--- /dev/null
+From 6524024feac032db6f8ab8bad87852b4bbd6dbc4 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 7 May 2019 10:45:24 -0700
+Subject: ARC: fix build warnings
+
+[ Upstream commit 89c92142f75eb80064f5b9f1111484b1b4d81790 ]
+
+| arch/arc/mm/tlb.c:914:2: warning: variable length array 'pd0' is used [-Wvla]
+| arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value]
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/cmpxchg.h | 14 ++++++++++----
+ arch/arc/mm/tlb.c | 13 ++++++++-----
+ 2 files changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
+index d819de1c5d10..3ea4112c8302 100644
+--- a/arch/arc/include/asm/cmpxchg.h
++++ b/arch/arc/include/asm/cmpxchg.h
+@@ -92,8 +92,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
+
+ #endif /* CONFIG_ARC_HAS_LLSC */
+
+-#define cmpxchg(ptr, o, n) ((typeof(*(ptr)))__cmpxchg((ptr), \
+- (unsigned long)(o), (unsigned long)(n)))
++#define cmpxchg(ptr, o, n) ({ \
++ (typeof(*(ptr)))__cmpxchg((ptr), \
++ (unsigned long)(o), \
++ (unsigned long)(n)); \
++})
+
+ /*
+ * atomic_cmpxchg is same as cmpxchg
+@@ -198,8 +201,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
+ return __xchg_bad_pointer();
+ }
+
+-#define xchg(ptr, with) ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), \
+- sizeof(*(ptr))))
++#define xchg(ptr, with) ({ \
++ (typeof(*(ptr)))__xchg((unsigned long)(with), \
++ (ptr), \
++ sizeof(*(ptr))); \
++})
+
+ #endif /* CONFIG_ARC_PLAT_EZNPS */
+
+diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
+index 4097764fea23..fa18c00b0cfd 100644
+--- a/arch/arc/mm/tlb.c
++++ b/arch/arc/mm/tlb.c
+@@ -911,9 +911,11 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ struct pt_regs *regs)
+ {
+ struct cpuinfo_arc_mmu *mmu = &cpuinfo_arc700[smp_processor_id()].mmu;
+- unsigned int pd0[mmu->ways];
+ unsigned long flags;
+- int set;
++ int set, n_ways = mmu->ways;
++
++ n_ways = min(n_ways, 4);
++ BUG_ON(mmu->ways > 4);
+
+ local_irq_save(flags);
+
+@@ -921,9 +923,10 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ for (set = 0; set < mmu->sets; set++) {
+
+ int is_valid, way;
++ unsigned int pd0[4];
+
+ /* read out all the ways of current set */
+- for (way = 0, is_valid = 0; way < mmu->ways; way++) {
++ for (way = 0, is_valid = 0; way < n_ways; way++) {
+ write_aux_reg(ARC_REG_TLBINDEX,
+ SET_WAY_TO_IDX(mmu, set, way));
+ write_aux_reg(ARC_REG_TLBCOMMAND, TLBRead);
+@@ -937,14 +940,14 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ continue;
+
+ /* Scan the set for duplicate ways: needs a nested loop */
+- for (way = 0; way < mmu->ways - 1; way++) {
++ for (way = 0; way < n_ways - 1; way++) {
+
+ int n;
+
+ if (!pd0[way])
+ continue;
+
+- for (n = way + 1; n < mmu->ways; n++) {
++ for (n = way + 1; n < n_ways; n++) {
+ if (pd0[way] != pd0[n])
+ continue;
+
+--
+2.20.1
+
--- /dev/null
+From 7c104545d791e0e083562500bb77f2481f10e57f Mon Sep 17 00:00:00 2001
+From: Jose Abreu <joabreu@synopsys.com>
+Date: Mon, 20 May 2019 15:43:13 +0200
+Subject: ARC: [plat-hsdk]: Add missing FIFO size entry in GMAC node
+
+[ Upstream commit 4c70850aeb2e40016722cd1abd43c679666d3ca0 ]
+
+Add the binding for RX/TX fifo size of GMAC node.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Vineet Gupta <vgupta@synopsys.com>
+Tested-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Acked-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 699f372b2a6f..6219b372e9c1 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -196,6 +196,9 @@
+ mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
+ dma-coherent;
+
++ tx-fifo-depth = <4096>;
++ rx-fifo-depth = <4096>;
++
+ mdio {
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.20.1
+
--- /dev/null
+From a61bb8a9e1b7067d90471d1a8d1926746458726b Mon Sep 17 00:00:00 2001
+From: Jose Abreu <joabreu@synopsys.com>
+Date: Mon, 20 May 2019 15:43:12 +0200
+Subject: ARC: [plat-hsdk]: Add missing multicast filter bins number to GMAC
+ node
+
+[ Upstream commit ecc906a11c2a0940e1a380debd8bd5bc09faf454 ]
+
+GMAC controller on HSDK boards supports 256 Hash Table size so we need to
+add the multicast filter bins property. This allows for the Hash filter
+to work properly using stmmac driver.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Acked-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 7425bb0f2d1b..699f372b2a6f 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -187,6 +187,7 @@
+ interrupt-names = "macirq";
+ phy-mode = "rgmii";
+ snps,pbl = <32>;
++ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+ clock-names = "stmmaceth";
+ phy-handle = <&phy0>;
+--
+2.20.1
+
--- /dev/null
+From f6b92b722af367103210f594f9589f31354fc651 Mon Sep 17 00:00:00 2001
+From: Dave Martin <Dave.Martin@arm.com>
+Date: Thu, 6 Jun 2019 11:33:43 +0100
+Subject: arm64: Silence gcc warnings about arch ABI drift
+
+[ Upstream commit ebcc5928c5d925b1c8d968d9c89cdb0d0186db17 ]
+
+Since GCC 9, the compiler warns about evolution of the
+platform-specific ABI, in particular relating for the marshaling of
+certain structures involving bitfields.
+
+The kernel is a standalone binary, and of course nobody would be
+so stupid as to expose structs containing bitfields as function
+arguments in ABI. (Passing a pointer to such a struct, however
+inadvisable, should be unaffected by this change. perf and various
+drivers rely on that.)
+
+So these warnings do more harm than good: turn them off.
+
+We may miss warnings about future ABI drift, but that's too bad.
+Future ABI breaks of this class will have to be debugged and fixed
+the traditional way unless the compiler evolves finer-grained
+diagnostics.
+
+Signed-off-by: Dave Martin <Dave.Martin@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index b025304bde46..8fbd583b18e1 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -51,6 +51,7 @@ endif
+
+ KBUILD_CFLAGS += -mgeneral-regs-only $(lseinstr) $(brokengasinst)
+ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
++KBUILD_CFLAGS += -Wno-psabi
+ KBUILD_AFLAGS += $(lseinstr) $(brokengasinst)
+
+ KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
+--
+2.20.1
+
--- /dev/null
+From 172db1ddf4ca65001a7827a3fea6c8fd013d0b75 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Wed, 22 May 2019 12:42:29 -0700
+Subject: crypto: hmac - fix memory leak in hmac_init_tfm()
+
+[ Upstream commit 7829a0c1cb9c80debfb4fdb49b4d90019f2ea1ac ]
+
+When I added the sanity check of 'descsize', I missed that the child
+hash tfm needs to be freed if the sanity check fails. Of course this
+should never happen, hence the use of WARN_ON(), but it should be fixed.
+
+Fixes: e1354400b25d ("crypto: hash - fix incorrect HASH_MAX_DESCSIZE")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/hmac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/hmac.c b/crypto/hmac.c
+index 4b8c8ee8f15c..c623778b36ba 100644
+--- a/crypto/hmac.c
++++ b/crypto/hmac.c
+@@ -168,8 +168,10 @@ static int hmac_init_tfm(struct crypto_tfm *tfm)
+
+ parent->descsize = sizeof(struct shash_desc) +
+ crypto_shash_descsize(hash);
+- if (WARN_ON(parent->descsize > HASH_MAX_DESCSIZE))
++ if (WARN_ON(parent->descsize > HASH_MAX_DESCSIZE)) {
++ crypto_free_shash(hash);
+ return -EINVAL;
++ }
+
+ ctx->hash = hash;
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 5a1c334a5c8911edc777f4ba611ec6aad311496b Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 8 May 2019 23:33:29 +0100
+Subject: dmaengine: dw-axi-dmac: fix null dereference when pointer first is
+ null
+
+[ Upstream commit 0788611c9a0925c607de536b2449de5ed98ef8df ]
+
+In the unlikely event that axi_desc_get returns a null desc in the
+very first iteration of the while-loop the error exit path ends
+up calling axi_desc_put on a null pointer 'first' and this causes
+a null pointer dereference. Fix this by adding a null check on
+pointer 'first' before calling axi_desc_put.
+
+Addresses-Coverity: ("Explicit null dereference")
+Fixes: 1fe20f1b8454 ("dmaengine: Introduce DW AXI DMAC driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index b2ac1d2c5b86..a1ce307c502f 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -512,7 +512,8 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
+ return vchan_tx_prep(&chan->vc, &first->vd, flags);
+
+ err_desc_get:
+- axi_desc_put(first);
++ if (first)
++ axi_desc_put(first);
+ return NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0690872a6349e526ab70619127fd37f74643a5a2 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sat, 4 May 2019 23:37:57 +0200
+Subject: dmaengine: jz4780: Fix transfers being ACKed too soon
+
+[ Upstream commit 4e4106f5e942bff65548e82fc330d40385c89220 ]
+
+When a multi-descriptor DMA transfer is in progress, the "IRQ pending"
+flag will apparently be set for that channel as soon as the last
+descriptor loads, way before the IRQ actually happens. This behaviour
+has been observed on the JZ4725B, but maybe other SoCs are affected.
+
+In the case where another DMA transfer is running into completion on a
+separate channel, the IRQ handler would then run the completion handler
+for our previous channel even if the transfer didn't actually finish.
+
+Fix this by checking in the completion handler that we're indeed done;
+if not the interrupted DMA transfer will simply be resumed.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 32 +++++++++++++++++++++-----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 9ce0a386225b..f49534019d37 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -666,10 +666,11 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ return status;
+ }
+
+-static void jz4780_dma_chan_irq(struct jz4780_dma_dev *jzdma,
+- struct jz4780_dma_chan *jzchan)
++static bool jz4780_dma_chan_irq(struct jz4780_dma_dev *jzdma,
++ struct jz4780_dma_chan *jzchan)
+ {
+ uint32_t dcs;
++ bool ack = true;
+
+ spin_lock(&jzchan->vchan.lock);
+
+@@ -692,12 +693,20 @@ static void jz4780_dma_chan_irq(struct jz4780_dma_dev *jzdma,
+ if ((dcs & (JZ_DMA_DCS_AR | JZ_DMA_DCS_HLT)) == 0) {
+ if (jzchan->desc->type == DMA_CYCLIC) {
+ vchan_cyclic_callback(&jzchan->desc->vdesc);
+- } else {
++
++ jz4780_dma_begin(jzchan);
++ } else if (dcs & JZ_DMA_DCS_TT) {
+ vchan_cookie_complete(&jzchan->desc->vdesc);
+ jzchan->desc = NULL;
+- }
+
+- jz4780_dma_begin(jzchan);
++ jz4780_dma_begin(jzchan);
++ } else {
++ /* False positive - continue the transfer */
++ ack = false;
++ jz4780_dma_chn_writel(jzdma, jzchan->id,
++ JZ_DMA_REG_DCS,
++ JZ_DMA_DCS_CTE);
++ }
+ }
+ } else {
+ dev_err(&jzchan->vchan.chan.dev->device,
+@@ -705,21 +714,22 @@ static void jz4780_dma_chan_irq(struct jz4780_dma_dev *jzdma,
+ }
+
+ spin_unlock(&jzchan->vchan.lock);
++
++ return ack;
+ }
+
+ static irqreturn_t jz4780_dma_irq_handler(int irq, void *data)
+ {
+ struct jz4780_dma_dev *jzdma = data;
++ unsigned int nb_channels = jzdma->soc_data->nb_channels;
+ uint32_t pending, dmac;
+ int i;
+
+ pending = jz4780_dma_ctrl_readl(jzdma, JZ_DMA_REG_DIRQP);
+
+- for (i = 0; i < jzdma->soc_data->nb_channels; i++) {
+- if (!(pending & (1<<i)))
+- continue;
+-
+- jz4780_dma_chan_irq(jzdma, &jzdma->chan[i]);
++ for_each_set_bit(i, (unsigned long *)&pending, nb_channels) {
++ if (jz4780_dma_chan_irq(jzdma, &jzdma->chan[i]))
++ pending &= ~BIT(i);
+ }
+
+ /* Clear halt and address error status of all channels. */
+@@ -728,7 +738,7 @@ static irqreturn_t jz4780_dma_irq_handler(int irq, void *data)
+ jz4780_dma_ctrl_writel(jzdma, JZ_DMA_REG_DMAC, dmac);
+
+ /* Clear interrupt pending status. */
+- jz4780_dma_ctrl_writel(jzdma, JZ_DMA_REG_DIRQP, 0);
++ jz4780_dma_ctrl_writel(jzdma, JZ_DMA_REG_DIRQP, pending);
+
+ return IRQ_HANDLED;
+ }
+--
+2.20.1
+
--- /dev/null
+From d0f2964f7c4b9ac799a379e7c6dc966bfd654d43 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 9 May 2019 13:09:23 +0300
+Subject: dmaengine: mediatek-cqdma: sleeping in atomic context
+
+[ Upstream commit 069b3c4214f27b130d0642f32438560db30f452e ]
+
+The mtk_cqdma_poll_engine_done() function takes a true/false parameter
+where true means it's called from atomic context. There are a couple
+places where it was set to false but it's actually in atomic context
+so it should be true.
+
+All the callers for mtk_cqdma_hard_reset() are holding a spin_lock and
+in mtk_cqdma_free_chan_resources() we take a spin_lock before calling
+the mtk_cqdma_poll_engine_done() function.
+
+Fixes: b1f01e48df5a ("dmaengine: mediatek: Add MediaTek Command-Queue DMA controller for MT6765 SoC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mediatek/mtk-cqdma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mediatek/mtk-cqdma.c b/drivers/dma/mediatek/mtk-cqdma.c
+index 814853842e29..723b11c190b3 100644
+--- a/drivers/dma/mediatek/mtk-cqdma.c
++++ b/drivers/dma/mediatek/mtk-cqdma.c
+@@ -225,7 +225,7 @@ static int mtk_cqdma_hard_reset(struct mtk_cqdma_pchan *pc)
+ mtk_dma_set(pc, MTK_CQDMA_RESET, MTK_CQDMA_HARD_RST_BIT);
+ mtk_dma_clr(pc, MTK_CQDMA_RESET, MTK_CQDMA_HARD_RST_BIT);
+
+- return mtk_cqdma_poll_engine_done(pc, false);
++ return mtk_cqdma_poll_engine_done(pc, true);
+ }
+
+ static void mtk_cqdma_start(struct mtk_cqdma_pchan *pc,
+@@ -671,7 +671,7 @@ static void mtk_cqdma_free_chan_resources(struct dma_chan *c)
+ mtk_dma_set(cvc->pc, MTK_CQDMA_FLUSH, MTK_CQDMA_FLUSH_BIT);
+
+ /* wait for the completion of flush operation */
+- if (mtk_cqdma_poll_engine_done(cvc->pc, false) < 0)
++ if (mtk_cqdma_poll_engine_done(cvc->pc, true) < 0)
+ dev_err(cqdma2dev(to_cqdma_dev(c)), "cqdma flush timeout\n");
+
+ /* clear the flush bit and interrupt flag */
+--
+2.20.1
+
--- /dev/null
+From 540239892f847ddff1802e5043f1fe2197ac2988 Mon Sep 17 00:00:00 2001
+From: Baolin Wang <baolin.wang@linaro.org>
+Date: Mon, 6 May 2019 15:28:29 +0800
+Subject: dmaengine: sprd: Add validation of current descriptor in irq handler
+
+[ Upstream commit 58152b0e573e5581c4b9ef7cf06d2e9fafae27d4 ]
+
+When user terminates one DMA channel to free all its descriptors, but
+at the same time one transaction interrupt was triggered possibly, now
+we should not handle this interrupt by validating if the 'schan->cur_desc'
+was set as NULL to avoid crashing the kernel.
+
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index e29342ab85f6..431e289d59a5 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -552,12 +552,17 @@ static irqreturn_t dma_irq_handle(int irq, void *dev_id)
+ schan = &sdev->channels[i];
+
+ spin_lock(&schan->vc.lock);
++
++ sdesc = schan->cur_desc;
++ if (!sdesc) {
++ spin_unlock(&schan->vc.lock);
++ return IRQ_HANDLED;
++ }
++
+ int_type = sprd_dma_get_int_type(schan);
+ req_type = sprd_dma_get_req_type(schan);
+ sprd_dma_clear_int(schan);
+
+- sdesc = schan->cur_desc;
+-
+ /* cyclic mode schedule callback */
+ cyclic = schan->linklist.phy_addr ? true : false;
+ if (cyclic == true) {
+--
+2.20.1
+
--- /dev/null
+From 4fdf8876020075dd12ca890ca77ad70eb66f4b99 Mon Sep 17 00:00:00 2001
+From: Eric Long <eric.long@unisoc.com>
+Date: Mon, 6 May 2019 15:28:31 +0800
+Subject: dmaengine: sprd: Fix block length overflow
+
+[ Upstream commit 89d03b3c126d683f7b2cd5b07178493993d12448 ]
+
+The maximum value of block length is 0xffff, so if the configured transfer length
+is more than 0xffff, that will cause block length overflow to lead a configuration
+error.
+
+Thus we can set block length as the maximum burst length to avoid this issue, since
+the maximum burst length will not be a big value which is more than 0xffff.
+
+Signed-off-by: Eric Long <eric.long@unisoc.com>
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 0f92e60529d1..a01c23246632 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -778,7 +778,7 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
+ temp |= slave_cfg->src_maxburst & SPRD_DMA_FRG_LEN_MASK;
+ hw->frg_len = temp;
+
+- hw->blk_len = len & SPRD_DMA_BLK_LEN_MASK;
++ hw->blk_len = slave_cfg->src_maxburst & SPRD_DMA_BLK_LEN_MASK;
+ hw->trsc_len = len & SPRD_DMA_TRSC_LEN_MASK;
+
+ temp = (dst_step & SPRD_DMA_TRSF_STEP_MASK) << SPRD_DMA_DEST_TRSF_STEP_OFFSET;
+--
+2.20.1
+
--- /dev/null
+From a114ba4e7658dcdd4b2a9b9fff0fcb29f5a6add5 Mon Sep 17 00:00:00 2001
+From: Eric Long <eric.long@unisoc.com>
+Date: Mon, 6 May 2019 15:28:30 +0800
+Subject: dmaengine: sprd: Fix the incorrect start for 2-stage destination
+ channels
+
+[ Upstream commit 3d626a97f0303e9c30d063434b749de3f0f91fb5 ]
+
+The 2-stage destination channel will be triggered by source channel
+automatically, which means we should not trigger it by software request.
