_pol;
+
+ #ifdef CONFIG_XFRM_SUB_POLICY
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -2050,6 +2050,13 @@ int xfrm_user_policy(struct sock *sk, in
+ struct xfrm_mgr *km;
+ struct xfrm_policy *pol = NULL;
+
++ if (!optval && !optlen) {
++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
++ __sk_dst_reset(sk);
++ return 0;
++ }
++
+ if (optlen <= 0 || optlen > PAGE_SIZE)
+ return -EMSGSIZE;
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Date: Tue, 28 Nov 2017 08:56:32 +0100
+Subject: perf annotate: Fix objdump comment parsing for Intel mov dissassembly
+
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+
+
+[ Upstream commit 35a8a148d8c1ee9e5ae18f9565a880490f816f89 ]
+
+The command 'perf annotate' parses the output of objdump and also
+investigates the comments produced by objdump. For example the
+output of objdump produces (on x86):
+
+23eee: 4c 8b 3d 13 01 21 00 mov 0x210113(%rip),%r15
+ # 234008 <stderr@@GLIBC_2.2.5+0x9a8>
+
+and the function mov__parse() is called to investigate the complete
+line. Mov__parse() breaks this line into several parts and finally
+calls function comment__symbol() to parse the data after the comment
+character '#'. Comment__symbol() expects a hexadecimal address followed
+by a symbol in '<' and '>' brackets.
+
+However the 2nd parameter given to function comment__symbol()
+always points to the comment character '#'. The address parsing
+always returns 0 because the character '#' is not a digit and
+strtoull() fails without being noticed.
+
+Fix this by advancing the second parameter to function comment__symbol()
+by one byte before invocation and add an error check after strtoull()
+has been called.
+
+Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Acked-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Fixes: 6de783b6f50f ("perf annotate: Resolve symbols using objdump comment")
+Link: http://lkml.kernel.org/r/20171128075632.72182-1-tmricht@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/annotate.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -323,6 +323,8 @@ static int comment__symbol(char *raw, ch
+ return 0;
+
+ *addrp = strtoull(comment, &endptr, 16);
++ if (endptr == comment)
++ return 0;
+ name = strchr(endptr, '<');
+ if (name == NULL)
+ return -1;
+@@ -436,8 +438,8 @@ static int mov__parse(struct arch *arch,
+ return 0;
+
+ comment = ltrim(comment);
+- comment__symbol(ops->source.raw, comment, &ops->source.addr, &ops->source.name);
+- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name);
++ comment__symbol(ops->source.raw, comment + 1, &ops->source.addr, &ops->source.name);
++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name);
+
+ return 0;
+
+@@ -481,7 +483,7 @@ static int dec__parse(struct arch *arch
+ return 0;
+
+ comment = ltrim(comment);
+- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name);
++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Date: Fri, 24 Nov 2017 10:46:37 +0100
+Subject: perf annotate: Fix unnecessary memory allocation for s390x
+
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+
+
+[ Upstream commit 36c263607d36c6a3788c09301d9f5fe35404048a ]
+
+This patch fixes a bug introduced with commit d9f8dfa9baf9 ("perf
+annotate s390: Implement jump types for perf annotate").
+
+'perf annotate' displays annotated assembler output by reading output of
+command objdump and parsing the disassembled lines. For each shown
+mnemonic this function sequence is executed:
+
+ disasm_line__new()
+ |
+ +--> disasm_line__init_ins()
+ |
+ +--> ins__find()
+ |
+ +--> arch->associate_instruction_ops()
+
+The s390x specific function assigned to function pointer
+associate_instruction_ops refers to function s390__associate_ins_ops().
+
+This function checks for supported mnemonics and assigns a NULL pointer
+to unsupported mnemonics. However even the NULL pointer is added to the
+architecture dependend instruction array.
+
+This leads to an extremely large architecture instruction array
+(due to array resize logic in function arch__grow_instructions()).
+
+Depending on the objdump output being parsed the array can end up
+with several ten-thousand elements.
+
+This patch checks if a mnemonic is supported and only adds supported
+ones into the architecture instruction array. The array does not contain
+elements with NULL pointers anymore.
+
+Before the patch (With some debug printf output):
+
+[root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxbb
+
+real 8m49.679s
+user 7m13.008s
+sys 0m1.649s
+[root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:'
+ /tmp/xxxbb | tail -1
+__ins__find sorted:1 nr_instructions:87433 ins:0x341583c0
+[root@s35lp76 perf]#
+
+The number of different s390x branch/jump/call/return instructions
+entered into the array is 87433.
+
+After the patch (With some printf debug output:)
+
+[root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxaa
+
+real 1m24.553s
+user 0m0.587s
+sys 0m1.530s
+[root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:'
+ /tmp/xxxaa | tail -1
+__ins__find sorted:1 nr_instructions:56 ins:0x3f406570
+[root@s35lp76 perf]#
+
+The number of different s390x branch/jump/call/return instructions
+entered into the array is 56 which is sensible.
+
+Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Acked-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Link: http://lkml.kernel.org/r/20171124094637.55558-1-tmricht@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/s390/annotate/instructions.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/arch/s390/annotate/instructions.c
++++ b/tools/perf/arch/s390/annotate/instructions.c
+@@ -16,7 +16,8 @@ static struct ins_ops *s390__associate_i
+ if (!strcmp(name, "br"))
+ ops = &ret_ops;
+
+- arch__associate_ins_ops(arch, name, ops);
++ if (ops)
++ arch__associate_ins_ops(arch, name, ops);
+ return ops;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Date: Tue, 14 Nov 2017 15:41:17 +0000
+Subject: pinctrl: sh-pfc: r8a7791: Add can_clk function
+
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+
+
+[ Upstream commit 57eec02caee60332b8052615e7257f932ae07abc ]
+
+This patch adds can_clk function to r8a7743/r8a7791 which is cleaner,
+and allows for independent configuration.
+We keep the can_clk* pins definitions from within can0_groups and
+can1_groups for uniformity and backwards compatibility.
+
+Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Reviewed-by: Ramesh Shanmugasundaram <ramesh.shanmugasundaram@bp.renesas.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4826,6 +4826,10 @@ static const char * const can0_groups[]
+ "can0_data_d",
+ "can0_data_e",
+ "can0_data_f",
++ /*
++ * Retained for backwards compatibility, use can_clk_groups in new
++ * designs.
++ */
+ "can_clk",
+ "can_clk_b",
+ "can_clk_c",
+@@ -4837,6 +4841,21 @@ static const char * const can1_groups[]
+ "can1_data_b",
+ "can1_data_c",
+ "can1_data_d",
++ /*
++ * Retained for backwards compatibility, use can_clk_groups in new
++ * designs.
++ */
++ "can_clk",
++ "can_clk_b",
++ "can_clk_c",
++ "can_clk_d",
++};
++
++/*
++ * can_clk_groups allows for independent configuration, use can_clk function
++ * in new designs.
