--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Eric Biggers <ebiggers3@gmail.com>
+Date: Fri, 8 Dec 2017 15:13:28 +0000
+Subject: 509: fix printing uninitialized stack memory when OID is empty
+
+From: Eric Biggers <ebiggers3@gmail.com>
+
+
+[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ]
+
+Callers of sprint_oid() do not check its return value before printing
+the result. In the case where the OID is zero-length, -EBADMSG was
+being returned without anything being written to the buffer, resulting
+in uninitialized stack memory being printed. Fix this by writing
+"(bad)" to the buffer in the cases where -EBADMSG is returned.
+
+Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/oid_registry.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/lib/oid_registry.c
++++ b/lib/oid_registry.c
+@@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t
+ int count;
+
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+
+ n = *v++;
+ ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
+@@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t
+ num = n & 0x7f;
+ do {
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+ n = *v++;
+ num <<= 7;
+ num |= n & 0x7f;
+@@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t
+ }
+
+ return ret;
++
++bad:
++ snprintf(buffer, bufsize, "(bad)");
++ return -EBADMSG;
+ }
+ EXPORT_SYMBOL_GPL(sprint_oid);
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Keerthy <j-keerthy@ti.com>
+Date: Fri, 10 Nov 2017 16:56:52 +0530
+Subject: ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
+
+From: Keerthy <j-keerthy@ti.com>
+
+
+[ Upstream commit b6d6af7226465b6d11eac09d0be2ab78a4a9eb62 ]
+
+Referring TRM Am335X series:
+http://www.ti.com/lit/ug/spruh73p/spruh73p.pdf
+
+The LastPowerStateEntered bitfield is present only for PM_CEFUSE
+domain. This is not present in any of the other power domains. Hence
+remove the generic am33xx_pwrdm_read_prev_pwrst hook which wrongly
+reads the reserved bit fields for all the other power domains.
+
+Reading the reserved bits leads to wrongly interpreting the low
+power transitions for various power domains that do not have the
+LastPowerStateEntered field. The pm debug counters values are wrong
+currently as we are incrementing them based on the reserved bits.
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/prm33xx.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/arch/arm/mach-omap2/prm33xx.c
++++ b/arch/arm/mach-omap2/prm33xx.c
+@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struc
+ return v;
+ }
+
+-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm)
+-{
+- u32 v;
+-
+- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs);
+- v &= AM33XX_LASTPOWERSTATEENTERED_MASK;
+- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT;
+-
+- return v;
+-}
+-
+ static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm)
+ {
+ am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK,
+@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations
+ .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst,
+ .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst,
+ .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst,
+- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst,
+ .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst,
+ .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst,
+ .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 1 Nov 2017 11:03:31 +0200
+Subject: ARM: dts: am4372: Correct the interrupts_properties of McASP
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit 627395a6f8091c0aa18f49dca7df59ba3ec147ef ]
+
+Fixes the following warnings:
+
+arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property):
+interrupts size is (8), expected multiple of 12 in
+/ocp@44000000/mcasp@48038000
+
+arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property):
+interrupts size is (8), expected multiple of 12 in
+/ocp@44000000/mcasp@4803C000
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am4372.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -927,7 +927,8 @@
+ reg = <0x48038000 0x2000>,
+ <0x46000000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <80>, <81>;
++ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 8 2>,
+@@ -941,7 +942,8 @@
+ reg = <0x4803C000 0x2000>,
+ <0x46400000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <82>, <83>;
++ interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 10 2>,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 1 Nov 2017 11:03:40 +0200
+Subject: ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit ca41e244517d6d3f1600c229ff7ca615049c1e9c ]
+
+The DMA binding for eDMA needs 2 parameters, not 1.
+The second, missing parameter is the tptc to be used for the channel.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am437x-cm-t43.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/am437x-cm-t43.dts
++++ b/arch/arm/boot/dts/am437x-cm-t43.dts
+@@ -301,8 +301,8 @@
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&spi0_pins>;
+- dmas = <&edma 16
+- &edma 17>;
++ dmas = <&edma 16 0
++ &edma 17 0>;
+ dma-names = "tx0", "rx0";
+
+ flash: w25q64cvzpig@0 {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 4 Dec 2017 08:27:17 -0800
+Subject: ARM: dts: Fix elm interrupt compiler warning
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit d364b038bc962f494cffb8f6cb6cddbe41bcb5b6 ]
+
+Looks like the interrupt property is missing the controller and level
+information causing:
+
+Warning (interrupts_property): interrupts size is (4), expected multiple
+of 12 in /ocp/elm@48078000
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -354,7 +354,7 @@
+ elm: elm@48078000 {
+ compatible = "ti,am3352-elm";
+ reg = <0x48078000 0x2000>;
+- interrupts = <4>;
++ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "elm";
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Fri, 17 Nov 2017 08:56:58 -0800
+Subject: ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit cf87634c8b24e24bf379b8c6807c8b0fb5f23567 ]
+
+There's been a reproducable USB OHCI/EHCI cpuidle related hang on omap4
+for a while that happens after about 20 - 40 minutes on an idle system
+with some data feeding device being connected, like a USB GPS device or
+a cellular modem.
+
+This issue happens in cpuidle states C2 and C3 and does not happen if
+cpuidle is limited to C1 state only. The symptoms are that the whole
+system hangs and never wakes up from idle, and if a watchdog is
+configured the system reboots after a while.
+
+Turns out that OHCI/EHCI devices on omap4 are trying to use the GIC
+interrupt controller directly as a parent instead of the WUGEN. We
+need to pass the interrupts through WUGEN to GIC to provide the wakeup
+events for the processor.
+
+Let's fix the issue by removing the gic interrupt-parent and use the
+default interrupt-parent wakeupgen instead. Note that omap5.dtsi had
+this already fixes earlier by commit 7136d457f365 ("ARM: omap: convert
+wakeupgen to stacked domains") but we somehow missed omap4 at that
+point.
+
+Fixes: 7136d457f365 ("ARM: omap: convert wakeupgen to stacked domains")
+Cc: Dave Gerlach <d-gerlach@ti.com>
+Cc: Nishanth Menon <nm@ti.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Reviewed-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -861,14 +861,12 @@
+ usbhsohci: ohci@4a064800 {
+ compatible = "ti,ohci-omap3";
+ reg = <0x4a064800 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ usbhsehci: ehci@4a064c00 {
+ compatible = "ti,ehci-omap";
+ reg = <0x4a064c00 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 31 Oct 2017 13:42:13 -0500
+Subject: ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
+
+From: Adam Ford <aford173@gmail.com>
+
+
+[ Upstream commit 3c18bbf3d11d2005da08b57ff26f44ff1c2b12d0 ]
+
+This patch fixes and issue where the NAND and GPMC based ethernet
+controller stopped working. This also updates the GPMC settings
+to be consistent with the Logic PD Torpedo development from the
+commit listed above.
+
+Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 3 ++-
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+@@ -72,7 +72,8 @@
+ };
+
+ &gpmc {
+- ranges = <1 0 0x08000000 0x1000000>; /* CS1: 16MB for LAN9221 */
++ ranges = <0 0 0x30000000 0x1000000 /* CS0: 16MB for NAND */
++ 1 0 0x2c000000 0x1000000>; /* CS1: 16MB for LAN9221 */
+
+ ethernet@gpmc {
+ pinctrl-names = "default";
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -37,7 +37,7 @@
+ };
+
+ &gpmc {
+- ranges = <0 0 0x00000000 0x1000000>; /* CS0: 16MB for NAND */
++ ranges = <0 0 0x30000000 0x1000000>; /* CS0: 16MB for NAND */
+
+ nand@0,0 {
+ compatible = "ti,omap2-nand";
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 31 Oct 2017 13:45:59 -0500
+Subject: ARM: dts: logicpd-somlv: Fix wl127x pinmux
+
+From: Adam Ford <aford173@gmail.com>
+
+
+[ Upstream commit cd7594ac3281722cb8f10d6f6c7e4287747c7a9d ]
+
+The pin assignment for the wl127x interrupt was incorrect. I am
+not sure how this every worked. This also eliminates a conflict with
+the SMC911x ethernet driver and properly moves pinmuxes for the
+related gpio to omap3_pmx_wkup from omap3_pmx_core.
+
+Fixes: ab8dd3aed011 ("ARM: DTS: Add minimal Support for Logic PD
+DM3730 SOM-LV")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -121,7 +121,7 @@
+
+ &mmc3 {
+ interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+- pinctrl-0 = <&mmc3_pins>;
++ pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
+ pinctrl-names = "default";
+ vmmc-supply = <&wl12xx_vmmc>;
+ non-removable;
+@@ -132,8 +132,8 @@
+ wlcore: wlcore@2 {
+ compatible = "ti,wl1273";
+ reg = <2>;
+- interrupt-parent = <&gpio5>;
+- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */
++ interrupt-parent = <&gpio1>;
++ interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */
+ ref-clock-frequency = <26000000>;
+ };
+ };
+@@ -157,8 +157,6 @@
+ OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
+ OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */
+ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */
+- OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */
+- OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */
+ >;
+@@ -228,6 +226,12 @@
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */
+ >;
+ };
++ wl127x_gpio: pinmux_wl127x_gpio_pin {
++ pinctrl-single,pins = <
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 27 Nov 2017 08:57:26 -0800
+Subject: ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
+
+From: Tony Lindgren <tony@atomide.com>
+
+
+[ Upstream commit d09220a887f70368afa79e850c95e74890c0a32d ]
+
+With the CMA changes from Joonsoo Kim <iamjoonsoo.kim@lge.com>, it
+was noticed that n900 stopped booting. After investigating it turned
+out that n900 save_secure_ram_context does some whacky virtual to
+physical address translation for the SRAM data address.
+
+As we now only have minimal parts of omap3 idle code copied to SRAM,
+running save_secure_ram_context() in SRAM is not needed. It only gets
+called on PM init. And it seems there's no need to ever call this from
+SRAM idle code.
+
+So let's just keep save_secure_ram_context() in DDR, and pass it the
+physical address of the parameters. We can do everything else in
+omap-secure.c like we already do for other secure code.
+
+And since we don't have any documentation, I still have no clue what
+the values for 0, 1 and 1 for the parameters might be. If somebody has
+figured it out, please do send a patch to add some comments.
+
+Debugged-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap-secure.c | 19 +++++++++++++++++++
+ arch/arm/mach-omap2/omap-secure.h | 4 ++++
+ arch/arm/mach-omap2/pm.h | 4 ----
+ arch/arm/mach-omap2/pm34xx.c | 13 ++++---------
+ arch/arm/mach-omap2/sleep34xx.S | 26 ++++----------------------
+ 5 files changed, 31 insertions(+), 35 deletions(-)
+
+--- a/arch/arm/mach-omap2/omap-secure.c
++++ b/arch/arm/mach-omap2/omap-secure.c
+@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base
+ return omap_secure_memblock_base;
+ }
+
++u32 omap3_save_secure_ram(void __iomem *addr, int size)
++{
++ u32 ret;
++ u32 param[5];
++
++ if (size != OMAP3_SAVE_SECURE_RAM_SZ)
++ return OMAP3_SAVE_SECURE_RAM_SZ;
++
++ param[0] = 4; /* Number of arguments */
++ param[1] = __pa(addr); /* Physical address for saving */
++ param[2] = 0;
++ param[3] = 1;
++ param[4] = 1;
++
++ ret = save_secure_ram_context(__pa(param));
++
++ return ret;
++}
++
+ /**
+ * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
+ * @idx: The PPA API index
+--- a/arch/arm/mach-omap2/omap-secure.h
++++ b/arch/arm/mach-omap2/omap-secure.h
+@@ -31,6 +31,8 @@
+ /* Maximum Secure memory storage size */
+ #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K)
+
++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F
++
+ /* Secure low power HAL API index */
+ #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a
+ #define OMAP4_HAL_SAVEHW_INDEX 0x1b
+@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u
+ extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs);
+ extern phys_addr_t omap_secure_ram_mempool_base(void);
+ extern int omap_secure_ram_reserve_memblock(void);
++extern u32 save_secure_ram_context(u32 args_pa);
++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size);
+
+ extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs,
+ u32 arg1, u32 arg2, u32 arg3, u32 arg4);
+--- a/arch/arm/mach-omap2/pm.h
++++ b/arch/arm/mach-omap2/pm.h
+@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz;
+ /* ... and its pointer from SRAM after copy */
+ extern void (*omap3_do_wfi_sram)(void);
+
+-/* save_secure_ram_context function pointer and size, for copy to SRAM */
+-extern int save_secure_ram_context(u32 *addr);
+-extern unsigned int save_secure_ram_context_sz;
+-
+ extern void omap3_save_scratchpad_contents(void);
+
+ #define PM_RTA_ERRATUM_i608 (1 << 0)
+--- a/arch/arm/mach-omap2/pm34xx.c
++++ b/arch/arm/mach-omap2/pm34xx.c
+@@ -48,6 +48,7 @@
+ #include "prm3xxx.h"
+ #include "pm.h"
+ #include "sdrc.h"
++#include "omap-secure.h"
+ #include "sram.h"
+ #include "control.h"
+ #include "vc.h"
+@@ -66,7 +67,6 @@ struct power_state {
+
+ static LIST_HEAD(pwrst_list);
+
+-static int (*_omap_save_secure_sram)(u32 *addr);
+ void (*omap3_do_wfi_sram)(void);
+
+ static struct powerdomain *mpu_pwrdm, *neon_pwrdm;
+@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_contex
+ * will hang the system.
+ */
+ pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
+- ret = _omap_save_secure_sram((u32 *)(unsigned long)
+- __pa(omap3_secure_ram_storage));
++ ret = omap3_save_secure_ram(omap3_secure_ram_storage,
++ OMAP3_SAVE_SECURE_RAM_SZ);
+ pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
+ /* Following is for error tracking, it should not happen */
+ if (ret) {
+@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct po
+ *
+ * The minimum set of functions is pushed to SRAM for execution:
+ * - omap3_do_wfi for erratum i581 WA,
+- * - save_secure_ram_context for security extensions.