+
+Signed-off-by: Eric Long <eric.long@unisoc.com>
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 431e289d59a5..0f92e60529d1 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -510,7 +510,9 @@ static void sprd_dma_start(struct sprd_dma_chn *schan)
+ sprd_dma_set_uid(schan);
+ sprd_dma_enable_chn(schan);
+
+- if (schan->dev_id == SPRD_DMA_SOFTWARE_UID)
++ if (schan->dev_id == SPRD_DMA_SOFTWARE_UID &&
++ schan->chn_mode != SPRD_DMA_DST_CHN0 &&
++ schan->chn_mode != SPRD_DMA_DST_CHN1)
+ sprd_dma_soft_request(schan);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4e8a37c025ec1d9e5c626507c81824a422329904 Mon Sep 17 00:00:00 2001
+From: Baolin Wang <baolin.wang@linaro.org>
+Date: Mon, 6 May 2019 15:28:28 +0800
+Subject: dmaengine: sprd: Fix the possible crash when getting descriptor
+ status
+
+[ Upstream commit 16d0f85e45b99411ac10cb12cdd9279204a72381 ]
+
+We will get a NULL virtual descriptor by vchan_find_desc() when the descriptor
+has been submitted, that will crash the kernel when getting the descriptor
+status.
+
+In this case, since the descriptor has been submitted to process, but it
+is not completed now, which means the descriptor is listed into the
+'vc->desc_submitted' list now. So we can not get current processing descriptor
+by vchan_find_desc(), but the pointer 'schan->cur_desc' will point to the
+current processing descriptor, then we can use 'schan->cur_desc' to get
+current processing descriptor's status to avoid this issue.
+
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 48431e2da987..e29342ab85f6 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -625,7 +625,7 @@ static enum dma_status sprd_dma_tx_status(struct dma_chan *chan,
+ else
+ pos = 0;
+ } else if (schan->cur_desc && schan->cur_desc->vd.tx.cookie == cookie) {
+- struct sprd_dma_desc *sdesc = to_sprd_dma_desc(vd);
++ struct sprd_dma_desc *sdesc = schan->cur_desc;
+
+ if (sdesc->dir == DMA_DEV_TO_MEM)
+ pos = sprd_dma_get_dst_addr(schan);
+--
+2.20.1
+
--- /dev/null
+From f89aa8525a8e3fd5d0aaf4114b15af7bf6f9a75f Mon Sep 17 00:00:00 2001
+From: Eric Long <eric.long@unisoc.com>
+Date: Mon, 6 May 2019 15:28:32 +0800
+Subject: dmaengine: sprd: Fix the right place to configure 2-stage transfer
+
+[ Upstream commit c434e377dad1dec05cad1870ce21bc539e1e024f ]
+
+Move the 2-stage configuration before configuring the link-list mode,
+since we will use some 2-stage configuration to fill the link-list
+configuration.
+
+Signed-off-by: Eric Long <eric.long@unisoc.com>
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index a01c23246632..01abed5cde49 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -911,6 +911,12 @@ sprd_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+ schan->linklist.virt_addr = 0;
+ }
+
++ /* Set channel mode and trigger mode for 2-stage transfer */
++ schan->chn_mode =
++ (flags >> SPRD_DMA_CHN_MODE_SHIFT) & SPRD_DMA_CHN_MODE_MASK;
++ schan->trg_mode =
++ (flags >> SPRD_DMA_TRG_MODE_SHIFT) & SPRD_DMA_TRG_MODE_MASK;
++
+ sdesc = kzalloc(sizeof(*sdesc), GFP_NOWAIT);
+ if (!sdesc)
+ return NULL;
+@@ -944,12 +950,6 @@ sprd_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+ }
+ }
+
+- /* Set channel mode and trigger mode for 2-stage transfer */
+- schan->chn_mode =
+- (flags >> SPRD_DMA_CHN_MODE_SHIFT) & SPRD_DMA_CHN_MODE_MASK;
+- schan->trg_mode =
+- (flags >> SPRD_DMA_TRG_MODE_SHIFT) & SPRD_DMA_TRG_MODE_MASK;
+-
+ ret = sprd_dma_fill_desc(chan, &sdesc->chn_hw, 0, 0, src, dst, len,
+ dir, flags, slave_cfg);
+ if (ret) {
+--
+2.20.1
+
--- /dev/null
+From bb9fcfff8bc1f7e0d49908797bd8e07dfd354892 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Fri, 17 May 2019 17:37:21 +0100
+Subject: drm/arm/hdlcd: Actually validate CRTC modes
+
+[ Upstream commit b96151edced4edb6a18aa89a5fa02c7066efff45 ]
+
+Rather than allowing any old mode through, then subsequently refusing
+unmatchable clock rates in atomic_check when it's too late to back out
+and pick a different mode, let's do that validation up-front where it
+will cause unsupported modes to be correctly pruned in the first place.
+
+This also eliminates an issue whereby a perceived clock rate of 0 would
+cause atomic disable to fail and prevent the module from being unloaded.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/hdlcd_crtc.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
+index 0b2b62f8fa3c..ecac6fe0b213 100644
+--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
++++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
+@@ -186,20 +186,19 @@ static void hdlcd_crtc_atomic_disable(struct drm_crtc *crtc,
+ clk_disable_unprepare(hdlcd->clk);
+ }
+
+-static int hdlcd_crtc_atomic_check(struct drm_crtc *crtc,
+- struct drm_crtc_state *state)
++static enum drm_mode_status hdlcd_crtc_mode_valid(struct drm_crtc *crtc,
++ const struct drm_display_mode *mode)
+ {
+ struct hdlcd_drm_private *hdlcd = crtc_to_hdlcd_priv(crtc);
+- struct drm_display_mode *mode = &state->adjusted_mode;
+ long rate, clk_rate = mode->clock * 1000;
+
+ rate = clk_round_rate(hdlcd->clk, clk_rate);
+ if (rate != clk_rate) {
+ /* clock required by mode not supported by hardware */
+- return -EINVAL;
++ return MODE_NOCLOCK;
+ }
+
+- return 0;
++ return MODE_OK;
+ }
+
+ static void hdlcd_crtc_atomic_begin(struct drm_crtc *crtc,
+@@ -220,7 +219,7 @@ static void hdlcd_crtc_atomic_begin(struct drm_crtc *crtc,
+ }
+
+ static const struct drm_crtc_helper_funcs hdlcd_crtc_helper_funcs = {
+- .atomic_check = hdlcd_crtc_atomic_check,
++ .mode_valid = hdlcd_crtc_mode_valid,
+ .atomic_begin = hdlcd_crtc_atomic_begin,
+ .atomic_enable = hdlcd_crtc_atomic_enable,
+ .atomic_disable = hdlcd_crtc_atomic_disable,
+--
+2.20.1
+
--- /dev/null
+From c63d59d9a26526ee657965665d3947366811ed6b Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Fri, 17 May 2019 17:37:22 +0100
+Subject: drm/arm/hdlcd: Allow a bit of clock tolerance
+
+[ Upstream commit 1c810739097fdeb31b393b67a0a1e3d7ffdd9f63 ]
+
+On the Arm Juno platform, the HDLCD pixel clock is constrained to 250KHz
+resolution in order to avoid the tiny System Control Processor spending
+aeons trying to calculate exact PLL coefficients. This means that modes
+like my oddball 1600x1200 with 130.89MHz clock get rejected since the
+rate cannot be matched exactly. In practice, though, this mode works
+quite happily with the clock at 131MHz, so let's relax the check to
+allow a little bit of slop.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/hdlcd_crtc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
+index ecac6fe0b213..a3efa28436ea 100644
+--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
++++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
+@@ -193,7 +193,8 @@ static enum drm_mode_status hdlcd_crtc_mode_valid(struct drm_crtc *crtc,
+ long rate, clk_rate = mode->clock * 1000;
+
+ rate = clk_round_rate(hdlcd->clk, clk_rate);
+- if (rate != clk_rate) {
++ /* 0.1% seems a close enough tolerance for the TDA19988 on Juno */
++ if (abs(rate - clk_rate) * 1000 > clk_rate) {
+ /* clock required by mode not supported by hardware */
+ return MODE_NOCLOCK;
+ }
+--
+2.20.1
+
--- /dev/null
+From bdb551e298cbad9fcbee32b330c934045b331435 Mon Sep 17 00:00:00 2001
+From: Wen He <wen.he_1@nxp.com>
+Date: Wed, 8 May 2019 10:58:18 +0000
+Subject: drm/arm/mali-dp: Add a loop around the second set CVAL and try 5
+ times
+
+[ Upstream commit 6a88e0c14813d00f8520d0e16cd4136c6cf8b4d4 ]
+
+This patch trying to fix monitor freeze issue caused by drm error
+'flip_done timed out' on LS1028A platform. this set try is make a loop
+around the second setting CVAL and try like 5 times before giveing up.
+
+Signed-off-by: Wen He <wen.he_1@nxp.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/malidp_drv.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
+index ab50ad06e271..64da56f4b0cf 100644
+--- a/drivers/gpu/drm/arm/malidp_drv.c
++++ b/drivers/gpu/drm/arm/malidp_drv.c
+@@ -192,6 +192,7 @@ static void malidp_atomic_commit_hw_done(struct drm_atomic_state *state)
+ {
+ struct drm_device *drm = state->dev;
+ struct malidp_drm *malidp = drm->dev_private;
++ int loop = 5;
+
+ malidp->event = malidp->crtc.state->event;
+ malidp->crtc.state->event = NULL;
+@@ -206,8 +207,18 @@ static void malidp_atomic_commit_hw_done(struct drm_atomic_state *state)
+ drm_crtc_vblank_get(&malidp->crtc);
+
+ /* only set config_valid if the CRTC is enabled */
+- if (malidp_set_and_wait_config_valid(drm) < 0)
++ if (malidp_set_and_wait_config_valid(drm) < 0) {
++ /*
++ * make a loop around the second CVAL setting and
++ * try 5 times before giving up.
++ */
++ while (loop--) {
++ if (!malidp_set_and_wait_config_valid(drm))
++ break;
++ }
+ DRM_DEBUG_DRIVER("timed out waiting for updated configuration\n");
++ }
++
+ } else if (malidp->event) {
+ /* CRTC inactive means vblank IRQ is disabled, send event directly */
+ spin_lock_irq(&drm->event_lock);
+--
+2.20.1
+
--- /dev/null
+From 996a359eed3bb4719c030e5689ae5bca45214376 Mon Sep 17 00:00:00 2001
+From: Scott Wood <swood@redhat.com>
+Date: Thu, 9 May 2019 16:08:28 -0500
+Subject: fpga: dfl: Add lockdep classes for pdata->lock
+
+[ Upstream commit dfe3de8d397bf878b31864d4e489d41118ec475f ]
+
+struct dfl_feature_platform_data (and it's mutex) is used
+by both fme and port devices, and when lockdep is enabled it
+complains about nesting between these locks. Tell lockdep about
+the difference so it can track each class separately.
+
+Here's the lockdep complaint:
+[ 409.680668] WARNING: possible recursive locking detected
+[ 409.685983] 5.1.0-rc3.fpga+ #1 Tainted: G E
+[ 409.691469] --------------------------------------------
+[ 409.696779] fpgaconf/9348 is trying to acquire lock:
+[ 409.701746] 00000000a443fe2e (&pdata->lock){+.+.}, at: port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.710006]
+[ 409.710006] but task is already holding lock:
+[ 409.715837] 0000000063b78782 (&pdata->lock){+.+.}, at: fme_pr_ioctl+0x21d/0x330 [dfl_fme]
+[ 409.724012]
+[ 409.724012] other info that might help us debug this:
+[ 409.730535] Possible unsafe locking scenario:
+[ 409.730535]
+[ 409.736457] CPU0
+[ 409.738910] ----
+[ 409.741360] lock(&pdata->lock);
+[ 409.744679] lock(&pdata->lock);
+[ 409.747999]
+[ 409.747999] *** DEADLOCK ***
+[ 409.747999]
+[ 409.753920] May be due to missing lock nesting notation
+[ 409.753920]
+[ 409.760704] 4 locks held by fpgaconf/9348:
+[ 409.764805] #0: 0000000063b78782 (&pdata->lock){+.+.}, at: fme_pr_ioctl+0x21d/0x330 [dfl_fme]
+[ 409.773408] #1: 00000000213c8a66 (®ion->mutex){+.+.}, at: fpga_region_program_fpga+0x24/0x200 [fpga_region]
+[ 409.783489] #2: 00000000fe63afb9 (&mgr->ref_mutex){+.+.}, at: fpga_mgr_lock+0x15/0x40 [fpga_mgr]
+[ 409.792354] #3: 000000000b2285c5 (&bridge->mutex){+.+.}, at: __fpga_bridge_get+0x26/0xa0 [fpga_bridge]
+[ 409.801740]
+[ 409.801740] stack backtrace:
+[ 409.806102] CPU: 45 PID: 9348 Comm: fpgaconf Kdump: loaded Tainted: G E 5.1.0-rc3.fpga+ #1
+[ 409.815658] Hardware name: Intel Corporation S2600BT/S2600BT, BIOS SE5C620.86B.01.00.0763.022420181017 02/24/2018
+[ 409.825911] Call Trace:
+[ 409.828369] dump_stack+0x5e/0x8b
+[ 409.831686] __lock_acquire+0xf3d/0x10e0
+[ 409.835612] ? find_held_lock+0x3c/0xa0
+[ 409.839451] lock_acquire+0xbc/0x1d0
+[ 409.843030] ? port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.847823] ? port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.852616] __mutex_lock+0x86/0x970
+[ 409.856195] ? port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.860989] ? port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.865777] ? __mutex_unlock_slowpath+0x4b/0x290
+[ 409.870486] port_enable_set+0x24/0x60 [dfl_afu]
+[ 409.875106] fpga_bridges_disable+0x36/0x50 [fpga_bridge]
+[ 409.880502] fpga_region_program_fpga+0xea/0x200 [fpga_region]
+[ 409.886338] fme_pr_ioctl+0x13e/0x330 [dfl_fme]
+[ 409.890870] fme_ioctl+0x66/0xe0 [dfl_fme]
+[ 409.894973] do_vfs_ioctl+0xa9/0x720
+[ 409.898548] ? lockdep_hardirqs_on+0xf0/0x1a0
+[ 409.902907] ksys_ioctl+0x60/0x90
+[ 409.906225] __x64_sys_ioctl+0x16/0x20
+[ 409.909981] do_syscall_64+0x5a/0x220
+[ 409.913644] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 409.918698] RIP: 0033:0x7f9d31b9b8d7
+[ 409.922276] Code: 44 00 00 48 8b 05 b9 15 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 89 15 2d 00 f7 d8 64 89 01 48
+[ 409.941020] RSP: 002b:00007ffe4cae0d68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+[ 409.948588] RAX: ffffffffffffffda RBX: 00007f9d32ade6a0 RCX: 00007f9d31b9b8d7
+[ 409.955719] RDX: 00007ffe4cae0df0 RSI: 000000000000b680 RDI: 0000000000000003
+[ 409.962852] RBP: 0000000000000003 R08: 00007f9d2b70a177 R09: 00007ffe4cae0e40
+[ 409.969984] R10: 00007ffe4cae0160 R11: 0000000000000202 R12: 00007ffe4cae0df0
+[ 409.977115] R13: 000000000000b680 R14: 0000000000000000 R15: 00007ffe4cae0f60
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Acked-by: Wu Hao <hao.wu@intel.com>
+Acked-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/dfl.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
+index 2c09e502e721..c25217cde5ca 100644
+--- a/drivers/fpga/dfl.c
++++ b/drivers/fpga/dfl.c
+@@ -40,6 +40,13 @@ enum dfl_fpga_devt_type {
+ DFL_FPGA_DEVT_MAX,
+ };
+
++static struct lock_class_key dfl_pdata_keys[DFL_ID_MAX];
++
++static const char *dfl_pdata_key_strings[DFL_ID_MAX] = {
++ "dfl-fme-pdata",
++ "dfl-port-pdata",
++};
++
+ /**
+ * dfl_dev_info - dfl feature device information.
+ * @name: name string of the feature platform device.
+@@ -443,11 +450,16 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+ struct platform_device *fdev = binfo->feature_dev;
+ struct dfl_feature_platform_data *pdata;
+ struct dfl_feature_info *finfo, *p;
++ enum dfl_id_type type;
+ int ret, index = 0;
+
+ if (!fdev)
+ return 0;
+
++ type = feature_dev_id_type(fdev);
++ if (WARN_ON_ONCE(type >= DFL_ID_MAX))
++ return -EINVAL;
++
+ /*
+ * we do not need to care for the memory which is associated with
+ * the platform device. After calling platform_device_unregister(),
+@@ -463,6 +475,8 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+ pdata->num = binfo->feature_num;
+ pdata->dfl_cdev = binfo->cdev;
+ mutex_init(&pdata->lock);
++ lockdep_set_class_and_name(&pdata->lock, &dfl_pdata_keys[type],
++ dfl_pdata_key_strings[type]);
+
+ /*
+ * the count should be initialized to 0 to make sure
+@@ -497,7 +511,7 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+
+ ret = platform_device_add(binfo->feature_dev);
+ if (!ret) {
+- if (feature_dev_id_type(binfo->feature_dev) == PORT_ID)
++ if (type == PORT_ID)
+ dfl_fpga_cdev_add_port_dev(binfo->cdev,
+ binfo->feature_dev);
+ else
+--
+2.20.1
+
--- /dev/null
+From 3231818198a16cd2800bc5a482c91ae5607654a0 Mon Sep 17 00:00:00 2001
+From: Scott Wood <swood@redhat.com>
+Date: Thu, 9 May 2019 16:08:27 -0500
+Subject: fpga: dfl: afu: Pass the correct device to dma_mapping_error()
+
+[ Upstream commit 13069847a475b60069918dc9971f5adb42811ce3 ]
+
+dma_mapping_error() was being called on a different device struct than
+what was passed to map/unmap. Besides rendering the error checking
+ineffective, it caused a debug splat with CONFIG_DMA_API_DEBUG.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Acked-by: Wu Hao <hao.wu@intel.com>
+Acked-by: Moritz Fischer <mdf@kernel.org>
+Acked-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/dfl-afu-dma-region.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
+index e18a786fc943..cd68002ac097 100644
+--- a/drivers/fpga/dfl-afu-dma-region.c
++++ b/drivers/fpga/dfl-afu-dma-region.c
+@@ -399,7 +399,7 @@ int afu_dma_map_region(struct dfl_feature_platform_data *pdata,
+ region->pages[0], 0,
+ region->length,
+ DMA_BIDIRECTIONAL);
+- if (dma_mapping_error(&pdata->dev->dev, region->iova)) {
++ if (dma_mapping_error(dfl_fpga_pdata_to_parent(pdata), region->iova)) {
+ dev_err(&pdata->dev->dev, "failed to map for dma\n");
+ ret = -EFAULT;
+ goto unpin_pages;
+--
+2.20.1
+
--- /dev/null
+From 07df33dd911470160389dc046ac99e8157981217 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 9 May 2019 16:08:26 -0500
+Subject: fpga: stratix10-soc: fix use-after-free on s10_init()
+
+[ Upstream commit f5dd87326fefe42a4b1a4b1a1a695060c33a88d6 ]
+
+The refcount of fw_np has already been decreased by of_find_matching_node()
+so it shouldn't be used anymore.
