--- /dev/null
+From 88a748419b84187fd1da05637b8e5928b04a1e06 Mon Sep 17 00:00:00 2001
+From: Faiz Abbas <faiz_abbas@ti.com>
+Date: Thu, 2 May 2019 14:17:48 +0530
+Subject: ARM: dts: am57xx-idk: Remove support for voltage switching for SD card
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+commit 88a748419b84187fd1da05637b8e5928b04a1e06 upstream.
+
+If UHS speed modes are enabled, a compatible SD card switches down to
+1.8V during enumeration. If after this a software reboot/crash takes
+place and on-chip ROM tries to enumerate the SD card, the difference in
+IO voltages (host @ 3.3V and card @ 1.8V) may end up damaging the card.
+
+The fix for this is to have support for power cycling the card in
+hardware (with a PORz/soft-reset line causing a power cycle of the
+card). Since am571x-, am572x- and am574x-idk don't have this
+capability, disable voltage switching for these boards.
+
+The major effect of this is that the maximum supported speed
+mode is now high speed(50 MHz) down from SDR104(200 MHz).
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/am57xx-idk-common.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+@@ -420,6 +420,7 @@
+ vqmmc-supply = <&ldo1_reg>;
+ bus-width = <4>;
+ cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */
++ no-1-8-v;
+ };
+
+ &mmc2 {
--- /dev/null
+From c3c0b70cd3f801bded7a548198ee1c9851a0ca82 Mon Sep 17 00:00:00 2001
+From: Faiz Abbas <faiz_abbas@ti.com>
+Date: Tue, 30 Apr 2019 11:38:56 +0530
+Subject: ARM: dts: dra76x: Update MMC2_HS200_MANUAL1 iodelay values
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+commit c3c0b70cd3f801bded7a548198ee1c9851a0ca82 upstream.
+
+Update the MMC2_HS200_MANUAL1 iodelay values to match with the latest
+dra76x data manual[1]. The new iodelay values will have better marginality
+and should prevent issues in corner cases.
+
+Also this particular pinctrl-array is using spaces instead of tabs for
+spacing between the values and the comments. Fix this as well.
+
+[1] http://www.ti.com/lit/ds/symlink/dra76p.pdf
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+[tony@atomide.com: updated description with a bit more info]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi | 40 +++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+--- a/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
++++ b/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
+@@ -22,7 +22,7 @@
+ *
+ * Datamanual Revisions:
+ *
+- * DRA76x Silicon Revision 1.0: SPRS993A, Revised July 2017
++ * DRA76x Silicon Revision 1.0: SPRS993E, Revised December 2018
+ *
+ */
+
+@@ -169,25 +169,25 @@
+ /* Corresponds to MMC2_HS200_MANUAL1 in datamanual */
+ mmc2_iodelay_hs200_conf: mmc2_iodelay_hs200_conf {
+ pinctrl-pin-array = <
+- 0x190 A_DELAY_PS(384) G_DELAY_PS(0) /* CFG_GPMC_A19_OEN */
+- 0x194 A_DELAY_PS(0) G_DELAY_PS(174) /* CFG_GPMC_A19_OUT */
+- 0x1a8 A_DELAY_PS(410) G_DELAY_PS(0) /* CFG_GPMC_A20_OEN */
+- 0x1ac A_DELAY_PS(85) G_DELAY_PS(0) /* CFG_GPMC_A20_OUT */
+- 0x1b4 A_DELAY_PS(468) G_DELAY_PS(0) /* CFG_GPMC_A21_OEN */
+- 0x1b8 A_DELAY_PS(139) G_DELAY_PS(0) /* CFG_GPMC_A21_OUT */
+- 0x1c0 A_DELAY_PS(676) G_DELAY_PS(0) /* CFG_GPMC_A22_OEN */
+- 0x1c4 A_DELAY_PS(69) G_DELAY_PS(0) /* CFG_GPMC_A22_OUT */
+- 0x1d0 A_DELAY_PS(1062) G_DELAY_PS(154) /* CFG_GPMC_A23_OUT */
+- 0x1d8 A_DELAY_PS(640) G_DELAY_PS(0) /* CFG_GPMC_A24_OEN */
+- 0x1dc A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A24_OUT */
+- 0x1e4 A_DELAY_PS(356) G_DELAY_PS(0) /* CFG_GPMC_A25_OEN */
+- 0x1e8 A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A25_OUT */
+- 0x1f0 A_DELAY_PS(579) G_DELAY_PS(0) /* CFG_GPMC_A26_OEN */
+- 0x1f4 A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A26_OUT */
+- 0x1fc A_DELAY_PS(435) G_DELAY_PS(0) /* CFG_GPMC_A27_OEN */
+- 0x200 A_DELAY_PS(36) G_DELAY_PS(0) /* CFG_GPMC_A27_OUT */
+- 0x364 A_DELAY_PS(759) G_DELAY_PS(0) /* CFG_GPMC_CS1_OEN */
+- 0x368 A_DELAY_PS(72) G_DELAY_PS(0) /* CFG_GPMC_CS1_OUT */
++ 0x190 A_DELAY_PS(384) G_DELAY_PS(0) /* CFG_GPMC_A19_OEN */
++ 0x194 A_DELAY_PS(350) G_DELAY_PS(174) /* CFG_GPMC_A19_OUT */
++ 0x1a8 A_DELAY_PS(410) G_DELAY_PS(0) /* CFG_GPMC_A20_OEN */