++ */
++static const char * const can_clk_groups[] = {
+ "can_clk",
+ "can_clk_b",
+ "can_clk_c",
+@@ -5308,7 +5327,7 @@ static const char * const vin2_groups[]
+ };
+
+ static const struct {
+- struct sh_pfc_function common[56];
++ struct sh_pfc_function common[57];
+ struct sh_pfc_function r8a779x[2];
+ } pinmux_functions = {
+ .common = {
+@@ -5316,6 +5335,7 @@ static const struct {
+ SH_PFC_FUNCTION(avb),
+ SH_PFC_FUNCTION(can0),
+ SH_PFC_FUNCTION(can1),
++ SH_PFC_FUNCTION(can_clk),
+ SH_PFC_FUNCTION(du),
+ SH_PFC_FUNCTION(du0),
+ SH_PFC_FUNCTION(du1),
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+Date: Thu, 16 Nov 2017 12:16:00 +0900
+Subject: pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
+
+From: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+
+
+[ Upstream commit b16cd900de7911f96af17327a081a2141a0b763f ]
+
+This patch fixes the implementation incorrect of MOD_SEL1 bit[25:24]
+value when STP_ISEN_1_D pin function is selected for IPSR16 bit[27:24].
+
+This is a correction to the incorrect implementation of MOD_SEL register
+pin assignment for R8A7795 SoC specification of R-Car Gen3 Hardware
+User's Manual Rev.0.51E.
+
+Fixes: 0b0ffc96dbe30fa9 ("pinctrl: sh-pfc: Initial R8A7795 PFC support)
+Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c
+@@ -1397,7 +1397,7 @@ static const u16 pinmux_data[] = {
+ PINMUX_IPSR_MSEL(IP16_27_24, AUDIO_CLKOUT_B, SEL_ADG_1),
+ PINMUX_IPSR_MSEL(IP16_27_24, SSI_SCK2_B, SEL_SSI_1),
+ PINMUX_IPSR_MSEL(IP16_27_24, TS_SDEN1_D, SEL_TSIF1_3),
+- PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_2),
++ PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_3),
+ PINMUX_IPSR_MSEL(IP16_27_24, STP_OPWM_0_E, SEL_SSP1_0_4),
+ PINMUX_IPSR_MSEL(IP16_27_24, RIF3_D0_B, SEL_DRIF3_1),
+ PINMUX_IPSR_MSEL(IP16_27_24, TCLK2_B, SEL_TIMER_TMU_1),
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 22 Nov 2017 21:31:20 +0100
+Subject: power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 09edcb647542487864e23aa8d2ef26be3e08978a ]
+
+If an error occurs when we enable the backup battery charging, we should
+go through the error handling path directly.
+
+Before commit db43e6c473b5 ("ab8500-bm: Add usb power path support") this
+was the case, but this commit has added some code between the last test and
+the 'out' label.
+So, in case of error, this added code is executed and the error may be
+silently ignored.
+
+Fix it by adding the missing 'goto out', as done in all other error
+handling paths.
+
+Fixes: db43e6c473b5 ("ab8500-bm: Add usb power path support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/ab8500_charger.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -3221,8 +3221,10 @@ static int ab8500_charger_init_hw_regist
+ ret = abx500_mask_and_set_register_interruptible(di->dev,
+ AB8500_RTC, AB8500_RTC_CTRL_REG,
+ RTC_BUP_CH_ENA, RTC_BUP_CH_ENA);
+- if (ret < 0)
++ if (ret < 0) {
+ dev_err(di->dev, "%s mask and set failed\n", __func__);
++ goto out;
++ }
+
+ if (is_ab8540(di->parent)) {
+ ret = abx500_mask_and_set_register_interruptible(di->dev,
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 22 Nov 2017 21:27:31 +0100
+Subject: power: supply: ab8500_charger: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit bf59fddde1c3eab89eb8dca8f3d3dc097887d2bb ]
+
+'ret' is know to be 0 at this point, because it has not been updated by the
+the previous call to 'abx500_mask_and_set_register_interruptible()'.
+
+Fix it by updating 'ret' before checking if an error occurred.
+
+Fixes: 84edbeeab67c ("ab8500-charger: AB8500 charger driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/ab8500_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -3218,7 +3218,7 @@ static int ab8500_charger_init_hw_regist
+ }
+
+ /* Enable backup battery charging */
+- abx500_mask_and_set_register_interruptible(di->dev,
++ ret = abx500_mask_and_set_register_interruptible(di->dev,
+ AB8500_RTC, AB8500_RTC_CTRL_REG,
+ RTC_BUP_CH_ENA, RTC_BUP_CH_ENA);
+ if (ret < 0)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Fri, 17 Nov 2017 02:00:50 +1000
+Subject: powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+
+[ Upstream commit acb1feab320e38588fccc568e3767761f494976f ]
+
+When an interrupt is returning to a soft-disabled context (which can
+happen for non-maskable interrupts or synchronous interrupts), it goes
+through the motions of soft-disabling again, including calling
+TRACE_DISABLE_INTS (i.e., trace_hardirqs_off()).
+
+This is not necessary, because we must already be soft-disabled in the
+interrupt context, it also may be causing crashes in the irq tracing
+code to re-enter as an nmi. Replace it with a warning to ensure that
+soft-interrupts are still disabled.
+
+Fixes: 7c0482e3d055 ("powerpc/irq: Fix another case of lazy IRQ state getting out of sync")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/entry_64.S | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -939,9 +939,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+ beq 1f
+ rlwinm r7,r7,0,~PACA_IRQ_HARD_DIS
+ stb r7,PACAIRQHAPPENED(r13)
+-1: li r0,0
+- stb r0,PACASOFTIRQEN(r13);
+- TRACE_DISABLE_INTS
++1:
++#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_BUG)
++ /* The interrupt should not have soft enabled. */
++ lbz r7,PACASOFTIRQEN(r13)
++1: tdnei r7,0
++ EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
++#endif
+ b .Ldo_restore
+
+ /*
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 16 Nov 2017 11:45:37 -0600
+Subject: powerpc/modules: Don't try to restore r2 after a sibling call
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+
+[ Upstream commit b9eab08d012fa093947b230f9a87257c27fb829b ]
+
+When attempting to load a livepatch module, I got the following error:
+
+ module_64: patch_module: Expect noop after relocate, got 3c820000
+
+The error was triggered by the following code in
+unregister_netdevice_queue():
+
+ 14c: 00 00 00 48 b 14c <unregister_netdevice_queue+0x14c>
+ 14c: R_PPC64_REL24 net_set_todo
+ 150: 00 00 82 3c addis r4,r2,0
+
+GCC didn't insert a nop after the branch to net_set_todo() because it's
+a sibling call, so it never returns. The nop isn't needed after the
+branch in that case.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Reviewed-and-tested-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/code-patching.h | 1 +
+ arch/powerpc/kernel/module_64.c | 12 +++++++++++-
+ arch/powerpc/lib/code-patching.c | 5 +++++
+ 3 files changed, 17 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/code-patching.h
++++ b/arch/powerpc/include/asm/code-patching.h
+@@ -33,6 +33,7 @@ int patch_branch(unsigned int *addr, uns
+ int patch_instruction(unsigned int *addr, unsigned int instr);
+
+ int instr_is_relative_branch(unsigned int instr);
++int instr_is_relative_link_branch(unsigned int instr);
+ int instr_is_branch_to_addr(const unsigned int *instr, unsigned long addr);
+ unsigned long branch_target(const unsigned int *instr);
+ unsigned int translate_branch(const unsigned int *dest,
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -486,7 +486,17 @@ static bool is_early_mcount_callsite(u32
+ restore r2. */
+ static int restore_r2(u32 *instruction, struct module *me)
+ {
+- if (is_early_mcount_callsite(instruction - 1))
++ u32 *prev_insn = instruction - 1;
++
++ if (is_early_mcount_callsite(prev_insn))
++ return 1;
++
++ /*
++ * Make sure the branch isn't a sibling call. Sibling calls aren't
++ * "link" branches and they don't return, so they don't need the r2
++ * restore afterwards.