+ */
+ void omap_push_sram_idle(void)
+ {
+ omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz);
+-
+- if (omap_type() != OMAP2_DEVICE_TYPE_GP)
+- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context,
+- save_secure_ram_context_sz);
+ }
+
+ static void __init pm_errata_configure(void)
+@@ -553,7 +548,7 @@ int __init omap3_pm_init(void)
+ clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
+ if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
+ omap3_secure_ram_storage =
+- kmalloc(0x803F, GFP_KERNEL);
++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL);
+ if (!omap3_secure_ram_storage)
+ pr_err("Memory allocation failed when allocating for secure sram context\n");
+
+--- a/arch/arm/mach-omap2/sleep34xx.S
++++ b/arch/arm/mach-omap2/sleep34xx.S
+@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_resto
+ ENDPROC(enable_omap3630_toggle_l2_on_restore)
+
+ /*
+- * Function to call rom code to save secure ram context. This gets
+- * relocated to SRAM, so it can be all in .data section. Otherwise
+- * we need to initialize api_params separately.
++ * Function to call rom code to save secure ram context.
++ *
++ * r0 = physical address of the parameters
+ */
+- .data
+- .align 3
+ ENTRY(save_secure_ram_context)
+ stmfd sp!, {r4 - r11, lr} @ save registers on stack
+- adr r3, api_params @ r3 points to parameters
+- str r0, [r3,#0x4] @ r0 has sdram address
+- ldr r12, high_mask
+- and r3, r3, r12
+- ldr r12, sram_phy_addr_mask
+- orr r3, r3, r12
++ mov r3, r0 @ physical address of parameters
+ mov r0, #25 @ set service ID for PPA
+ mov r12, r0 @ copy secure service ID in r12
+ mov r1, #0 @ set task id for ROM code in r1
+@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context)
+ nop
+ nop
+ ldmfd sp!, {r4 - r11, pc}
+- .align
+-sram_phy_addr_mask:
+- .word SRAM_BASE_P
+-high_mask:
+- .word 0xffff
+-api_params:
+- .word 0x4, 0x0, 0x0, 0x1, 0x1
+ ENDPROC(save_secure_ram_context)
+-ENTRY(save_secure_ram_context_sz)
+- .word . - save_secure_ram_context
+-
+- .text
+
+ /*
+ * ======================
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Date: Wed, 6 Dec 2017 16:03:24 +0100
+Subject: ASoC: rockchip: disable clock on error
+
+From: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+
+
+[ Upstream commit c7b92172a61b91936be985cb9bc499a4ebc6489b ]
+
+Disable the clocks in rk_spdif_probe when an error occurs after one
+of the clocks has been enabled previously.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: f874b80e1571 ASoC: rockchip: Add rockchip SPDIF transceiver driver
+Signed-off-by: Stefan Potyra <Stefan.Potyra@elektrobit.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/rockchip/rockchip_spdif.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/rockchip/rockchip_spdif.c
++++ b/sound/soc/rockchip/rockchip_spdif.c
+@@ -322,26 +322,30 @@ static int rk_spdif_probe(struct platfor
+ spdif->mclk = devm_clk_get(&pdev->dev, "mclk");
+ if (IS_ERR(spdif->mclk)) {
+ dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n");
+- return PTR_ERR(spdif->mclk);
++ ret = PTR_ERR(spdif->mclk);
++ goto err_disable_hclk;
+ }
+
+ ret = clk_prepare_enable(spdif->mclk);
+ if (ret) {
+ dev_err(spdif->dev, "clock enable failed %d\n", ret);
+- return ret;
++ goto err_disable_clocks;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(regs))
+- return PTR_ERR(regs);
++ if (IS_ERR(regs)) {
++ ret = PTR_ERR(regs);
++ goto err_disable_clocks;
++ }
+
+ spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs,
+ &rk_spdif_regmap_config);
+ if (IS_ERR(spdif->regmap)) {
+ dev_err(&pdev->dev,
+ "Failed to initialise managed register map\n");
+- return PTR_ERR(spdif->regmap);
++ ret = PTR_ERR(spdif->regmap);
++ goto err_disable_clocks;
+ }
+
+ spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR;
+@@ -373,6 +377,10 @@ static int rk_spdif_probe(struct platfor
+
+ err_pm_runtime:
+ pm_runtime_disable(&pdev->dev);
++err_disable_clocks:
++ clk_disable_unprepare(spdif->mclk);
++err_disable_hclk:
++ clk_disable_unprepare(spdif->hclk);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jiada Wang <jiada_wang@mentor.com>
+Date: Thu, 7 Dec 2017 22:15:38 -0800
+Subject: ASoC: rsnd: ssi: fix race condition in rsnd_ssi_pointer_update
+
+From: Jiada Wang <jiada_wang@mentor.com>
+
+
+[ Upstream commit 33f801366bdf3f8b67dfe325b84f4051a090d01e ]
+
+Currently there is race condition between set of byte_pos and wrap
+it around when new buffer starts. If .pointer is called in-between
+it will result in inconsistent pointer position be returned
+from .pointer callback.
+
+This patch increments buffer pointer atomically to avoid this issue.
+
+Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
+Reviewed-by: Takashi Sakamoto <takashi.sakamoto@miraclelinux.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/ssi.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -449,25 +449,29 @@ static bool rsnd_ssi_pointer_update(stru
+ int byte)
+ {
+ struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
++ bool ret = false;
++ int byte_pos;
+
+- ssi->byte_pos += byte;
++ byte_pos = ssi->byte_pos + byte;
+
+- if (ssi->byte_pos >= ssi->next_period_byte) {
++ if (byte_pos >= ssi->next_period_byte) {
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+ ssi->period_pos++;
+ ssi->next_period_byte += ssi->byte_per_period;
+
+ if (ssi->period_pos >= runtime->periods) {
+- ssi->byte_pos = 0;
++ byte_pos = 0;
+ ssi->period_pos = 0;
+ ssi->next_period_byte = ssi->byte_per_period;
+ }
+
+- return true;
++ ret = true;
+ }
+
+- return false;
++ WRITE_ONCE(ssi->byte_pos, byte_pos);
++
++ return ret;
+ }
+
+ /*
+@@ -838,7 +842,7 @@ static int rsnd_ssi_pointer(struct rsnd_
+ struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+- *pointer = bytes_to_frames(runtime, ssi->byte_pos);
++ *pointer = bytes_to_frames(runtime, READ_ONCE(ssi->byte_pos));
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Fri, 1 Dec 2017 03:13:02 -0500
+Subject: bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown
+
+From: Ray Jui <ray.jui@broadcom.com>
+
+
+[ Upstream commit a7f3f939dd7d8398acebecd1ceb2e9e7ffbe91d2 ]
+
+The current 'bnxt_shutdown' implementation only invokes
+'bnxt_ulp_shutdown' to shut down RoCE in the case when the system is in
+the path of power off (SYSTEM_POWER_OFF). While this may work in most
+cases, it does not work in the smart NIC case, when Linux 'reboot'
+command is initiated from the Linux that runs on the ARM cores of the
+NIC card. In this particular case, Linux 'reboot' results in a system
+'L3' level reset where the entire ARM and associated subsystems are
+being reset, but at the same time, Nitro core is being kept in sane state
+(to allow external PCIe connected servers to continue to work). Without
+properly shutting down RoCE and freeing all associated resources, it
+results in the ARM core to hang immediately after the 'reboot'
+
+By always invoking 'bnxt_ulp_shutdown' in 'bnxt_shutdown', it fixes the
+above issue
+
+Fixes: 0efd2fc65c92 ("bnxt_en: Add a callback to inform RDMA driver during PCI shutdown.")
+
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8218,8 +8218,9 @@ static void bnxt_shutdown(struct pci_dev
+ if (netif_running(dev))
+ dev_close(dev);
+
++ bnxt_ulp_shutdown(bp);
++
+ if (system_state == SYSTEM_POWER_OFF) {
+- bnxt_ulp_shutdown(bp);
+ bnxt_clear_int_mode(bp);
+ pci_wake_from_d3(pdev, bp->wol);
+ pci_set_power_state(pdev, PCI_D3hot);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 23 Nov 2017 17:57:04 +0200
+Subject: brcmfmac: Avoid build error with make W=1
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit 51ef7925e10688c57186d438e784532e063492e4 ]
+
+When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
+the first run, all next ones are okay.
+
+ CC [M] drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
+
+Seems like something happened with W=1 and wrong kernel doc format.
+As a quick fix remove dubious /** in the code.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2064,7 +2064,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
+ return head_pad;
+ }
+
+-/**
++/*
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Tue, 5 Dec 2017 22:54:02 -0800
+Subject: Btrfs: disable FUA if mounted with nobarrier
+
+From: Omar Sandoval <osandov@fb.com>
+
+
+[ Upstream commit 1b9e619c5bc8235cfba3dc4ced2fb0e3554a05d4 ]
+
+I was seeing disk flushes still happening when I mounted a Btrfs
+filesystem with nobarrier for testing. This is because we use FUA to
+write out the first super block, and on devices without FUA support, the
+block layer translates FUA to a flush. Even on devices supporting true
+FUA, using FUA when we asked for no barriers is surprising.
+
+Fixes: 387125fc722a8ed ("Btrfs: fix barrier flushes")
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/disk-io.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3391,6 +3391,7 @@ static int write_dev_supers(struct btrfs
+ int errors = 0;
+ u32 crc;
+ u64 bytenr;
++ int op_flags;
+
+ if (max_mirrors == 0)
+ max_mirrors = BTRFS_SUPER_MIRROR_MAX;
+@@ -3433,13 +3434,10 @@ static int write_dev_supers(struct btrfs
+ * we fua the first super. The others we allow
+ * to go down lazy.
+ */
+- if (i == 0) {
+- ret = btrfsic_submit_bh(REQ_OP_WRITE,
+- REQ_SYNC | REQ_FUA | REQ_META | REQ_PRIO, bh);
+- } else {
+- ret = btrfsic_submit_bh(REQ_OP_WRITE,
+- REQ_SYNC | REQ_META | REQ_PRIO, bh);
+- }
++ op_flags = REQ_SYNC | REQ_META | REQ_PRIO;
++ if (i == 0 && !btrfs_test_opt(device->fs_info, NOBARRIER))
++ op_flags |= REQ_FUA;
++ ret = btrfsic_submit_bh(REQ_OP_WRITE, op_flags, bh);
+ if (ret)
+ errors++;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Fri, 1 Dec 2017 11:19:42 +0200
+Subject: btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+
+[ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ]
+
+The name char array passed to btrfs_search_path_in_tree is of size
+BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes
+are in the range of [0, 4079]. Currently the code uses the define but this
+represents an off-by-one.
+
+Implications:
+
+Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be
+written to extra space, not some padding that could be provided by the
+allocator.
+
+btrfs-progs store the arguments on stack, but kernel does own copy of
+the ioctl buffer and the off-by-one overwrite does not affect userspace,
+but the ending 0 might be lost.
+
+Kernel ioctl buffer is allocated dynamically so we're overwriting
+somebody else's memory, and the ioctl is privileged if args.objectid is
+not 256. Which is in most cases, but resolving a subvolume stored in
+another directory will trigger that path.
+
+Before this patch the buffer was one byte larger, but then the -1 was
+not added.
+
+Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls")
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ added implications ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2221,7 +2221,7 @@ static noinline int btrfs_search_path_in
+ if (!path)
+ return -ENOMEM;
+
+- ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
++ ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1];
+
+ key.objectid = tree_id;
+ key.type = BTRFS_ROOT_ITEM_KEY;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Justin Maggard <jmaggard10@gmail.com>
+Date: Mon, 30 Oct 2017 15:29:10 -0700
+Subject: btrfs: Fix quota reservation leak on preallocated files
+
+From: Justin Maggard <jmaggard10@gmail.com>
+
+
+[ Upstream commit b430b7751286b3acff2d324553c8cec4f1e87764 ]
+
+Commit c6887cd11149 ("Btrfs: don't do nocow check unless we have to")
+changed the behavior of __btrfs_buffered_write() so that it first tries
+to get a data space reservation, and then skips the relatively expensive
+nocow check if the reservation succeeded.
+
+If we have quotas enabled, the data space reservation also includes a
+quota reservation. But in the rewrite case, the space has already been
+accounted for in qgroups. So btrfs_check_data_free_space() increases
+the quota reservation, but it never gets decreased when the data
+actually gets written and overwrites the pre-existing data. So we're
+left with both the qgroup and qgroup reservation accounting for the same
+space.
+
+This commit adds the missing btrfs_qgroup_free_data() call in the case
+of BTRFS_ORDERED_PREALLOC extents.
+
+Fixes: c6887cd11149 ("Btrfs: don't do nocow check unless we have to")
+Signed-off-by: Justin Maggard <jmaggard@netgear.com>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3016,6 +3016,8 @@ static int btrfs_finish_ordered_io(struc
+ compress_type = ordered_extent->compress_type;
+ if (test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags)) {
+ BUG_ON(compress_type);
++ btrfs_qgroup_free_data(inode, NULL, ordered_extent->file_offset,
++ ordered_extent->len);
+ ret = btrfs_mark_extent_written(trans, BTRFS_I(inode),
+ ordered_extent->file_offset,
+ ordered_extent->file_offset +
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Cai Li <cai.li@spreadtrum.com>
+Date: Tue, 21 Nov 2017 17:24:38 +0800
+Subject: clk: fix a panic error caused by accessing NULL pointer
+
+From: Cai Li <cai.li@spreadtrum.com>
+
+
+[ Upstream commit 975b820b6836b6b6c42fb84cd2e772e2b41bca67 ]
+
+In some cases the clock parent would be set NULL when doing re-parent,
+it will cause a NULL pointer accessing if clk_set trace event is
+enabled.
+
+This patch sets the parent as "none" if the input parameter is NULL.
+
+Fixes: dfc202ead312 (clk: Add tracepoints for hardware operations)
+Signed-off-by: Cai Li <cai.li@spreadtrum.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/events/clk.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/trace/events/clk.h
++++ b/include/trace/events/clk.h
+@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent,
+
+ TP_STRUCT__entry(
+ __string( name, core->name )
+- __string( pname, parent->name )
++ __string( pname, parent ? parent->name : "none" )
+ ),
+
+ TP_fast_assign(
+ __assign_str(name, core->name);
+- __assign_str(pname, parent->name);
++ __assign_str(pname, parent ? parent->name : "none");
+ ),
+
+ TP_printk("%s %s", __get_str(name), __get_str(pname))
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+Date: Mon, 20 Nov 2017 08:28:14 -0600
+Subject: dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
+
+From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
+
+
+[ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ]
+
+_xt_ is being dereferenced before it is null checked, hence there is a
+potential null pointer dereference.