+This patch adds an of_node_get() before of_find_matching_node() to avoid
+the use-after-free problem.
+
+Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: Alan Tull <atull@kernel.org>
+Cc: Moritz Fischer <mdf@kernel.org>
+Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Cc: linux-fpga@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Moritz Fischer <mdf@kernel.org>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/stratix10-soc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
+index 13851b3d1c56..215d33789c74 100644
+--- a/drivers/fpga/stratix10-soc.c
++++ b/drivers/fpga/stratix10-soc.c
+@@ -507,12 +507,16 @@ static int __init s10_init(void)
+ if (!fw_np)
+ return -ENODEV;
+
++ of_node_get(fw_np);
+ np = of_find_matching_node(fw_np, s10_of_match);
+- if (!np)
++ if (!np) {
++ of_node_put(fw_np);
+ return -ENODEV;
++ }
+
+ of_node_put(np);
+ ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
++ of_node_put(fw_np);
+ if (ret)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 4b0a8722861b96447c9faea4c2f96c50dd30c774 Mon Sep 17 00:00:00 2001
+From: Oded Gabbay <oded.gabbay@gmail.com>
+Date: Tue, 28 May 2019 23:03:54 +0300
+Subject: habanalabs: fix bug in checking huge page optimization
+
+[ Upstream commit d724170160f800fa8dfd3c0cdebb8b093570b504 ]
+
+This patch fix a bug in the mmu code that checks whether we can use huge
+page mappings for host pages.
+
+The code is supposed to enable huge page mappings only if ALL DMA
+addresses are aligned to 2MB AND the number of pages in each DMA chunk is
+a modulo of the number of pages in 2MB. However, the code ignored the
+first requirement for the first DMA chunk.
+
+This patch fix that issue by making sure the requirement of address
+alignment is validated against all DMA chunks.
+
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/memory.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c
+index fadaf557603f..425442819d31 100644
+--- a/drivers/misc/habanalabs/memory.c
++++ b/drivers/misc/habanalabs/memory.c
+@@ -675,11 +675,6 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx,
+
+ total_npages += npages;
+
+- if (first) {
+- first = false;
+- dma_addr &= PAGE_MASK_2MB;
+- }
+-
+ if ((npages % PGS_IN_2MB_PAGE) ||
+ (dma_addr & (PAGE_SIZE_2MB - 1)))
+ is_huge_page_opt = false;
+@@ -704,7 +699,6 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx,
+ phys_pg_pack->total_size = total_npages * page_size;
+
+ j = 0;
+- first = true;
+ for_each_sg(userptr->sgt->sgl, sg, userptr->sgt->nents, i) {
+ npages = get_sg_info(sg, &dma_addr);
+
+--
+2.20.1
+
--- /dev/null
+From 060a3ae205a3a319c11591b35edcd15bcc2a6ec3 Mon Sep 17 00:00:00 2001
+From: Eduardo Valentin <eduval@amazon.com>
+Date: Wed, 29 May 2019 19:56:04 -0700
+Subject: hwmon: (core) add thermal sensors only if dev->of_node is present
+
+[ Upstream commit c41dd48e21fae3e55b3670ccf2eb562fc1f6a67d ]
+
+Drivers may register to hwmon and request for also registering
+with the thermal subsystem (HWMON_C_REGISTER_TZ). However,
+some of these driver, e.g. marvell phy, may be probed from
+Device Tree or being dynamically allocated, and in the later
+case, it will not have a dev->of_node entry.
+
+Registering with hwmon without the dev->of_node may result in
+different outcomes depending on the device tree, which may
+be a bit misleading. If the device tree blob has no 'thermal-zones'
+node, the *hwmon_device_register*() family functions are going
+to gracefully succeed, because of-thermal,
+*thermal_zone_of_sensor_register() return -ENODEV in this case,
+and the hwmon error path handles this error code as success to
+cover for the case where CONFIG_THERMAL_OF is not set.
+However, if the device tree blob has the 'thermal-zones'
+entry, the *hwmon_device_register*() will always fail on callers
+with no dev->of_node, propagating -EINVAL.
+
+If dev->of_node is not present, calling of-thermal does not
+make sense. For this reason, this patch checks first if the
+device has a of_node before going over the process of registering
+with the thermal subsystem of-thermal interface. And in this case,
+when a caller of *hwmon_device_register*() with HWMON_C_REGISTER_TZ
+and no dev->of_node will still register with hwmon, but not with
+the thermal subsystem. If all the hwmon part bits are in place,
+the registration will succeed.
+
+Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API")
+Cc: Jean Delvare <jdelvare@suse.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: linux-hwmon@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Eduardo Valentin <eduval@amazon.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index c22dc1e07911..c38883f748a1 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -633,7 +633,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ if (err)
+ goto free_hwmon;
+
+- if (dev && chip && chip->ops->read &&
++ if (dev && dev->of_node && chip && chip->ops->read &&
+ chip->info[0]->type == hwmon_chip &&
+ (chip->info[0]->config[0] & HWMON_C_REGISTER_TZ)) {
+ const struct hwmon_channel_info **info = chip->info;
+--
+2.20.1
+
--- /dev/null
+From b9ce8102c6bbc9093f71b69f47a0097790d6456b Mon Sep 17 00:00:00 2001
+From: Robert Hancock <hancock@sedsystems.ca>
+Date: Wed, 5 Jun 2019 13:49:00 -0600
+Subject: hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
+
+[ Upstream commit 4a60570dce658e3f8885bbcf852430b99f65aca5 ]
+
+Some chips have attributes which exist on more than one page but the
+attribute is not presently marked as paged. This causes the attributes
+to be generated with the same label, which makes it impossible for
+userspace to tell them apart.
+
+Marking all such attributes as paged would result in the page suffix
+being added regardless of whether they were present on more than one
+page or not, which might break existing setups. Therefore, we add a
+second check which treats the attribute as paged, even if not marked as
+such, if it is present on multiple pages.
+
+Fixes: b4ce237b7f7d ("hwmon: (pmbus) Introduce infrastructure to detect sensors and limit registers")
+Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 34 ++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 2e2b5851139c..cd24b375df1e 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1230,7 +1230,8 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+ const struct pmbus_driver_info *info,
+ const char *name,
+ int index, int page,
+- const struct pmbus_sensor_attr *attr)
++ const struct pmbus_sensor_attr *attr,
++ bool paged)
+ {
+ struct pmbus_sensor *base;
+ bool upper = !!(attr->gbit & 0xff00); /* need to check STATUS_WORD */
+@@ -1238,7 +1239,7 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+
+ if (attr->label) {
+ ret = pmbus_add_label(data, name, index, attr->label,
+- attr->paged ? page + 1 : 0);
++ paged ? page + 1 : 0);
+ if (ret)
+ return ret;
+ }
+@@ -1271,6 +1272,30 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+ return 0;
+ }
+
++static bool pmbus_sensor_is_paged(const struct pmbus_driver_info *info,
++ const struct pmbus_sensor_attr *attr)
++{
++ int p;
++
++ if (attr->paged)
++ return true;
++
++ /*
++ * Some attributes may be present on more than one page despite
++ * not being marked with the paged attribute. If that is the case,
++ * then treat the sensor as being paged and add the page suffix to the
++ * attribute name.
++ * We don't just add the paged attribute to all such attributes, in
++ * order to maintain the un-suffixed labels in the case where the
++ * attribute is only on page 0.
++ */
++ for (p = 1; p < info->pages; p++) {
++ if (info->func[p] & attr->func)
++ return true;
++ }
++ return false;
++}
++
+ static int pmbus_add_sensor_attrs(struct i2c_client *client,
+ struct pmbus_data *data,
+ const char *name,
+@@ -1284,14 +1309,15 @@ static int pmbus_add_sensor_attrs(struct i2c_client *client,
+ index = 1;
+ for (i = 0; i < nattrs; i++) {
+ int page, pages;
++ bool paged = pmbus_sensor_is_paged(info, attrs);
+
+- pages = attrs->paged ? info->pages : 1;
++ pages = paged ? info->pages : 1;
+ for (page = 0; page < pages; page++) {
+ if (!(info->func[page] & attrs->func))
+ continue;
+ ret = pmbus_add_sensor_attrs_one(client, data, info,
+ name, index, page,
+- attrs);
++ attrs, paged);
+ if (ret)
+ return ret;
+ index++;
+--
+2.20.1
+
--- /dev/null
+From 2938ebb2cf60369ec872b8c1e6497b41b4ca45df Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 24 May 2019 11:44:45 -0400
+Subject: IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
+
+[ Upstream commit 6d517353c70bb0818b691ca003afdcb5ee5ea44e ]
+
+By code inspection, the freeze_work is never canceled.
+
+Fix by adding a cancel_work_sync in the shutdown path to insure it is no
+longer running.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index e02d9a739e9c..597f2f02f3a8 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -9848,6 +9848,7 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
+
+ /* disable the port */
+ clear_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK);
++ cancel_work_sync(&ppd->freeze_work);
+ }
+
+ static inline int init_cpu_counters(struct hfi1_devdata *dd)
+--
+2.20.1
+
--- /dev/null
+From 513c78cfe3b08ed7fd95edc225dc0c320e9dbfba Mon Sep 17 00:00:00 2001
+From: Kamenee Arumugam <kamenee.arumugam@intel.com>
+Date: Fri, 24 May 2019 11:45:04 -0400
+Subject: IB/hfi1: Validate page aligned for a given virtual address
+
+[ Upstream commit 97736f36dbebf2cda2799db3b54717ba5b388255 ]
+
+User applications can register memory regions for TID buffers that are not
+aligned on page boundaries. Hfi1 is expected to pin those pages in memory
+and cache the pages with mmu_rb. The rb tree will fail to insert pages
+that are not aligned correctly.
+
+Validate whether a given virtual address is page aligned before pinning.
+
+Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body")
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Kamenee Arumugam <kamenee.arumugam@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_exp_rcv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index 0cd71ce7cc71..3592a9ec155e 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -324,6 +324,9 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ u32 *tidlist = NULL;
+ struct tid_user_buf *tidbuf;
+
++ if (!PAGE_ALIGNED(tinfo->vaddr))
++ return -EINVAL;
++
+ tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL);
+ if (!tidbuf)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 7cbff6b5c876db030f008ddf94361be7df376995 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 24 May 2019 11:44:51 -0400
+Subject: IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
+
+[ Upstream commit 35164f5259a47ea756fa1deb3e463ac2a4f10dc9 ]
+
+The command 'ibv_devinfo -v' reports 0 for max_mr.
+
+Fix by assigning the query values after the mr lkey_table has been built
+rather than early on in the driver.
+
+Fixes: 7b1e2099adc8 ("IB/rdmavt: Move memory registration into rdmavt")
+Reviewed-by: Josh Collier <josh.d.collier@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/verbs.c | 2 --
+ drivers/infiniband/hw/qib/qib_verbs.c | 2 --
+ drivers/infiniband/sw/rdmavt/mr.c | 2 ++
+ 3 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 55a56b3d7f83..ea68eeba3f22 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1355,8 +1355,6 @@ static void hfi1_fill_device_attr(struct hfi1_devdata *dd)
+ rdi->dparms.props.max_cq = hfi1_max_cqs;
+ rdi->dparms.props.max_ah = hfi1_max_ahs;
+ rdi->dparms.props.max_cqe = hfi1_max_cqes;
+- rdi->dparms.props.max_mr = rdi->lkey_table.max;
+- rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ rdi->dparms.props.max_map_per_fmr = 32767;
+ rdi->dparms.props.max_pd = hfi1_max_pds;
+ rdi->dparms.props.max_qp_rd_atom = HFI1_MAX_RDMA_ATOMIC;
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index 5ff32d32c61c..2c4e569ce438 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -1459,8 +1459,6 @@ static void qib_fill_device_attr(struct qib_devdata *dd)
+ rdi->dparms.props.max_cq = ib_qib_max_cqs;
+ rdi->dparms.props.max_cqe = ib_qib_max_cqes;
+ rdi->dparms.props.max_ah = ib_qib_max_ahs;
+- rdi->dparms.props.max_mr = rdi->lkey_table.max;
+- rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ rdi->dparms.props.max_map_per_fmr = 32767;
+ rdi->dparms.props.max_qp_rd_atom = QIB_MAX_RDMA_ATOMIC;
+ rdi->dparms.props.max_qp_init_rd_atom = 255;
+diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
+index 0bb6e39dd03a..b04d2173e3f4 100644
+--- a/drivers/infiniband/sw/rdmavt/mr.c
++++ b/drivers/infiniband/sw/rdmavt/mr.c
+@@ -96,6 +96,8 @@ int rvt_driver_mr_init(struct rvt_dev_info *rdi)
+ for (i = 0; i < rdi->lkey_table.max; i++)
+ RCU_INIT_POINTER(rdi->lkey_table.table[i], NULL);
+
++ rdi->dparms.props.max_mr = rdi->lkey_table.max;
++ rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f5d86574639260360d4400ea4db206e24e17210a Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 24 May 2019 11:44:38 -0400
+Subject: IB/rdmavt: Fix alloc_qpn() WARN_ON()
+
+[ Upstream commit 2abae62a26a265129b364d8c1ef3be55e2c01309 ]
+
+The qpn allocation logic has a WARN_ON() that intends to detect the use of
+an index that will introduce bits in the lower order bits of the QOS bits
+in the QPN.
+
+Unfortunately, it has the following bugs:
+- it misfires when wrapping QPN allocation for non-QOS
+- it doesn't correctly detect low order QOS bits (despite the comment)
+
+The WARN_ON() should not be applied to non-QOS (qos_shift == 1).
+
+Additionally, it SHOULD test the qpn bits per the table below:
+
+2 data VLs: [qp7, qp6, qp5, qp4, qp3, qp2, qp1] ^
+ [ 0, 0, 0, 0, 0, 0, sc0], qp bit 1 always 0*
+3-4 data VLs: [qp7, qp6, qp5, qp4, qp3, qp2, qp1] ^
+ [ 0, 0, 0, 0, 0, sc1, sc0], qp bits [21] always 0
+5-8 data VLs: [qp7, qp6, qp5, qp4, qp3, qp2, qp1] ^
+ [ 0, 0, 0, 0, sc2, sc1, sc0] qp bits [321] always 0
+
+Fix by qualifying the warning for qos_shift > 1 and producing the correct
+mask to insure the above bits are zero without generating a superfluous
+warning.
+
+Fixes: 501edc42446e ("IB/rdmavt: Correct warning during QPN allocation")
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index a34b9a2a32b6..a77436ee5ff7 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -594,7 +594,8 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
+ offset = qpt->incr | ((offset & 1) ^ 1);
+ }
+ /* there can be no set bits in low-order QoS bits */
+- WARN_ON(offset & (BIT(rdi->dparms.qos_shift) - 1));
++ WARN_ON(rdi->dparms.qos_shift > 1 &&
++ offset & ((BIT(rdi->dparms.qos_shift - 1) - 1) << 1));
+ qpn = mk_qpn(qpt, map, offset);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 10a50fe35f7fff80ec6429e6412814d54845928f Mon Sep 17 00:00:00 2001
+From: Trevor Bourget <tgb.kernel@gmail.com>
+Date: Mon, 27 May 2019 16:54:23 -0700
+Subject: kbuild: tar-pkg: enable communication with jobserver
+
+[ Upstream commit a6e0487709ded7cd1ba0c390d9771e5cb76a8453 ]
+
+The buildtar script might want to invoke a make, so tell the parent
+make to pass the jobserver token pipe to the subcommand by prefixing
+the command with a +.
+
+This addresses the issue seen here:
+
+ /bin/sh ../scripts/package/buildtar tar-pkg
+ make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
+
+See https://www.gnu.org/software/make/manual/html_node/Job-Slots.html
+for more information.
+
+Signed-off-by: Trevor Bourget <tgb.kernel@gmail.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/package/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/package/Makefile b/scripts/package/Makefile
+index 2c6de21e5152..fd854439de0f 100644
+--- a/scripts/package/Makefile
++++ b/scripts/package/Makefile
+@@ -103,7 +103,7 @@ clean-dirs += $(objtree)/snap/
+ # ---------------------------------------------------------------------------
+ tar%pkg: FORCE
+ $(MAKE) -f $(srctree)/Makefile
+- $(CONFIG_SHELL) $(srctree)/scripts/package/buildtar $@
++ +$(CONFIG_SHELL) $(srctree)/scripts/package/buildtar $@
+
+ clean-dirs += $(objtree)/tar-install/
+
+--
+2.20.1
+
--- /dev/null
+From 301b162525acdad55086379bfbb0b463d2df0feb Mon Sep 17 00:00:00 2001
+From: Alex Shi <alex.shi@linux.alibaba.com>
+Date: Mon, 27 May 2019 14:28:07 +0800
+Subject: kselftest/cgroup: fix incorrect test_core skip
+
+[ Upstream commit f97f3f8839eb9de5843066d80819884f7722c8c5 ]
+
+The test_core will skip the
+test_cgcore_no_internal_process_constraint_on_threads test case if the
+'cpu' controller missing in root's subtree_control. In fact we need to
+set the 'cpu' in subtree_control, to make the testing meaningful.