++ */
++ if (!instr_is_relative_link_branch(*prev_insn))
+ return 1;
+
+ if (*instruction != PPC_INST_NOP) {
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -302,6 +302,11 @@ int instr_is_relative_branch(unsigned in
+ return instr_is_branch_iform(instr) || instr_is_branch_bform(instr);
+ }
+
++int instr_is_relative_link_branch(unsigned int instr)
++{
++ return instr_is_relative_branch(instr) && (instr & BRANCH_SET_LINK);
++}
++
+ static unsigned long branch_iform_target(const unsigned int *instr)
+ {
+ signed long imm;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Axel Lin <axel.lin@ingics.com>
+Date: Tue, 7 Nov 2017 13:18:53 +0800
+Subject: pwm: stmpe: Fix wrong register offset for hwpwm=2 case
+
+From: Axel Lin <axel.lin@ingics.com>
+
+
+[ Upstream commit 8472b529e113e0863ea064fdee51bf73c3f86fd6 ]
+
+Fix trivial copy/paste bug.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Fixes: ef1f09eca74a ("pwm: Add a driver for the STMPE PWM")
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pwm/pwm-stmpe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pwm/pwm-stmpe.c
++++ b/drivers/pwm/pwm-stmpe.c
+@@ -145,7 +145,7 @@ static int stmpe_24xx_pwm_config(struct
+ break;
+
+ case 2:
+- offset = STMPE24XX_PWMIC1;
++ offset = STMPE24XX_PWMIC2;
+ break;
+
+ default:
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: SeongJae Park <sj38.park@gmail.com>
+Date: Fri, 3 Nov 2017 19:17:20 +0900
+Subject: rcutorture/configinit: Fix build directory error message
+
+From: SeongJae Park <sj38.park@gmail.com>
+
+
+[ Upstream commit 2adfa4210f8f35cdfb4e08318cc06b99752964c2 ]
+
+The 'configinit.sh' script checks the format of optional argument for the
+build directory, printing an error message if the format is not valid.
+However, the error message uses the wrong variable, indicating an empty
+string even though the user entered a non-empty (but erroneous) string.
+This commit fixes the script to use the correct variable.
+
+Fixes: c87b9c601ac8 ("rcutorture: Add KVM-based test framework")
+
+Signed-off-by: SeongJae Park <sj38.park@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/rcutorture/bin/configinit.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/rcutorture/bin/configinit.sh
++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh
+@@ -51,7 +51,7 @@ then
+ mkdir $builddir
+ fi
+ else
+- echo Bad build directory: \"$builddir\"
++ echo Bad build directory: \"$buildloc\"
+ exit 2
+ fi
+ fi
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sat, 18 Nov 2017 00:15:58 +0300
+Subject: rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+
+[ Upstream commit f2eef045de9defbc6fc6b72b17f0941cbe26c81d ]
+
+brcmstb_waketmr_probe() does not disable timer->clk on error paths.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: c4f07ecee22e ("rtc: brcmstb-waketimer: Add Broadcom STB wake-timer")
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-brcmstb-waketimer.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/rtc/rtc-brcmstb-waketimer.c
++++ b/drivers/rtc/rtc-brcmstb-waketimer.c
+@@ -253,7 +253,7 @@ static int brcmstb_waketmr_probe(struct
+ ret = devm_request_irq(dev, timer->irq, brcmstb_waketmr_irq, 0,
+ "brcmstb-waketimer", timer);
+ if (ret < 0)
+- return ret;
++ goto err_clk;
+
+ timer->reboot_notifier.notifier_call = brcmstb_waketmr_reboot;
+ register_reboot_notifier(&timer->reboot_notifier);
+@@ -262,12 +262,21 @@ static int brcmstb_waketmr_probe(struct
+ &brcmstb_waketmr_ops, THIS_MODULE);
+ if (IS_ERR(timer->rtc)) {
+ dev_err(dev, "unable to register device\n");
+- unregister_reboot_notifier(&timer->reboot_notifier);
+- return PTR_ERR(timer->rtc);
++ ret = PTR_ERR(timer->rtc);
++ goto err_notifier;
+ }
+
+ dev_info(dev, "registered, with irq %d\n", timer->irq);
+
++ return 0;
++
++err_notifier:
++ unregister_reboot_notifier(&timer->reboot_notifier);
++
++err_clk:
++ if (timer->clk)
++ clk_disable_unprepare(timer->clk);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 13 Oct 2017 16:24:28 -0700
+Subject: sched: Stop resched_cpu() from sending IPIs to offline CPUs
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+
+[ Upstream commit a0982dfa03efca6c239c52cabebcea4afb93ea6b ]
+
+The rcutorture test suite occasionally provokes a splat due to invoking
+resched_cpu() on an offline CPU:
+
+WARNING: CPU: 2 PID: 8 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
+Modules linked in:
+CPU: 2 PID: 8 Comm: rcu_preempt Not tainted 4.14.0-rc4+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+task: ffff902ede9daf00 task.stack: ffff96c50010c000
+RIP: 0010:native_smp_send_reschedule+0x37/0x40
+RSP: 0018:ffff96c50010fdb8 EFLAGS: 00010096
+RAX: 000000000000002e RBX: ffff902edaab4680 RCX: 0000000000000003
+RDX: 0000000080000003 RSI: 0000000000000000 RDI: 00000000ffffffff
+RBP: ffff96c50010fdb8 R08: 0000000000000000 R09: 0000000000000001
+R10: 0000000000000000 R11: 00000000299f36ae R12: 0000000000000001
+R13: ffffffff9de64240 R14: 0000000000000001 R15: ffffffff9de64240
+FS: 0000000000000000(0000) GS:ffff902edfc80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000f7d4c642 CR3: 000000001e0e2000 CR4: 00000000000006e0
+Call Trace:
+ resched_curr+0x8f/0x1c0
+ resched_cpu+0x2c/0x40
+ rcu_implicit_dynticks_qs+0x152/0x220
+ force_qs_rnp+0x147/0x1d0
+ ? sync_rcu_exp_select_cpus+0x450/0x450
+ rcu_gp_kthread+0x5a9/0x950
+ kthread+0x142/0x180
+ ? force_qs_rnp+0x1d0/0x1d0
+ ? kthread_create_on_node+0x40/0x40
+ ret_from_fork+0x27/0x40
+Code: 14 01 0f 92 c0 84 c0 74 14 48 8b 05 14 4f f4 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 38 89 ca 9d e8 e5 56 08 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 52 9e 37 02 85 c0 75 38 55 48
+---[ end trace 26df9e5df4bba4ac ]---
+
+This splat cannot be generated by expedited grace periods because they
+always invoke resched_cpu() on the current CPU, which is good because
+expedited grace periods require that resched_cpu() unconditionally
+succeed. However, other parts of RCU can tolerate resched_cpu() acting
+as a no-op, at least as long as it doesn't happen too often.