++ 0x1ac A_DELAY_PS(335) G_DELAY_PS(0) /* CFG_GPMC_A20_OUT */
++ 0x1b4 A_DELAY_PS(468) G_DELAY_PS(0) /* CFG_GPMC_A21_OEN */
++ 0x1b8 A_DELAY_PS(339) G_DELAY_PS(0) /* CFG_GPMC_A21_OUT */
++ 0x1c0 A_DELAY_PS(676) G_DELAY_PS(0) /* CFG_GPMC_A22_OEN */
++ 0x1c4 A_DELAY_PS(219) G_DELAY_PS(0) /* CFG_GPMC_A22_OUT */
++ 0x1d0 A_DELAY_PS(1062) G_DELAY_PS(154) /* CFG_GPMC_A23_OUT */
++ 0x1d8 A_DELAY_PS(640) G_DELAY_PS(0) /* CFG_GPMC_A24_OEN */
++ 0x1dc A_DELAY_PS(150) G_DELAY_PS(0) /* CFG_GPMC_A24_OUT */
++ 0x1e4 A_DELAY_PS(356) G_DELAY_PS(0) /* CFG_GPMC_A25_OEN */
++ 0x1e8 A_DELAY_PS(150) G_DELAY_PS(0) /* CFG_GPMC_A25_OUT */
++ 0x1f0 A_DELAY_PS(579) G_DELAY_PS(0) /* CFG_GPMC_A26_OEN */
++ 0x1f4 A_DELAY_PS(200) G_DELAY_PS(0) /* CFG_GPMC_A26_OUT */
++ 0x1fc A_DELAY_PS(435) G_DELAY_PS(0) /* CFG_GPMC_A27_OEN */
++ 0x200 A_DELAY_PS(236) G_DELAY_PS(0) /* CFG_GPMC_A27_OUT */
++ 0x364 A_DELAY_PS(759) G_DELAY_PS(0) /* CFG_GPMC_CS1_OEN */
++ 0x368 A_DELAY_PS(372) G_DELAY_PS(0) /* CFG_GPMC_CS1_OUT */
+ >;
+ };
+
--- /dev/null
+From b25af2ff7c07bd19af74e3f64ff82e2880d13d81 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 13 May 2019 00:15:31 -0300
+Subject: ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit b25af2ff7c07bd19af74e3f64ff82e2880d13d81 upstream.
+
+Since commit 1e434b703248 ("ARM: imx: update the cpu power up timing
+setting on i.mx6sx") some characters loss is noticed on i.MX6ULL UART
+as reported by Christoph Niedermaier.
+
+The intention of such commit was to increase the SW2ISO field for i.MX6SX
+only, but since cpuidle-imx6sx is also used on i.MX6UL/i.MX6ULL this caused
+unintended side effects on other SoCs.
+
+Fix this problem by keeping the original SW2ISO value for i.MX6UL/i.MX6ULL
+and only increase SW2ISO in the i.MX6SX case.
+
+Cc: stable@vger.kernel.org
+Fixes: 1e434b703248 ("ARM: imx: update the cpu power up timing setting on i.mx6sx")
+Reported-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Tested-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/cpuidle-imx6sx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -15,6 +15,7 @@
+
+ #include "common.h"
+ #include "cpuidle.h"
++#include "hardware.h"
+
+ static int imx6sx_idle_finish(unsigned long val)
+ {
+@@ -110,7 +111,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(0xf, 1);
++ imx_gpc_set_arm_power_up_timing(cpu_is_imx6sx() ? 0xf : 0x2, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
--- /dev/null
+From cc538ca4308372e81b824be08561c466b1d73b72 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
+Date: Fri, 17 May 2019 17:01:42 +0200
+Subject: ARM: mvebu_v7_defconfig: fix Ethernet on Clearfog
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kundrát <jan.kundrat@cesnet.cz>
+
+commit cc538ca4308372e81b824be08561c466b1d73b72 upstream.
+
+Compared to kernel 5.0, patches merged for 5.1 added support for A38x'
+PHY guarded by a config option which was not enabled by default. As a
+result, there was no eth1 and eth2 on a Solid Run Clearfog Base.
+
+Ensure that A38x PHY is enabled on mvebu.
+
+[gregory: issue appeared in 5.1 not in 5.2 and added Fixes tag]
+
+Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz>
+Cc: Baruch Siach <baruch@tkos.co.il>
+Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
+Cc: Russell King <rmk+kernel@armlinux.org.uk>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Fixes: a10c1c8191e0 ("net: marvell: neta: add comphy support")
+Cc: stable@kernel.org
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/configs/mvebu_v7_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/configs/mvebu_v7_defconfig
++++ b/arch/arm/configs/mvebu_v7_defconfig
+@@ -131,6 +131,7 @@ CONFIG_MV_XOR=y
+ # CONFIG_IOMMU_SUPPORT is not set
+ CONFIG_MEMORY=y
+ CONFIG_PWM=y
++CONFIG_PHY_MVEBU_A38X_COMPHY=y
+ CONFIG_EXT4_FS=y
+ CONFIG_ISO9660_FS=y
+ CONFIG_JOLIET=y
--- /dev/null
+From adeaa21a4b6954e878f3f7d1c5659ed9c1fe567a Mon Sep 17 00:00:00 2001
+From: Anisse Astier <aastier@freebox.fr>
+Date: Mon, 17 Jun 2019 15:22:21 +0200
+Subject: arm64: ssbd: explicitly depend on <linux/prctl.h>
+
+From: Anisse Astier <aastier@freebox.fr>
+
+commit adeaa21a4b6954e878f3f7d1c5659ed9c1fe567a upstream.