+
+./test_core
+...
+ok 4 # skip test_cgcore_no_internal_process_constraint_on_threads
+...
+
+Signed-off-by: Alex Shi <alex.shi@linux.alibaba.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Claudio Zumbo <claudioz@fb.com>
+Cc: Claudio <claudiozumbo@gmail.com>
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c
+index d78f1c5366d3..79053a4f4783 100644
+--- a/tools/testing/selftests/cgroup/test_core.c
++++ b/tools/testing/selftests/cgroup/test_core.c
+@@ -198,7 +198,7 @@ static int test_cgcore_no_internal_process_constraint_on_threads(const char *roo
+ char *parent = NULL, *child = NULL;
+
+ if (cg_read_strstr(root, "cgroup.controllers", "cpu") ||
+- cg_read_strstr(root, "cgroup.subtree_control", "cpu")) {
++ cg_write(root, "cgroup.subtree_control", "+cpu")) {
+ ret = KSFT_SKIP;
+ goto cleanup;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9ecc7352076c50b6843537a5d984c060125d108a Mon Sep 17 00:00:00 2001
+From: Alex Shi <alex.shi@linux.alibaba.com>
+Date: Mon, 27 May 2019 14:28:05 +0800
+Subject: kselftest/cgroup: fix unexpected testing failure on test_memcontrol
+
+[ Upstream commit f6131f28057d4fd8922599339e701a2504e0f23d ]
+
+The cgroup testing relies on the root cgroup's subtree_control setting,
+If the 'memory' controller isn't set, all test cases will be failed
+as following:
+
+$ sudo ./test_memcontrol
+not ok 1 test_memcg_subtree_control
+not ok 2 test_memcg_current
+ok 3 # skip test_memcg_min
+not ok 4 test_memcg_low
+not ok 5 test_memcg_high
+not ok 6 test_memcg_max
+not ok 7 test_memcg_oom_events
+ok 8 # skip test_memcg_swap_max
+not ok 9 test_memcg_sock
+not ok 10 test_memcg_oom_group_leaf_events
+not ok 11 test_memcg_oom_group_parent_events
+not ok 12 test_memcg_oom_group_score_events
+
+To correct this unexpected failure, this patch write the 'memory' to
+subtree_control of root to get a right result.
+
+Signed-off-by: Alex Shi <alex.shi@linux.alibaba.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
+Cc: Jay Kamat <jgkamat@fb.com>
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_memcontrol.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c
+index 6f339882a6ca..c19a97dd02d4 100644
+--- a/tools/testing/selftests/cgroup/test_memcontrol.c
++++ b/tools/testing/selftests/cgroup/test_memcontrol.c
+@@ -1205,6 +1205,10 @@ int main(int argc, char **argv)
+ if (cg_read_strstr(root, "cgroup.controllers", "memory"))
+ ksft_exit_skip("memory controller isn't available\n");
+
++ if (cg_read_strstr(root, "cgroup.subtree_control", "memory"))
++ if (cg_write(root, "cgroup.subtree_control", "+memory"))
++ ksft_exit_skip("Failed to set memory controller\n");
++
+ for (i = 0; i < ARRAY_SIZE(tests); i++) {
+ switch (tests[i].fn(root)) {
+ case KSFT_PASS:
+--
+2.20.1
+
--- /dev/null
+From d6ba161abc9651b1db5bd64454313e25a9f52590 Mon Sep 17 00:00:00 2001
+From: Alex Shi <alex.shi@linux.alibaba.com>
+Date: Mon, 27 May 2019 14:28:06 +0800
+Subject: kselftest/cgroup: fix unexpected testing failure on test_core
+
+[ Upstream commit 00e38a5d753d7788852f81703db804a60a84c26e ]
+
+The cgroup testing relys on the root cgroup's subtree_control setting,
+If the 'memory' controller isn't set, some test cases will be failed
+as following:
+
+$sudo ./test_core
+not ok 1 test_cgcore_internal_process_constraint
+ok 2 test_cgcore_top_down_constraint_enable
+not ok 3 test_cgcore_top_down_constraint_disable
+...
+
+To correct this unexpected failure, this patch write the 'memory' to
+subtree_control of root to get a right result.
+
+Signed-off-by: Alex Shi <alex.shi@linux.alibaba.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Claudio Zumbo <claudioz@fb.com>
+Cc: Claudio <claudiozumbo@gmail.com>
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c
+index be59f9c34ea2..d78f1c5366d3 100644
+--- a/tools/testing/selftests/cgroup/test_core.c
++++ b/tools/testing/selftests/cgroup/test_core.c
+@@ -376,6 +376,11 @@ int main(int argc, char *argv[])
+
+ if (cg_find_unified_root(root, sizeof(root)))
+ ksft_exit_skip("cgroup v2 isn't mounted\n");
++
++ if (cg_read_strstr(root, "cgroup.subtree_control", "memory"))
++ if (cg_write(root, "cgroup.subtree_control", "+memory"))
++ ksft_exit_skip("Failed to set memory controller\n");
++
+ for (i = 0; i < ARRAY_SIZE(tests); i++) {
+ switch (tests[i].fn(root)) {
+ case KSFT_PASS:
+--
+2.20.1
+
--- /dev/null
+From 4b7d86a4d89bbb31c00a048afdd78c788a9b57e4 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Sat, 6 Apr 2019 08:52:11 -0700
+Subject: lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical
+
+[ Upstream commit 2bf8496f6e9b7e9a557f65eb95eab16fea7958c7 ]
+
+The prior implementation of the KERNEL_DS fault checking would work on
+any unmapped kernel address, but this was narrowed to the non-canonical
+range instead. This adjusts the LKDTM test to match.
+
+Fixes: 00c42373d397 ("x86-64: add warning for non-canonical user access address dereferences")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lkdtm/usercopy.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
+index d5a0e7f1813b..e172719dd86d 100644
+--- a/drivers/misc/lkdtm/usercopy.c
++++ b/drivers/misc/lkdtm/usercopy.c
+@@ -324,14 +324,16 @@ free_user:
+
+ void lkdtm_USERCOPY_KERNEL_DS(void)
+ {
+- char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL);
++ char __user *user_ptr =
++ (char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4));
+ mm_segment_t old_fs = get_fs();
+ char buf[10] = {0};
+
+- pr_info("attempting copy_to_user on unmapped kernel address\n");
++ pr_info("attempting copy_to_user() to noncanonical address: %px\n",
++ user_ptr);
+ set_fs(KERNEL_DS);
+- if (copy_to_user(user_ptr, buf, sizeof(buf)))
+- pr_info("copy_to_user un unmapped kernel address failed\n");
++ if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0)
++ pr_err("copy_to_user() to noncanonical address succeeded!?\n");
+ set_fs(old_fs);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2716d7a086e16a97ac698adcc86f6fb1fbc21c55 Mon Sep 17 00:00:00 2001
+From: Gen Zhang <blackgod016574@gmail.com>
+Date: Fri, 31 May 2019 09:24:18 +0800
+Subject: mdesc: fix a missing-check bug in get_vdev_port_node_info()
+
+[ Upstream commit 80caf43549e7e41a695c6d1e11066286538b336f ]
+
+In get_vdev_port_node_info(), 'node_info->vdev_port.name' is allcoated
+by kstrdup_const(), and it returns NULL when fails. So
+'node_info->vdev_port.name' should be checked.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/mdesc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
+index 9a26b442f820..8e645ddac58e 100644
+--- a/arch/sparc/kernel/mdesc.c
++++ b/arch/sparc/kernel/mdesc.c
+@@ -356,6 +356,8 @@ static int get_vdev_port_node_info(struct mdesc_handle *md, u64 node,
+
+ node_info->vdev_port.id = *idp;
+ node_info->vdev_port.name = kstrdup_const(name, GFP_KERNEL);
++ if (!node_info->vdev_port.name)
++ return -1;
+ node_info->vdev_port.parent_cfg_hdl = *parent_cfg_hdlp;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From b7f4e51ead0e10ca69d6a900574c987ed26f9456 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 21 May 2019 15:20:39 +0900
+Subject: MIPS: mark ginvt() as __always_inline
+
+[ Upstream commit 6074c33c6b2eabc70867ef76d57ca256e9ea9da7 ]
+
+To meet the 'i' (immediate) constraint for the asm operands,
+this function must be always inlined.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/ginvt.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/ginvt.h b/arch/mips/include/asm/ginvt.h
+index 49c6dbe37338..6eb7c2b94dc7 100644
+--- a/arch/mips/include/asm/ginvt.h
++++ b/arch/mips/include/asm/ginvt.h
+@@ -19,7 +19,7 @@ _ASM_MACRO_1R1I(ginvt, rs, type,
+ # define _ASM_SET_GINV
+ #endif
+
+-static inline void ginvt(unsigned long addr, enum ginvt_type type)
++static __always_inline void ginvt(unsigned long addr, enum ginvt_type type)
+ {
+ asm volatile(
+ ".set push\n"
+--
+2.20.1
+
--- /dev/null
+From 95b1a372a304256d6672a8c88298c65f81a266f1 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Sat, 25 May 2019 20:20:24 +0800
+Subject: MIPS: uprobes: remove set but not used variable 'epc'
+
+[ Upstream commit f532beeeff0c0a3586cc15538bc52d249eb19e7c ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+arch/mips/kernel/uprobes.c: In function 'arch_uprobe_pre_xol':
+arch/mips/kernel/uprobes.c:115:17: warning: variable 'epc' set but not used [-Wunused-but-set-variable]
+
+It's never used since introduction in
+commit 40e084a506eb ("MIPS: Add uprobes support.")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: <ralf@linux-mips.org>
+Cc: <jhogan@kernel.org>
+Cc: <linux-kernel@vger.kernel.org>
+Cc: <linux-mips@vger.kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/uprobes.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
+index 4aaff3b3175c..6dbe4eab0a0e 100644
+--- a/arch/mips/kernel/uprobes.c
++++ b/arch/mips/kernel/uprobes.c
+@@ -112,9 +112,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
+ */
+ aup->resume_epc = regs->cp0_epc + 4;
+ if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
+- unsigned long epc;
+-
+- epc = regs->cp0_epc;
+ __compute_return_epc_for_insn(regs,
+ (union mips_instruction) aup->insn[0]);
+ aup->resume_epc = regs->cp0_epc;
+--
+2.20.1
+
--- /dev/null
+From 7f214592e69ae8ea788b0a1413191e9de05190d3 Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincentc@andestech.com>
+Date: Mon, 20 May 2019 09:21:12 +0800
+Subject: nds32: Avoid IEX status being incorrectly modified
+
+[ Upstream commit ed32949e0acb73e7bc054bb02e0453d4d561ceda ]
+
+In order for kernel to capture each denormalized output, the UDF
+trapping enable bit is always raised in $fpcsr. Because underflow case will
+issue not an underflow exception but also an inexact exception, it causes
+that the IEX, IEX cumulative exception, flag in $fpcsr to be raised in each
+denormalized output handling. To make the emulation transparent to the
+user, the emulator needs to clear the IEX flag in $fpcsr if the result is a
+denormalized number. However, if the IEX flag has been raised before this
+floating point emulation, this cleanup may be incorrect. To avoid the IEX
+flags in $fpcsr be raised in each denormalized output handling, the IEX
+trap shall be always enabled.
+
+Signed-off-by: Vincent Chen <vincentc@andestech.com>
+Acked-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nds32/include/asm/bitfield.h | 2 +-
+ arch/nds32/include/asm/fpu.h | 2 +-
+ arch/nds32/include/asm/syscalls.h | 2 +-
+ arch/nds32/include/uapi/asm/fp_udfiex_crtl.h | 16 ++++++++++++
+ arch/nds32/include/uapi/asm/sigcontext.h | 24 ++++++++++++------
+ arch/nds32/include/uapi/asm/udftrap.h | 13 ----------
+ arch/nds32/include/uapi/asm/unistd.h | 4 +--
+ arch/nds32/kernel/fpu.c | 15 +++++------
+ arch/nds32/kernel/sys_nds32.c | 26 +++++++++++---------
+ 9 files changed, 58 insertions(+), 46 deletions(-)
+ create mode 100644 arch/nds32/include/uapi/asm/fp_udfiex_crtl.h
+ delete mode 100644 arch/nds32/include/uapi/asm/udftrap.h
+
+diff --git a/arch/nds32/include/asm/bitfield.h b/arch/nds32/include/asm/bitfield.h
+index 7414fcbbab4e..03bbb6d27828 100644
+--- a/arch/nds32/include/asm/bitfield.h
++++ b/arch/nds32/include/asm/bitfield.h
+@@ -937,7 +937,7 @@
+ #define FPCSR_mskDNIT ( 0x1 << FPCSR_offDNIT )
+ #define FPCSR_mskRIT ( 0x1 << FPCSR_offRIT )
+ #define FPCSR_mskALL (FPCSR_mskIVO | FPCSR_mskDBZ | FPCSR_mskOVF | FPCSR_mskUDF | FPCSR_mskIEX)
+-#define FPCSR_mskALLE_NO_UDFE (FPCSR_mskIVOE | FPCSR_mskDBZE | FPCSR_mskOVFE | FPCSR_mskIEXE)
++#define FPCSR_mskALLE_NO_UDF_IEXE (FPCSR_mskIVOE | FPCSR_mskDBZE | FPCSR_mskOVFE)
+ #define FPCSR_mskALLE (FPCSR_mskIVOE | FPCSR_mskDBZE | FPCSR_mskOVFE | FPCSR_mskUDFE | FPCSR_mskIEXE)
+ #define FPCSR_mskALLT (FPCSR_mskIVOT | FPCSR_mskDBZT | FPCSR_mskOVFT | FPCSR_mskUDFT | FPCSR_mskIEXT |FPCSR_mskDNIT | FPCSR_mskRIT)
+
+diff --git a/arch/nds32/include/asm/fpu.h b/arch/nds32/include/asm/fpu.h
+index 019f1bcfc5ee..8294ed4aaa2c 100644
+--- a/arch/nds32/include/asm/fpu.h
++++ b/arch/nds32/include/asm/fpu.h
+@@ -36,7 +36,7 @@ extern int do_fpuemu(struct pt_regs *regs, struct fpu_struct *fpu);
+ * enabled by default and kerenl will re-execute it by fpu emulator
+ * when getting underflow exception.
+ */
+-#define FPCSR_INIT FPCSR_mskUDFE
++#define FPCSR_INIT (FPCSR_mskUDFE | FPCSR_mskIEXE)
+ #else
+ #define FPCSR_INIT 0x0UL
+ #endif
+diff --git a/arch/nds32/include/asm/syscalls.h b/arch/nds32/include/asm/syscalls.h
+index da32101b455d..b9c9becce5d6 100644
+--- a/arch/nds32/include/asm/syscalls.h
++++ b/arch/nds32/include/asm/syscalls.h
+@@ -7,7 +7,7 @@
+ asmlinkage long sys_cacheflush(unsigned long addr, unsigned long len, unsigned int op);
+ asmlinkage long sys_fadvise64_64_wrapper(int fd, int advice, loff_t offset, loff_t len);
+ asmlinkage long sys_rt_sigreturn_wrapper(void);
+-asmlinkage long sys_udftrap(int option);
++asmlinkage long sys_fp_udfiex_crtl(int cmd, int act);
+
+ #include <asm-generic/syscalls.h>
+
+diff --git a/arch/nds32/include/uapi/asm/fp_udfiex_crtl.h b/arch/nds32/include/uapi/asm/fp_udfiex_crtl.h
+new file mode 100644
+index 000000000000..d54a5d6c6538
+--- /dev/null
++++ b/arch/nds32/include/uapi/asm/fp_udfiex_crtl.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright (C) 2005-2019 Andes Technology Corporation */
++#ifndef _FP_UDF_IEX_CRTL_H
++#define _FP_UDF_IEX_CRTL_H
++
++/*
++ * The cmd list of sys_fp_udfiex_crtl()
++ */
++/* Disable UDF or IEX trap based on the content of parameter act */
++#define DISABLE_UDF_IEX_TRAP 0
++/* Enable UDF or IEX trap based on the content of parameter act */
++#define ENABLE_UDF_IEX_TRAP 1
++/* Get current status of UDF and IEX trap */
++#define GET_UDF_IEX_TRAP 2
++
++#endif /* _FP_UDF_IEX_CRTL_H */
+diff --git a/arch/nds32/include/uapi/asm/sigcontext.h b/arch/nds32/include/uapi/asm/sigcontext.h
+index 58afc416473e..b53634033e32 100644
+--- a/arch/nds32/include/uapi/asm/sigcontext.h
++++ b/arch/nds32/include/uapi/asm/sigcontext.h
+@@ -13,14 +13,24 @@ struct fpu_struct {
+ unsigned long long fd_regs[32];
+ unsigned long fpcsr;
+ /*
+- * UDF_trap is used to recognize whether underflow trap is enabled
+- * or not. When UDF_trap == 1, this process will be traped and then
+- * get a SIGFPE signal when encountering an underflow exception.
+- * UDF_trap is only modified through setfputrap syscall. Therefore,
+- * UDF_trap needn't be saved or loaded to context in each context
+- * switch.
++ * When CONFIG_SUPPORT_DENORMAL_ARITHMETIC is defined, kernel prevents
++ * hardware from treating the denormalized output as an underflow case
++ * and rounding it to a normal number. Hence kernel enables the UDF and
++ * IEX trap in the fpcsr register to step in the calculation.
++ * However, the UDF and IEX trap enable bit in $fpcsr also lose
++ * their use.
++ *
++ * UDF_IEX_trap replaces the feature of UDF and IEX trap enable bit in
++ * $fpcsr to control the trap of underflow and inexact. The bit filed
++ * of UDF_IEX_trap is the same as $fpcsr, 10th bit is used to enable UDF
++ * exception trapping and 11th bit is used to enable IEX exception
++ * trapping.
++ *
++ * UDF_IEX_trap is only modified through fp_udfiex_crtl syscall.
++ * Therefore, UDF_IEX_trap needn't be saved and restored in each
++ * context switch.