+
+This commit therefore makes resched_cpu() invoke resched_curr() only if
+the CPU is either online or is the current CPU.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -506,7 +506,8 @@ void resched_cpu(int cpu)
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&rq->lock, flags);
+- resched_curr(rq);
++ if (cpu_online(cpu) || cpu == smp_processor_id())
++ resched_curr(rq);
+ raw_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 13 Oct 2017 17:00:18 -0700
+Subject: sched: Stop switched_to_rt() from sending IPIs to offline CPUs
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+
+[ Upstream commit 2fe2582649aa2355f79acddb86bd4d6c5363eb63 ]
+
+The rcutorture test suite occasionally provokes a splat due to invoking
+rt_mutex_lock() which needs to boost the priority of a task currently
+sitting on a runqueue that belongs to an offline CPU:
+
+WARNING: CPU: 0 PID: 12 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
+Modules linked in:
+CPU: 0 PID: 12 Comm: rcub/7 Not tainted 4.14.0-rc4+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+task: ffff9ed3de5f8cc0 task.stack: ffffbbf80012c000
+RIP: 0010:native_smp_send_reschedule+0x37/0x40
+RSP: 0018:ffffbbf80012fd10 EFLAGS: 00010082
+RAX: 000000000000002f RBX: ffff9ed3dd9cb300 RCX: 0000000000000004
+RDX: 0000000080000004 RSI: 0000000000000086 RDI: 00000000ffffffff
+RBP: ffffbbf80012fd10 R08: 000000000009da7a R09: 0000000000007b9d
+R10: 0000000000000001 R11: ffffffffbb57c2cd R12: 000000000000000d
+R13: ffff9ed3de5f8cc0 R14: 0000000000000061 R15: ffff9ed3ded59200
+FS: 0000000000000000(0000) GS:ffff9ed3dea00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000080686f0 CR3: 000000001b9e0000 CR4: 00000000000006f0
+Call Trace:
+ resched_curr+0x61/0xd0
+ switched_to_rt+0x8f/0xa0
+ rt_mutex_setprio+0x25c/0x410
+ task_blocks_on_rt_mutex+0x1b3/0x1f0
+ rt_mutex_slowlock+0xa9/0x1e0
+ rt_mutex_lock+0x29/0x30
+ rcu_boost_kthread+0x127/0x3c0
+ kthread+0x104/0x140
+ ? rcu_report_unblock_qs_rnp+0x90/0x90
+ ? kthread_create_on_node+0x40/0x40
+ ret_from_fork+0x22/0x30
+Code: f0 00 0f 92 c0 84 c0 74 14 48 8b 05 34 74 c5 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 a0 c6 fc b9 e8 d5 b5 06 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 a2 d1 13 02 85 c0 75 38 55 48
+
+But the target task's priority has already been adjusted, so the only
+purpose of switched_to_rt() invoking resched_curr() is to wake up the
+CPU running some task that needs to be preempted by the boosted task.
+But the CPU is offline, which presumably means that the task must be
+migrated to some other CPU, and that this other CPU will undertake any
+needed preemption at the time of migration. Because the runqueue lock
+is held when resched_curr() is invoked, we know that the boosted task
+cannot go anywhere, so it is not necessary to invoke resched_curr()
+in this particular case.
+
+This commit therefore makes switched_to_rt() refrain from invoking
+resched_curr() when the target CPU is offline.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/rt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2218,7 +2218,7 @@ static void switched_to_rt(struct rq *rq
+ if (p->nr_cpus_allowed > 1 && rq->rt.overloaded)
+ queue_push_tasks(rq);
+ #endif /* CONFIG_SMP */
+- if (p->prio < rq->curr->prio)
++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq)))
+ resched_curr(rq);
+ }
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 4 Dec 2017 10:36:31 -0800
+Subject: scsi: core: scsi_get_device_flags_keyed(): Always return device flags
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+
+[ Upstream commit a44c9d36509c83cf64f33b93f6ab2e63822c01eb ]
+
+Since scsi_get_device_flags_keyed() callers do not check whether or not
+the returned value is an error code, change that function such that it
+returns a flags value even if the 'key' argument is invalid. Note:
+since commit 28a0bc4120d3 ("scsi: sd: Implement blacklist option for
+WRITE SAME w/ UNMAP") bit 31 is a valid device information flag so
+checking whether bit 31 is set in the return value is not sufficient to
+tell the difference between an error code and a flags value.
+
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_devinfo.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -595,17 +595,12 @@ int scsi_get_device_flags_keyed(struct s
+ int key)
+ {
+ struct scsi_dev_info_list *devinfo;
+- int err;
+
+ devinfo = scsi_dev_info_list_find(vendor, model, key);
+ if (!IS_ERR(devinfo))
+ return devinfo->flags;
+
+- err = PTR_ERR(devinfo);
+- if (err != -ENOENT)
+- return err;
+-
+- /* nothing found, return nothing */
++ /* key or device not found: return nothing */
+ if (key != SCSI_DEVINFO_GLOBAL)
+ return 0;
+
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Date: Fri, 17 Nov 2017 21:31:36 +0100
+Subject: scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
+
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+
+
+[ Upstream commit b369a0471503130cfc74f9f62071db97f48948c3 ]
+
+Commit 56f3d383f37b ("scsi: scsi_devinfo: Add TRY_VPD_PAGES to HITACHI
+OPEN-V blacklist entry") modified some Hitachi entries:
+
+ HITACHI is always supporting VPD pages, even though it's claiming to
+ support SCSI Revision 3 only.
+
+The same should have been done also for HP-rebranded.