+
+Fix this by moving the pointer dereference after _xt_ has been null
+checked.
+
+This issue was detected with the help of Coccinelle.
+
+Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
+Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan
+ unsigned long flags)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
+- struct data_chunk *first = xt->sgl;
++ struct data_chunk *first;
+ struct at_desc *desc = NULL;
+ size_t xfer_count;
+ unsigned int dwidth;
+@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan
+ if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
+ return NULL;
+
++ first = xt->sgl;
++
+ dev_info(chan2dev(chan),
+ "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+ __func__, &xt->src_start, &xt->dst_start, xt->numf,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 17 Nov 2017 22:37:53 +0100
+Subject: dmaengine: ioat: Fix error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 5c9afbda911ce20b3f2181d1e440a0222e1027dd ]
+
+If the last test in 'ioat_dma_self_test()' fails, we must release all
+the allocated resources and not just part of them.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ioat/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioa
+ if (memcmp(src, dest, IOAT_TEST_SIZE)) {
+ dev_err(dev, "Self-test copy failed compare, disabling\n");
+ err = -ENODEV;
+- goto free_resources;
++ goto unmap_dma;
+ }
+
+ unmap_dma:
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Date: Wed, 6 Dec 2017 14:28:27 +0100
+Subject: dmaengine: jz4740: disable/unprepare clk if probe fails
+
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+
+
+[ Upstream commit eb9436966fdc84cebdf222952a99898ab46d9bb0 ]
+
+in error path of jz4740_dma_probe(), call clk_disable_unprepare() to clean
+up.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 25ce6c35fea0 MIPS: jz4740: Remove custom DMA API
+Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dma-jz4740.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dma-jz4740.c
++++ b/drivers/dma/dma-jz4740.c
+@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platf
+
+ ret = dma_async_device_register(dd);
+ if (ret)
+- return ret;
++ goto err_clk;
+
+ irq = platform_get_irq(pdev, 0);
+ ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
+@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platf
+
+ err_unregister:
+ dma_async_device_unregister(dd);
++err_clk:
++ clk_disable_unprepare(dmadev->clk);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 8 Dec 2017 12:16:22 +0000
+Subject: drm/armada: fix leak of crtc structure
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 33cd3c07a976e11c3c4cc6b0b3db6760ad1590c5 ]
+
+Fix the leak of the CRTC structure in the failure paths of
+armada_drm_crtc_create().
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/armada/armada_crtc.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/armada/armada_crtc.c
++++ b/drivers/gpu/drm/armada/armada_crtc.c
+@@ -1225,17 +1225,13 @@ static int armada_drm_crtc_create(struct
+
+ ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
+ dcrtc);
+- if (ret < 0) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret < 0)
++ goto err_crtc;
+
+ if (dcrtc->variant->init) {
+ ret = dcrtc->variant->init(dcrtc, dev);
+- if (ret) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret)
++ goto err_crtc;
+ }
+
+ /* Ensure AXI pipeline is enabled */
+@@ -1246,13 +1242,15 @@ static int armada_drm_crtc_create(struct
+ dcrtc->crtc.port = port;
+
+ primary = kzalloc(sizeof(*primary), GFP_KERNEL);
+- if (!primary)
+- return -ENOMEM;
++ if (!primary) {
++ ret = -ENOMEM;
++ goto err_crtc;
++ }
+
+ ret = armada_drm_plane_init(primary);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_universal_plane_init(drm, &primary->base, 0,
+@@ -1263,7 +1261,7 @@ static int armada_drm_crtc_create(struct
+ DRM_PLANE_TYPE_PRIMARY, NULL);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL,
+@@ -1282,6 +1280,9 @@ static int armada_drm_crtc_create(struct
+
+ err_crtc_init:
+ primary->base.funcs->destroy(&primary->base);
++err_crtc:
++ kfree(dcrtc);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Stefan Schake <stschake@gmail.com>
+Date: Sat, 2 Dec 2017 18:40:39 +0100
+Subject: drm/vc4: Release fence after signalling
+
+From: Stefan Schake <stschake@gmail.com>
+
+
+[ Upstream commit babc8110057cb9ca542c3c1666cbda4e8ccf9250 ]
+
+We were never releasing the initial fence reference that is obtained
+through dma_fence_init.
+
+Link: https://github.com/anholt/linux/issues/122
+Fixes: cdec4d361323 ("drm/vc4: Expose dma-buf fences for V3D rendering.")
+Signed-off-by: Stefan Schake <stschake@gmail.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/1512236444-301-1-git-send-email-stschake@gmail.com
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_gem.c | 4 +++-
+ drivers/gpu/drm/vc4/vc4_irq.c | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -829,8 +829,10 @@ vc4_complete_exec(struct drm_device *dev
+ /* If we got force-completed because of GPU reset rather than
+ * through our IRQ handler, signal the fence now.
+ */
+- if (exec->fence)
++ if (exec->fence) {
+ dma_fence_signal(exec->fence);
++ dma_fence_put(exec->fence);
++ }
+
+ if (exec->bo) {
+ for (i = 0; i < exec->bo_count; i++)
+--- a/drivers/gpu/drm/vc4/vc4_irq.c
++++ b/drivers/gpu/drm/vc4/vc4_irq.c
+@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_dev
+ list_move_tail(&exec->head, &vc4->job_done_list);
+ if (exec->fence) {
+ dma_fence_signal_locked(exec->fence);
++ dma_fence_put(exec->fence);
+ exec->fence = NULL;
+ }
+ vc4_submit_next_render_job(dev);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+Date: Thu, 7 Dec 2017 18:44:23 +0200
+Subject: gianfar: Disable EEE autoneg by default
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+
+[ Upstream commit b6b5e8a691185606dfffff3198c89e3b4fd9d4f6 ]
+
+This controller does not support EEE, but it may connect to a PHY
+which supports EEE and advertises EEE by default, while its link
+partner also advertises EEE. If this happens, the PHY enters low
+power mode when the traffic rate is low and causes packet loss.
+This patch disables EEE advertisement by default for any PHY that
+gianfar connects to, to prevent the above unwanted outcome.
+
+Signed-off-by: Shaohui Xie <Shaohui.Xie@nxp.com>
+Tested-by: Yangbo Lu <Yangbo.lu@nxp.com>
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1792,6 +1792,7 @@ static int init_phy(struct net_device *d
+ GFAR_SUPPORTED_GBIT : 0;
+ phy_interface_t interface;
+ struct phy_device *phydev;
++ struct ethtool_eee edata;
+
+ priv->oldlink = 0;
+ priv->oldspeed = 0;
+@@ -1816,6 +1817,10 @@ static int init_phy(struct net_device *d
+ /* Add support for flow control, but don't advertise it by default */
+ phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause);
+
++ /* disable EEE autoneg, EEE not supported by eTSEC */
++ memset(&edata, 0, sizeof(struct ethtool_eee));
++ phy_ethtool_set_eee(phydev, &edata);
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Zumeng Chen <zumeng.chen@gmail.com>
+Date: Mon, 4 Dec 2017 11:22:02 +0800
+Subject: gianfar: fix a flooded alignment reports because of padding issue.
+
+From: Zumeng Chen <zumeng.chen@gmail.com>
+
+
+[ Upstream commit 58117672943734715bbe7565ac9f062effa524f0 ]
+
+According to LS1021A RM, the value of PAL can be set so that the start of the
+IP header in the receive data buffer is aligned to a 32-bit boundary. Normally,
+setting PAL = 2 provides minimal padding to ensure such alignment of the IP
+header.
+
+However every incoming packet's 8-byte time stamp will be inserted into the
+packet data buffer as padding alignment bytes when hardware time stamping is
+enabled.
+
+So we set the padding 8+2 here to avoid the flooded alignment faults:
+
+root@128:~# cat /proc/cpu/alignment
+User: 0
+System: 17539 (inet_gro_receive+0x114/0x2c0)
+Skipped: 0
+Half: 0
+Word: 0
+DWord: 0
+Multi: 17539
+User faults: 2 (fixup)
+
+Also shown when exception report enablement
+
+CPU: 0 PID: 161 Comm: irq/66-eth1_g0_ Not tainted 4.1.21-rt13-WR8.0.0.0_preempt-rt #16
+Hardware name: Freescale LS1021A
+[<8001b420>] (unwind_backtrace) from [<8001476c>] (show_stack+0x20/0x24)
+[<8001476c>] (show_stack) from [<807cfb48>] (dump_stack+0x94/0xac)
+[<807cfb48>] (dump_stack) from [<80025d70>] (do_alignment+0x720/0x958)
+[<80025d70>] (do_alignment) from [<80009224>] (do_DataAbort+0x40/0xbc)
+[<80009224>] (do_DataAbort) from [<80015398>] (__dabt_svc+0x38/0x60)
+Exception stack(0x86ad1cc0 to 0x86ad1d08)
+1cc0: f9b3e080 86b3d072 2d78d287 00000000 866816c0 86b3d05e 86e785d0 00000000
+1ce0: 00000011 0000000e 80840ab0 86ad1d3c 86ad1d08 86ad1d08 806d7fc0 806d806c
+1d00: 40070013 ffffffff
+[<80015398>] (__dabt_svc) from [<806d806c>] (inet_gro_receive+0x114/0x2c0)
+[<806d806c>] (inet_gro_receive) from [<80660eec>] (dev_gro_receive+0x21c/0x3c0)
+[<80660eec>] (dev_gro_receive) from [<8066133c>] (napi_gro_receive+0x44/0x17c)
+[<8066133c>] (napi_gro_receive) from [<804f0538>] (gfar_clean_rx_ring+0x39c/0x7d4)
+[<804f0538>] (gfar_clean_rx_ring) from [<804f0bf4>] (gfar_poll_rx_sq+0x58/0xe0)
+[<804f0bf4>] (gfar_poll_rx_sq) from [<80660b10>] (net_rx_action+0x27c/0x43c)
+[<80660b10>] (net_rx_action) from [<80033638>] (do_current_softirqs+0x1e0/0x3dc)
+[<80033638>] (do_current_softirqs) from [<800338c4>] (__local_bh_enable+0x90/0xa8)
+[<800338c4>] (__local_bh_enable) from [<8008025c>] (irq_forced_thread_fn+0x70/0x84)
+[<8008025c>] (irq_forced_thread_fn) from [<800805e8>] (irq_thread+0x16c/0x244)
+[<800805e8>] (irq_thread) from [<8004e490>] (kthread+0xe8/0x104)
+[<8004e490>] (kthread) from [<8000fda8>] (ret_from_fork+0x14/0x2c)
+
+Signed-off-by: Zumeng Chen <zumeng.chen@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1378,9 +1378,11 @@ static int gfar_probe(struct platform_de
+
+ gfar_init_addr_hash_table(priv);
+
+- /* Insert receive time stamps into padding alignment bytes */
++ /* Insert receive time stamps into padding alignment bytes, and
++ * plus 2 bytes padding to ensure the cpu alignment.
++ */
+ if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+- priv->padding = 8;
++ priv->padding = 8 + DEFAULT_PADDING;
+
+ if (dev->features & NETIF_F_IP_CSUM ||
+ priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 21 Nov 2017 15:18:10 +0100
+Subject: gpio: 74x164: Fix crash during .remove()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit a158531f3c92467df0e93e000d58185acae78a6e ]
+
+Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios'
+property") added a new member gpiod_oe to the end of the struct
+gen_74x164_chip, after the zero-length buffer array.
+
+However, this buffer is a flexible array, allocated together with the
+structure during .probe(). As the buffer is no longer the last member,
+writing to it corrupts the newly added member after it.
+During device removal, the corrupted member will be used as a pointer,
+leading to a crash.
+
+This went unnoticed, as the flexible array was declared as "buffer[0]"
+instead of "buffer[]", and thus did not trigger a "flexible array member
+not at end of struct" error from gcc.
+
+Move the gpiod_oe field up to fix this, and drop the zero from the array
+size to prevent future similar bugs.
+
+Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-74x164.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-74x164.c
++++ b/drivers/gpio/gpio-74x164.c
+@@ -23,6 +23,7 @@
+ struct gen_74x164_chip {
+ struct gpio_chip gpio_chip;
+ struct mutex lock;
++ struct gpio_desc *gpiod_oe;
+ u32 registers;
+ /*
+ * Since the registers are chained, every byte sent will make
+@@ -31,8 +32,7 @@ struct gen_74x164_chip {
+ * register at the end of the transfer. So, to have a logical
+ * numbering, store the bytes in reverse order.
+ */
+- u8 buffer[0];
+- struct gpio_desc *gpiod_oe;
++ u8 buffer[];
+ };
+
+ static int __gen_74x164_write_config(struct gen_74x164_chip *chip)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Keerthy <j-keerthy@ti.com>
+Date: Fri, 10 Nov 2017 16:43:17 +0530
+Subject: gpio: davinci: Assign first bank regs for unbanked case
+
+From: Keerthy <j-keerthy@ti.com>
+
+
+[ Upstream commit 7f8e2a85c1b0bd440ffe87be82c79fdc319e8291 ]
+
+As per the re-design assign the first bank regs for unbanked
+irq case. This was missed out in the original patch.
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Fixes: b5cf3fd827d2e1 ("gpio: davinci: Redesign driver to accommodate ngpios in one gpio chip")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-davinci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-davinci.c
++++ b/drivers/gpio/gpio-davinci.c
+@@ -383,7 +383,7 @@ static int gpio_irq_type_unbanked(struct
+ u32 mask;
+
+ d = (struct davinci_gpio_controller *)irq_data_get_irq_handler_data(data);
+- g = (struct davinci_gpio_regs __iomem *)d->regs;
++ g = (struct davinci_gpio_regs __iomem *)d->regs[0];
+ mask = __gpio_mask(data->irq - d->base_irq);
+
+ if (trigger & ~(IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jia-Ju Bai <baijiaju1990@163.com>
+Date: Tue, 12 Dec 2017 16:49:52 +0800
+Subject: hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
+
+From: Jia-Ju Bai <baijiaju1990@163.com>
+
+
+[ Upstream commit 6e266610eb6553cfb7e7eb5d11914bd01509c406 ]
+
+The driver may sleep under a spinlock.