+ */
+- unsigned long UDF_trap;
++ unsigned long UDF_IEX_trap;
+ };
+
+ struct zol_struct {
+diff --git a/arch/nds32/include/uapi/asm/udftrap.h b/arch/nds32/include/uapi/asm/udftrap.h
+deleted file mode 100644
+index 433f79d679c0..000000000000
+--- a/arch/nds32/include/uapi/asm/udftrap.h
++++ /dev/null
+@@ -1,13 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright (C) 2005-2018 Andes Technology Corporation */
+-#ifndef _ASM_SETFPUTRAP
+-#define _ASM_SETFPUTRAP
+-
+-/*
+- * Options for setfputrap system call
+- */
+-#define DISABLE_UDFTRAP 0 /* disable underflow exception trap */
+-#define ENABLE_UDFTRAP 1 /* enable undeflos exception trap */
+-#define GET_UDFTRAP 2 /* only get undeflos exception trap status */
+-
+-#endif /* _ASM_CACHECTL */
+diff --git a/arch/nds32/include/uapi/asm/unistd.h b/arch/nds32/include/uapi/asm/unistd.h
+index 4ec8f543103f..6b9ff90e3ae5 100644
+--- a/arch/nds32/include/uapi/asm/unistd.h
++++ b/arch/nds32/include/uapi/asm/unistd.h
+@@ -11,6 +11,6 @@
+
+ /* Additional NDS32 specific syscalls. */
+ #define __NR_cacheflush (__NR_arch_specific_syscall)
+-#define __NR_udftrap (__NR_arch_specific_syscall + 1)
++#define __NR_fp_udfiex_crtl (__NR_arch_specific_syscall + 1)
+ __SYSCALL(__NR_cacheflush, sys_cacheflush)
+-__SYSCALL(__NR_udftrap, sys_udftrap)
++__SYSCALL(__NR_fp_udfiex_crtl, sys_fp_udfiex_crtl)
+diff --git a/arch/nds32/kernel/fpu.c b/arch/nds32/kernel/fpu.c
+index fddd40c7a16f..cf0b8760f261 100644
+--- a/arch/nds32/kernel/fpu.c
++++ b/arch/nds32/kernel/fpu.c
+@@ -14,7 +14,7 @@ const struct fpu_struct init_fpuregs = {
+ .fd_regs = {[0 ... 31] = sNAN64},
+ .fpcsr = FPCSR_INIT,
+ #if IS_ENABLED(CONFIG_SUPPORT_DENORMAL_ARITHMETIC)
+- .UDF_trap = 0
++ .UDF_IEX_trap = 0
+ #endif
+ };
+
+@@ -178,7 +178,7 @@ inline void do_fpu_context_switch(struct pt_regs *regs)
+ /* First time FPU user. */
+ load_fpu(&init_fpuregs);
+ #if IS_ENABLED(CONFIG_SUPPORT_DENORMAL_ARITHMETIC)
+- current->thread.fpu.UDF_trap = init_fpuregs.UDF_trap;
++ current->thread.fpu.UDF_IEX_trap = init_fpuregs.UDF_IEX_trap;
+ #endif
+ set_used_math();
+ }
+@@ -206,7 +206,7 @@ inline void handle_fpu_exception(struct pt_regs *regs)
+ unsigned int fpcsr;
+ int si_code = 0, si_signo = SIGFPE;
+ #if IS_ENABLED(CONFIG_SUPPORT_DENORMAL_ARITHMETIC)
+- unsigned long redo_except = FPCSR_mskDNIT|FPCSR_mskUDFT;
++ unsigned long redo_except = FPCSR_mskDNIT|FPCSR_mskUDFT|FPCSR_mskIEXT;
+ #else
+ unsigned long redo_except = FPCSR_mskDNIT;
+ #endif
+@@ -215,21 +215,18 @@ inline void handle_fpu_exception(struct pt_regs *regs)
+ fpcsr = current->thread.fpu.fpcsr;
+
+ if (fpcsr & redo_except) {
+-#if IS_ENABLED(CONFIG_SUPPORT_DENORMAL_ARITHMETIC)
+- if (fpcsr & FPCSR_mskUDFT)
+- current->thread.fpu.fpcsr &= ~FPCSR_mskIEX;
+-#endif
+ si_signo = do_fpuemu(regs, ¤t->thread.fpu);
+ fpcsr = current->thread.fpu.fpcsr;
+- if (!si_signo)
++ if (!si_signo) {
++ current->thread.fpu.fpcsr &= ~(redo_except);
+ goto done;
++ }
+ } else if (fpcsr & FPCSR_mskRIT) {
+ if (!user_mode(regs))
+ do_exit(SIGILL);
+ si_signo = SIGILL;
+ }
+
+-
+ switch (si_signo) {
+ case SIGFPE:
+ fill_sigfpe_signo(fpcsr, &si_code);
+diff --git a/arch/nds32/kernel/sys_nds32.c b/arch/nds32/kernel/sys_nds32.c
+index 0835277636ce..cb2d1e219bb3 100644
+--- a/arch/nds32/kernel/sys_nds32.c
++++ b/arch/nds32/kernel/sys_nds32.c
+@@ -6,8 +6,8 @@
+
+ #include <asm/cachectl.h>
+ #include <asm/proc-fns.h>
+-#include <asm/udftrap.h>
+ #include <asm/fpu.h>
++#include <asm/fp_udfiex_crtl.h>
+
+ SYSCALL_DEFINE6(mmap2, unsigned long, addr, unsigned long, len,
+ unsigned long, prot, unsigned long, flags,
+@@ -51,31 +51,33 @@ SYSCALL_DEFINE3(cacheflush, unsigned int, start, unsigned int, end, int, cache)
+ return 0;
+ }
+
+-SYSCALL_DEFINE1(udftrap, int, option)
++SYSCALL_DEFINE2(fp_udfiex_crtl, unsigned int, cmd, unsigned int, act)
+ {
+ #if IS_ENABLED(CONFIG_SUPPORT_DENORMAL_ARITHMETIC)
+- int old_udftrap;
++ int old_udf_iex;
+
+ if (!used_math()) {
+ load_fpu(&init_fpuregs);
+- current->thread.fpu.UDF_trap = init_fpuregs.UDF_trap;
++ current->thread.fpu.UDF_IEX_trap = init_fpuregs.UDF_IEX_trap;
+ set_used_math();
+ }
+
+- old_udftrap = current->thread.fpu.UDF_trap;
+- switch (option) {
+- case DISABLE_UDFTRAP:
+- current->thread.fpu.UDF_trap = 0;
++ old_udf_iex = current->thread.fpu.UDF_IEX_trap;
++ act &= (FPCSR_mskUDFE | FPCSR_mskIEXE);
++
++ switch (cmd) {
++ case DISABLE_UDF_IEX_TRAP:
++ current->thread.fpu.UDF_IEX_trap &= ~act;
+ break;
+- case ENABLE_UDFTRAP:
+- current->thread.fpu.UDF_trap = FPCSR_mskUDFE;
++ case ENABLE_UDF_IEX_TRAP:
++ current->thread.fpu.UDF_IEX_trap |= act;
+ break;
+- case GET_UDFTRAP:
++ case GET_UDF_IEX_TRAP:
+ break;
+ default:
+ return -EINVAL;
+ }
+- return old_udftrap;
++ return old_udf_iex;
+ #else
+ return -ENOTSUPP;
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 73964d48ee9c298f7d9932d03e4e37efe7825300 Mon Sep 17 00:00:00 2001
+From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Date: Fri, 31 May 2019 10:35:14 +0300
+Subject: net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
+
+[ Upstream commit 62394708f3e01c9f2be6be74eb6305bae1ed924f ]
+
+When non-bridged, non-vlan'ed mv88e6xxx port is moving down, error
+message is logged:
+
+failed to kill vid 0081/0 for device eth_cu_1000_4
+
+This is caused by call from __vlan_vid_del() with vin set to zero, over
+call chain this results into _mv88e6xxx_port_vlan_del() called with
+vid=0, and mv88e6xxx_vtu_get() called from there returns -EINVAL.
+
+On symmetric path moving port up, call goes through
+mv88e6xxx_port_vlan_prepare() that calls mv88e6xxx_port_check_hw_vlan()
+that returns -EOPNOTSUPP for zero vid.
+
+This patch changes mv88e6xxx_vtu_get() to also return -EOPNOTSUPP for
+zero vid, then this error code is explicitly cleared in
+dsa_slave_vlan_rx_kill_vid() and error message is no longer logged.
+
+Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 720f1dde2c2d..ae750ab9a4d7 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -1517,7 +1517,7 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid,
+ int err;
+
+ if (!vid)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+
+ entry->vid = vid - 1;
+ entry->valid = false;
+--
+2.20.1
+
--- /dev/null
+From f5a989c99c3cca8841561d9d3a8daff84c911f91 Mon Sep 17 00:00:00 2001
+From: Sean Wang <sean.wang@mediatek.com>
+Date: Sat, 1 Jun 2019 08:16:26 +0800
+Subject: net: ethernet: mediatek: Use hw_feature to judge if HWLRO is
+ supported
+
+[ Upstream commit 9e4f56f1a7f3287718d0083b5cb85298dc05a5fd ]
+
+Should hw_feature as hardware capability flags to check if hardware LRO
+got support.
+
+Signed-off-by: Mark Lee <mark-mc.lee@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 549d36497b8c..59601cb5aeee 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2297,13 +2297,13 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- if (dev->features & NETIF_F_LRO) {
++ if (dev->hw_features & NETIF_F_LRO) {
+ cmd->data = MTK_MAX_RX_RING_NUM;
+ ret = 0;
+ }
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+- if (dev->features & NETIF_F_LRO) {
++ if (dev->hw_features & NETIF_F_LRO) {
+ struct mtk_mac *mac = netdev_priv(dev);
+
+ cmd->rule_cnt = mac->hwlro_ip_cnt;
+@@ -2311,11 +2311,11 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ }
+ break;
+ case ETHTOOL_GRXCLSRULE:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_get_fdir_entry(dev, cmd);
+ break;
+ case ETHTOOL_GRXCLSRLALL:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_get_fdir_all(dev, cmd,
+ rule_locs);
+ break;
+@@ -2332,11 +2332,11 @@ static int mtk_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+
+ switch (cmd->cmd) {
+ case ETHTOOL_SRXCLSRLINS:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_add_ipaddr(dev, cmd);
+ break;
+ case ETHTOOL_SRXCLSRLDEL:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_del_ipaddr(dev, cmd);
+ break;
+ default:
+--
+2.20.1
+
--- /dev/null
+From b41099d527a205fb518b77706e2892c335649fc6 Mon Sep 17 00:00:00 2001
+From: Sean Wang <sean.wang@mediatek.com>
+Date: Sat, 1 Jun 2019 08:16:27 +0800
+Subject: net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW
+ RX_2BYTE_OFFSET is enabled
+
+[ Upstream commit 880c2d4b2fdfd580ebcd6bb7240a8027a1d34751 ]
+
+Should only enable HW RX_2BYTE_OFFSET function in the case NET_IP_ALIGN
+equals to 2.
+
+Signed-off-by: Mark Lee <mark-mc.lee@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 59601cb5aeee..f3f7551162a9 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1777,6 +1777,7 @@ static void mtk_poll_controller(struct net_device *dev)
+
+ static int mtk_start_dma(struct mtk_eth *eth)
+ {
++ u32 rx_2b_offset = (NET_IP_ALIGN == 2) ? MTK_RX_2B_OFFSET : 0;
+ int err;
+
+ err = mtk_dma_init(eth);
+@@ -1793,7 +1794,7 @@ static int mtk_start_dma(struct mtk_eth *eth)
+ MTK_QDMA_GLO_CFG);
+
+ mtk_w32(eth,
+- MTK_RX_DMA_EN | MTK_RX_2B_OFFSET |
++ MTK_RX_DMA_EN | rx_2b_offset |
+ MTK_RX_BT_32DWORDS | MTK_MULTI_EN,
+ MTK_PDMA_GLO_CFG);
+
+--
+2.20.1
+
--- /dev/null
+From d9dd387cfbfb11020fac79e9c33cea481b0f6bc3 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Fri, 31 May 2019 16:59:50 +0800
+Subject: net: hns: Fix loopback test failed at copper ports
+
+[ Upstream commit 2e1f164861e500f4e068a9d909bbd3fcc7841483 ]
+
+When doing a loopback test at copper ports, the serdes loopback
+and the phy loopback will fail, because of the adjust link had
+not finished, and phy not ready.
+
+Adds sleep between adjust link and test process to fix it.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index ce15d2350db9..188c3f6791b5 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -339,6 +339,7 @@ static int __lb_setup(struct net_device *ndev,
+ static int __lb_up(struct net_device *ndev,
+ enum hnae_loop loop_mode)
+ {
++#define NIC_LB_TEST_WAIT_PHY_LINK_TIME 300
+ struct hns_nic_priv *priv = netdev_priv(ndev);
+ struct hnae_handle *h = priv->ae_handle;
+ int speed, duplex;
+@@ -365,6 +366,9 @@ static int __lb_up(struct net_device *ndev,
+
+ h->dev->ops->adjust_link(h, speed, duplex);
+
++ /* wait adjust link done and phy ready */
++ msleep(NIC_LB_TEST_WAIT_PHY_LINK_TIME);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From abc06e416484de400bedc15fbe17d94367f568af Mon Sep 17 00:00:00 2001
+From: Miaohe Lin <linmiaohe@huawei.com>
+Date: Tue, 4 Jun 2019 06:07:34 +0000
+Subject: net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is
+ set
+
+[ Upstream commit ceae266bf0ae6564ac16d086bf749a096fa90ded ]
+
+There's some NICs, such as hinic, with NETIF_F_IP_CSUM and NETIF_F_TSO
+on but NETIF_F_HW_CSUM off. And ipvlan device features will be
+NETIF_F_TSO on with NETIF_F_IP_CSUM and NETIF_F_IP_CSUM both off as
+IPVLAN_FEATURES only care about NETIF_F_HW_CSUM. So TSO will be
+disabled in netdev_fix_features.
+For example:
+Features for enp129s0f0:
+rx-checksumming: on
+tx-checksumming: on
+ tx-checksum-ipv4: on
+ tx-checksum-ip-generic: off [fixed]
+ tx-checksum-ipv6: on
+
+Fixes: a188222b6ed2 ("net: Rename NETIF_F_ALL_CSUM to NETIF_F_CSUM_MASK")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipvlan/ipvlan_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index bbeb1623e2d5..717fce6edeb7 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -112,7 +112,7 @@ static void ipvlan_port_destroy(struct net_device *dev)
+ }
+
+ #define IPVLAN_FEATURES \
+- (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
++ (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
+ NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
+ NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
+ NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
+--
+2.20.1
+
--- /dev/null
+From 6ca784417a7c3ddbc0c8a42fb1f68bf57e74c945 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sun, 2 Jun 2019 15:12:54 +0100
+Subject: net: phylink: avoid reducing support mask
+
+[ Upstream commit 77316763321ee4050f0576ffd472183aa90dcb30 ]
+
+Avoid reducing the support mask as a result of the interface type
+selected for SFP modules, or when setting the link settings through
+ethtool - this should only change when the supported link modes of
+the hardware combination change.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index efa31fcda505..611dfc3d89a0 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1080,6 +1080,7 @@ EXPORT_SYMBOL_GPL(phylink_ethtool_ksettings_get);
+ int phylink_ethtool_ksettings_set(struct phylink *pl,
+ const struct ethtool_link_ksettings *kset)
+ {
++ __ETHTOOL_DECLARE_LINK_MODE_MASK(support);
+ struct ethtool_link_ksettings our_kset;
+ struct phylink_link_state config;
+ int ret;
+@@ -1090,11 +1091,12 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
+ kset->base.autoneg != AUTONEG_ENABLE)
+ return -EINVAL;
+
++ linkmode_copy(support, pl->supported);
+ config = pl->link_config;
+
+ /* Mask out unsupported advertisements */
+ linkmode_and(config.advertising, kset->link_modes.advertising,
+- pl->supported);
++ support);
+
+ /* FIXME: should we reject autoneg if phy/mac does not support it? */
+ if (kset->base.autoneg == AUTONEG_DISABLE) {
+@@ -1104,7 +1106,7 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
+ * duplex.
+ */
+ s = phy_lookup_setting(kset->base.speed, kset->base.duplex,
+- pl->supported, false);
++ support, false);
+ if (!s)
+ return -EINVAL;
+
+@@ -1133,7 +1135,7 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
+ __set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, config.advertising);
+ }
+
+- if (phylink_validate(pl, pl->supported, &config))
++ if (phylink_validate(pl, support, &config))
+ return -EINVAL;
+
+ /* If autonegotiation is enabled, we must have an advertisement */
+@@ -1583,6 +1585,7 @@ static int phylink_sfp_module_insert(void *upstream,
+ {
+ struct phylink *pl = upstream;
+ __ETHTOOL_DECLARE_LINK_MODE_MASK(support) = { 0, };
++ __ETHTOOL_DECLARE_LINK_MODE_MASK(support1);
+ struct phylink_link_state config;
+ phy_interface_t iface;
+ int ret = 0;
+@@ -1610,6 +1613,8 @@ static int phylink_sfp_module_insert(void *upstream,
+ return ret;
+ }
+
++ linkmode_copy(support1, support);
++
+ iface = sfp_select_interface(pl->sfp_bus, id, config.advertising);
+ if (iface == PHY_INTERFACE_MODE_NA) {
+ netdev_err(pl->netdev,
+@@ -1619,7 +1624,7 @@ static int phylink_sfp_module_insert(void *upstream,
+ }
+
+ config.interface = iface;
+- ret = phylink_validate(pl, support, &config);
++ ret = phylink_validate(pl, support1, &config);
+ if (ret) {
+ netdev_err(pl->netdev, "validation of %s/%s with support %*pb failed: %d\n",
+ phylink_an_mode_str(MLO_AN_INBAND),
+--
+2.20.1
+
--- /dev/null
+From cbcf2f3f9c998dabb869a9e3b3f22125fbb8520f Mon Sep 17 00:00:00 2001
+From: Jaesoo Lee <jalee@purestorage.com>
+Date: Mon, 3 Jun 2019 16:42:28 -0700
+Subject: nvme: Fix u32 overflow in the number of namespace list calculation
+
+[ Upstream commit c8e8c77b3bdbade6e26e8e76595f141ede12b692 ]
+
+The Number of Namespaces (nn) field in the identify controller data structure is
+defined as u32 and the maximum allowed value in NVMe specification is
+0xFFFFFFFEUL. This change fixes the possible overflow of the DIV_ROUND_UP()
+operation used in nvme_scan_ns_list() by casting the nn to u64.