+
+[mkp: checkpatch and tweaked commit message]
+
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Takahiro Yasui <takahiro.yasui@hds.com>
+Cc: Matthias Rudolph <Matthias.Rudolph@hitachivantara.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
+Cc: SCSI ML <linux-scsi@vger.kernel.org>
+Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_devinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -181,7 +181,7 @@ static struct {
+ {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */
+- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */
++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */
+ {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN},
+ {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
+ {"HP", "C1557A", NULL, BLIST_FORCELUN},
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Date: Fri, 17 Nov 2017 22:05:13 +0100
+Subject: scsi: dh: add new rdac devices
+
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+
+
+[ Upstream commit 4b3aec2bbbce1c35f50e7475a9fd78d24b9ea4ea ]
+
+Add IBM 3542 and 3552, arrays: FAStT200 and FAStT500.
+
+Add full STK OPENstorage family, arrays: 9176, D173, D178, D210, D220,
+D240 and D280.
+
+Add STK BladeCtlr family, arrays: B210, B220, B240 and B280.
+
+These changes were done in multipath-tools time ago.
+
+Cc: NetApp RDAC team <ng-eseries-upstream-maintainers@netapp.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christophe Varoqui <christophe.varoqui@opensvc.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
+Cc: SCSI ML <linux-scsi@vger.kernel.org>
+Cc: device-mapper development <dm-devel@redhat.com>
+Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_dh.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_d
+ {"IBM", "1815", "rdac", },
+ {"IBM", "1818", "rdac", },
+ {"IBM", "3526", "rdac", },
++ {"IBM", "3542", "rdac", },
++ {"IBM", "3552", "rdac", },
+ {"SGI", "TP9", "rdac", },
+ {"SGI", "IS", "rdac", },
+- {"STK", "OPENstorage D280", "rdac", },
++ {"STK", "OPENstorage", "rdac", },
+ {"STK", "FLEXLINE 380", "rdac", },
++ {"STK", "BladeCtlr", "rdac", },
+ {"SUN", "CSM", "rdac", },
+ {"SUN", "LCSM100", "rdac", },
+ {"SUN", "STK6580_6780", "rdac", },
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Li Dongyang <dongyang.li@anu.edu.au>
+Date: Tue, 14 Nov 2017 10:48:04 +1100
+Subject: scsi: ses: don't ask for diagnostic pages repeatedly during probe
+
+From: Li Dongyang <dongyang.li@anu.edu.au>
+
+
+[ Upstream commit 9c0a50022b8ac7e863e6ec8342fa476fe5d1d75c ]
+
+We are testing if there is a match with the ses device in a loop by
+calling ses_match_to_enclosure(), which will issue scsi receive
+diagnostics commands to the ses device for every device on the same
+host. On one of our boxes with 840 disks, it takes a long time to load
+the driver:
+
+[root@g1b-oss06 ~]# time modprobe ses
+
+real 40m48.247s
+user 0m0.001s
+sys 0m0.196s
+
+With the patch:
+
+[root@g1b-oss06 ~]# time modprobe ses
+
+real 0m17.915s
+user 0m0.008s
+sys 0m0.053s
+
+Note that we still need to refresh page 10 when we see a new disk to
+create the link.
+
+Signed-off-by: Li Dongyang <dongyang.li@anu.edu.au>
+Tested-by: Jason Ozolins <jason.ozolins@hpe.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ses.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -615,13 +615,16 @@ static void ses_enclosure_data_process(s
+ }
+
+ static void ses_match_to_enclosure(struct enclosure_device *edev,
+- struct scsi_device *sdev)
++ struct scsi_device *sdev,
++ int refresh)
+ {
++ struct scsi_device *edev_sdev = to_scsi_device(edev->edev.parent);
+ struct efd efd = {
+ .addr = 0,
+ };
+
+- ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
++ if (refresh)
++ ses_enclosure_data_process(edev, edev_sdev, 0);
+
+ if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent))
+ efd.addr = sas_get_address(sdev);
+@@ -652,7 +655,7 @@ static int ses_intf_add(struct device *c
+ struct enclosure_device *prev = NULL;
+
+ while ((edev = enclosure_find(&sdev->host->shost_gendev, prev)) != NULL) {
+- ses_match_to_enclosure(edev, sdev);
++ ses_match_to_enclosure(edev, sdev, 1);
+ prev = edev;
+ }
+ return -ENODEV;
+@@ -768,7 +771,7 @@ page2_not_supported:
+ shost_for_each_device(tmp_sdev, sdev->host) {
+ if (tmp_sdev->lun != 0 || scsi_device_enclosure(tmp_sdev))
+ continue;
+- ses_match_to_enclosure(edev, tmp_sdev);
++ ses_match_to_enclosure(edev, tmp_sdev, 0);
+ }
+
+ return 0;
earlycon-add-reg-offset-to-physical-address-before-mapping.patch
dm-mpath-fix-passing-integrity-data.patch
revert-btrfs-use-proper-endianness-accessors-for.patch
+drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch
+dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch
+video-hdmi-allow-empty-hdmi-infoframes.patch
+hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch
+hid-elo-clear-btn_left-mapping.patch
+iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch
+arm-dts-koelsch-move-cec_clock-to-root-node.patch
+clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch
+arm-dts-exynos-correct-trats2-panel-reset-line.patch
+drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch
+staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch
+typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch
+usb-ledtrig-usbport-fix-of-node-leak.patch
+sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch
+sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch
+crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch
+crypto-cavium-fix-memory-leak-on-info.patch
+test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch
+net-ieee802154-adf7242-fix-bug-if-defined-debug.patch
+rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch
+net-xfrm-allow-clearing-socket-xfrm-policies.patch
+mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch
+net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch
+arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch
+arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch
+mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch
+userns-don-t-fail-follow_automount-based-on-s_user_ns.patch
+xfrm-fix-xfrm_replay_overflow_offload_esn.patch
+leds-pm8058-silence-pointer-to-integer-size-warning.patch
+clk-ti-clkctrl-add-support-for-retrying-failed-init.patch
+power-supply-ab8500_charger-fix-an-error-handling-path.patch
+power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch
+drm-etnaviv-make-thermal-selectable.patch
+iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch
+iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch
+ath10k-update-tdls-teardown-state-to-target.patch
+cpufreq-fix-governor-module-removal-race.patch
+dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch
+dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch
+drm-amdgpu-fix-random-missing-of-flr-notify.patch
+scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch
+pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch
+drm-sun4i-fix-format-mask-in-de2-driver.patch
+pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch
+pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch
+perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch
+perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch
+iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch
+drm-amdgpu-fix-virtual-dce-bug.patch
+clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch
+mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch
+ath10k-fix-invalid-sts_cap_offset_mask.patch
+tools-usbip-fixes-build-with-musl-libc-toolchain.patch
+spi-sun6i-disable-unprepare-clocks-on-remove.patch
+bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch
+scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch
+scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch
+scsi-dh-add-new-rdac-devices.patch
+media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch
+dm-raid-fix-raid-set-size-revalidation.patch
+media-cpia2-fix-a-couple-off-by-one-bugs.patch
+media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch
+virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch
+net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch
+veth-set-peer-gso-values.patch
+drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch
+powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch
+powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch
+arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch
+agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch
+mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch
+mac80211-remove-bug-when-interface-type-is-invalid.patch
+crypto-caam-qi-use-correct-print-specifier-for-size_t.patch
+asoc-nuc900-fix-a-loop-timeout-test.patch
+mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch
+fix-misannotated-out-of-line-_copy_to_user.patch
+ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch
+rcutorture-configinit-fix-build-directory-error-message.patch
+locking-locktorture-fix-num-reader-writer-corner-cases.patch
+ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch
+ib-mlx5-revisit-wmaybe-uninitialized-warning.patch
+dmaengine-qcom_hidma-check-pending-interrupts.patch
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Date: Thu, 7 Dec 2017 15:04:53 +0100
+Subject: spi: sun6i: disable/unprepare clocks on remove
+
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+
+
+[ Upstream commit 2d9bbd02c54094ceffa555143b0d68cd06504d63 ]
+
+sun6i_spi_probe() uses sun6i_spi_runtime_resume() to prepare/enable
+clocks, so sun6i_spi_remove() should use sun6i_spi_runtime_suspend() to
+disable/unprepare them if we're not suspended.