+The function call path is:
+rr_close (acquire the spinlock)
+ free_irq --> may sleep
+
+To fix it, free_irq is moved to the place without holding the spinlock.
+
+This bug is found by my static analysis tool(DSAC) and checked by my code review.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hippi/rrunner.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *d
+ rrpriv->info_dma);
+ rrpriv->info = NULL;
+
+- free_irq(pdev->irq, dev);
+ spin_unlock_irqrestore(&rrpriv->lock, flags);
++ free_irq(pdev->irq, dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Chien Tin Tung <chien.tin.tung@intel.com>
+Date: Tue, 21 Nov 2017 16:18:30 -0600
+Subject: i40iw: Allocate a sdbuf per CQP WQE
+
+From: Chien Tin Tung <chien.tin.tung@intel.com>
+
+
+[ Upstream commit 100d6de2ced538c539d923dc14a1b5cbae234503 ]
+
+Currently there is only one sdbuf per Control QP (CQP) for
+programming Segment Descriptor (SD). If multiple SD work
+requests are posted simultaneously, the sdbuf is reused
+by all WQEs and new WQEs can corrupt previous WQEs sdbuf
+leading to incorrect SD programming.
+
+Fix this by allocating one sdbuf per CQP SQ WQE. When an
+SD command is posted, it will use the corresponding sdbuf
+for the WQE.
+
+Fixes: 86dbcd0f12e9 ("i40iw: add file to handle cqp calls")
+Signed-off-by: Chien Tin Tung <chien.tin.tung@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 43 +++++++++++++++++++++----------
+ drivers/infiniband/hw/i40iw/i40iw_d.h | 4 ++
+ 2 files changed, 33 insertions(+), 14 deletions(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+@@ -506,7 +506,7 @@ static enum i40iw_status_code i40iw_sc_c
+
+ ret_code = i40iw_allocate_dma_mem(cqp->dev->hw,
+ &cqp->sdbuf,
+- 128,
++ I40IW_UPDATE_SD_BUF_SIZE * cqp->sq_size,
+ I40IW_SD_BUF_ALIGNMENT);
+
+ if (ret_code)
+@@ -589,14 +589,15 @@ void i40iw_sc_cqp_post_sq(struct i40iw_s
+ }
+
+ /**
+- * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq
+- * @cqp: struct for cqp hw
+- * @wqe_idx: we index of cqp ring
++ * i40iw_sc_cqp_get_next_send_wqe_idx - get next WQE on CQP SQ and pass back the index
++ * @cqp: pointer to CQP structure
++ * @scratch: private data for CQP WQE
++ * @wqe_idx: WQE index for next WQE on CQP SQ
+ */
+-u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch)
++static u64 *i40iw_sc_cqp_get_next_send_wqe_idx(struct i40iw_sc_cqp *cqp,
++ u64 scratch, u32 *wqe_idx)
+ {
+ u64 *wqe = NULL;
+- u32 wqe_idx;
+ enum i40iw_status_code ret_code;
+
+ if (I40IW_RING_FULL_ERR(cqp->sq_ring)) {
+@@ -609,21 +610,33 @@ u64 *i40iw_sc_cqp_get_next_send_wqe(stru
+ cqp->sq_ring.size);
+ return NULL;
+ }
+- I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, wqe_idx, ret_code);
++ I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, *wqe_idx, ret_code);
+ cqp->dev->cqp_cmd_stats[OP_REQUESTED_COMMANDS]++;
+ if (ret_code)
+ return NULL;
+- if (!wqe_idx)
++ if (!*wqe_idx)
+ cqp->polarity = !cqp->polarity;
+
+- wqe = cqp->sq_base[wqe_idx].elem;
+- cqp->scratch_array[wqe_idx] = scratch;
++ wqe = cqp->sq_base[*wqe_idx].elem;
++ cqp->scratch_array[*wqe_idx] = scratch;
+ I40IW_CQP_INIT_WQE(wqe);
+
+ return wqe;
+ }
+
+ /**
++ * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq
++ * @cqp: struct for cqp hw
++ * @scratch: private data for CQP WQE
++ */
++u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch)
++{
++ u32 wqe_idx;
++
++ return i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx);
++}
++
++/**
+ * i40iw_sc_cqp_destroy - destroy cqp during close
+ * @cqp: struct for cqp hw
+ */
+@@ -3534,8 +3547,10 @@ static enum i40iw_status_code cqp_sds_wq
+ u64 *wqe;
+ int mem_entries, wqe_entries;
+ struct i40iw_dma_mem *sdbuf = &cqp->sdbuf;
++ u64 offset;
++ u32 wqe_idx;
+
+- wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch);
++ wqe = i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx);
+ if (!wqe)
+ return I40IW_ERR_RING_FULL;
+
+@@ -3548,8 +3563,10 @@ static enum i40iw_status_code cqp_sds_wq
+ LS_64(mem_entries, I40IW_CQPSQ_UPESD_ENTRY_COUNT);
+
+ if (mem_entries) {
+- memcpy(sdbuf->va, &info->entry[3], (mem_entries << 4));
+- data = sdbuf->pa;
++ offset = wqe_idx * I40IW_UPDATE_SD_BUF_SIZE;
++ memcpy((char *)sdbuf->va + offset, &info->entry[3],
++ mem_entries << 4);
++ data = (u64)sdbuf->pa + offset;
+ } else {
+ data = 0;
+ }
+--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
+@@ -1516,7 +1516,7 @@ enum i40iw_alignment {
+ I40IW_AEQ_ALIGNMENT = 0x100,
+ I40IW_CEQ_ALIGNMENT = 0x100,
+ I40IW_CQ0_ALIGNMENT = 0x100,
+- I40IW_SD_BUF_ALIGNMENT = 0x100
++ I40IW_SD_BUF_ALIGNMENT = 0x80
+ };
+
+ #define I40IW_WQE_SIZE_64 64
+@@ -1524,6 +1524,8 @@ enum i40iw_alignment {
+ #define I40IW_QP_WQE_MIN_SIZE 32
+ #define I40IW_QP_WQE_MAX_SIZE 128
+
++#define I40IW_UPDATE_SD_BUF_SIZE 128
++
+ #define I40IW_CQE_QTYPE_RQ 0
+ #define I40IW_CQE_QTYPE_SQ 1
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+Date: Tue, 21 Nov 2017 16:18:32 -0600
+Subject: i40iw: Correct ARP index mask
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+
+[ Upstream commit a283cdc4d3670700182c820b59078387f9a01a30 ]
+
+The ARP table entry indexes are aliased to 12bits
+instead of the intended 16bits when uploaded to
+the QP Context. This will present an issue when the
+number of connections exceeds 4096 as ARP entries are
+reused. Fix this by adjusting the mask to account for
+the full 16bits.
+
+Fixes: 4e9042e647ff ("i40iw: add hw and utils files")
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_d.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
+@@ -1109,7 +1109,7 @@
+ #define I40IWQPC_VLANTAG_MASK (0xffffULL << I40IWQPC_VLANTAG_SHIFT)
+
+ #define I40IWQPC_ARPIDX_SHIFT 48
+-#define I40IWQPC_ARPIDX_MASK (0xfffULL << I40IWQPC_ARPIDX_SHIFT)
++#define I40IWQPC_ARPIDX_MASK (0xffffULL << I40IWQPC_ARPIDX_SHIFT)
+
+ #define I40IWQPC_FLOWLABEL_SHIFT 0
+ #define I40IWQPC_FLOWLABEL_MASK (0xfffffUL << I40IWQPC_FLOWLABEL_SHIFT)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+Date: Tue, 21 Nov 2017 16:18:31 -0600
+Subject: i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+
+[ Upstream commit 10499986dbd8778e1acf9f9d2e166800dfee44b4 ]
+
+When the event type is I40IW_TIMER_TYPE_CLOSE, there is no sqbuf and
+it should not be freed as one in i40iw_schedule_cm_timer().
+
+Fixes: f27b4746f378 ("i40iw: add connection management code")
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_cm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1043,7 +1043,7 @@ negotiate_done:
+ * i40iw_schedule_cm_timer
+ * @@cm_node: connection's node
+ * @sqbuf: buffer to send
+- * @type: if it es send ot close
++ * @type: if it is send or close
+ * @send_retrans: if rexmits to be done
+ * @close_when_complete: is cm_node to be removed
+ *
+@@ -1067,7 +1067,8 @@ int i40iw_schedule_cm_timer(struct i40iw
+
+ new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
+ if (!new_send) {
+- i40iw_free_sqbuf(vsi, (void *)sqbuf);
++ if (type != I40IW_TIMER_TYPE_CLOSE)
++ i40iw_free_sqbuf(vsi, (void *)sqbuf);
+ return -ENOMEM;
+ }
+ new_send->retrycount = I40IW_DEFAULT_RETRYS;
+@@ -1082,7 +1083,6 @@ int i40iw_schedule_cm_timer(struct i40iw
+ new_send->timetosend += (HZ / 10);
+ if (cm_node->close_entry) {
+ kfree(new_send);
+- i40iw_free_sqbuf(vsi, (void *)sqbuf);
+ i40iw_pr_err("already close entry\n");
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+Date: Mon, 27 Nov 2017 13:39:05 +0000
+Subject: IB/core: Init subsys if compiled to vmlinuz-core
+
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+
+
+[ Upstream commit a9cd1a673737dd81332fce1145801bfacfb90d90 ]
+
+Once infiniband is compiled as a core component its subsystem must be
+enabled before device initialization. Otherwise there is a NULL pointer
+dereference during mlx4_core init, calltrace:
+->device_add
+ if (dev->class) {
+ deref dev->class->p =>NULLPTR
+
+#Config
+CONFIG_NET_DEVLINK=y
+CONFIG_MAY_USE_DEVLINK=y
+CONFIG_MLX4_EN=y
+
+Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1261,5 +1261,5 @@ static void __exit ib_core_cleanup(void)
+
+ MODULE_ALIAS_RDMA_NETLINK(RDMA_NL_LS, 4);
+
+-module_init(ib_core_init);
++subsys_initcall(ib_core_init);
+ module_exit(ib_core_cleanup);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Date: Tue, 14 Nov 2017 04:34:23 -0800
+Subject: IB/hfi1: Initialize bth1 in 16B rc ack builder
+
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+
+
+[ Upstream commit 8935780b9f7bbad0f2eb5dd43f61ba7b509a1575 ]
+
+It is possible the bth1 variable could be used uninitialized so going
+ahead and giving it a default value.
+
+Otherwise we leak stack memory to the network.
+
+Fixes: 5b6cabb0db77 ("IB/hfi1: Add 16B RC/UC support")
+Reviewed-by: Don Hiatt <don.hiatt@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hfi1/rc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -815,7 +815,7 @@ static inline void hfi1_make_rc_ack_16B(
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ struct hfi1_16b_header *hdr = &opa_hdr->opah;
+ struct ib_other_headers *ohdr;
+- u32 bth0, bth1;
++ u32 bth0, bth1 = 0;
+ u16 len, pkey;
+ u8 becn = !!is_fecn;
+ u8 l4 = OPA_16B_L4_IB_LOCAL;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Guy Levi <guyle@mellanox.com>
+Date: Tue, 5 Dec 2017 22:30:03 +0200
+Subject: IB/mlx4: Fix RSS hash fields restrictions
+
+From: Guy Levi <guyle@mellanox.com>
+
+
+[ Upstream commit 4d02ebd9bbbdde1d524e62b540b0402cee7bbcdf ]
+
+Mistakenly the driver didn't allow RSS hash fields combinations which
+involve both IPv4 and IPv6 protocols. This bug caused to failures for
+user's use cases for RSS.
+
+Consequently, this patch fixes this bug and allows any combination that
+the HW can support.
+
+Additionally, the patch fixes the driver to return an error in case the
+user provides an unsupported mask for RSS hash fields.
+
+Fixes: 3078f5f1bd8b ("IB/mlx4: Add support for RSS QP")
+Signed-off-by: Guy Levi <guyle@mellanox.com>
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/qp.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev
+ return (-EOPNOTSUPP);
+ }
+
++ if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 |
++ MLX4_IB_RX_HASH_DST_IPV4 |
++ MLX4_IB_RX_HASH_SRC_IPV6 |
++ MLX4_IB_RX_HASH_DST_IPV6 |
++ MLX4_IB_RX_HASH_SRC_PORT_TCP |
++ MLX4_IB_RX_HASH_DST_PORT_TCP |
++ MLX4_IB_RX_HASH_SRC_PORT_UDP |
++ MLX4_IB_RX_HASH_DST_PORT_UDP)) {
++ pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
++ ucmd->rx_hash_fields_mask);
++ return (-EOPNOTSUPP);
++ }
++
+ if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
+ rss_ctx->flags = MLX4_RSS_IPV4;
+@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev
+ return (-EOPNOTSUPP);
+ }
+
+- if (rss_ctx->flags & MLX4_RSS_IPV4) {
++ if (rss_ctx->flags & MLX4_RSS_IPV4)
+ rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
+- } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
++ if (rss_ctx->flags & MLX4_RSS_IPV6)
+ rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
+- } else {
++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
+ pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
+ return (-EOPNOTSUPP);
+ }
+@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev
+
+ if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
+- if (rss_ctx->flags & MLX4_RSS_IPV4) {
++ if (rss_ctx->flags & MLX4_RSS_IPV4)
+ rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
+- } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
++ if (rss_ctx->flags & MLX4_RSS_IPV6)
+ rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
+- } else {
++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
+ pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
+ return (-EOPNOTSUPP);
+ }
+-
+ } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
+ pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Sun, 29 Oct 2017 17:06:01 -0700
+Subject: iio: fix kernel-doc build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+
+[ Upstream commit c175cb7cd953782bbf4e8bdf088ad61440d6dde5 ]
+
+Fix build errors in kernel-doc notation. Symbols that end in '_'
+have a special meaning, but adding a '*' makes them OK.
+
+../drivers/iio/industrialio-core.c:635: ERROR: Unknown target name: "iio_val".
+../drivers/iio/industrialio-core.c:642: ERROR: Unknown target name: "iio_val".