+
+Signed-off-by: Jaesoo Lee <jalee@purestorage.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 35d2202ee2fd..3a390b2c7540 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3397,7 +3397,8 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn)
+ {
+ struct nvme_ns *ns;
+ __le32 *ns_list;
+- unsigned i, j, nsid, prev = 0, num_lists = DIV_ROUND_UP(nn, 1024);
++ unsigned i, j, nsid, prev = 0;
++ unsigned num_lists = DIV_ROUND_UP_ULL((u64)nn, 1024);
+ int ret = 0;
+
+ ns_list = kzalloc(NVME_IDENTIFY_DATA_SIZE, GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From f43c4d0bd15a235a768f4bc65512575876b55719 Mon Sep 17 00:00:00 2001
+From: Minwoo Im <minwoo.im.dev@gmail.com>
+Date: Sun, 2 Jun 2019 12:43:39 +0900
+Subject: nvmet: fix data_len to 0 for bdev-backed write_zeroes
+
+[ Upstream commit 3562f5d9f21e7779ae442a45197fed6cb247fd22 ]
+
+The WRITE ZEROES command has no data transfer so that we need to
+initialize the struct (nvmet_req *req)->data_len to 0x0. While
+(nvmet_req *req)->transfer_len is initialized in nvmet_req_init(),
+data_len will be initialized by nowhere which might cause the failure
+with status code NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR randomly. It's
+because nvmet_req_execute() checks like:
+
+ if (unlikely(req->data_len != req->transfer_len)) {
+ req->error_loc = offsetof(struct nvme_common_command, dptr);
+ nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR);
+ } else
+ req->execute(req);
+
+This patch fixes req->data_len not to be a randomly assigned by
+initializing it to 0x0 when preparing the command in
+nvmet_bdev_parse_io_cmd().
+
+nvmet_file_parse_io_cmd() which is for file-backed I/O has already
+initialized the data_len field to 0x0, though.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Sagi Grimberg <sagi@grimberg.me>
+Cc: Chaitanya Kulkarni <Chaitanya.Kulkarni@wdc.com>
+Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/io-cmd-bdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
+index a065dbfc43b1..a77fd8674ecf 100644
+--- a/drivers/nvme/target/io-cmd-bdev.c
++++ b/drivers/nvme/target/io-cmd-bdev.c
+@@ -295,6 +295,7 @@ u16 nvmet_bdev_parse_io_cmd(struct nvmet_req *req)
+ return 0;
+ case nvme_cmd_write_zeroes:
+ req->execute = nvmet_bdev_execute_write_zeroes;
++ req->data_len = 0;
+ return 0;
+ default:
+ pr_err("unhandled cmd %d on qid %d\n", cmd->common.opcode,
+--
+2.20.1
+
--- /dev/null
+From 6c86153039226b359d8cc005231d38162006a403 Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Thu, 18 Apr 2019 17:42:08 +0300
+Subject: ovl: detect overlapping layers
+
+[ Upstream commit 146d62e5a5867fbf84490d82455718bfb10fe824 ]
+
+Overlapping overlay layers are not supported and can cause unexpected
+behavior, but overlayfs does not currently check or warn about these
+configurations.
+
+User is not supposed to specify the same directory for upper and
+lower dirs or for different lower layers and user is not supposed to
+specify directories that are descendants of each other for overlay
+layers, but that is exactly what this zysbot repro did:
+
+ https://syzkaller.appspot.com/x/repro.syz?x=12c7a94f400000
+
+Moving layer root directories into other layers while overlayfs
+is mounted could also result in unexpected behavior.
+
+This commit places "traps" in the overlay inode hash table.
+Those traps are dummy overlay inodes that are hashed by the layers
+root inodes.
+
+On mount, the hash table trap entries are used to verify that overlay
+layers are not overlapping. While at it, we also verify that overlay
+layers are not overlapping with directories "in-use" by other overlay
+instances as upperdir/workdir.
+
+On lookup, the trap entries are used to verify that overlay layers
+root inodes have not been moved into other layers after mount.
+
+Some examples:
+
+$ ./run --ov --samefs -s
+...
+( mkdir -p base/upper/0/u base/upper/0/w base/lower lower upper mnt
+ mount -o bind base/lower lower
+ mount -o bind base/upper upper
+ mount -t overlay none mnt ...
+ -o lowerdir=lower,upperdir=upper/0/u,workdir=upper/0/w)
+
+$ umount mnt
+$ mount -t overlay none mnt ...
+ -o lowerdir=base,upperdir=upper/0/u,workdir=upper/0/w
+
+ [ 94.434900] overlayfs: overlapping upperdir path
+ mount: mount overlay on mnt failed: Too many levels of symbolic links
+
+$ mount -t overlay none mnt ...
+ -o lowerdir=upper/0/u,upperdir=upper/0/u,workdir=upper/0/w
+
+ [ 151.350132] overlayfs: conflicting lowerdir path
+ mount: none is already mounted or mnt busy
+
+$ mount -t overlay none mnt ...
+ -o lowerdir=lower:lower/a,upperdir=upper/0/u,workdir=upper/0/w
+
+ [ 201.205045] overlayfs: overlapping lowerdir path
+ mount: mount overlay on mnt failed: Too many levels of symbolic links
+
+$ mount -t overlay none mnt ...
+ -o lowerdir=lower,upperdir=upper/0/u,workdir=upper/0/w
+$ mv base/upper/0/ base/lower/
+$ find mnt/0
+ mnt/0
+ mnt/0/w
+ find: 'mnt/0/w/work': Too many levels of symbolic links
+ find: 'mnt/0/u': Too many levels of symbolic links
+
+Reported-by: syzbot+9c69c282adc4edd2b540@syzkaller.appspotmail.com
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/inode.c | 48 +++++++++++
+ fs/overlayfs/namei.c | 8 ++
+ fs/overlayfs/overlayfs.h | 3 +
+ fs/overlayfs/ovl_entry.h | 6 ++
+ fs/overlayfs/super.c | 169 +++++++++++++++++++++++++++++++++++----
+ fs/overlayfs/util.c | 12 +++
+ 6 files changed, 229 insertions(+), 17 deletions(-)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index b48273e846ad..f7eba21effa5 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -777,6 +777,54 @@ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
+ return inode;
+ }
+
++bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir)
++{
++ struct inode *key = d_inode(dir);
++ struct inode *trap;
++ bool res;
++
++ trap = ilookup5(sb, (unsigned long) key, ovl_inode_test, key);
++ if (!trap)
++ return false;
++
++ res = IS_DEADDIR(trap) && !ovl_inode_upper(trap) &&
++ !ovl_inode_lower(trap);
++
++ iput(trap);
++ return res;
++}
++
++/*
++ * Create an inode cache entry for layer root dir, that will intentionally
++ * fail ovl_verify_inode(), so any lookup that will find some layer root
++ * will fail.
++ */
++struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir)
++{
++ struct inode *key = d_inode(dir);
++ struct inode *trap;
++
++ if (!d_is_dir(dir))
++ return ERR_PTR(-ENOTDIR);
++
++ trap = iget5_locked(sb, (unsigned long) key, ovl_inode_test,
++ ovl_inode_set, key);
++ if (!trap)
++ return ERR_PTR(-ENOMEM);
++
++ if (!(trap->i_state & I_NEW)) {
++ /* Conflicting layer roots? */
++ iput(trap);
++ return ERR_PTR(-ELOOP);
++ }
++
++ trap->i_mode = S_IFDIR;
++ trap->i_flags = S_DEAD;
++ unlock_new_inode(trap);
++
++ return trap;
++}
++
+ /*
+ * Does overlay inode need to be hashed by lower inode?
+ */
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index efd372312ef1..badf039267a2 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -18,6 +18,7 @@
+ #include "overlayfs.h"
+
+ struct ovl_lookup_data {
++ struct super_block *sb;
+ struct qstr name;
+ bool is_dir;
+ bool opaque;
+@@ -244,6 +245,12 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ if (!d->metacopy || d->last)
+ goto out;
+ } else {
++ if (ovl_lookup_trap_inode(d->sb, this)) {
++ /* Caught in a trap of overlapping layers */
++ err = -ELOOP;
++ goto out_err;
++ }
++
+ if (last_element)
+ d->is_dir = true;
+ if (d->last)
+@@ -819,6 +826,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+ int err;
+ bool metacopy = false;
+ struct ovl_lookup_data d = {
++ .sb = dentry->d_sb,
+ .name = dentry->d_name,
+ .is_dir = false,
+ .opaque = false,
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index d26efed9f80a..cec40077b522 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -270,6 +270,7 @@ void ovl_clear_flag(unsigned long flag, struct inode *inode);
+ bool ovl_test_flag(unsigned long flag, struct inode *inode);
+ bool ovl_inuse_trylock(struct dentry *dentry);
+ void ovl_inuse_unlock(struct dentry *dentry);
++bool ovl_is_inuse(struct dentry *dentry);
+ bool ovl_need_index(struct dentry *dentry);
+ int ovl_nlink_start(struct dentry *dentry);
+ void ovl_nlink_end(struct dentry *dentry);
+@@ -376,6 +377,8 @@ struct ovl_inode_params {
+ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev);
+ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
+ bool is_upper);
++bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir);
++struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir);
+ struct inode *ovl_get_inode(struct super_block *sb,
+ struct ovl_inode_params *oip);
+ static inline void ovl_copyattr(struct inode *from, struct inode *to)
+diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
+index ec237035333a..6ed1ace8f8b3 100644
+--- a/fs/overlayfs/ovl_entry.h
++++ b/fs/overlayfs/ovl_entry.h
+@@ -29,6 +29,8 @@ struct ovl_sb {
+
+ struct ovl_layer {
+ struct vfsmount *mnt;
++ /* Trap in ovl inode cache */
++ struct inode *trap;
+ struct ovl_sb *fs;
+ /* Index of this layer in fs root (upper idx == 0) */
+ int idx;
+@@ -65,6 +67,10 @@ struct ovl_fs {
+ /* Did we take the inuse lock? */
+ bool upperdir_locked;
+ bool workdir_locked;
++ /* Traps in ovl inode cache */
++ struct inode *upperdir_trap;
++ struct inode *workdir_trap;
++ struct inode *indexdir_trap;
+ /* Inode numbers in all layers do not use the high xino_bits */
+ unsigned int xino_bits;
+ };
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 0116735cc321..c481bf5f6fe2 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -217,6 +217,9 @@ static void ovl_free_fs(struct ovl_fs *ofs)
+ {
+ unsigned i;
+
++ iput(ofs->indexdir_trap);
++ iput(ofs->workdir_trap);
++ iput(ofs->upperdir_trap);
+ dput(ofs->indexdir);
+ dput(ofs->workdir);
+ if (ofs->workdir_locked)
+@@ -225,8 +228,10 @@ static void ovl_free_fs(struct ovl_fs *ofs)
+ if (ofs->upperdir_locked)
+ ovl_inuse_unlock(ofs->upper_mnt->mnt_root);
+ mntput(ofs->upper_mnt);
+- for (i = 0; i < ofs->numlower; i++)
++ for (i = 0; i < ofs->numlower; i++) {
++ iput(ofs->lower_layers[i].trap);
+ mntput(ofs->lower_layers[i].mnt);
++ }
+ for (i = 0; i < ofs->numlowerfs; i++)
+ free_anon_bdev(ofs->lower_fs[i].pseudo_dev);
+ kfree(ofs->lower_layers);
+@@ -984,7 +989,26 @@ static const struct xattr_handler *ovl_xattr_handlers[] = {
+ NULL
+ };
+
+-static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
++static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
++ struct inode **ptrap, const char *name)
++{
++ struct inode *trap;
++ int err;
++
++ trap = ovl_get_trap_inode(sb, dir);
++ err = PTR_ERR(trap);
++ if (IS_ERR(trap)) {
++ if (err == -ELOOP)
++ pr_err("overlayfs: conflicting %s path\n", name);
++ return err;
++ }
++
++ *ptrap = trap;
++ return 0;
++}
++
++static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *upperpath)
+ {
+ struct vfsmount *upper_mnt;
+ int err;
+@@ -1004,6 +1028,11 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
+ if (err)
+ goto out;
+
++ err = ovl_setup_trap(sb, upperpath->dentry, &ofs->upperdir_trap,
++ "upperdir");
++ if (err)
++ goto out;
++
+ upper_mnt = clone_private_mount(upperpath);
+ err = PTR_ERR(upper_mnt);
+ if (IS_ERR(upper_mnt)) {
+@@ -1030,7 +1059,8 @@ out:
+ return err;
+ }
+
+-static int ovl_make_workdir(struct ovl_fs *ofs, struct path *workpath)
++static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *workpath)
+ {
+ struct vfsmount *mnt = ofs->upper_mnt;
+ struct dentry *temp;
+@@ -1045,6 +1075,10 @@ static int ovl_make_workdir(struct ovl_fs *ofs, struct path *workpath)
+ if (!ofs->workdir)
+ goto out;
+
++ err = ovl_setup_trap(sb, ofs->workdir, &ofs->workdir_trap, "workdir");
++ if (err)
++ goto out;
++
+ /*
+ * Upper should support d_type, else whiteouts are visible. Given
+ * workdir and upper are on same fs, we can do iterate_dir() on
+@@ -1105,7 +1139,8 @@ out:
+ return err;
+ }
+
+-static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
++static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *upperpath)
+ {
+ int err;
+ struct path workpath = { };
+@@ -1136,19 +1171,16 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
+ pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
+ }
+
+- err = ovl_make_workdir(ofs, &workpath);
+- if (err)
+- goto out;
++ err = ovl_make_workdir(sb, ofs, &workpath);
+
+- err = 0;
+ out:
+ path_put(&workpath);
+
+ return err;
+ }
+
+-static int ovl_get_indexdir(struct ovl_fs *ofs, struct ovl_entry *oe,
+- struct path *upperpath)
++static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct ovl_entry *oe, struct path *upperpath)
+ {
+ struct vfsmount *mnt = ofs->upper_mnt;
+ int err;
+@@ -1167,6 +1199,11 @@ static int ovl_get_indexdir(struct ovl_fs *ofs, struct ovl_entry *oe,
+
+ ofs->indexdir = ovl_workdir_create(ofs, OVL_INDEXDIR_NAME, true);
+ if (ofs->indexdir) {
++ err = ovl_setup_trap(sb, ofs->indexdir, &ofs->indexdir_trap,
++ "indexdir");
++ if (err)
++ goto out;
++
+ /*
+ * Verify upper root is exclusively associated with index dir.
+ * Older kernels stored upper fh in "trusted.overlay.origin"
+@@ -1254,8 +1291,8 @@ static int ovl_get_fsid(struct ovl_fs *ofs, const struct path *path)
+ return ofs->numlowerfs;
+ }
+
+-static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+- unsigned int numlower)
++static int ovl_get_lower_layers(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *stack, unsigned int numlower)
+ {
+ int err;
+ unsigned int i;
+@@ -1273,16 +1310,28 @@ static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+
+ for (i = 0; i < numlower; i++) {
+ struct vfsmount *mnt;
++ struct inode *trap;
+ int fsid;
+
+ err = fsid = ovl_get_fsid(ofs, &stack[i]);
+ if (err < 0)
+ goto out;
+
++ err = -EBUSY;
++ if (ovl_is_inuse(stack[i].dentry)) {
++ pr_err("overlayfs: lowerdir is in-use as upperdir/workdir\n");
++ goto out;
++ }
++
++ err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
++ if (err)
++ goto out;
++
+ mnt = clone_private_mount(&stack[i]);
+ err = PTR_ERR(mnt);
+ if (IS_ERR(mnt)) {
+ pr_err("overlayfs: failed to clone lowerpath\n");
++ iput(trap);
+ goto out;
+ }
+
+@@ -1292,6 +1341,7 @@ static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+ */
+ mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME;
+
++ ofs->lower_layers[ofs->numlower].trap = trap;
+ ofs->lower_layers[ofs->numlower].mnt = mnt;
+ ofs->lower_layers[ofs->numlower].idx = i + 1;
+ ofs->lower_layers[ofs->numlower].fsid = fsid;
+@@ -1386,7 +1436,7 @@ static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb,
+ goto out_err;
+ }
+
+- err = ovl_get_lower_layers(ofs, stack, numlower);
++ err = ovl_get_lower_layers(sb, ofs, stack, numlower);
+ if (err)
+ goto out_err;
+
+@@ -1418,6 +1468,85 @@ out_err:
+ goto out;
+ }
+
++/*
++ * Check if this layer root is a descendant of:
++ * - another layer of this overlayfs instance
++ * - upper/work dir of any overlayfs instance
++ * - a disconnected dentry (detached root)
++ */
++static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
++ const char *name)
++{
++ struct dentry *next, *parent;
++ bool is_root = false;
++ int err = 0;
++
++ if (!dentry || dentry == dentry->d_sb->s_root)
++ return 0;
++
++ next = dget(dentry);
++ /* Walk back ancestors to fs root (inclusive) looking for traps */
++ do {
++ parent = dget_parent(next);
++ is_root = (parent == next);
++ if (ovl_is_inuse(parent)) {
++ err = -EBUSY;
++ pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
++ name);
++ } else if (ovl_lookup_trap_inode(sb, parent)) {
++ err = -ELOOP;
++ pr_err("overlayfs: overlapping %s path\n", name);
++ }
++ dput(next);
++ next = parent;
++ } while (!err && !is_root);
++
++ /* Did we really walk to fs root or found a detached root? */
++ if (!err && next != dentry->d_sb->s_root) {
++ err = -ESTALE;
++ pr_err("overlayfs: disconnected %s path\n", name);
++ }
++
++ dput(next);
++
++ return err;
++}
++
++/*
++ * Check if any of the layers or work dirs overlap.
++ */
++static int ovl_check_overlapping_layers(struct super_block *sb,
++ struct ovl_fs *ofs)
++{
++ int i, err;
++
++ if (ofs->upper_mnt) {
++ err = ovl_check_layer(sb, ofs->upper_mnt->mnt_root, "upperdir");
++ if (err)
++ return err;
++
++ /*
++ * Checking workbasedir avoids hitting ovl_is_inuse(parent) of
++ * this instance and covers overlapping work and index dirs,
++ * unless work or index dir have been moved since created inside
++ * workbasedir. In that case, we already have their traps in
++ * inode cache and we will catch that case on lookup.