+Replacing pm_runtime_disable() by pm_runtime_force_suspend() will ensure
+that sun6i_spi_runtime_suspend() is called if needed.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver)
+Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-sun6i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -541,7 +541,7 @@ err_free_master:
+
+ static int sun6i_spi_remove(struct platform_device *pdev)
+ {
+- pm_runtime_disable(&pdev->dev);
++ pm_runtime_force_suspend(&pdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 17 Nov 2017 14:50:55 +0000
+Subject: staging: rtl8822be: fix missing null check on dev_alloc_skb return
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 3eb23426e1749a0483bc4c9b18e51f657569e3ed ]
+
+dev_alloc_skb can potentially return NULL, so add a null check to
+avoid a null pointer dereference on skb
+
+Detected by CoverityScan, CID#1454558 ("Dereference on null return")
+
+Fixes: 7e5b796cde7e ("staging: r8822be: Add the driver code")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
+@@ -464,6 +464,8 @@ bool rtl8822b_halmac_cb_write_data_rsvd_
+ int count;
+
+ skb = dev_alloc_skb(size);
++ if (!skb)
++ return false;
+ memcpy((u8 *)skb_put(skb, size), buf, size);
+
+ if (!_rtl8822be_send_bcn_or_cmd_packet(rtlpriv->hw, skb, BEACON_QUEUE))
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Mon, 20 Nov 2017 09:45:35 -0800
+Subject: test_firmware: fix setting old custom fw path back on exit
+
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+
+
+[ Upstream commit 65c79230576873b312c3599479c1e42355c9f349 ]
+
+The file /sys/module/firmware_class/parameters/path can be used
+to set a custom firmware path. The fw_filesystem.sh script creates
+a temporary directory to add a test firmware file to be used during
+testing, in order for this to work it uses the custom path syfs file
+and it was supposed to reset back the file on execution exit. The
+script failed to do this due to a typo, it was using OLD_PATH instead
+of OLD_FWPATH, since its inception since v3.17.
+
+Its not as easy to just keep the old setting, it turns out that
+resetting an empty setting won't actually do what we want, we need
+to check if it was empty and set an empty space.
+
+Without this we end up having the temporary path always set after
+we run these tests.
+
+Fixes: 0a8adf58475 ("test: add firmware_class loader test")
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/firmware/fw_filesystem.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/firmware/fw_filesystem.sh
++++ b/tools/testing/selftests/firmware/fw_filesystem.sh
+@@ -45,7 +45,10 @@ test_finish()
+ if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+ echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
+ fi
+- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path
++ if [ "$OLD_FWPATH" = "" ]; then
++ OLD_FWPATH=" "
++ fi
++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+ rm -f "$FW"
+ rmdir "$FWPATH"
+ }
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+Date: Tue, 5 Dec 2017 18:48:14 +0100
+Subject: tools/usbip: fixes build with musl libc toolchain
+
+From: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+
+
+[ Upstream commit 77be4c878c72e411ad22af96b6f81dd45c26450a ]
+
+Indeed musl doesn't define old SIGCLD signal name but only new one SIGCHLD.
+SIGCHLD is the new POSIX name for that signal so it doesn't change
+anything on other libcs.
+
+This fixes this kind of build error:
+
+usbipd.c: In function ‘set_signal’:
+usbipd.c:459:12: error: 'SIGCLD' undeclared (first use in this function)
+ sigaction(SIGCLD, &act, NULL);
+ ^~~~~~
+usbipd.c:459:12: note: each undeclared identifier is reported only once
+ for each function it appears in
+Makefile:407: recipe for target 'usbipd.o' failed
+make[3]: *** [usbipd.o] Error 1
+
+Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com>
+Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/usb/usbip/src/usbipd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/usb/usbip/src/usbipd.c
++++ b/tools/usb/usbip/src/usbipd.c
+@@ -456,7 +456,7 @@ static void set_signal(void)
+ sigaction(SIGTERM, &act, NULL);
+ sigaction(SIGINT, &act, NULL);
+ act.sa_handler = SIG_IGN;
+- sigaction(SIGCLD, &act, NULL);
++ sigaction(SIGCHLD, &act, NULL);
+ }
+
+ static const char *pid_file;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Date: Tue, 21 Nov 2017 14:12:12 +0000
+Subject: typec: tcpm: fusb302: Resolve out of order messaging events
+
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+
+
+[ Upstream commit ab69f61321140ff632d560775bc226259a78dfa2 ]
+
+The expectation in the FUSB302 driver is that a TX_SUCCESS event
+should occur after a message has been sent, but before a GCRCSENT
+event is raised to indicate successful receipt of a message from
+the partner. However in some circumstances it is possible to see
+the hardware raise a GCRCSENT event before a TX_SUCCESS event
+is raised. The upshot of this is that the GCRCSENT handling portion
+of code ends up reporting the GoodCRC message to TCPM because the
+TX_SUCCESS event hasn't yet arrived to trigger a consumption of it.
+When TX_SUCCESS is then raised by the chip it ends up consuming the
+actual message that was meant for TCPM, and this incorrect sequence
+results in a hard reset from TCPM.
+
+To avoid this problem, this commit updates the message reading
+code to check whether a GoodCRC message was received or not. Based
+on this check it will either report that the previous transmission
+has completed or it will pass the msg data to TCPM for futher
+processing. This way the incorrect ordering of the events no longer
+matters.