+
+Fix ssbd.c which depends implicitly on asm/ptrace.h including
+linux/prctl.h (through for example linux/compat.h, then linux/time.h,
+linux/seqlock.h, linux/spinlock.h and linux/irqflags.h), and uses
+PR_SPEC* defines.
+
+This is an issue since we'll soon be removing the include from
+asm/ptrace.h.
+
+Fixes: 9cdc0108baa8 ("arm64: ssbd: Add prctl interface for per-thread mitigation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anisse Astier <aastier@freebox.fr>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/ssbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/kernel/ssbd.c
++++ b/arch/arm64/kernel/ssbd.c
+@@ -5,6 +5,7 @@
+
+ #include <linux/compat.h>
+ #include <linux/errno.h>
++#include <linux/prctl.h>
+ #include <linux/sched.h>
+ #include <linux/sched/task_stack.h>
+ #include <linux/thread_info.h>
--- /dev/null
+From 35341ca0614ab13e1ef34ad4f29a39e15ef31fa8 Mon Sep 17 00:00:00 2001
+From: Anisse Astier <aastier@freebox.fr>
+Date: Mon, 17 Jun 2019 15:22:22 +0200
+Subject: arm64/sve: <uapi/asm/ptrace.h> should not depend on <uapi/linux/prctl.h>
+
+From: Anisse Astier <aastier@freebox.fr>
+
+commit 35341ca0614ab13e1ef34ad4f29a39e15ef31fa8 upstream.
+
+Pulling linux/prctl.h into asm/ptrace.h in the arm64 UAPI headers causes
+userspace build issues for any program (e.g. strace and qemu) that
+includes both <sys/prctl.h> and <linux/ptrace.h> when using musl libc:
+
+ | error: redefinition of 'struct prctl_mm_map'
+ | struct prctl_mm_map {
+
+See https://github.com/foundriesio/meta-lmp/commit/6d4a106e191b5d79c41b9ac78fd321316d3013c0
+for a public example of people working around this issue.
+
+Although it's a bit grotty, fix this breakage by duplicating the prctl
+constant definitions. Since these are part of the kernel ABI, they
+cannot be changed in future and so it's not the end of the world to have
+them open-coded.
+
+Fixes: 43d4da2c45b2 ("arm64/sve: ptrace and ELF coredump support")
+Cc: stable@vger.kernel.org
+Acked-by: Dave Martin <Dave.Martin@arm.com>
+Signed-off-by: Anisse Astier <aastier@freebox.fr>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/uapi/asm/ptrace.h | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/include/uapi/asm/ptrace.h
++++ b/arch/arm64/include/uapi/asm/ptrace.h
+@@ -65,8 +65,6 @@
+
+ #ifndef __ASSEMBLY__
+
+-#include <linux/prctl.h>
+-
+ /*
+ * User structures for general purpose, floating point and debug registers.
+ */
+@@ -113,10 +111,10 @@ struct user_sve_header {
+
+ /*
+ * Common SVE_PT_* flags:
+- * These must be kept in sync with prctl interface in <linux/ptrace.h>
++ * These must be kept in sync with prctl interface in <linux/prctl.h>
+ */
+-#define SVE_PT_VL_INHERIT (PR_SVE_VL_INHERIT >> 16)
+-#define SVE_PT_VL_ONEXEC (PR_SVE_SET_VL_ONEXEC >> 16)
++#define SVE_PT_VL_INHERIT ((1 << 17) /* PR_SVE_VL_INHERIT */ >> 16)
++#define SVE_PT_VL_ONEXEC ((1 << 18) /* PR_SVE_SET_VL_ONEXEC */ >> 16)
+
+
+ /*
--- /dev/null
+From c4e0540d0ad49c8ceab06cceed1de27c4fe29f6e Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naohiro.aota@wdc.com>
+Date: Thu, 6 Jun 2019 16:54:44 +0900
+Subject: btrfs: start readahead also in seed devices
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+commit c4e0540d0ad49c8ceab06cceed1de27c4fe29f6e upstream.
+
+Currently, btrfs does not consult seed devices to start readahead. As a
+result, if readahead zone is added to the seed devices, btrfs_reada_wait()
+indefinitely wait for the reada_ctl to finish.
+
+You can reproduce the hung by modifying btrfs/163 to have larger initial
+file size (e.g. xfs_io pwrite 4M instead of current 256K).