++ */
++ err = ovl_check_layer(sb, ofs->workbasedir, "workdir");
++ if (err)
++ return err;
++ }
++
++ for (i = 0; i < ofs->numlower; i++) {
++ err = ovl_check_layer(sb, ofs->lower_layers[i].mnt->mnt_root,
++ "lowerdir");
++ if (err)
++ return err;
++ }
++
++ return 0;
++}
++
+ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ {
+ struct path upperpath = { };
+@@ -1457,17 +1586,20 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ if (ofs->config.xino != OVL_XINO_OFF)
+ ofs->xino_bits = BITS_PER_LONG - 32;
+
++ /* alloc/destroy_inode needed for setting up traps in inode cache */
++ sb->s_op = &ovl_super_operations;
++
+ if (ofs->config.upperdir) {
+ if (!ofs->config.workdir) {
+ pr_err("overlayfs: missing 'workdir'\n");
+ goto out_err;
+ }
+
+- err = ovl_get_upper(ofs, &upperpath);
++ err = ovl_get_upper(sb, ofs, &upperpath);
+ if (err)
+ goto out_err;
+
+- err = ovl_get_workdir(ofs, &upperpath);
++ err = ovl_get_workdir(sb, ofs, &upperpath);
+ if (err)
+ goto out_err;
+
+@@ -1488,7 +1620,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_flags |= SB_RDONLY;
+
+ if (!(ovl_force_readonly(ofs)) && ofs->config.index) {
+- err = ovl_get_indexdir(ofs, oe, &upperpath);
++ err = ovl_get_indexdir(sb, ofs, oe, &upperpath);
+ if (err)
+ goto out_free_oe;
+
+@@ -1501,6 +1633,10 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+
+ }
+
++ err = ovl_check_overlapping_layers(sb, ofs);
++ if (err)
++ goto out_free_oe;
++
+ /* Show index=off in /proc/mounts for forced r/o mount */
+ if (!ofs->indexdir) {
+ ofs->config.index = false;
+@@ -1522,7 +1658,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
+
+ sb->s_magic = OVERLAYFS_SUPER_MAGIC;
+- sb->s_op = &ovl_super_operations;
+ sb->s_xattr = ovl_xattr_handlers;
+ sb->s_fs_info = ofs;
+ sb->s_flags |= SB_POSIXACL;
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index 4035e640f402..e135064e87ad 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -652,6 +652,18 @@ void ovl_inuse_unlock(struct dentry *dentry)
+ }
+ }
+
++bool ovl_is_inuse(struct dentry *dentry)
++{
++ struct inode *inode = d_inode(dentry);
++ bool inuse;
++
++ spin_lock(&inode->i_lock);
++ inuse = (inode->i_state & I_OVL_INUSE);
++ spin_unlock(&inode->i_lock);
++
++ return inuse;
++}
++
+ /*
+ * Does this overlay dentry need to be indexed on copy up?
+ */
+--
+2.20.1
+
--- /dev/null
+From 595c7c2e1908d1cae3162117c03bdff00ca706b3 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Tue, 18 Jun 2019 15:06:16 +0200
+Subject: ovl: don't fail with disconnected lower NFS
+
+[ Upstream commit 9179c21dc6ed1c993caa5fe4da876a6765c26af7 ]
+
+NFS mounts can be disconnected from fs root. Don't fail the overlapping
+layer check because of this.
+
+The check is not authoritative anyway, since topology can change during or
+after the check.
+
+Reported-by: Antti Antinoja <antti@fennosys.fi>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Fixes: 146d62e5a586 ("ovl: detect overlapping layers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/super.c | 26 +++++++++-----------------
+ 1 file changed, 9 insertions(+), 17 deletions(-)
+
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index c481bf5f6fe2..fa5060f59b88 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -1472,23 +1472,20 @@ out_err:
+ * Check if this layer root is a descendant of:
+ * - another layer of this overlayfs instance
+ * - upper/work dir of any overlayfs instance
+- * - a disconnected dentry (detached root)
+ */
+ static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
+ const char *name)
+ {
+- struct dentry *next, *parent;
+- bool is_root = false;
++ struct dentry *next = dentry, *parent;
+ int err = 0;
+
+- if (!dentry || dentry == dentry->d_sb->s_root)
++ if (!dentry)
+ return 0;
+
+- next = dget(dentry);
+- /* Walk back ancestors to fs root (inclusive) looking for traps */
+- do {
+- parent = dget_parent(next);
+- is_root = (parent == next);
++ parent = dget_parent(next);
++
++ /* Walk back ancestors to root (inclusive) looking for traps */
++ while (!err && parent != next) {
+ if (ovl_is_inuse(parent)) {
+ err = -EBUSY;
+ pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
+@@ -1497,17 +1494,12 @@ static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
+ err = -ELOOP;
+ pr_err("overlayfs: overlapping %s path\n", name);
+ }
+- dput(next);
+ next = parent;
+- } while (!err && !is_root);
+-
+- /* Did we really walk to fs root or found a detached root? */
+- if (!err && next != dentry->d_sb->s_root) {
+- err = -ESTALE;
+- pr_err("overlayfs: disconnected %s path\n", name);
++ parent = dget_parent(next);
++ dput(next);
+ }
+
+- dput(next);
++ dput(parent);
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From f094a7918ad2000e74b64f4d170a1dc1baa7e90b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 17 Jun 2019 14:39:29 +0200
+Subject: ovl: fix bogus -Wmaybe-unitialized warning
+
+[ Upstream commit 1dac6f5b0ed2601be21bb4e27a44b0c3e667b7f4 ]
+
+gcc gets a bit confused by the logic in ovl_setup_trap() and
+can't figure out whether the local 'trap' variable in the caller
+was initialized or not:
+
+fs/overlayfs/super.c: In function 'ovl_fill_super':
+fs/overlayfs/super.c:1333:4: error: 'trap' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ iput(trap);
+ ^~~~~~~~~~
+fs/overlayfs/super.c:1312:17: note: 'trap' was declared here
+
+Reword slightly to make it easier for the compiler to understand.
+
+Fixes: 146d62e5a586 ("ovl: detect overlapping layers")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/super.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index fa5060f59b88..9780617c69ee 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -996,8 +996,8 @@ static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
+ int err;
+
+ trap = ovl_get_trap_inode(sb, dir);
+- err = PTR_ERR(trap);
+- if (IS_ERR(trap)) {
++ err = PTR_ERR_OR_ZERO(trap);
++ if (err) {
+ if (err == -ELOOP)
+ pr_err("overlayfs: conflicting %s path\n", name);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From 3569dfebf9afd8632401aceaab4c49eb31c2738e Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 24 May 2019 23:16:25 +0200
+Subject: parisc: Fix compiler warnings in float emulation code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 6b98d9134e14f5ef4bcf64b27eedf484ed19a1ec ]
+
+Avoid such compiler warnings:
+arch/parisc/math-emu/cnv_float.h:71:27: warning: ‘<<’ in boolean context, did you mean ‘<’ ? [-Wint-in-bool-context]
+ ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB))
+arch/parisc/math-emu/fcnvxf.c:257:6: note: in expansion of macro ‘Dint_isinexact_to_sgl’
+ if (Dint_isinexact_to_sgl(srcp1,srcp2)) {
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/math-emu/cnv_float.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/parisc/math-emu/cnv_float.h b/arch/parisc/math-emu/cnv_float.h
+index 933423fa5144..b0db61188a61 100644
+--- a/arch/parisc/math-emu/cnv_float.h
++++ b/arch/parisc/math-emu/cnv_float.h
+@@ -60,19 +60,19 @@
+ ((exponent < (SGL_P - 1)) ? \
+ (Sall(sgl_value) << (SGL_EXP_LENGTH + 1 + exponent)) : FALSE)
+
+-#define Int_isinexact_to_sgl(int_value) (int_value << 33 - SGL_EXP_LENGTH)
++#define Int_isinexact_to_sgl(int_value) ((int_value << 33 - SGL_EXP_LENGTH) != 0)
+
+ #define Sgl_roundnearest_from_int(int_value,sgl_value) \
+ if (int_value & 1<<(SGL_EXP_LENGTH - 2)) /* round bit */ \
+- if ((int_value << 34 - SGL_EXP_LENGTH) || Slow(sgl_value)) \
++ if (((int_value << 34 - SGL_EXP_LENGTH) != 0) || Slow(sgl_value)) \
+ Sall(sgl_value)++
+
+ #define Dint_isinexact_to_sgl(dint_valueA,dint_valueB) \
+- ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB))
++ (((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) != 0) || Dintp2(dint_valueB))
+
+ #define Sgl_roundnearest_from_dint(dint_valueA,dint_valueB,sgl_value) \
+ if (Dintp1(dint_valueA) & 1<<(SGL_EXP_LENGTH - 2)) \
+- if ((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) || \
++ if (((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) != 0) || \
+ Dintp2(dint_valueB) || Slow(sgl_value)) Sall(sgl_value)++
+
+ #define Dint_isinexact_to_dbl(dint_value) \
+--
+2.20.1
+
--- /dev/null
+From 4f466882bb9791aadecb6b87708822c9c1bf5aa8 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 14 May 2019 23:24:37 +0800
+Subject: parport: Fix mem leak in parport_register_dev_model
+
+[ Upstream commit 1c7ebeabc9e5ee12e42075a597de40fdb9059530 ]
+
+BUG: memory leak
+unreferenced object 0xffff8881df48cda0 (size 16):
+ comm "syz-executor.0", pid 5077, jiffies 4295994670 (age 22.280s)
+ hex dump (first 16 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000d2d0d5fe>] parport_register_dev_model+0x141/0x6e0 [parport]
+ [<00000000782f6dab>] 0xffffffffc15d1196
+ [<00000000d2ca6ae4>] platform_drv_probe+0x7e/0x100
+ [<00000000628c2a94>] really_probe+0x342/0x4d0
+ [<000000006874f5da>] driver_probe_device+0x8c/0x170
+ [<00000000424de37a>] __device_attach_driver+0xda/0x100
+ [<000000002acab09a>] bus_for_each_drv+0xfe/0x170
+ [<000000003d9e5f31>] __device_attach+0x190/0x230
+ [<0000000035d32f80>] bus_probe_device+0x123/0x140
+ [<00000000a05ba627>] device_add+0x7cc/0xce0
+ [<000000003f7560bf>] platform_device_add+0x230/0x3c0
+ [<000000002a0be07d>] 0xffffffffc15d0949
+ [<000000007361d8d2>] port_check+0x3b/0x50 [parport]
+ [<000000004d67200f>] bus_for_each_dev+0x115/0x180
+ [<000000003ccfd11c>] __parport_register_driver+0x1f0/0x210 [parport]
+ [<00000000987f06fc>] 0xffffffffc15d803e
+
+After commit 4e5a74f1db8d ("parport: Revert "parport: fix
+memory leak""), free_pardevice do not free par_dev->state,
+we should free it in error path of parport_register_dev_model
+before return.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 4e5a74f1db8d ("parport: Revert "parport: fix memory leak"")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parport/share.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/parport/share.c b/drivers/parport/share.c
+index 5dc53d420ca8..7b4ee33c1935 100644
+--- a/drivers/parport/share.c
++++ b/drivers/parport/share.c
+@@ -895,6 +895,7 @@ parport_register_dev_model(struct parport *port, const char *name,
+ par_dev->devmodel = true;
+ ret = device_register(&par_dev->dev);
+ if (ret) {
++ kfree(par_dev->state);
+ put_device(&par_dev->dev);
+ goto err_put_port;
+ }
+@@ -912,6 +913,7 @@ parport_register_dev_model(struct parport *port, const char *name,
+ spin_unlock(&port->physport->pardevice_lock);
+ pr_debug("%s: cannot grant exclusive access for device %s\n",
+ port->name, name);
++ kfree(par_dev->state);
+ device_unregister(&par_dev->dev);
+ goto err_put_port;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0bbe8a9ea2a04ab172ccf0453f30c119051fccad Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Wed, 5 Jun 2019 13:48:49 +0200
+Subject: s390/qeth: check dst entry before use
+
+[ Upstream commit 0cd6783d3c7d40be165d1f3c811cedf0e3dfcdf1 ]
+
+While qeth_l3 uses netif_keep_dst() to hold onto the dst, a skb's dst
+may still have been obsoleted (via dst_dev_put()) by the time that we
+end up using it. The dst then points to the loopback interface, which
+means the neighbour lookup in qeth_l3_get_cast_type() determines a bogus
+cast type of RTN_BROADCAST.
+For IQD interfaces this causes us to place such skbs on the wrong
+HW queue, resulting in TX errors.
+
+Fix-up the various call sites to first validate the dst entry with
+dst_check(), and fall back accordingly.
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_main.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index cb641fd303d3..93a5748036de 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1883,13 +1883,20 @@ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+
+ static int qeth_l3_get_cast_type(struct sk_buff *skb)
+ {
++ int ipv = qeth_get_ip_version(skb);
+ struct neighbour *n = NULL;
+ struct dst_entry *dst;
+
+ rcu_read_lock();
+ dst = skb_dst(skb);
+- if (dst)
+- n = dst_neigh_lookup_skb(dst, skb);
++ if (dst) {
++ struct rt6_info *rt = (struct rt6_info *) dst;
++
++ dst = dst_check(dst, (ipv == 6) ? rt6_get_cookie(rt) : 0);
++ if (dst)
++ n = dst_neigh_lookup_skb(dst, skb);
++ }
++
+ if (n) {
+ int cast_type = n->type;
+
+@@ -1904,7 +1911,7 @@ static int qeth_l3_get_cast_type(struct sk_buff *skb)
+ rcu_read_unlock();
+
+ /* no neighbour (eg AF_PACKET), fall back to target's IP address ... */
+- switch (qeth_get_ip_version(skb)) {
++ switch (ipv) {
+ case 4:
+ if (ipv4_is_lbcast(ip_hdr(skb)->daddr))
+ return RTN_BROADCAST;
+@@ -1943,6 +1950,7 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue,
+ struct qeth_hdr_layer3 *l3_hdr = &hdr->hdr.l3;
+ struct vlan_ethhdr *veth = vlan_eth_hdr(skb);
+ struct qeth_card *card = queue->card;
++ struct dst_entry *dst;
+
+ hdr->hdr.l3.length = data_len;
+
+@@ -1993,15 +2001,27 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue,
+
+ hdr->hdr.l3.flags = qeth_l3_cast_type_to_flag(cast_type);
+ rcu_read_lock();
++ dst = skb_dst(skb);
++
+ if (ipv == 4) {
+- struct rtable *rt = skb_rtable(skb);
++ struct rtable *rt;
++
++ if (dst)
++ dst = dst_check(dst, 0);
++ rt = (struct rtable *) dst;
+
+ *((__be32 *) &hdr->hdr.l3.next_hop.ipv4.addr) = (rt) ?
+ rt_nexthop(rt, ip_hdr(skb)->daddr) :
+ ip_hdr(skb)->daddr;
+ } else {
+ /* IPv6 */
+- const struct rt6_info *rt = skb_rt6_info(skb);
++ struct rt6_info *rt;
++
++ if (dst) {
++ rt = (struct rt6_info *) dst;
++ dst = dst_check(dst, rt6_get_cookie(rt));
++ }
++ rt = (struct rt6_info *) dst;
+
+ if (rt && !ipv6_addr_any(&rt->rt6i_gateway))
+ l3_hdr->next_hop.ipv6_addr = rt->rt6i_gateway;
+--
+2.20.1
+
--- /dev/null
+From a34b7df4f30ec7da26e1a5efa181ec88e3fc79ab Mon Sep 17 00:00:00 2001
+From: Alexandra Winter <wintera@linux.ibm.com>
+Date: Wed, 5 Jun 2019 13:48:50 +0200
+Subject: s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
+
+[ Upstream commit 335726195e460cb6b3f795b695bfd31f0ea70ef0 ]
+
+Enabling sysfs attribute bridge_hostnotify triggers a series of udev events
+for the MAC addresses of all currently connected peers. In case no VLAN is
+set for a peer, the device reports the corresponding MAC addresses with
+VLAN ID 4096. This currently results in attribute VLAN=4096 for all
+non-VLAN interfaces in the initial series of events after host-notify is
+enabled.
+
+Instead, no VLAN attribute should be reported in the udev event for
+non-VLAN interfaces.
+
+Only the initial events face this issue. For dynamic changes that are
+reported later, the device uses a validity flag.
+
+This also changes the code so that it now sets the VLAN attribute for
+MAC addresses with VID 0. On Linux, no qeth interface will ever be
+registered with VID 0: Linux kernel registers VID 0 on all network
+interfaces initially, but qeth will drop .ndo_vlan_rx_add_vid for VID 0.
+Peers with other OSs could register MACs with VID 0.
+
+Fixes: 9f48b9db9a22 ("qeth: bridgeport support - address notifications")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c3067fd3bd9e..fece768efcb1 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1679,7 +1679,7 @@ static void qeth_bridgeport_an_set_cb(void *priv,
+
+ l2entry = (struct qdio_brinfo_entry_l2 *)entry;
+ code = IPA_ADDR_CHANGE_CODE_MACADDR;
+- if (l2entry->addr_lnid.lnid)
++ if (l2entry->addr_lnid.lnid < VLAN_N_VID)
+ code |= IPA_ADDR_CHANGE_CODE_VLANID;
+ qeth_bridge_emit_host_event(card, anev_reg_unreg, code,
+ (struct net_if_token *)&l2entry->nit,
+--
+2.20.1
+
--- /dev/null
+From c721b1a78145cd4c57805f4b06491ce851379bc4 Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Wed, 5 Jun 2019 13:48:48 +0200
+Subject: s390/qeth: handle limited IPv4 broadcast in L3 TX path
+
+[ Upstream commit 72c87976c5abbf8a834ad85f10d03c0cd58b985c ]
+
+When selecting the cast type of a neighbourless IPv4 skb (eg. on a raw
+socket), qeth_l3 falls back to the packet's destination IP address.
+For this case we should classify traffic sent to 255.255.255.255 as
+broadcast.
+This fixes DHCP requests, which were misclassified as unicast
+(and for IQD interfaces thus ended up on the wrong HW queue).
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l3_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 53712cf26406..cb641fd303d3 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1906,6 +1906,8 @@ static int qeth_l3_get_cast_type(struct sk_buff *skb)
+ /* no neighbour (eg AF_PACKET), fall back to target's IP address ... */
+ switch (qeth_get_ip_version(skb)) {
+ case 4:
++ if (ipv4_is_lbcast(ip_hdr(skb)->daddr))
++ return RTN_BROADCAST;
+ return ipv4_is_multicast(ip_hdr(skb)->daddr) ?