+
+Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/typec/fusb302/fusb302.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/typec/fusb302/fusb302.c
++++ b/drivers/staging/typec/fusb302/fusb302.c
+@@ -1552,6 +1552,21 @@ static int fusb302_pd_read_message(struc
+ fusb302_log(chip, "PD message header: %x", msg->header);
+ fusb302_log(chip, "PD message len: %d", len);
+
++ /*
++ * Check if we've read off a GoodCRC message. If so then indicate to
++ * TCPM that the previous transmission has completed. Otherwise we pass
++ * the received message over to TCPM for processing.
++ *
++ * We make this check here instead of basing the reporting decision on
++ * the IRQ event type, as it's possible for the chip to report the
++ * TX_SUCCESS and GCRCSENT events out of order on occasion, so we need
++ * to check the message type to ensure correct reporting to TCPM.
++ */
++ if ((!len) && (pd_header_type_le(msg->header) == PD_CTRL_GOOD_CRC))
++ tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS);
++ else
++ tcpm_pd_receive(chip->tcpm_port, msg);
++
+ return ret;
+ }
+
+@@ -1659,13 +1674,12 @@ static irqreturn_t fusb302_irq_intn(int
+
+ if (interrupta & FUSB_REG_INTERRUPTA_TX_SUCCESS) {
+ fusb302_log(chip, "IRQ: PD tx success");
+- /* read out the received good CRC */
+ ret = fusb302_pd_read_message(chip, &pd_msg);
+ if (ret < 0) {
+- fusb302_log(chip, "cannot read in GCRC, ret=%d", ret);
++ fusb302_log(chip,
++ "cannot read in PD message, ret=%d", ret);
+ goto done;
+ }
+- tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS);
+ }
+
+ if (interrupta & FUSB_REG_INTERRUPTA_HARDRESET) {
+@@ -1686,7 +1700,6 @@ static irqreturn_t fusb302_irq_intn(int
+ "cannot read in PD message, ret=%d", ret);
+ goto done;
+ }
+- tcpm_pd_receive(chip->tcpm_port, &pd_msg);
+ }
+ done:
+ mutex_unlock(&chip->lock);
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Nov 2017 18:07:22 +0100
+Subject: USB: ledtrig-usbport: fix of-node leak
+
+From: Johan Hovold <johan@kernel.org>
+
+
+[ Upstream commit 03310a15484ab6a8f6d91bbf7fe486b17275c09a ]
+
+This code looks up a USB device node from a given parent USB device but
+never dropped its reference to the returned node.
+
+As only the address of the node is used for a later matching, the
+reference can be dropped immediately.
+
+Note that this trigger implementation confuses the description of the
+USB device connected to a port with the port itself (which does not have
+a device-tree representation).
+
+Fixes: 4f04c210d031 ("usb: core: read USB ports from DT in the usbport LED trigger driver")
+Cc: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/ledtrig-usbport.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/ledtrig-usbport.c
++++ b/drivers/usb/core/ledtrig-usbport.c
+@@ -140,11 +140,17 @@ static bool usbport_trig_port_observed(s
+ if (!led_np)
+ return false;
+
+- /* Get node of port being added */
++ /*
++ * Get node of port being added
++ *
++ * FIXME: This is really the device node of the connected device
++ */
+ port_np = usb_of_get_child_node(usb_dev->dev.of_node, port1);
+ if (!port_np)
+ return false;
+
++ of_node_put(port_np);
++
+ /* Amount of trigger sources for this LED */
+ count = of_count_phandle_with_args(led_np, "trigger-sources",
+ "#trigger-source-cells");
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 29 Nov 2017 17:29:20 -0600
+Subject: userns: Don't fail follow_automount based on s_user_ns
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+
+[ Upstream commit bbc3e471011417598e598707486f5d8814ec9c01 ]
+
+When vfs_submount was added the test to limit automounts from
+filesystems that with s_user_ns != &init_user_ns accidentially left
+in follow_automount. The test was never about any security concerns
+and was always about how do we implement this for filesystems whose
+s_user_ns != &init_user_ns.
+
+At the moment this check makes no difference as there are no
+filesystems that both set FS_USERNS_MOUNT and implement d_automount.
+
+Remove this check now while I am thinking about it so there will not
+be odd booby traps for someone who does want to make this combination
+work.
+
+vfs_submount still needs improvements to allow this combination to work,
+and vfs_submount contains a check that presents a warning.
+
+The autofs4 filesystem could be modified to set FS_USERNS_MOUNT and it would
+need not work on this code path, as userspace performs the mounts.
+
+Fixes: 93faccbbfa95 ("fs: Better permission checking for submounts")
+Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds")
+Acked-by: Ian Kent <raven@themaw.net>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/namei.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1133,9 +1133,6 @@ static int follow_automount(struct path
+ path->dentry->d_inode)
+ return -EISDIR;
+
+- if (path->dentry->d_sb->s_user_ns != &init_user_ns)
+- return -EACCES;
+-
+ nd->total_link_count++;
+ if (nd->total_link_count >= 40)
+ return -ELOOP;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Thu, 7 Dec 2017 15:40:20 -0800
+Subject: veth: set peer GSO values
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+
+[ Upstream commit 72d24955b44a4039db54a1c252b5031969eeaac3 ]
+
+When new veth is created, and GSO values have been configured
+on one device, clone those values to the peer.
+
+For example:
+ # ip link add dev vm1 gso_max_size 65530 type veth peer name vm2
+
+This should create vm1 <--> vm2 with both having GSO maximum
+size set to 65530.
+
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/veth.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -410,6 +410,9 @@ static int veth_newlink(struct net *src_
+ if (ifmp && (dev->ifindex != 0))
+ peer->ifindex = ifmp->ifi_index;
+
++ peer->gso_max_size = dev->gso_max_size;
++ peer->gso_max_segs = dev->gso_max_segs;
++
+ err = register_netdevice(peer);
+ put_net(net);
+ net = NULL;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:16 CET 2018
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+Date: Mon, 13 Nov 2017 19:04:18 +0200
+Subject: video/hdmi: Allow "empty" HDMI infoframes
+
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+
+
+[ Upstream commit 593f4b19a094c4426bd1e1e3cbab87a48bd13c71 ]
+
+HDMI 2.0 Appendix F suggest that we should keep sending the infoframe
+when switching from 3D to 2D mode, even if the infoframe isn't strictly
+necessary (ie. not needed to transmit the VIC or stereo information).
+This is a workaround against some sinks that fail to realize that they
+should switch from 3D to 2D mode when the source stop transmitting
+the infoframe.