+
+Fixes: 7414a03fbf9e ("btrfs: initial readahead code and prototypes")
+Cc: stable@vger.kernel.org # 3.2+: ce7791ffee1e: Btrfs: fix race between readahead and device replace/removal
+Cc: stable@vger.kernel.org # 3.2+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/reada.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -747,6 +747,7 @@ static void __reada_start_machine(struct
+ u64 total = 0;
+ int i;
+
++again:
+ do {
+ enqueued = 0;
+ mutex_lock(&fs_devices->device_list_mutex);
+@@ -758,6 +759,10 @@ static void __reada_start_machine(struct
+ mutex_unlock(&fs_devices->device_list_mutex);
+ total += enqueued;
+ } while (enqueued && total < 10000);
++ if (fs_devices->seed) {
++ fs_devices = fs_devices->seed;
++ goto again;
++ }
+
+ if (enqueued == 0)
+ return;
--- /dev/null
+From 247e5356a709eb49a0d95ff2a7f07dac05c8252c Mon Sep 17 00:00:00 2001
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+Date: Thu, 31 Jan 2019 09:37:22 +0000
+Subject: can: flexcan: fix timeout when set small bitrate
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+commit 247e5356a709eb49a0d95ff2a7f07dac05c8252c upstream.
+
+Current we can meet timeout issue when setting a small bitrate like
+10000 as follows on i.MX6UL EVK board (ipg clock = 66MHZ, per clock =
+30MHZ):
+
+| root@imx6ul7d:~# ip link set can0 up type can bitrate 10000
+
+A link change request failed with some changes committed already.
+Interface can0 may have been left with an inconsistent configuration,
+please check.
+
+| RTNETLINK answers: Connection timed out
+
+It is caused by calling of flexcan_chip_unfreeze() timeout.
+
+Originally the code is using usleep_range(10, 20) for unfreeze
+operation, but the patch (8badd65 can: flexcan: avoid calling
+usleep_range from interrupt context) changed it into udelay(10) which is
+only a half delay of before, there're also some other delay changes.
+
+After double to FLEXCAN_TIMEOUT_US to 100 can fix the issue.
+
+Meanwhile, Rasmus Villemoes reported that even with a timeout of 100,
+flexcan_probe() fails on the MPC8309, which requires a value of at least
+140 to work reliably. 250 works for everyone.
+
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -166,7 +166,7 @@
+ #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16)
+ #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff)
+
+-#define FLEXCAN_TIMEOUT_US (50)
++#define FLEXCAN_TIMEOUT_US (250)
+
+ /* FLEXCAN hardware feature flags
+ *
--- /dev/null
+From fd704bd5ee749d560e86c4f1fd2ef486d8abf7cf Mon Sep 17 00:00:00 2001
+From: Willem de Bruijn <willemb@google.com>
+Date: Fri, 7 Jun 2019 16:46:07 -0400
+Subject: can: purge socket error queue on sock destruct
+
+From: Willem de Bruijn <willemb@google.com>
+
+commit fd704bd5ee749d560e86c4f1fd2ef486d8abf7cf upstream.
+
+CAN supports software tx timestamps as of the below commit. Purge
+any queued timestamp packets on socket destroy.
+
+Fixes: 51f31cabe3ce ("ip: support for TX timestamps on UDP and RAW sockets")
+Reported-by: syzbot+a90604060cb40f5bdd16@syzkaller.appspotmail.com
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/can/af_can.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -105,6 +105,7 @@ EXPORT_SYMBOL(can_ioctl);
+ static void can_sock_destruct(struct sock *sk)
+ {
+ skb_queue_purge(&sk->sk_receive_queue);
++ skb_queue_purge(&sk->sk_error_queue);
+ }
+
+ static const struct can_proto *can_get_proto(int protocol)
--- /dev/null
+From 904044dd8fff43e289c11a2f90fa532e946a1d8b Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Tue, 11 Sep 2018 14:47:46 +0300
+Subject: can: xilinx_can: use correct bittiming_const for CAN FD core
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 904044dd8fff43e289c11a2f90fa532e946a1d8b upstream.
+
+Commit 9e5f1b273e6a ("can: xilinx_can: add support for Xilinx CAN FD
+core") added a new can_bittiming_const structure for CAN FD cores that
+support larger values for tseg1, tseg2, and sjw than previous Xilinx CAN
+cores, but the commit did not actually take that into use.
+
+Fix that.
+
+Tested with CAN FD core on a ZynqMP board.
+
+Fixes: 9e5f1b273e6a ("can: xilinx_can: add support for Xilinx CAN FD core")
+Reported-by: Shubhrajyoti Datta <shubhrajyoti.datta@gmail.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@gmail.com>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/xilinx_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/xilinx_can.c
++++ b/drivers/net/can/xilinx_can.c
+@@ -1443,7 +1443,7 @@ static const struct xcan_devtype_data xc
+ XCAN_FLAG_RXMNF |
+ XCAN_FLAG_TX_MAILBOXES |
+ XCAN_FLAG_RX_FIFO_MULTI,
+- .bittiming_const = &xcan_bittiming_const,
++ .bittiming_const = &xcan_bittiming_const_canfd,
+ .btr_ts2_shift = XCAN_BTR_TS2_SHIFT_CANFD,
+ .btr_sjw_shift = XCAN_BTR_SJW_SHIFT_CANFD,
+ .bus_clk_name = "s_axi_aclk",
--- /dev/null
+From 475df5d0f3eb2d031e4505f84d8fba75baaf2e80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 19 Jun 2019 15:09:29 +0300
+Subject: drm/i915: Don't clobber M/N values during fastset check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 475df5d0f3eb2d031e4505f84d8fba75baaf2e80 upstream.