+ RTN_MULTICAST : RTN_UNICAST;
+ case 6:
+--
+2.20.1
+
--- /dev/null
+From a571eec125138f67c369509be81691a5789e758c Mon Sep 17 00:00:00 2001
+From: "George G. Davis" <george_davis@mentor.com>
+Date: Mon, 3 Jun 2019 10:30:39 -0400
+Subject: scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
+
+[ Upstream commit 4f45d62a52297b10ded963412a158685647ecdec ]
+
+The following error occurs for the `make ARCH=arm64 checkstack` case:
+
+aarch64-linux-gnu-objdump -d vmlinux $(find . -name '*.ko') | \
+perl ./scripts/checkstack.pl arm64
+wrong or unknown architecture "arm64"
+
+As suggested by Masahiro Yamada, fix the above error using regular
+expressions in the same way it was fixed for the `ARCH=x86` case via
+commit fda9f9903be6 ("scripts/checkstack.pl: automatically handle
+32-bit and 64-bit mode for ARCH=x86").
+
+Suggested-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: George G. Davis <george_davis@mentor.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkstack.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index 122aef5e4e14..371bd17a4983 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -46,7 +46,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $x = "[0-9a-f]"; # hex character
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+- if ($arch eq 'aarch64') {
++ if ($arch =~ '^(aarch|arm)64$') {
+ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
+ #a110: d11643ff sub sp, sp, #0x590
+ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+--
+2.20.1
+
--- /dev/null
+From c9e0c26babdf2d39dba121bbe71157c2ec2332b7 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 29 May 2019 14:07:39 +0300
+Subject: scsi: smartpqi: unlock on error in
+ pqi_submit_raid_request_synchronous()
+
+[ Upstream commit cc8f52609bb4177febade24d11713e20c0893b0a ]
+
+We need to drop the "ctrl_info->sync_request_sem" lock before returning.
+
+Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 531824afba5f..392695b4691a 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -4044,8 +4044,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info,
+ return -ETIMEDOUT;
+ msecs_blocked =
+ jiffies_to_msecs(jiffies - start_jiffies);
+- if (msecs_blocked >= timeout_msecs)
+- return -ETIMEDOUT;
++ if (msecs_blocked >= timeout_msecs) {
++ rc = -ETIMEDOUT;
++ goto out;
++ }
+ timeout_msecs -= msecs_blocked;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 71020aff2c42e7ef3b30401f1c0b678ac7881d0b Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Tue, 21 May 2019 11:24:22 +0300
+Subject: scsi: ufs: Check that space was properly alloced in
+ copy_query_response
+
+[ Upstream commit 1c90836f70f9a8ef7b7ad9e1fdd8961903e6ced6 ]
+
+struct ufs_dev_cmd is the main container that supports device management
+commands. In the case of a read descriptor request, we assume that the
+proper space was allocated in dev_cmd to hold the returning descriptor.
+
+This is no longer true, as there are flows that doesn't use dev_cmd for
+device management requests, and was wrong in the first place.
+
+Fixes: d44a5f98bb49 (ufs: query descriptor API)
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Acked-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 5ba49c8cd2a3..dbd1f8c253bf 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1917,7 +1917,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE);
+
+ /* Get the descriptor */
+- if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
++ if (hba->dev_cmd.query.descriptor &&
++ lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
+ u8 *descp = (u8 *)lrbp->ucd_rsp_ptr +
+ GENERAL_UPIU_REQUEST_SIZE;
+ u16 resp_len;
+--
+2.20.1
+
--- /dev/null
+From 5b31603626a85f2b6f3475ad0a997b529cf12d90 Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sun, 2 Jun 2019 19:09:55 +0800
+Subject: selftests: set sysctl bc_forwarding properly in router_broadcast.sh
+
+[ Upstream commit 67c0aaa1eaec60e9dab301012bdebe6726ae04bd ]
+
+sysctl setting bc_forwarding for $rp2 is needed when ping_test_from h2,
+otherwise the bc packets from $rp2 won't be forwarded. This patch is to
+add this setting for $rp2.
+
+Also, as ping_test_from does grep "$from" only, which could match some
+unexpected output, some test case doesn't really work, like:
+
+ # ping_test_from $h2 198.51.200.255 198.51.200.2
+ PING 198.51.200.255 from 198.51.100.2 veth3: 56(84) bytes of data.
+ 64 bytes from 198.51.100.1: icmp_seq=1 ttl=64 time=0.336 ms
+
+When doing grep $form (198.51.200.2), the output could still match.
+So change to grep "bytes from $from" instead.
+
+Fixes: 40f98b9af943 ("selftests: add a selftest for directed broadcast forwarding")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/router_broadcast.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/router_broadcast.sh b/tools/testing/selftests/net/forwarding/router_broadcast.sh
+index 9a678ece32b4..4eac0a06f451 100755
+--- a/tools/testing/selftests/net/forwarding/router_broadcast.sh
++++ b/tools/testing/selftests/net/forwarding/router_broadcast.sh
+@@ -145,16 +145,19 @@ bc_forwarding_disable()
+ {
+ sysctl_set net.ipv4.conf.all.bc_forwarding 0
+ sysctl_set net.ipv4.conf.$rp1.bc_forwarding 0
++ sysctl_set net.ipv4.conf.$rp2.bc_forwarding 0
+ }
+
+ bc_forwarding_enable()
+ {
+ sysctl_set net.ipv4.conf.all.bc_forwarding 1
+ sysctl_set net.ipv4.conf.$rp1.bc_forwarding 1
++ sysctl_set net.ipv4.conf.$rp2.bc_forwarding 1
+ }
+
+ bc_forwarding_restore()
+ {
++ sysctl_restore net.ipv4.conf.$rp2.bc_forwarding
+ sysctl_restore net.ipv4.conf.$rp1.bc_forwarding
+ sysctl_restore net.ipv4.conf.all.bc_forwarding
+ }
+@@ -171,7 +174,7 @@ ping_test_from()
+ log_info "ping $dip, expected reply from $from"
+ ip vrf exec $(master_name_get $oif) \
+ $PING -I $oif $dip -c 10 -i 0.1 -w $PING_TIMEOUT -b 2>&1 \
+- | grep $from &> /dev/null
++ | grep "bytes from $from" > /dev/null
+ check_err_fail $fail $?
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d44b3e90c255315c30212a315353784975c3842e Mon Sep 17 00:00:00 2001
+From: Naresh Kamboju <naresh.kamboju@linaro.org>
+Date: Tue, 28 May 2019 13:18:09 +0100
+Subject: selftests: vm: install test_vmalloc.sh for run_vmtests
+
+[ Upstream commit bc2cce3f2ebcae02aa4bb29e3436bf75ee674c32 ]
+
+Add test_vmalloc.sh to TEST_FILES to make sure it gets installed for
+run_vmtests.
+
+Fixed below error:
+./run_vmtests: line 217: ./test_vmalloc.sh: No such file or directory
+
+Tested with: make TARGETS=vm install INSTALL_PATH=$PWD/x
+
+Signed-off-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
+index e13eb6cc8901..05306c58ff9f 100644
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -25,6 +25,8 @@ TEST_GEN_FILES += virtual_address_range
+
+ TEST_PROGS := run_vmtests
+
++TEST_FILES := test_vmalloc.sh
++
+ KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
+--
+2.20.1
+
revert-brcmfmac-disable-command-decode-in-sdio_aos.patch
brcmfmac-sdio-disable-auto-tuning-around-commands-expected-to-fail.patch
brcmfmac-sdio-don-t-tune-while-the-card-is-off.patch
+lkdtm-usercopy-moves-the-kernel_ds-test-to-non-canon.patch
+arc-fix-build-warnings.patch
+dmaengine-jz4780-fix-transfers-being-acked-too-soon.patch
+dmaengine-dw-axi-dmac-fix-null-dereference-when-poin.patch
+dmaengine-mediatek-cqdma-sleeping-in-atomic-context.patch
+dmaengine-sprd-fix-the-possible-crash-when-getting-d.patch
+dmaengine-sprd-add-validation-of-current-descriptor-.patch
+dmaengine-sprd-fix-the-incorrect-start-for-2-stage-d.patch
+dmaengine-sprd-fix-block-length-overflow.patch
+dmaengine-sprd-fix-the-right-place-to-configure-2-st.patch
+arc-plat-hsdk-add-missing-multicast-filter-bins-numb.patch
+arc-plat-hsdk-add-missing-fifo-size-entry-in-gmac-no.patch
+mips-mark-ginvt-as-__always_inline.patch
+fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch
+fpga-dfl-afu-pass-the-correct-device-to-dma_mapping_.patch
+fpga-dfl-add-lockdep-classes-for-pdata-lock.patch
+parport-fix-mem-leak-in-parport_register_dev_model.patch
+parisc-fix-compiler-warnings-in-float-emulation-code.patch
+habanalabs-fix-bug-in-checking-huge-page-optimizatio.patch
+ib-rdmavt-fix-alloc_qpn-warn_on.patch
+ib-hfi1-insure-freeze_work-work_struct-is-canceled-o.patch
+ib-qib-hfi1-rdmavt-correct-ibv_devinfo-max_mr-value.patch
+ib-hfi1-validate-page-aligned-for-a-given-virtual-ad.patch
+mips-uprobes-remove-set-but-not-used-variable-epc.patch
+crypto-hmac-fix-memory-leak-in-hmac_init_tfm.patch
+xtensa-fix-section-mismatch-between-memblock_reserve.patch
+kselftest-cgroup-fix-unexpected-testing-failure-on-t.patch
+kselftest-cgroup-fix-unexpected-testing-failure-on-t.patch-32330
+kselftest-cgroup-fix-incorrect-test_core-skip.patch
+userfaultfd-selftest-fix-compiler-warning.patch
+selftests-vm-install-test_vmalloc.sh-for-run_vmtests.patch
+nds32-avoid-iex-status-being-incorrectly-modified.patch
+net-dsa-mv88e6xxx-avoid-error-message-on-remove-from.patch
+net-hns-fix-loopback-test-failed-at-copper-ports.patch
+mdesc-fix-a-missing-check-bug-in-get_vdev_port_node_.patch
+sparc-perf-fix-updated-event-period-in-response-to-p.patch
+net-ethernet-mediatek-use-hw_feature-to-judge-if-hwl.patch
+net-ethernet-mediatek-use-net_ip_align-to-judge-if-h.patch
+selftests-set-sysctl-bc_forwarding-properly-in-route.patch
+drm-arm-mali-dp-add-a-loop-around-the-second-set-cva.patch
+drm-arm-hdlcd-actually-validate-crtc-modes.patch
+drm-arm-hdlcd-allow-a-bit-of-clock-tolerance.patch
+nvmet-fix-data_len-to-0-for-bdev-backed-write_zeroes.patch
+kbuild-tar-pkg-enable-communication-with-jobserver.patch
+scripts-checkstack.pl-fix-arm64-wrong-or-unknown-arc.patch
+net-phylink-avoid-reducing-support-mask.patch
+scsi-ufs-check-that-space-was-properly-alloced-in-co.patch
+scsi-smartpqi-unlock-on-error-in-pqi_submit_raid_req.patch
+net-ipvlan-fix-ipvlan-device-tso-disabled-while-neti.patch
+udmabuf-actually-unmap-the-scatterlist.patch
+tests-fix-pidfd-test-compilation.patch
+s390-qeth-handle-limited-ipv4-broadcast-in-l3-tx-pat.patch
+s390-qeth-check-dst-entry-before-use.patch
+s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-ud.patch
+hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch
+hwmon-pmbus-core-treat-parameters-as-paged-if-on-mul.patch
+arm64-silence-gcc-warnings-about-arch-abi-drift.patch
+nvme-fix-u32-overflow-in-the-number-of-namespace-lis.patch
+ovl-detect-overlapping-layers.patch
+ovl-don-t-fail-with-disconnected-lower-nfs.patch
+ovl-fix-bogus-wmaybe-unitialized-warning.patch
--- /dev/null
+From 41ee7be4a5dcd09704b40340dba777e42e250534 Mon Sep 17 00:00:00 2001
+From: Young Xiao <92siuyang@gmail.com>
+Date: Wed, 29 May 2019 10:21:48 +0800
+Subject: sparc: perf: fix updated event period in response to
+ PERF_EVENT_IOC_PERIOD
+
+[ Upstream commit 56cd0aefa475079e9613085b14a0f05037518fed ]
+
+The PERF_EVENT_IOC_PERIOD ioctl command can be used to change the
+sample period of a running perf_event. Consequently, when calculating
+the next event period, the new period will only be considered after the
+previous one has overflowed.
+
+This patch changes the calculation of the remaining event ticks so that
+they are offset if the period has changed.
+
+See commit 3581fe0ef37c ("ARM: 7556/1: perf: fix updated event period in
+response to PERF_EVENT_IOC_PERIOD") for details.
+
+Signed-off-by: Young Xiao <92siuyang@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/perf_event.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
+index 6de7c684c29f..a58ae9c42803 100644
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -891,6 +891,10 @@ static int sparc_perf_event_set_period(struct perf_event *event,
+ s64 period = hwc->sample_period;
+ int ret = 0;
+
++ /* The period may have been changed by PERF_EVENT_IOC_PERIOD */
++ if (unlikely(period != hwc->last_period))
++ left = period - (hwc->last_period - left);
++
+ if (unlikely(left <= -period)) {
+ left = period;
+ local64_set(&hwc->period_left, left);
+--
+2.20.1
+
--- /dev/null
+From f7f8119842976f1391b0dcf51c537d1d8e9f3f1b Mon Sep 17 00:00:00 2001
+From: Christian Brauner <christian@brauner.io>
+Date: Wed, 5 Jun 2019 15:06:32 +0200
+Subject: tests: fix pidfd-test compilation
+
+[ Upstream commit 1fcd0eb356ad56c4e405f06e31dd9fde2109d5ab ]
+
+Define __NR_pidfd_send_signal if it isn't to prevent a potential
+compilation error.
+
+To make pidfd-test compile on all arches, irrespective of whether
+or not syscall numbers are assigned, define the syscall number to -1.
+If it isn't defined this will cause the kernel to return -ENOSYS.
+
+Fixes: 575a0ae9744d ("selftests: add tests for pidfd_send_signal()")
+Signed-off-by: Christian Brauner <christian@brauner.io>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/pidfd/pidfd_test.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/pidfd/pidfd_test.c b/tools/testing/selftests/pidfd/pidfd_test.c
+index d59378a93782..20323f55613a 100644
+--- a/tools/testing/selftests/pidfd/pidfd_test.c
++++ b/tools/testing/selftests/pidfd/pidfd_test.c
+@@ -16,6 +16,10 @@
+
+ #include "../kselftest.h"
+
++#ifndef __NR_pidfd_send_signal
++#define __NR_pidfd_send_signal -1
++#endif
++
+ static inline int sys_pidfd_send_signal(int pidfd, int sig, siginfo_t *info,
+ unsigned int flags)
+ {
+--
+2.20.1
+
--- /dev/null
+From c3dcd042147cf138f6a4d689e0186c15016f8f99 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Tue, 4 Jun 2019 22:23:31 +0200
+Subject: udmabuf: actually unmap the scatterlist
+
+[ Upstream commit 283f1e383e91d96fe652fad549537ae15cf31d60 ]
+
+unmap_udmabuf fails to actually unmap the scatterlist, leaving dangling
+mappings around.
+
+Fixes: fbb0de795078 ("Add udmabuf misc device")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Link: http://patchwork.freedesktop.org/patch/msgid/20190604202331.17482-1-l.stach@pengutronix.de
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/udmabuf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index cd57747286f2..9635897458a0 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -77,6 +77,7 @@ static void unmap_udmabuf(struct dma_buf_attachment *at,
+ struct sg_table *sg,
+ enum dma_data_direction direction)
+ {
++ dma_unmap_sg(at->dev, sg->sgl, sg->nents, direction);
+ sg_free_table(sg);
+ kfree(sg);
+ }
+--
+2.20.1
+
--- /dev/null
+From ebab88e6c2686c3953c8e996524ba0b01e39861e Mon Sep 17 00:00:00 2001
+From: Alakesh Haloi <alakesh.haloi@gmail.com>
+Date: Mon, 27 May 2019 15:18:59 +0000
+Subject: userfaultfd: selftest: fix compiler warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 98a13a8d253999cf25eb16d901c35fbd2a8455c4 ]
+
+Fixes following compiler warning
+
+userfaultfd.c: In function ‘usage’:
+userfaultfd.c:126:2: warning: format not a string literal and no format
+ arguments [-Wformat-security]
+ fprintf(stderr, examples);
+
+Signed-off-by: Alakesh Haloi <alakesh.haloi@gmail.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/userfaultfd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
+index 5d1db824f73a..b3e6497b080c 100644
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -123,7 +123,7 @@ static void usage(void)
+ fprintf(stderr, "Supported <test type>: anon, hugetlb, "
+ "hugetlb_shared, shmem\n\n");
+ fprintf(stderr, "Examples:\n\n");
+- fprintf(stderr, examples);
++ fprintf(stderr, "%s", examples);
+ exit(1);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ab4a6c83fca4f3c8689a7227d915dbd7d7c71066 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 30 May 2019 05:41:38 -0700
+Subject: xtensa: Fix section mismatch between memblock_reserve and mem_reserve
+
+[ Upstream commit adefd051a6707a6ca0ebad278d3c1c05c960fc3b ]
+
+Since commit 9012d011660ea5cf2 ("compiler: allow all arches to enable
+CONFIG_OPTIMIZE_INLINING"), xtensa:tinyconfig fails to build with section
+mismatch errors.
+
+WARNING: vmlinux.o(.text.unlikely+0x68): Section mismatch in reference
+ from the function ___pa()
+ to the function .meminit.text:memblock_reserve()
+WARNING: vmlinux.o(.text.unlikely+0x74): Section mismatch in reference
+ from the function mem_reserve()
+ to the function .meminit.text:memblock_reserve()
+FATAL: modpost: Section mismatches detected.
+
+This was not seen prior to the above mentioned commit because mem_reserve()
+was always inlined.
+
+Mark mem_reserve(() as __init_memblock to have it reside in the same
+section as memblock_reserve().
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Message-Id: <1559220098-9955-1-git-send-email-linux@roeck-us.net>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/kernel/setup.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 4ec6fbb696bf..a5139f1d9220 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -310,7 +310,8 @@ extern char _SecondaryResetVector_text_start;
+ extern char _SecondaryResetVector_text_end;
+ #endif
+
+-static inline int mem_reserve(unsigned long start, unsigned long end)
++static inline int __init_memblock mem_reserve(unsigned long start,
++ unsigned long end)
+ {
+ return memblock_reserve(start, end - start);
+ }
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