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/industrialio-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -631,7 +631,7 @@ static ssize_t __iio_format_value(char *
+ * iio_format_value() - Formats a IIO value into its string representation
+ * @buf: The buffer to which the formatted value gets written
+ * which is assumed to be big enough (i.e. PAGE_SIZE).
+- * @type: One of the IIO_VAL_... constants. This decides how the val
++ * @type: One of the IIO_VAL_* constants. This decides how the val
+ * and val2 parameters are formatted.
+ * @size: Number of IIO value entries contained in vals
+ * @vals: Pointer to the values, exact meaning depends on the
+@@ -639,7 +639,7 @@ static ssize_t __iio_format_value(char *
+ *
+ * Return: 0 by default, a negative number on failure or the
+ * total number of characters written for a type that belongs
+- * to the IIO_VAL_... constant.
++ * to the IIO_VAL_* constant.
+ */
+ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
+ {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 3 Nov 2017 15:03:36 +0200
+Subject: iio: proximity: sx9500: Assign interrupt from GpioIo()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit e53111ad5deaef98d8c18a9933ef1f5624c5979d ]
+
+The commit 0f0796509c07
+
+("iio: remove gpio interrupt probing from drivers that use a single interrupt")
+
+removed custom IRQ assignment for the drivers which are enumerated via
+ACPI or OF. Unfortunately, some ACPI tables have IRQ line defined as
+GpioIo() resource and thus automatic IRQ allocation will fail.
+
+Partially revert the commit 0f0796509c07 to restore original behaviour.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/proximity/sx9500.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/iio/proximity/sx9500.c
++++ b/drivers/iio/proximity/sx9500.c
+@@ -871,6 +871,7 @@ static int sx9500_init_device(struct iio
+ static void sx9500_gpio_probe(struct i2c_client *client,
+ struct sx9500_data *data)
+ {
++ struct gpio_desc *gpiod_int;
+ struct device *dev;
+
+ if (!client)
+@@ -878,6 +879,14 @@ static void sx9500_gpio_probe(struct i2c
+
+ dev = &client->dev;
+
++ if (client->irq <= 0) {
++ gpiod_int = devm_gpiod_get(dev, SX9500_GPIO_INT, GPIOD_IN);
++ if (IS_ERR(gpiod_int))
++ dev_err(dev, "gpio get irq failed\n");
++ else
++ client->irq = gpiod_to_irq(gpiod_int);
++ }
++
+ data->gpiod_rst = devm_gpiod_get(dev, SX9500_GPIO_RESET, GPIOD_OUT_HIGH);
+ if (IS_ERR(data->gpiod_rst)) {
+ dev_warn(dev, "gpio get reset pin failed\n");
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Gao Feng <gfree.wind@vip.163.com>
+Date: Fri, 1 Dec 2017 09:58:42 +0800
+Subject: ipvlan: Add the skb->mark as flow4's member to lookup route
+
+From: Gao Feng <gfree.wind@vip.163.com>
+
+
+[ Upstream commit a98a4ebc8c61d20f0150d6be66e0e65223a347af ]
+
+Current codes don't use skb->mark to assign flowi4_mark, it would
+make the policy route rule with fwmark doesn't work as expected.
+
+Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -375,6 +375,7 @@ static int ipvlan_process_v4_outbound(st
+ .flowi4_oif = dev->ifindex,
+ .flowi4_tos = RT_TOS(ip4h->tos),
+ .flowi4_flags = FLOWI_FLAG_ANYSRC,
++ .flowi4_mark = skb->mark,
+ .daddr = ip4h->daddr,
+ .saddr = ip4h->saddr,
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Thu, 30 Nov 2017 17:00:30 +0000
+Subject: KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+
+[ Upstream commit 7465894e90e5a47e0e52aa5f1f708653fc40020f ]
+
+vgic_set_owner acquires the irq lock without disabling interrupts,
+resulting in a lockdep splat (an interrupt could fire and result
+in the same lock being taken if the same virtual irq is to be
+injected).
+
+In practice, it is almost impossible to trigger this bug, but
+better safe than sorry. Convert the lock acquisition to a
+spin_lock_irqsave() and keep lockdep happy.
+
+Reported-by: James Morse <james.morse@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/arm/vgic/vgic.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -454,6 +454,7 @@ int kvm_vgic_unmap_phys_irq(struct kvm_v
+ int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
+ {
+ struct vgic_irq *irq;
++ unsigned long flags;
+ int ret = 0;
+
+ if (!vgic_initialized(vcpu->kvm))
+@@ -464,12 +465,12 @@ int kvm_vgic_set_owner(struct kvm_vcpu *
+ return -EINVAL;
+
+ irq = vgic_get_irq(vcpu->kvm, vcpu, intid);
+- spin_lock(&irq->irq_lock);
++ spin_lock_irqsave(&irq->irq_lock, flags);
+ if (irq->owner && irq->owner != owner)
+ ret = -EEXIST;
+ else
+ irq->owner = owner;
+- spin_unlock(&irq->irq_lock);
++ spin_unlock_irqrestore(&irq->irq_lock, flags);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 28 Nov 2017 15:18:19 +0000
+Subject: kvm: arm: don't treat unavailable HYP mode as an error
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+
+[ Upstream commit 58d0d19a204604ca0da26058828a53558b265da3 ]
+
+Since it is perfectly legal to run the kernel at EL1, it is not
+actually an error if HYP mode is not available when attempting to
+initialize KVM, given that KVM support cannot be built as a module.
+So demote the kvm_err() to kvm_info(), which prevents the error from
+appearing on an otherwise 'quiet' console.
+
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/arm/arm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1453,7 +1453,7 @@ int kvm_arch_init(void *opaque)
+ bool in_hyp_mode;
+
+ if (!is_hyp_mode_available()) {
+- kvm_err("HYP mode not available\n");
++ kvm_info("HYP mode not available\n");
+ return -ENODEV;
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jim Mattson <jmattson@google.com>
+Date: Fri, 1 Dec 2017 09:57:56 -0800
+Subject: KVM: VMX: fix page leak in hardware_setup()
+
+From: Jim Mattson <jmattson@google.com>
+
+
+[ Upstream commit 2895db67b01cb875457c9c3f30a14723b6b5dfd5 ]
+
+vmx_io_bitmap_b should not be allocated twice.
+
+Fixes: 23611332938d ("KVM: VMX: refactor setup of global page-sized bitmaps")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6950,7 +6950,6 @@ static __init int hardware_setup(void)
+ goto out;
+ }
+
+- vmx_io_bitmap_b = (unsigned long *)__get_free_page(GFP_KERNEL);
+ memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
+ memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 6 Dec 2017 17:32:47 +0100
+Subject: locking/lockdep: Fix possible NULL deref
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit 5e351ad106997e06b2dc3da9c6b939b95f67fb88 ]
+
+We can't invalidate xhlocks when we've not yet allocated any.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Fixes: f52be5708076 ("locking/lockdep: Untangle xhlock history save/restore from task independence")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4777,7 +4777,8 @@ void lockdep_invariant_state(bool force)
+ * Verify the former, enforce the latter.
+ */
+ WARN_ON_ONCE(!force && current->lockdep_depth);
+- invalidate_xhlock(&xhlock(current->xhlock_idx));
++ if (current->xhlocks)
++ invalidate_xhlock(&xhlock(current->xhlock_idx));
+ }
+
+ static int cross_lock(struct lockdep_map *lock)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Greg Ungerer <gerg@linux-m68k.org>
+Date: Tue, 14 Nov 2017 11:50:07 +1000
+Subject: m68k: add missing SOFTIRQENTRY_TEXT linker section
+
+From: Greg Ungerer <gerg@linux-m68k.org>
+
+
+[ Upstream commit 969de0988b77e5a57aac2f7270191a3c50540c52 ]
+
+Commit be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries
+into separate sections") added a new linker section, SOFTIRQENTRY_TEXT,
+to the linker scripts for most architectures. It didn't add it to any of
+the linker scripts for the m68k architecture. This was not really a problem
+because it is only defined if either of CONFIG_FUNCTION_GRAPH_TRACER or
+CONFIG_KASAN are enabled - which can never be true for m68k.
+
+However commit 229a71860547 ("irq: Make the irqentry text section
+unconditional") means that SOFTIRQENTRY_TEXT is now always defined. So on
+m68k we now end up with a separate ELF section for .softirqentry.text
+instead of it being part of the .text section. On some m68k targets in some
+configurations this can also cause a fatal link error:
+
+ LD vmlinux
+/usr/local/bin/../m68k-uclinux/bin/ld.real: section .softirqentry.text loaded at [0000000010de10c0,0000000010de12dd] overlaps section .rodata loaded at [0000000010de10c0,0000000010e0fd67]
+
+To fix add in the missing SOFTIRQENTRY_TEXT section into the m68k linker
+scripts. I noticed that m68k is also missing the IRQENTRY_TEXT section,
+so this patch also adds an entry for that too.
+
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/kernel/vmlinux-nommu.lds | 2 ++
+ arch/m68k/kernel/vmlinux-std.lds | 2 ++
+ arch/m68k/kernel/vmlinux-sun3.lds | 2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/arch/m68k/kernel/vmlinux-nommu.lds
++++ b/arch/m68k/kernel/vmlinux-nommu.lds
+@@ -45,6 +45,8 @@ SECTIONS {
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+--- a/arch/m68k/kernel/vmlinux-std.lds
++++ b/arch/m68k/kernel/vmlinux-std.lds
+@@ -16,6 +16,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+--- a/arch/m68k/kernel/vmlinux-sun3.lds
++++ b/arch/m68k/kernel/vmlinux-sun3.lds
+@@ -16,6 +16,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Shaohua Li <shli@fb.com>
+Date: Fri, 1 Dec 2017 12:12:34 -0800
+Subject: md/raid1/10: add missed blk plug
+
+From: Shaohua Li <shli@fb.com>
+
+
+[ Upstream commit 18022a1bd3709b74ca31ef0b28fccd52bcd6c504 ]
+
+flush_pending_writes isn't always called with block plug, so add it, and plug
+works in nested way.
+
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid1.c | 4 ++++
+ drivers/md/raid10.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -810,11 +810,15 @@ static void flush_pending_writes(struct
+ spin_lock_irq(&conf->device_lock);
+
+ if (conf->pending_bio_list.head) {
++ struct blk_plug plug;
+ struct bio *bio;
++
+ bio = bio_list_get(&conf->pending_bio_list);
+ conf->pending_count = 0;
+ spin_unlock_irq(&conf->device_lock);
++ blk_start_plug(&plug);
+ flush_bio_list(conf, bio);
++ blk_finish_plug(&plug);
+ } else
+ spin_unlock_irq(&conf->device_lock);
+ }
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -890,10 +890,13 @@ static void flush_pending_writes(struct
+ spin_lock_irq(&conf->device_lock);
+
+ if (conf->pending_bio_list.head) {
++ struct blk_plug plug;
+ struct bio *bio;
++
+ bio = bio_list_get(&conf->pending_bio_list);
+ conf->pending_count = 0;
+ spin_unlock_irq(&conf->device_lock);
++ blk_start_plug(&plug);
+ /* flush any pending bitmap writes to disk
+ * before proceeding w/ I/O */
+ bitmap_unplug(conf->mddev->bitmap);
+@@ -914,6 +917,7 @@ static void flush_pending_writes(struct
+ generic_make_request(bio);
+ bio = next;
+ }
++ blk_finish_plug(&plug);
+ } else
+ spin_unlock_irq(&conf->device_lock);
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: bingjingc <bingjingc@synology.com>
+Date: Fri, 17 Nov 2017 10:57:44 +0800
+Subject: md/raid5: correct degraded calculation in raid5_error
+
+From: bingjingc <bingjingc@synology.com>
+
+
+[ Upstream commit aff69d89bdebc39235cddb4445371eb979b49685 ]
+
+When disk failure occurs on new disks for reshape, mddev->degraded
+is not calculated correctly. Faulty bit of the failure device is not
+set before raid5_calc_degraded(conf).
+
+mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/loop[012]
+mdadm /dev/md0 -a /dev/loop3
+mdadm /dev/md0 --grow -n4
+mdadm /dev/md0 -f /dev/loop3 # simulating disk failure
+
+cat /sys/block/md0/md/degraded # it outputs 0, but it should be 1.
+
+However, mdadm -D /dev/md0 will show that it is degraded. It's a bug.
+It can be fixed by moving the resources raid5_calc_degraded() depends
+on before it.
+
+Reported-by: Roy Chung <roychung@synology.com>
+Reviewed-by: Alex Wu <alexwu@synology.com>
+Signed-off-by: BingJing Chang <bingjingc@synology.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2678,13 +2678,13 @@ static void raid5_error(struct mddev *md
+ pr_debug("raid456: error called\n");
+
+ spin_lock_irqsave(&conf->device_lock, flags);
++ set_bit(Faulty, &rdev->flags);
+ clear_bit(In_sync, &rdev->flags);
+ mddev->degraded = raid5_calc_degraded(conf);
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+
+ set_bit(Blocked, &rdev->flags);
+- set_bit(Faulty, &rdev->flags);
+ set_mask_bits(&mddev->sb_flags, 0,
+ BIT(MD_SB_CHANGE_DEVS) | BIT(MD_SB_CHANGE_PENDING));
+ pr_crit("md/raid:%s: Disk failure on %s, disabling device.\n"
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Sun, 5 Nov 2017 17:51:00 -0500
+Subject: media: ov13858: Select V4L2_FWNODE
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+
+[ Upstream commit fce8ba670b7418319da14a6fc6668db1f1a96267 ]
+
+The ov13858 driver depends on the V4L2 fwnode, thus add that to Kconfig.
+
+Fixes: 5fcf092e0c9f ("[media] ov13858: add support for OV13858 sensor")
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -660,6 +660,7 @@ config VIDEO_OV13858
+ tristate "OmniVision OV13858 sensor support"
+ depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+ depends on MEDIA_CAMERA_SUPPORT
++ select V4L2_FWNODE
+ ---help---
+ This is a Video4Linux2 sensor-level driver for the OmniVision
+ OV13858 camera.