+
+We're now calling intel_pipe_config_compare(..., true) uncoditionally
+which means we're always going clobber the calculated M/N values with
+the old values if the fuzzy M/N check passes. That causes problems
+because the fuzzy check allows for a huge difference in the values.
+
+I'm actually tempted to just make the M/N checks exact, but that might
+prevent fastboot from kicking in when people want it. So for now let's
+overwrite the computed values with the old values only if decide to skip
+the modeset.
+
+v2: Copy has_drrs along with M/N M2/N2 values
+
+Cc: stable@vger.kernel.org
+Cc: Blubberbub@protonmail.com
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Blubberbub@protonmail.com
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110782
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110675
+Fixes: d19f958db23c ("drm/i915: Enable fastset for non-boot modesets.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190612172423.25231-1-ville.syrjala@linux.intel.com
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+(cherry picked from commit f0521558a2a89d58a08745e225025d338572e60a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190619120929.4057-1-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 38 ++++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -11820,9 +11820,6 @@ intel_compare_link_m_n(const struct inte
+ m2_n2->gmch_m, m2_n2->gmch_n, !adjust) &&
+ intel_compare_m_n(m_n->link_m, m_n->link_n,
+ m2_n2->link_m, m2_n2->link_n, !adjust)) {
+- if (adjust)
+- *m2_n2 = *m_n;
+-
+ return true;
+ }
+
+@@ -12855,6 +12852,33 @@ static int calc_watermark_data(struct in
+ return 0;
+ }
+
++static void intel_crtc_check_fastset(struct intel_crtc_state *old_crtc_state,
++ struct intel_crtc_state *new_crtc_state)
++{
++ struct drm_i915_private *dev_priv =
++ to_i915(new_crtc_state->base.crtc->dev);
++
++ if (!intel_pipe_config_compare(dev_priv, old_crtc_state,
++ new_crtc_state, true))
++ return;
++
++ new_crtc_state->base.mode_changed = false;
++ new_crtc_state->update_pipe = true;
++
++ /*
++ * If we're not doing the full modeset we want to
++ * keep the current M/N values as they may be
++ * sufficiently different to the computed values
++ * to cause problems.
++ *
++ * FIXME: should really copy more fuzzy state here
++ */
++ new_crtc_state->fdi_m_n = old_crtc_state->fdi_m_n;
++ new_crtc_state->dp_m_n = old_crtc_state->dp_m_n;
++ new_crtc_state->dp_m2_n2 = old_crtc_state->dp_m2_n2;
++ new_crtc_state->has_drrs = old_crtc_state->has_drrs;
++}
++
+ /**
+ * intel_atomic_check - validate state object
+ * @dev: drm device
+@@ -12903,12 +12927,8 @@ static int intel_atomic_check(struct drm
+ return ret;
+ }
+
+- if (intel_pipe_config_compare(dev_priv,
+- to_intel_crtc_state(old_crtc_state),
+- pipe_config, true)) {
+- crtc_state->mode_changed = false;
+- pipe_config->update_pipe = true;
+- }
++ intel_crtc_check_fastset(to_intel_crtc_state(old_crtc_state),
++ pipe_config);
+
+ if (needs_modeset(crtc_state))
+ any_ms = true;
--- /dev/null
+From cc0ba0d8624f210995924bb57a8b181ce8976606 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Wed, 29 May 2019 08:15:19 +0200
+Subject: drm/vmwgfx: Use the backdoor port if the HB port is not available
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit cc0ba0d8624f210995924bb57a8b181ce8976606 upstream.
+
+The HB port may not be available for various reasons. Either it has been
+disabled by a config option or by the hypervisor for other reasons.
+In that case, make sure we have a backup plan and use the backdoor port
+instead with a performance penalty.
+
+Cc: stable@vger.kernel.org
+Fixes: 89da76fde68d ("drm/vmwgfx: Add VMWare host messaging capability")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 146 ++++++++++++++++++++++++++++--------
+ 1 file changed, 117 insertions(+), 29 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -136,6 +136,114 @@ static int vmw_close_channel(struct rpc_
+ return 0;
+ }
+
++/**
++ * vmw_port_hb_out - Send the message payload either through the
++ * high-bandwidth port if available, or through the backdoor otherwise.
++ * @channel: The rpc channel.
++ * @msg: NULL-terminated message.
++ * @hb: Whether the high-bandwidth port is available.
++ *
++ * Return: The port status.
++ */
++static unsigned long vmw_port_hb_out(struct rpc_channel *channel,
++ const char *msg, bool hb)
++{
++ unsigned long si, di, eax, ebx, ecx, edx;
++ unsigned long msg_len = strlen(msg);
++
++ if (hb) {
++ unsigned long bp = channel->cookie_high;
++
++ si = (uintptr_t) msg;
++ di = channel->cookie_low;
++
++ VMW_PORT_HB_OUT(
++ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
++ msg_len, si, di,
++ VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC, bp,
++ eax, ebx, ecx, edx, si, di);
++
++ return ebx;
++ }
++
++ /* HB port not available. Send the message 4 bytes at a time. */
++ ecx = MESSAGE_STATUS_SUCCESS << 16;
++ while (msg_len && (HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS)) {
++ unsigned int bytes = min_t(size_t, msg_len, 4);
++ unsigned long word = 0;
++
++ memcpy(&word, msg, bytes);
++ msg_len -= bytes;
++ msg += bytes;
++ si = channel->cookie_high;
++ di = channel->cookie_low;
++
++ VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_SENDPAYLOAD << 16),
++ word, si, di,
++ VMW_HYPERVISOR_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC,
++ eax, ebx, ecx, edx, si, di);
++ }
++
++ return ecx;
++}
++
++/**
++ * vmw_port_hb_in - Receive the message payload either through the
++ * high-bandwidth port if available, or through the backdoor otherwise.