+
+v2: Handle unpack() as well
+ Pull the length calculation into a helper
+
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: linux-media@vger.kernel.org
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> #v1
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171113170427.4150-2-ville.syrjala@linux.intel.com
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/hdmi.c | 51 +++++++++++++++++++++++++++++++--------------------
+ 1 file changed, 31 insertions(+), 20 deletions(-)
+
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hd
+ }
+ EXPORT_SYMBOL(hdmi_vendor_infoframe_init);
+
++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame)
++{
++ /* for side by side (half) we also need to provide 3D_Ext_Data */
++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
++ return 6;
++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID)
++ return 5;
++ else
++ return 4;
++}
++
+ /**
+ * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer
+ * @frame: HDMI infoframe
+@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struc
+ u8 *ptr = buffer;
+ size_t length;
+
+- /* empty info frame */
+- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID)
+- return -EINVAL;
+-
+ /* only one of those can be supplied */
+ if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID)
+ return -EINVAL;
+
+- /* for side by side (half) we also need to provide 3D_Ext_Data */
+- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
+- frame->length = 6;
+- else
+- frame->length = 5;
++ frame->length = hdmi_vendor_infoframe_length(frame);
+
+ length = HDMI_INFOFRAME_HEADER_SIZE + frame->length;
+
+@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struc
+ ptr[5] = 0x0c;
+ ptr[6] = 0x00;
+
+- if (frame->vic) {
+- ptr[7] = 0x1 << 5; /* video format */
+- ptr[8] = frame->vic;
+- } else {
++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) {
+ ptr[7] = 0x2 << 5; /* video format */
+ ptr[8] = (frame->s3d_struct & 0xf) << 4;
+ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF)
+ ptr[9] = (frame->s3d_ext_data & 0xf) << 4;
++ } else if (frame->vic) {
++ ptr[7] = 0x1 << 5; /* video format */
++ ptr[8] = frame->vic;
++ } else {
++ ptr[7] = 0x0 << 5; /* video format */
+ }
+
+ hdmi_infoframe_set_checksum(buffer, length);
+@@ -1165,7 +1170,7 @@ hdmi_vendor_any_infoframe_unpack(union h
+
+ if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR ||
+ ptr[1] != 1 ||
+- (ptr[2] != 5 && ptr[2] != 6))
++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6))
+ return -EINVAL;
+
+ length = ptr[2];
+@@ -1193,16 +1198,22 @@ hdmi_vendor_any_infoframe_unpack(union h
+
+ hvf->length = length;
+
+- if (hdmi_video_format == 0x1) {
+- hvf->vic = ptr[4];
+- } else if (hdmi_video_format == 0x2) {
++ if (hdmi_video_format == 0x2) {
++ if (length != 5 && length != 6)
++ return -EINVAL;
+ hvf->s3d_struct = ptr[4] >> 4;
+ if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) {
+- if (length == 6)
+- hvf->s3d_ext_data = ptr[5] >> 4;
+- else
++ if (length != 6)
+ return -EINVAL;
++ hvf->s3d_ext_data = ptr[5] >> 4;
+ }
++ } else if (hdmi_video_format == 0x1) {
++ if (length != 5)
++ return -EINVAL;
++ hvf->vic = ptr[4];
++ } else {
++ if (length != 4)
++ return -EINVAL;
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Thu, 7 Dec 2017 13:15:15 +0900
+Subject: virtio_net: Disable interrupts if napi_complete_done rescheduled napi
+
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+
+
+[ Upstream commit fdaa767aefc1685f9a41e91f447c9aea94103df6 ]
+
+Since commit 39e6c8208d7b ("net: solve a NAPI race") napi has been able
+to be rescheduled within napi_complete_done() even in non-busypoll case,
+but virtnet_poll() always enabled interrupts before complete, and when
+napi was rescheduled within napi_complete_done() it did not disable
+interrupts.
+This caused more interrupts when event idx is disabled.
+
+According to commit cbdadbbf0c79 ("virtio_net: fix race in RX VQ
+processing") we cannot place virtqueue_enable_cb_prepare() after
+NAPI_STATE_SCHED is cleared, so disable interrupts again if
+napi_complete_done() returned false.
+
+Tested with vhost-user of OVS 2.7 on host, which does not have the event
+idx feature.
+
+* Before patch:
+
+$ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472
+MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET
+Socket Message Elapsed Messages
+Size Size Time Okay Errors Throughput
+bytes bytes secs # # 10^6bits/sec
+
+212992 1472 60.00 32763206 0 6430.32
+212992 60.00 23384299 4589.56
+
+Interrupts on guest: 9872369
+Packets/interrupt: 2.37
+
+* After patch
+
+$ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472
+MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET
+Socket Message Elapsed Messages
+Size Size Time Okay Errors Throughput
+bytes bytes secs # # 10^6bits/sec
+
+212992 1472 60.00 32794646 0 6436.49
+212992 60.00 32793501 6436.27
+
+Interrupts on guest: 4941299
+Packets/interrupt: 6.64
+
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -260,9 +260,12 @@ static void virtqueue_napi_complete(stru
+ int opaque;
+
+ opaque = virtqueue_enable_cb_prepare(vq);
+- if (napi_complete_done(napi, processed) &&
+- unlikely(virtqueue_poll(vq, opaque)))
+- virtqueue_napi_schedule(napi, vq);
++ if (napi_complete_done(napi, processed)) {
++ if (unlikely(virtqueue_poll(vq, opaque)))
++ virtqueue_napi_schedule(napi, vq);
++ } else {
++ virtqueue_disable_cb(vq);
++ }
+ }
+
+ static void skb_xmit_done(struct virtqueue *vq)
--- /dev/null
+From foo@baz Fri Mar 16 15:43:17 CET 2018
+From: Yossef Efraim <yossefe@mellanox.com>
+Date: Tue, 28 Nov 2017 11:49:28 +0200
+Subject: xfrm: Fix xfrm_replay_overflow_offload_esn
+
+From: Yossef Efraim <yossefe@mellanox.com>
+
+
+[ Upstream commit 0ba23a211360af7b6658e4fcfc571970bbbacc55 ]
+
+In case of wrap around, replay_esn->oseq_hi is not updated
+before it is tested for it's actual value, leading function
+to fail with overflow indication and packets being dropped.
+
+This patch updates replay_esn->oseq_hi in the right place.
+
+Fixes: d7dbefc45cf5 ("xfrm: Add xfrm_replay_overflow functions for offloading")
+Signed-off-by: Yossef Efraim <yossefe@mellanox.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_replay.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_replay.c
++++ b/net/xfrm/xfrm_replay.c
+@@ -666,7 +666,7 @@ static int xfrm_replay_overflow_offload_
+ if (unlikely(oseq < replay_esn->oseq)) {
+ XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi;
+ xo->seq.hi = oseq_hi;
+-
++ replay_esn->oseq_hi = oseq_hi;
+ if (replay_esn->oseq_hi == 0) {
+ replay_esn->oseq--;
+ replay_esn->oseq_hi--;
+@@ -678,7 +678,6 @@ static int xfrm_replay_overflow_offload_
+ }
+
+ replay_esn->oseq = oseq;
+- replay_esn->oseq_hi = oseq_hi;
+
+ if (xfrm_aevent_is_on(net))
+ x->repl->notify(x, XFRM_REPLAY_UPDATE);
projects / thirdparty / kernel / stable-queue.git / commitdiff