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Wed, 29 Nov 2017 08:44:41 -0500
+Subject: media: s5k6aa: describe some function parameters
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+
+[ Upstream commit 070250a1715cee2297de0d9e7e2cea58be999d37 ]
+
+as warned:
+ drivers/media/i2c/s5k6aa.c:429: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:679: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 's5k6aa'
+ drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 'preset'
+ drivers/media/i2c/s5k6aa.c:787: warning: No description found for parameter 'sd'
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/s5k6aa.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/media/i2c/s5k6aa.c
++++ b/drivers/media/i2c/s5k6aa.c
+@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct
+
+ /**
+ * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ *
+ * Configure the internal ISP PLL for the required output frequency.
+ * Locking: called with s5k6aa.lock mutex held.
+@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struc
+
+ /**
+ * s5k6aa_configure_video_bus - configure the video output interface
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ * @bus_type: video bus type: parallel or MIPI-CSI
+ * @nlanes: number of MIPI lanes to be used (MIPI-CSI only)
+ *
+@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct
+
+ /**
+ * s5k6aa_set_prev_config - write user preview register set
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
++ * @preset: s5kaa preset to be applied
+ *
+ * Configure output resolution and color fromat, pixel clock
+ * frequency range, device frame rate type and frame period range.
+@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct
+
+ /**
+ * s5k6aa_initialize_isp - basic ISP MCU initialization
++ * @sd: pointer to V4L2 sub-device descriptor
+ *
+ * Configure AHB addresses for registers read/write; configure PLLs for
+ * required output pixel clock. The ISP power supply needs to be already
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Arnaud Patard <arnaud.patard@rtp-net.org>
+Date: Wed, 29 Nov 2017 16:09:46 +0100
+Subject: meson-gx-socinfo: Fix package id parsing
+
+From: Arnaud Patard <arnaud.patard@rtp-net.org>
+
+
+[ Upstream commit 044d71bc6cdee8980d0fdc35ec79a0d5818b2ce3 ]
+
+I've noticed the following message while booting a S905X based board:
+
+soc soc0: Amlogic Meson GXL (S905D) Revision 21:82 (b:2) Detected
+
+The S905D string is obviously wrong. The vendor code does:
+...
+ ver = (readl(assist_hw_rev) >> 8) & 0xff;
+ meson_cpu_version[MESON_CPU_VERSION_LVL_MINOR] = ver;
+ ver = (readl(assist_hw_rev) >> 16) & 0xff;
+ meson_cpu_version[MESON_CPU_VERSION_LVL_PACK] = ver;
+...
+
+while the current code does:
+...
+...
+
+This means that the current mainline code has package id and minor
+version reversed.
+
+Fixes: a9daaba2965e8 ("soc: Add Amlogic SoC Information driver")
+Signed-off-by: Arnaud Patard <apatard@hupstream.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/amlogic/meson-gx-socinfo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/amlogic/meson-gx-socinfo.c
++++ b/drivers/soc/amlogic/meson-gx-socinfo.c
+@@ -20,8 +20,8 @@
+ #define AO_SEC_SOCINFO_OFFSET AO_SEC_SD_CFG8
+
+ #define SOCINFO_MAJOR GENMASK(31, 24)
+-#define SOCINFO_MINOR GENMASK(23, 16)
+-#define SOCINFO_PACK GENMASK(15, 8)
++#define SOCINFO_PACK GENMASK(23, 16)
++#define SOCINFO_MINOR GENMASK(15, 8)
+ #define SOCINFO_MISC GENMASK(7, 0)
+
+ static const struct meson_gx_soc_id {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Dave Young <dyoung@redhat.com>
+Date: Sat, 9 Dec 2017 12:16:10 +0800
+Subject: mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
+
+From: Dave Young <dyoung@redhat.com>
+
+
+[ Upstream commit 7f6f60a1ba52538c16f26930bfbcfe193d9d746a ]
+
+earlyprintk=efi,keep does not work any more with a warning
+in mm/early_ioremap.c: WARN_ON(system_state != SYSTEM_BOOTING):
+Boot just hangs because of the earlyprintk within the earlyprintk
+implementation code itself.
+
+This is caused by a new introduced middle state in:
+
+ 69a78ff226fe ("init: Introduce SYSTEM_SCHEDULING state")
+
+early_ioremap() is fine in both SYSTEM_BOOTING and SYSTEM_SCHEDULING
+states, original condition should be updated accordingly.
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: bp@suse.de
+Cc: linux-efi@vger.kernel.org
+Cc: linux-mm@kvack.org
+Link: http://lkml.kernel.org/r/20171209041610.GA3249@dhcp-128-65.nay.redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/early_ioremap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/early_ioremap.c
++++ b/mm/early_ioremap.c
+@@ -111,7 +111,7 @@ __early_ioremap(resource_size_t phys_add
+ enum fixed_addresses idx;
+ int i, slot;
+
+- WARN_ON(system_state != SYSTEM_BOOTING);
++ WARN_ON(system_state >= SYSTEM_RUNNING);
+
+ slot = -1;
+ for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Thu, 7 Dec 2017 01:05:56 +0100
+Subject: net: dsa: mv88e6xxx: Fix interrupt masking on removal
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+
+[ Upstream commit 3d5fdba1842bdd2eef29364c660558cb4cbb3fe0 ]
+
+When removing the interrupt handling code, we should mask the
+generation of interrupts. The code however unmasked all
+interrupts. This can then cause a new interrupt. We then get into a
+deadlock where the interrupt thread is waiting to run, and the code
+continues, trying to remove the interrupt handler, which means waiting
+for the thread to complete. On a UP machine this deadlocks.
+
+Fix so we really mask interrupts in the hardware. The same error is
+made in the error path when install the interrupt handling code.
+
+Fixes: 3460a5770ce9 ("net: dsa: mv88e6xxx: Mask g1 interrupts and free interrupt")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -339,7 +339,7 @@ static void mv88e6xxx_g1_irq_free(struct
+ u16 mask;
+
+ mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &mask);
+- mask |= GENMASK(chip->g1_irq.nirqs, 0);
++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
+ mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
+
+ free_irq(chip->irq, chip);
+@@ -395,7 +395,7 @@ static int mv88e6xxx_g1_irq_setup(struct
+ return 0;
+
+ out_disable:
+- mask |= GENMASK(chip->g1_irq.nirqs, 0);
++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
+ mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
+
+ out_mapping:
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Thu, 7 Dec 2017 01:05:57 +0100
+Subject: net: dsa: mv88e6xxx: Unregister MDIO bus on error path
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+
+[ Upstream commit 3126aeec5313565bfa19e2dd8fd7e3c3390514cb ]
+
+The MDIO busses need to be unregistered before they are freed,
+otherwise BUG() is called. Add a call to the unregister code if the
+registration fails, since we can have multiple busses, of which some
+may correctly register before one fails. This requires moving the code
+around a little.
+
+Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2153,6 +2153,19 @@ static const struct of_device_id mv88e6x
+ { },
+ };
+
++static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
++
++{
++ struct mv88e6xxx_mdio_bus *mdio_bus;
++ struct mii_bus *bus;
++
++ list_for_each_entry(mdio_bus, &chip->mdios, list) {
++ bus = mdio_bus->bus;
++
++ mdiobus_unregister(bus);
++ }
++}
++
+ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
+ struct device_node *np)
+ {
+@@ -2177,27 +2190,16 @@ static int mv88e6xxx_mdios_register(stru
+ match = of_match_node(mv88e6xxx_mdio_external_match, child);
+ if (match) {
+ err = mv88e6xxx_mdio_register(chip, child, true);
+- if (err)
++ if (err) {
++ mv88e6xxx_mdios_unregister(chip);
+ return err;
++ }
+ }
+ }
+
+ return 0;
+ }
+
+-static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
+-
+-{
+- struct mv88e6xxx_mdio_bus *mdio_bus;
+- struct mii_bus *bus;
+-
+- list_for_each_entry(mdio_bus, &chip->mdios, list) {
+- bus = mdio_bus->bus;
+-
+- mdiobus_unregister(bus);
+- }
+-}
+-
+ static int mv88e6xxx_get_eeprom_len(struct dsa_switch *ds)
+ {
+ struct mv88e6xxx_chip *chip = ds->priv;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Branislav Radocaj <branislav@radocaj.org>
+Date: Thu, 7 Dec 2017 00:07:38 +0100
+Subject: net: ethernet: arc: fix error handling in emac_rockchip_probe
+
+From: Branislav Radocaj <branislav@radocaj.org>
+
+
+[ Upstream commit e46772a6946a7d1f3fbbc1415871851d6651f1d4 ]
+
+If clk_set_rate() fails, we should disable clk before return.
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Branislav Radocaj <branislav@radocaj.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/arc/emac_rockchip.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/arc/emac_rockchip.c
++++ b/drivers/net/ethernet/arc/emac_rockchip.c
+@@ -220,9 +220,11 @@ static int emac_rockchip_probe(struct pl
+
+ /* RMII TX/RX needs always a rate of 25MHz */
+ err = clk_set_rate(priv->macclk, 25000000);
+- if (err)
++ if (err) {
+ dev_err(dev,
+ "failed to change mac clock rate (%d)\n", err);
++ goto out_clk_disable_macclk;
++ }
+ }
+
+ err = arc_emac_probe(ndev, interface);
+@@ -232,7 +234,8 @@ static int emac_rockchip_probe(struct pl
+ }
+
+ return 0;
+-
++out_clk_disable_macclk:
++ clk_disable_unprepare(priv->macclk);
+ out_regulator_disable:
+ if (priv->regulator)
+ regulator_disable(priv->regulator);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Yan Markman <ymarkman@marvell.com>
+Date: Thu, 30 Nov 2017 10:49:46 +0100
+Subject: net: mvpp2: allocate zeroed tx descriptors
+
+From: Yan Markman <ymarkman@marvell.com>
+
+
+[ Upstream commit a154f8e399a063137fc42b961f437248d55ece29 ]
+
+Reserved and unused fields in the Tx descriptors should be 0. The PPv2
+driver doesn't clear them at run-time (for performance reasons) but
+these descriptors aren't zeroed when allocated, which can lead to
+unpredictable behaviors. This patch fixes this by using
+dma_zalloc_coherent instead of dma_alloc_coherent.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Yan Markman <ymarkman@marvell.com>
+[Antoine: commit message]
+Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -5399,7 +5399,7 @@ static int mvpp2_aggr_txq_init(struct pl
+ u32 txq_dma;
+
+ /* Allocate memory for TX descriptors */
+- aggr_txq->descs = dma_alloc_coherent(&pdev->dev,
++ aggr_txq->descs = dma_zalloc_coherent(&pdev->dev,
+ MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+ &aggr_txq->descs_dma, GFP_KERNEL);
+ if (!aggr_txq->descs)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Date: Tue, 5 Dec 2017 13:41:17 -0700
+Subject: net: qualcomm: rmnet: Fix leak on transmit failure
+
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+
+
+[ Upstream commit c20a548792f15f8d8e38cd74356301c6db0d241f ]
+
+If a skb in transmit path does not have sufficient headroom to add
+the map header, the skb is not sent out and is never freed.
+
+Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
+Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -166,12 +166,12 @@ static int rmnet_map_egress_handler(stru
+
+ if (skb_headroom(skb) < required_headroom) {
+ if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL))
+- return RMNET_MAP_CONSUMED;
++ goto fail;
+ }
+
+ map_header = rmnet_map_add_map_header(skb, additional_header_len, 0);
+ if (!map_header)
+- return RMNET_MAP_CONSUMED;
++ goto fail;
+
+ if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) {
+ if (ep->mux_id == 0xff)
+@@ -183,6 +183,10 @@ static int rmnet_map_egress_handler(stru
+ skb->protocol = htons(ETH_P_MAP);
+
+ return RMNET_MAP_SUCCESS;
++
++fail:
++ kfree_skb(skb);
++ return RMNET_MAP_CONSUMED;
+ }
+
+ /* Ingress / Egress Entry Points */
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Nogah Frankel <nogahf@mellanox.com>
+Date: Mon, 4 Dec 2017 13:31:10 +0200
+Subject: net_sched: red: Avoid devision by zero
+
+From: Nogah Frankel <nogahf@mellanox.com>
+
+
+[ Upstream commit 5c472203421ab4f928aa1ae9e1dbcfdd80324148 ]
+
+Do not allow delta value to be zero since it is used as a divisor.
+
+Fixes: 8af2a218de38 ("sch_red: Adaptative RED AQM")
+Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -179,7 +179,7 @@ static inline void red_set_parms(struct
+ p->qth_max = qth_max << Wlog;
+ p->Wlog = Wlog;
+ p->Plog = Plog;
+- if (delta < 0)
++ if (delta <= 0)
+ delta = 1;
+ p->qth_delta = delta;
+ if (!max_P) {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Nogah Frankel <nogahf@mellanox.com>
+Date: Mon, 4 Dec 2017 13:31:11 +0200
+Subject: net_sched: red: Avoid illegal values
+
+From: Nogah Frankel <nogahf@mellanox.com>
+
+
+[ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ]
+
+Check the qmin & qmax values doesn't overflow for the given Wlog value.
+Check that qmin <= qmax.
+
+Fixes: a783474591f2 ("[PKT_SCHED]: Generic RED layer")
+Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 11 +++++++++++
+ net/sched/sch_choke.c | 3 +++
+ net/sched/sch_gred.c | 3 +++
+ net/sched/sch_red.c | 2 ++
+ net/sched/sch_sfq.c | 3 +++
+ 5 files changed, 22 insertions(+)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,6 +168,17 @@ static inline void red_set_vars(struct r
+ v->qcount = -1;
+ }
+
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++{
++ if (fls(qth_min) + Wlog > 32)
++ return false;
++ if (fls(qth_max) + Wlog > 32)
++ return false;
++ if (qth_max < qth_min)
++ return false;
++ return true;
++}
++
+ static inline void red_set_parms(struct red_parms *p,
+ u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog,
+ u8 Scell_log, u8 *stab, u32 max_P)
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -369,6 +369,9 @@ static int choke_change(struct Qdisc *sc
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+ return -EINVAL;
+
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (!q) {
+ table->tab[dp] = q = *prealloc;
+ *prealloc = NULL;
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -184,6 +184,8 @@ static int red_change(struct Qdisc *sch,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
+
+ if (ctl->limit > 0) {
+ child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit);
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -637,6 +637,9 @@ static int sfq_change(struct Qdisc *sch,
+ if (ctl->divisor &&
+ (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
+ return -EINVAL;
++ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
++ ctl_v1->Wlog))
++ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jann Horn <jannh@google.com>
+Date: Fri, 1 Dec 2017 01:46:07 +0100
+Subject: netfilter: xt_bpf: add overflow checks
+
+From: Jann Horn <jannh@google.com>
+
+
+[ Upstream commit 6ab405114b0b229151ef06f4e31c7834dd09d0c0 ]
+
+Check whether inputs from userspace are too long (explicit length field too
+big or string not null-terminated) to avoid out-of-bounds reads.