++ * @channel: The rpc channel.
++ * @reply: Pointer to buffer holding reply.
++ * @reply_len: Length of the reply.
++ * @hb: Whether the high-bandwidth port is available.
++ *
++ * Return: The port status.
++ */
++static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,
++ unsigned long reply_len, bool hb)
++{
++ unsigned long si, di, eax, ebx, ecx, edx;
++
++ if (hb) {
++ unsigned long bp = channel->cookie_low;
++
++ si = channel->cookie_high;
++ di = (uintptr_t) reply;
++
++ VMW_PORT_HB_IN(
++ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
++ reply_len, si, di,
++ VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC, bp,
++ eax, ebx, ecx, edx, si, di);
++
++ return ebx;
++ }
++
++ /* HB port not available. Retrieve the message 4 bytes at a time. */
++ ecx = MESSAGE_STATUS_SUCCESS << 16;
++ while (reply_len) {
++ unsigned int bytes = min_t(unsigned long, reply_len, 4);
++
++ si = channel->cookie_high;
++ di = channel->cookie_low;
++
++ VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_RECVPAYLOAD << 16),
++ MESSAGE_STATUS_SUCCESS, si, di,
++ VMW_HYPERVISOR_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC,
++ eax, ebx, ecx, edx, si, di);
++
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
++ break;
++
++ memcpy(reply, &ebx, bytes);
++ reply_len -= bytes;
++ reply += bytes;
++ }
++
++ return ecx;
++}
+
+
+ /**
+@@ -148,11 +256,10 @@ static int vmw_close_channel(struct rpc_
+ */
+ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
+ {
+- unsigned long eax, ebx, ecx, edx, si, di, bp;
++ unsigned long eax, ebx, ecx, edx, si, di;
+ size_t msg_len = strlen(msg);
+ int retries = 0;
+
+-
+ while (retries < RETRIES) {
+ retries++;
+
+@@ -166,23 +273,14 @@ static int vmw_send_msg(struct rpc_chann
+ VMW_HYPERVISOR_MAGIC,
+ eax, ebx, ecx, edx, si, di);
+
+- if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
+- (HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
+- /* Expected success + high-bandwidth. Give up. */
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
++ /* Expected success. Give up. */
+ return -EINVAL;
+ }
+
+ /* Send msg */
+- si = (uintptr_t) msg;
+- di = channel->cookie_low;
+- bp = channel->cookie_high;
+-
+- VMW_PORT_HB_OUT(
+- (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+- msg_len, si, di,
+- VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
+- VMW_HYPERVISOR_MAGIC, bp,
+- eax, ebx, ecx, edx, si, di);
++ ebx = vmw_port_hb_out(channel, msg,
++ !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
+
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) != 0) {
+ return 0;
+@@ -211,7 +309,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
+ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ size_t *msg_len)
+ {
+- unsigned long eax, ebx, ecx, edx, si, di, bp;
++ unsigned long eax, ebx, ecx, edx, si, di;
+ char *reply;
+ size_t reply_len;
+ int retries = 0;
+@@ -233,8 +331,7 @@ static int vmw_recv_msg(struct rpc_chann
+ VMW_HYPERVISOR_MAGIC,
+ eax, ebx, ecx, edx, si, di);
+
+- if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
+- (HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ DRM_ERROR("Failed to get reply size for host message.\n");
+ return -EINVAL;
+ }
+@@ -252,17 +349,8 @@ static int vmw_recv_msg(struct rpc_chann
+
+
+ /* Receive buffer */
+- si = channel->cookie_high;
+- di = (uintptr_t) reply;
+- bp = channel->cookie_low;
+-
+- VMW_PORT_HB_IN(
+- (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+- reply_len, si, di,
+- VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
+- VMW_HYPERVISOR_MAGIC, bp,
+- eax, ebx, ecx, edx, si, di);
+-
++ ebx = vmw_port_hb_in(channel, reply, reply_len,
++ !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ kfree(reply);
+
--- /dev/null
+From b6b80c78af838bef17501416d5d383fedab0010a Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Thu, 13 Jun 2019 10:22:23 -0700
+Subject: KVM: x86/mmu: Allocate PAE root array when using SVM's 32-bit NPT
+
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+
+commit b6b80c78af838bef17501416d5d383fedab0010a upstream.
+
+SVM's Nested Page Tables (NPT) reuses x86 paging for the host-controlled
+page walk. For 32-bit KVM, this means PAE paging is used even when TDP
+is enabled, i.e. the PAE root array needs to be allocated.