+
+As far as I can tell, this can at worst lead to very limited kernel heap
+memory disclosure or oopses.
+
+This bug can be triggered by an unprivileged user even if the xt_bpf module
+is not loaded: iptables is available in network namespaces, and the xt_bpf
+module can be autoloaded.
+
+Triggering the bug with a classic BPF filter with fake length 0x1000 causes
+the following KASAN report:
+
+==================================================================
+BUG: KASAN: slab-out-of-bounds in bpf_prog_create+0x84/0xf0
+Read of size 32768 at addr ffff8801eff2c494 by task test/4627
+
+CPU: 0 PID: 4627 Comm: test Not tainted 4.15.0-rc1+ #1
+[...]
+Call Trace:
+ dump_stack+0x5c/0x85
+ print_address_description+0x6a/0x260
+ kasan_report+0x254/0x370
+ ? bpf_prog_create+0x84/0xf0
+ memcpy+0x1f/0x50
+ bpf_prog_create+0x84/0xf0
+ bpf_mt_check+0x90/0xd6 [xt_bpf]
+[...]
+Allocated by task 4627:
+ kasan_kmalloc+0xa0/0xd0
+ __kmalloc_node+0x47/0x60
+ xt_alloc_table_info+0x41/0x70 [x_tables]
+[...]
+The buggy address belongs to the object at ffff8801eff2c3c0
+ which belongs to the cache kmalloc-2048 of size 2048
+The buggy address is located 212 bytes inside of
+ 2048-byte region [ffff8801eff2c3c0, ffff8801eff2cbc0)
+[...]
+==================================================================
+
+Fixes: e6f30c731718 ("netfilter: x_tables: add xt_bpf match")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/xt_bpf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/netfilter/xt_bpf.c
++++ b/net/netfilter/xt_bpf.c
+@@ -27,6 +27,9 @@ static int __bpf_mt_check_bytecode(struc
+ {
+ struct sock_fprog_kern program;
+
++ if (len > XT_BPF_MAX_NUM_INSTR)
++ return -EINVAL;
++
+ program.len = len;
+ program.filter = insns;
+
+@@ -55,6 +58,9 @@ static int __bpf_mt_check_path(const cha
+ mm_segment_t oldfs = get_fs();
+ int retval, fd;
+
++ if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX)
++ return -EINVAL;
++
+ set_fs(KERNEL_DS);
+ fd = bpf_obj_get_user(path);
+ set_fs(oldfs);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Date: Fri, 1 Dec 2017 21:37:23 -0800
+Subject: nfp: fix port stats for mac representors
+
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+
+
+[ Upstream commit 42d779ffc186f6dd26271fc60a7417cb51aca93e ]
+
+Previously we swapped the tx_packets, tx_bytes and tx_dropped counters
+with rx_packets, rx_bytes and rx_dropped counters, respectively. This
+behaviour is correct and expected for VF representors but it should not
+be swapped for physical port mac representors.
+
+Fixes: eadfa4c3be99 ("nfp: add stats and xmit helpers for representors")
+Signed-off-by: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_repr.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+@@ -84,16 +84,13 @@ nfp_repr_phy_port_get_stats64(struct nfp
+ {
+ u8 __iomem *mem = port->eth_stats;
+
+- /* TX and RX stats are flipped as we are returning the stats as seen
+- * at the switch port corresponding to the phys port.
+- */
+- stats->tx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
+- stats->tx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
+- stats->tx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
++ stats->tx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
++ stats->tx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
++ stats->tx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
+
+- stats->rx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
+- stats->rx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
+- stats->rx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
++ stats->rx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
++ stats->rx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
++ stats->rx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
+ }
+
+ static void
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Thu, 7 Dec 2017 11:15:19 +0100
+Subject: PCI: rcar: Fix use-after-free in probe error path
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+
+[ Upstream commit 0c31f1d7be1b5c4858b1d714dcefa25f41428cab ]
+
+If CONFIG_DEBUG_SLAB=y, and no PCIe card is inserted, the kernel crashes
+during probe on r8a7791/koelsch:
+
+ rcar-pcie fe000000.pcie: PCIe link down
+ Unable to handle kernel paging request at virtual address 6b6b6b6b
+
+(seeing this message requires earlycon and keep_bootcon).
+
+Indeed, pci_free_host_bridge() frees the PCI host bridge, including the
+embedded rcar_pcie object, so pci_free_resource_list() must not be called
+afterwards.
+
+To fix this, move the call to pci_free_resource_list() up, and update the
+label name accordingly.
+
+Fixes: ddd535f1ea3eb27e ("PCI: rcar: Fix memory leak when no PCIe card is inserted")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Simon Horman <horms+renesas@verge.net.au>
+Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/host/pcie-rcar.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -1146,12 +1146,12 @@ static int rcar_pcie_probe(struct platfo
+ err = rcar_pcie_get_resources(pcie);
+ if (err < 0) {
+ dev_err(dev, "failed to request resources: %d\n", err);
+- goto err_free_bridge;
++ goto err_free_resource_list;
+ }
+
+ err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
+ if (err)
+- goto err_free_bridge;
++ goto err_free_resource_list;
+
+ pm_runtime_enable(dev);
+ err = pm_runtime_get_sync(dev);
+@@ -1194,9 +1194,9 @@ err_pm_put:
+ err_pm_disable:
+ pm_runtime_disable(dev);
+
+-err_free_bridge:
+- pci_free_host_bridge(bridge);
++err_free_resource_list:
+ pci_free_resource_list(&pcie->resources);
++ pci_free_host_bridge(bridge);
+
+ return err;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Tue, 14 Nov 2017 08:55:40 +0530
+Subject: perf annotate: Do not truncate instruction names at 6 chars
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+
+[ Upstream commit 05d0e62d9fa0f1002cf82009ef31b36174da5472 ]
+
+There are many instructions, esp on PowerPC, whose mnemonics are longer
+than 6 characters. Using precision limit causes truncation of such
+mnemonics.
+
+Fix this by removing precision limit. Note that, 'width' is still 6, so
+alignment won't get affected for length <= 6.
+
+Before:
+
+ li r11,-1
+ xscvdp vs1,vs1
+ add. r10,r10,r11
+
+After:
+
+ li r11,-1
+ xscvdpsxds vs1,vs1
+ add. r10,r10,r11
+
+Reported-by: Donald Stence <dstence@us.ibm.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Taeung Song <treeze.taeung@gmail.com>
+Link: http://lkml.kernel.org/r/20171114032540.4564-1-ravi.bangoria@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/annotate.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -166,7 +166,7 @@ static void ins__delete(struct ins_opera
+ static int ins__raw_scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->raw);
++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->raw);
+ }
+
+ int ins__scnprintf(struct ins *ins, char *bf, size_t size,
+@@ -231,12 +231,12 @@ static int call__scnprintf(struct ins *i
+ struct ins_operands *ops)
+ {
+ if (ops->target.name)
+- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->target.name);
++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name);
+
+ if (ops->target.addr == 0)
+ return ins__raw_scnprintf(ins, bf, size, ops);
+
+- return scnprintf(bf, size, "%-6.6s *%" PRIx64, ins->name, ops->target.addr);
++ return scnprintf(bf, size, "%-6s *%" PRIx64, ins->name, ops->target.addr);
+ }
+
+ static struct ins_ops call_ops = {
+@@ -300,7 +300,7 @@ static int jump__scnprintf(struct ins *i
+ c++;
+ }
+
+- return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
++ return scnprintf(bf, size, "%-6s %.*s%" PRIx64,
+ ins->name, c ? c - ops->raw : 0, ops->raw,
+ ops->target.offset);
+ }
+@@ -373,7 +373,7 @@ static int lock__scnprintf(struct ins *i
+ if (ops->locked.ins.ops == NULL)
+ return ins__raw_scnprintf(ins, bf, size, ops);
+
+- printed = scnprintf(bf, size, "%-6.6s ", ins->name);
++ printed = scnprintf(bf, size, "%-6s ", ins->name);
+ return printed + ins__scnprintf(&ops->locked.ins, bf + printed,
+ size - printed, ops->locked.ops);
+ }
+@@ -449,7 +449,7 @@ out_free_source:
+ static int mov__scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s,%s", ins->name,
++ return scnprintf(bf, size, "%-6s %s,%s", ins->name,
+ ops->source.name ?: ops->source.raw,
+ ops->target.name ?: ops->target.raw);
+ }
+@@ -489,7 +489,7 @@ static int dec__parse(struct arch *arch
+ static int dec__scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s", ins->name,
++ return scnprintf(bf, size, "%-6s %s", ins->name,
+ ops->target.name ?: ops->target.raw);
+ }
+
+@@ -501,7 +501,7 @@ static struct ins_ops dec_ops = {
+ static int nop__scnprintf(struct ins *ins __maybe_unused, char *bf, size_t size,
+ struct ins_operands *ops __maybe_unused)
+ {
+- return scnprintf(bf, size, "%-6.6s", "nop");
++ return scnprintf(bf, size, "%-6s", "nop");
+ }
+
+ static struct ins_ops nop_ops = {
+@@ -925,7 +925,7 @@ void disasm_line__free(struct disasm_lin
+ int disasm_line__scnprintf(struct disasm_line *dl, char *bf, size_t size, bool raw)
+ {
+ if (raw || !dl->ins.ops)
+- return scnprintf(bf, size, "%-6.6s %s", dl->ins.name, dl->ops.raw);
++ return scnprintf(bf, size, "%-6s %s", dl->ins.name, dl->ops.raw);
+
+ return ins__scnprintf(&dl->ins, bf, size, &dl->ops);
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Date: Wed, 22 Nov 2017 22:13:53 +0530
+Subject: perf bench numa: Fixup discontiguous/sparse numa nodes
+
+From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+
+
+[ Upstream commit 321a7c35c90cc834851ceda18a8ee18f1d032b92 ]
+
+Certain systems are designed to have sparse/discontiguous nodes. On
+such systems, 'perf bench numa' hangs, shows wrong number of nodes and
+shows values for non-existent nodes. Handle this by only taking nodes
+that are exposed by kernel to userspace.
+
+Signed-off-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/1edbcd353c009e109e93d78f2f46381930c340fe.1511368645.git.sathnaga@linux.vnet.ibm.com
+Signed-off-by: Balamuruhan S <bala24@linux.vnet.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/bench/numa.c | 56 +++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 51 insertions(+), 5 deletions(-)
+
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -216,6 +216,47 @@ static const char * const numa_usage[] =
+ NULL
+ };
+
++/*
++ * To get number of numa nodes present.
++ */
++static int nr_numa_nodes(void)
++{
++ int i, nr_nodes = 0;
++
++ for (i = 0; i < g->p.nr_nodes; i++) {
++ if (numa_bitmask_isbitset(numa_nodes_ptr, i))
++ nr_nodes++;
++ }
++
++ return nr_nodes;
++}
++
++/*
++ * To check if given numa node is present.
++ */
++static int is_node_present(int node)
++{
++ return numa_bitmask_isbitset(numa_nodes_ptr, node);
++}
++
++/*
++ * To check given numa node has cpus.
++ */
++static bool node_has_cpus(int node)
++{
++ struct bitmask *cpu = numa_allocate_cpumask();
++ unsigned int i;
++
++ if (cpu && !numa_node_to_cpus(node, cpu)) {
++ for (i = 0; i < cpu->size; i++) {
++ if (numa_bitmask_isbitset(cpu, i))
++ return true;
++ }
++ }
++
++ return false; /* lets fall back to nocpus safely */
++}
++
+ static cpu_set_t bind_to_cpu(int target_cpu)
+ {
+ cpu_set_t orig_mask, mask;
+@@ -244,12 +285,12 @@ static cpu_set_t bind_to_cpu(int target_
+
+ static cpu_set_t bind_to_node(int target_node)
+ {
+- int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes;
++ int cpus_per_node = g->p.nr_cpus / nr_numa_nodes();
+ cpu_set_t orig_mask, mask;
+ int cpu;
+ int ret;
+
+- BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus);
++ BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus);
+ BUG_ON(!cpus_per_node);
+
+ ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask);
+@@ -649,7 +690,7 @@ static int parse_setup_node_list(void)
+ int i;
+
+ for (i = 0; i < mul; i++) {
+- if (t >= g->p.nr_tasks) {
++ if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) {
+ printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node);
+ goto out;
+ }
+@@ -964,6 +1005,8 @@ static void calc_convergence(double runt
+ sum = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
++ if (!is_node_present(node))
++ continue;
+ nr = nodes[node];
+ nr_min = min(nr, nr_min);
+ nr_max = max(nr, nr_max);
+@@ -984,8 +1027,11 @@ static void calc_convergence(double runt
+ process_groups = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
+- int processes = count_node_processes(node);
++ int processes;
+
++ if (!is_node_present(node))
++ continue;
++ processes = count_node_processes(node);
+ nr = nodes[node];
+ tprintf(" %2d/%-2d", nr, processes);
+
+@@ -1291,7 +1337,7 @@ static void print_summary(void)
+
+ printf("\n ###\n");
+ printf(" # %d %s will execute (on %d nodes, %d CPUs):\n",
+- g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus);
++ g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus);
+ printf(" # %5dx %5ldMB global shared mem operations\n",
+ g->p.nr_loops, g->p.bytes_global/1024/1024);
+ printf(" # %5dx %5ldMB process shared mem operations\n",
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 9 Aug 2017 18:14:06 +0200
+Subject: perf: Fix header.size for namespace events
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+
+[ Upstream commit 34900ec5c9577cc1b0f22887ac7349f458ba8ac2 ]
+
+Reset header size for namespace events, otherwise it only gets bigger in
+ctx iterations.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Fixes: e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
+Link: http://lkml.kernel.org/n/tip-nlo4gonz9d4guyb8153ukzt0@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/events/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6719,6 +6719,7 @@ static void perf_event_namespaces_output
+ struct perf_namespaces_event *namespaces_event = data;
+ struct perf_output_handle handle;
+ struct perf_sample_data sample;
++ u16 header_size = namespaces_event->event_id.header.size;
+ int ret;
+
+ if (!perf_event_namespaces_match(event))
+@@ -6729,7 +6730,7 @@ static void perf_event_namespaces_output
+ ret = perf_output_begin(&handle, event,
+ namespaces_event->event_id.header.size);
+ if (ret)
+- return;
++ goto out;
+
+ namespaces_event->event_id.pid = perf_event_pid(event,
+ namespaces_event->task);
+@@ -6741,6 +6742,8 @@ static void perf_event_namespaces_output
+ perf_event__output_id_sample(event, &handle, &sample);
+
+ perf_output_end(&handle);
++out:
++ namespaces_event->event_id.header.size = header_size;
+ }
+
+ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Tue, 14 Nov 2017 09:15:42 +0900
+Subject: perf help: Fix a bug during strstart() conversion
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+
+[ Upstream commit af98f2273fd0af31ce327cd1406b67c7be0b6734 ]
+
+The commit 8e99b6d4533c changed prefixcmp() to strstart() but missed to
+change the return value in some place. It makes perf help print
+annoying output even for sane config items like below:
+
+ $ perf help
+ '.root': unsupported man viewer sub key.