+
+Fixes: ee6268ba3a68 ("KVM: x86: Skip pae_root shadow allocation if tdp enabled")
+Cc: stable@vger.kernel.org
+Reported-by: Jiri Palecek <jpalecek@web.de>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/mmu.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5591,14 +5591,18 @@ static int alloc_mmu_pages(struct kvm_vc
+ struct page *page;
+ int i;
+
+- if (tdp_enabled)
+- return 0;
+-
+ /*
+- * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
+- * Therefore we need to allocate shadow page tables in the first
+- * 4GB of memory, which happens to fit the DMA32 zone.
++ * When using PAE paging, the four PDPTEs are treated as 'root' pages,
++ * while the PDP table is a per-vCPU construct that's allocated at MMU
++ * creation. When emulating 32-bit mode, cr3 is only 32 bits even on
++ * x86_64. Therefore we need to allocate the PDP table in the first
++ * 4GB of memory, which happens to fit the DMA32 zone. Except for
++ * SVM's 32-bit NPT support, TDP paging doesn't use PAE paging and can
++ * skip allocating the PDP table.
+ */
++ if (tdp_enabled && kvm_x86_ops->get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)
++ return 0;
++
+ page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_DMA32);
+ if (!page)
+ return -ENOMEM;
--- /dev/null
+From 6dde1e42f497b2d4e22466f23019016775607947 Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Sun, 9 Jun 2019 19:03:44 +0300
+Subject: ovl: make i_ino consistent with st_ino in more cases
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 6dde1e42f497b2d4e22466f23019016775607947 upstream.
+
+Relax the condition that overlayfs supports nfs export, to require
+that i_ino is consistent with st_ino/d_ino.
+
+It is enough to require that st_ino and d_ino are consistent.
+
+This fixes the failure of xfstest generic/504, due to mismatch of
+st_ino to inode number in the output of /proc/locks.
+
+Fixes: 12574a9f4c9c ("ovl: consistent i_ino for non-samefs with xino")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/inode.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -553,15 +553,15 @@ static void ovl_fill_inode(struct inode
+ int xinobits = ovl_xino_bits(inode->i_sb);
+
+ /*
+- * When NFS export is enabled and d_ino is consistent with st_ino
+- * (samefs or i_ino has enough bits to encode layer), set the same
+- * value used for d_ino to i_ino, because nfsd readdirplus compares
+- * d_ino values to i_ino values of child entries. When called from
++ * When d_ino is consistent with st_ino (samefs or i_ino has enough
++ * bits to encode layer), set the same value used for st_ino to i_ino,
++ * so inode number exposed via /proc/locks and a like will be
++ * consistent with d_ino and st_ino values. An i_ino value inconsistent
++ * with d_ino also causes nfsd readdirplus to fail. When called from
+ * ovl_new_inode(), ino arg is 0, so i_ino will be updated to real
+ * upper inode i_ino on ovl_inode_init() or ovl_inode_update().
+ */
+- if (inode->i_sb->s_export_op &&
+- (ovl_same_sb(inode->i_sb) || xinobits)) {
++ if (ovl_same_sb(inode->i_sb) || xinobits) {
+ inode->i_ino = ino;
+ if (xinobits && fsid && !(ino >> (64 - xinobits)))
+ inode->i_ino |= (unsigned long)fsid << (64 - xinobits);
--- /dev/null
+From 758f2046ea040773ae8ea7f72dd3bbd8fa984501 Mon Sep 17 00:00:00 2001
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Thu, 13 Jun 2019 00:21:40 +0530
+Subject: powerpc/bpf: use unsigned division instruction for 64-bit operations
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+commit 758f2046ea040773ae8ea7f72dd3bbd8fa984501 upstream.
+
+BPF_ALU64 div/mod operations are currently using signed division, unlike
+BPF_ALU32 operations. Fix the same. DIV64 and MOD64 overflow tests pass
+with this fix.
+
+Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
+Cc: stable@vger.kernel.org # v4.8+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/ppc-opcode.h | 1 +
+ arch/powerpc/net/bpf_jit.h | 2 +-
+ arch/powerpc/net/bpf_jit_comp64.c | 8 ++++----
+ 3 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -342,6 +342,7 @@
+ #define PPC_INST_MADDLD 0x10000033
+ #define PPC_INST_DIVWU 0x7c000396
+ #define PPC_INST_DIVD 0x7c0003d2
++#define PPC_INST_DIVDU 0x7c000392
+ #define PPC_INST_RLWINM 0x54000000
+ #define PPC_INST_RLWINM_DOT 0x54000001
+ #define PPC_INST_RLWIMI 0x50000000
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -116,7 +116,7 @@
+ ___PPC_RA(a) | IMM_L(i))
+ #define PPC_DIVWU(d, a, b) EMIT(PPC_INST_DIVWU | ___PPC_RT(d) | \
+ ___PPC_RA(a) | ___PPC_RB(b))
+-#define PPC_DIVD(d, a, b) EMIT(PPC_INST_DIVD | ___PPC_RT(d) | \
++#define PPC_DIVDU(d, a, b) EMIT(PPC_INST_DIVDU | ___PPC_RT(d) | \
+ ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_AND(d, a, b) EMIT(PPC_INST_AND | ___PPC_RA(d) | \
+ ___PPC_RS(a) | ___PPC_RB(b))
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -399,12 +399,12 @@ static int bpf_jit_build_body(struct bpf
+ case BPF_ALU64 | BPF_DIV | BPF_X: /* dst /= src */
+ case BPF_ALU64 | BPF_MOD | BPF_X: /* dst %= src */
+ if (BPF_OP(code) == BPF_MOD) {
+- PPC_DIVD(b2p[TMP_REG_1], dst_reg, src_reg);
++ PPC_DIVDU(b2p[TMP_REG_1], dst_reg, src_reg);
+ PPC_MULD(b2p[TMP_REG_1], src_reg,
+ b2p[TMP_REG_1]);
+ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]);
+ } else
+- PPC_DIVD(dst_reg, dst_reg, src_reg);
++ PPC_DIVDU(dst_reg, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */
+ case BPF_ALU | BPF_DIV | BPF_K: /* (u32) dst /= (u32) imm */
+@@ -432,7 +432,7 @@ static int bpf_jit_build_body(struct bpf
+ break;
+ case BPF_ALU64:
+ if (BPF_OP(code) == BPF_MOD) {
+- PPC_DIVD(b2p[TMP_REG_2], dst_reg,
++ PPC_DIVDU(b2p[TMP_REG_2], dst_reg,
+ b2p[TMP_REG_1]);
+ PPC_MULD(b2p[TMP_REG_1],
+ b2p[TMP_REG_1],
+@@ -440,7 +440,7 @@ static int bpf_jit_build_body(struct bpf
+ PPC_SUB(dst_reg, dst_reg,
+ b2p[TMP_REG_1]);
+ } else
+- PPC_DIVD(dst_reg, dst_reg,
++ PPC_DIVDU(dst_reg, dst_reg,
+ b2p[TMP_REG_1]);
+ break;
+ }
--- /dev/null
+From bf587caae305ae3b4393077fb22c98478ee55755 Mon Sep 17 00:00:00 2001
+From: ShihPo Hung <shihpo.hung@sifive.com>
+Date: Mon, 17 Jun 2019 12:26:17 +0800
+Subject: riscv: mm: synchronize MMU after pte change
+
+From: ShihPo Hung <shihpo.hung@sifive.com>
+
+commit bf587caae305ae3b4393077fb22c98478ee55755 upstream.
+
+Because RISC-V compliant implementations can cache invalid entries
+in TLB, an SFENCE.VMA is necessary after changes to the page table.
+This patch adds an SFENCE.vma for the vmalloc_fault path.
+
+Signed-off-by: ShihPo Hung <shihpo.hung@sifive.com>
+[paul.walmsley@sifive.com: reversed tab->whitespace conversion,
+ wrapped comment lines]
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: Palmer Dabbelt <palmer@sifive.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-riscv@lists.infradead.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/mm/fault.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/riscv/mm/fault.c
++++ b/arch/riscv/mm/fault.c
+@@ -29,6 +29,7 @@
+
+ #include <asm/pgalloc.h>
+ #include <asm/ptrace.h>
++#include <asm/tlbflush.h>
+
+ /*
+ * This routine handles page faults. It determines the address and the
+@@ -281,6 +282,18 @@ vmalloc_fault:
+ pte_k = pte_offset_kernel(pmd_k, addr);
+ if (!pte_present(*pte_k))
+ goto no_context;
++
++ /*
++ * The kernel assumes that TLBs don't cache invalid
++ * entries, but in RISC-V, SFENCE.VMA specifies an
++ * ordering constraint, not a cache flush; it is
++ * necessary even after writing invalid entries.
++ * Relying on flush_tlb_fix_spurious_fault would
++ * suffice, but the extra traps reduce
++ * performance. So, eagerly SFENCE.VMA.
++ */
++ local_flush_tlb_page(addr);
++
+ return;
+ }
+ }
revert-brcmfmac-disable-command-decode-in-sdio_aos.patch
brcmfmac-sdio-disable-auto-tuning-around-commands-expected-to-fail.patch
brcmfmac-sdio-don-t-tune-while-the-card-is-off.patch
+btrfs-start-readahead-also-in-seed-devices.patch
+can-xilinx_can-use-correct-bittiming_const-for-can-fd-core.patch
+can-flexcan-fix-timeout-when-set-small-bitrate.patch
+can-purge-socket-error-queue-on-sock-destruct.patch
+riscv-mm-synchronize-mmu-after-pte-change.patch
+powerpc-bpf-use-unsigned-division-instruction-for-64-bit-operations.patch
+arm-imx-cpuidle-imx6sx-restrict-the-sw2iso-increase-to-i.mx6sx.patch
+arm-mvebu_v7_defconfig-fix-ethernet-on-clearfog.patch
+arm-dts-dra76x-update-mmc2_hs200_manual1-iodelay-values.patch
+arm-dts-am57xx-idk-remove-support-for-voltage-switching-for-sd-card.patch
+arm64-sve-uapi-asm-ptrace.h-should-not-depend-on-uapi-linux-prctl.h.patch
+arm64-ssbd-explicitly-depend-on-linux-prctl.h.patch
+kvm-x86-mmu-allocate-pae-root-array-when-using-svm-s-32-bit-npt.patch
+ovl-make-i_ino-consistent-with-st_ino-in-more-cases.patch
+drm-vmwgfx-use-the-backdoor-port-if-the-hb-port-is-not-available.patch
+drm-i915-don-t-clobber-m-n-values-during-fastset-check.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