+ ...
+
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Taeung Song <treeze.taeung@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Sihyeon Jang <uneedsihyeon@gmail.com>
+Cc: kernel-team@lge.com
+Link: http://lkml.kernel.org/r/20171114001542.GA16464@sejong
+Fixes: 8e99b6d4533c ("tools include: Adopt strstarts() from the kernel")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-help.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/builtin-help.c
++++ b/tools/perf/builtin-help.c
+@@ -284,7 +284,7 @@ static int perf_help_config(const char *
+ add_man_viewer(value);
+ return 0;
+ }
+- if (!strstarts(var, "man."))
++ if (strstarts(var, "man."))
+ return add_man_viewer_info(var, value);
+
+ return 0;
+@@ -314,7 +314,7 @@ static const char *cmd_to_page(const cha
+
+ if (!perf_cmd)
+ return "perf";
+- else if (!strstarts(perf_cmd, "perf"))
++ else if (strstarts(perf_cmd, "perf"))
+ return perf_cmd;
+
+ return asprintf(&s, "perf-%s", perf_cmd) < 0 ? NULL : s;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andi Kleen <ak@linux.intel.com>
+Date: Fri, 20 Oct 2017 13:27:55 -0700
+Subject: perf record: Fix -c/-F options for cpu event aliases
+
+From: Andi Kleen <ak@linux.intel.com>
+
+
+[ Upstream commit 59622fd496a3175c7bf549046e091d81c303ecff ]
+
+The Intel PMU event aliases have a implicit period= specifier to set the
+default period.
+
+Unfortunately this breaks overriding these periods with -c or -F,
+because the alias terms look like they are user specified to the
+internal parser, and user specified event qualifiers override the
+command line options.
+
+Track that they are coming from aliases by adding a "weak" state to the
+term. Any weak terms don't override command line options.
+
+I only did it for -c/-F for now, I think that's the only case that's
+broken currently.
+
+Before:
+
+$ perf record -c 1000 -vv -e uops_issued.any
+...
+ { sample_period, sample_freq } 2000003
+
+After:
+
+$ perf record -c 1000 -vv -e uops_issued.any
+...
+ { sample_period, sample_freq } 1000
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: http://lkml.kernel.org/r/20171020202755.21410-2-andi@firstfloor.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/evsel.c | 12 ++++++++----
+ tools/perf/util/evsel.h | 1 +
+ tools/perf/util/parse-events.c | 2 ++
+ tools/perf/util/parse-events.h | 3 +++
+ tools/perf/util/pmu.c | 5 +++++
+ 5 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -733,12 +733,16 @@ static void apply_config_terms(struct pe
+ list_for_each_entry(term, config_terms, list) {
+ switch (term->type) {
+ case PERF_EVSEL__CONFIG_TERM_PERIOD:
+- attr->sample_period = term->val.period;
+- attr->freq = 0;
++ if (!(term->weak && opts->user_interval != ULLONG_MAX)) {
++ attr->sample_period = term->val.period;
++ attr->freq = 0;
++ }
+ break;
+ case PERF_EVSEL__CONFIG_TERM_FREQ:
+- attr->sample_freq = term->val.freq;
+- attr->freq = 1;
++ if (!(term->weak && opts->user_freq != UINT_MAX)) {
++ attr->sample_freq = term->val.freq;
++ attr->freq = 1;
++ }
+ break;
+ case PERF_EVSEL__CONFIG_TERM_TIME:
+ if (term->val.time)
+--- a/tools/perf/util/evsel.h
++++ b/tools/perf/util/evsel.h
+@@ -67,6 +67,7 @@ struct perf_evsel_config_term {
+ bool overwrite;
+ char *branch;
+ } val;
++ bool weak;
+ };
+
+ /** struct perf_evsel - event selector
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1115,6 +1115,7 @@ do { \
+ INIT_LIST_HEAD(&__t->list); \
+ __t->type = PERF_EVSEL__CONFIG_TERM_ ## __type; \
+ __t->val.__name = __val; \
++ __t->weak = term->weak; \
+ list_add_tail(&__t->list, head_terms); \
+ } while (0)
+
+@@ -2395,6 +2396,7 @@ static int new_term(struct parse_events_
+
+ *term = *temp;
+ INIT_LIST_HEAD(&term->list);
++ term->weak = false;
+
+ switch (term->type_val) {
+ case PARSE_EVENTS__TERM_TYPE_NUM:
+--- a/tools/perf/util/parse-events.h
++++ b/tools/perf/util/parse-events.h
+@@ -101,6 +101,9 @@ struct parse_events_term {
+ /* error string indexes for within parsed string */
+ int err_term;
+ int err_val;
++
++ /* Coming from implicit alias */
++ bool weak;
+ };
+
+ struct parse_events_error {
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -404,6 +404,11 @@ static int pmu_alias_terms(struct perf_p
+ parse_events_terms__purge(&list);
+ return ret;
+ }
++ /*
++ * Weak terms don't override command line options,
++ * which we don't want for implicit terms in aliases.
++ */
++ cloned->weak = true;
+ list_add_tail(&cloned->list, &list);
+ }
+ list_splice(&list, terms);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Date: Thu, 23 Nov 2017 12:46:11 +0100
+Subject: perf test: Fix test 21 for s390x
+
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+
+
+[ Upstream commit 996548499df61babae5306544c7daf5fd39db31c ]
+
+Test case 21 (Number of exit events of a simple workload) fails on
+s390x. The reason is the invalid sample frequency supplied for this
+test. On s390x the minimum sample frequency is much higher (see output
+of /proc/service_levels).
+
+Supply a save sample frequency value for s390x to fix this. The value
+will be adjusted by the s390x CPUMF frequency convertion function to a
+value well below the sysctl kernel.perf_event_max_sample_rate value.
+
+Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+LPU-Reference: 20171123114611.93397-1-tmricht@linux.vnet.ibm.com
+Link: https://lkml.kernel.org/n/tip-1ynblyhi1n81idpido59nt1y@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/task-exit.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/tools/perf/tests/task-exit.c
++++ b/tools/perf/tests/task-exit.c
+@@ -84,7 +84,11 @@ int test__task_exit(struct test *test __
+
+ evsel = perf_evlist__first(evlist);
+ evsel->attr.task = 1;
++#ifdef __s390x__
++ evsel->attr.sample_freq = 1000000;
++#else
+ evsel->attr.sample_freq = 1;
++#endif
+ evsel->attr.inherit = 0;
+ evsel->attr.watermark = 0;
+ evsel->attr.wakeup_events = 1;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Date: Tue, 14 Nov 2017 08:18:46 +0100
+Subject: perf test shell: Fix check open filename arg using 'perf trace' on s390x
+
+From: Thomas Richter <tmricht@linux.vnet.ibm.com>
+
+
+[ Upstream commit ccafc38f1c778847ab6d53dd7933260426731cf3 ]
+
+This 'perf test' case fails on s390x. The 'touch' command on s390x uses
+the 'openat' system call to open the file named on the command line:
+
+[root@s35lp76 perf]# perf probe -l
+ probe:vfs_getname (on getname_flags:72@fs/namei.c with pathname)
+[root@s35lp76 perf]# perf trace -e open touch /tmp/abc
+ 0.400 ( 0.015 ms): touch/27542 open(filename:
+ /usr/lib/locale/locale-archive, flags: CLOEXEC) = 3
+[root@s35lp76 perf]#
+
+There is no 'open' system call for file '/tmp/abc'. Instead the 'openat'
+system call is used:
+
+[root@s35lp76 perf]# strace touch /tmp/abc
+ execve("/usr/bin/touch", ["touch", "/tmp/abc"], 0x3ffd547ec98
+ /* 30 vars */) = 0
+ [...]
+ openat(AT_FDCWD, "/tmp/abc", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
+ [...]
+
+On s390x the 'egrep' command does not find a matching pattern and
+returns an error.
+
+Fix this for s390x create a platform dependent command line to enable
+the 'perf probe' call to listen to the 'openat' system call and get the
+expected output.
+
+Signed-off-by: Thomas-Mich Richter <tmricht@linux.vnet.ibm.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Thomas-Mich Richter <tmricht@linux.vnet.ibm.com>
+LPU-Reference: 20171114071847.2381-1-tmricht@linux.vnet.ibm.com
+Link: http://lkml.kernel.org/n/tip-3qf38jk0prz54rhmhyu871my@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/shell/trace+probe_vfs_getname.sh | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+@@ -17,8 +17,10 @@ skip_if_no_perf_probe || exit 2
+ file=$(mktemp /tmp/temporary_file.XXXXX)
+
+ trace_open_vfs_getname() {
+- perf trace -e open touch $file 2>&1 | \
+- egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ open\(filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
++ test "$(uname -m)" = s390x && { svc="openat"; txt="dfd: +CWD, +"; }
++
++ perf trace -e ${svc:-open} touch $file 2>&1 | \
++ egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ ${svc:-open}\(${txt}filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
+ }
+
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 14 Nov 2017 10:23:39 +0100
+Subject: perf top: Fix window dimensions change handling
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+
+[ Upstream commit 89d0aeab4252adc2a7ea693637dd21c588bfa2d1 ]
+
+The stdio perf top crashes when we change the terminal
+window size. The reason is that we assumed we get the
+perf_top pointer as a signal handler argument which is
+not the case.
+
+Changing the SIGWINCH handler logic to change global
+resize variable, which is checked in the main thread
+loop.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/n/tip-ysuzwz77oev1ftgvdscn9bpu@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-top.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -77,6 +77,7 @@
+ #include "sane_ctype.h"
+
+ static volatile int done;
++static volatile int resize;
+
+ #define HEADER_LINE_NR 5
+
+@@ -86,10 +87,13 @@ static void perf_top__update_print_entri
+ }
+
+ static void perf_top__sig_winch(int sig __maybe_unused,
+- siginfo_t *info __maybe_unused, void *arg)
++ siginfo_t *info __maybe_unused, void *arg __maybe_unused)
+ {
+- struct perf_top *top = arg;
++ resize = 1;
++}
+
++static void perf_top__resize(struct perf_top *top)
++{
+ get_term_dimensions(&top->winsize);
+ perf_top__update_print_entries(top);
+ }
+@@ -477,7 +481,7 @@ static bool perf_top__handle_keypress(st
+ .sa_sigaction = perf_top__sig_winch,
+ .sa_flags = SA_SIGINFO,
+ };
+- perf_top__sig_winch(SIGWINCH, NULL, top);
++ perf_top__resize(top);
+ sigaction(SIGWINCH, &act, NULL);
+ } else {
+ signal(SIGWINCH, SIG_DFL);
+@@ -1022,6 +1026,11 @@ static int __cmd_top(struct perf_top *to
+
+ if (hits == top->samples)
+ ret = perf_evlist__poll(top->evlist, 100);
++
++ if (resize) {
++ perf_top__resize(top);
++ resize = 0;
++ }
+ }
+
+ ret = 0;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 30 Nov 2017 13:59:26 +0000
+Subject: phylink: ensure we take the link down when phylink_stop() is called
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 2012b7d6b2868c532f22d9172c8b24611637eb48 ]
+
+Ensure that we tell the MAC to take the link down when phylink_stop()
+is called, and that this completes prior to phylink_stop() returns.
+
+Reported-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phylink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -772,6 +772,7 @@ void phylink_stop(struct phylink *pl)
+ sfp_upstream_stop(pl->sfp_bus);
+
+ set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
++ queue_work(system_power_efficient_wq, &pl->resolve);
+ flush_work(&pl->resolve);
+ }
+ EXPORT_SYMBOL_GPL(phylink_stop);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 10 Nov 2017 19:55:18 +0200
+Subject: pinctrl: denverton: Fix UART2 RTS pin mode
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit 4bd6683da2e64590bdc27ecf7e61ad8376861768 ]
+
+UART2 RTS is mode 2 of the pin.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-denverton.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-denverton.c
++++ b/drivers/pinctrl/intel/pinctrl-denverton.c
+@@ -207,7 +207,7 @@ static const unsigned int dnv_uart0_pins
+ static const unsigned int dnv_uart0_modes[] = { 2, 3, 1, 1 };
+ static const unsigned int dnv_uart1_pins[] = { 94, 95, 96, 97 };
+ static const unsigned int dnv_uart2_pins[] = { 60, 61, 62, 63 };
+-static const unsigned int dnv_uart2_modes[] = { 1, 1, 2, 2 };
++static const unsigned int dnv_uart2_modes[] = { 1, 2, 2, 2 };
+ static const unsigned int dnv_emmc_pins[] = {
+ 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,
+ };
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andre Przywara <andre.przywara@arm.com>
+Date: Sat, 25 Nov 2017 12:12:30 +0000
+Subject: pinctrl: sunxi: Fix A64 UART mux value
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+
+[ Upstream commit 7c5c2c2d18d778e51fd8b899965097168306031c ]
+
+To use pin PF4 as the RX signal of UART0, we have to write 0b011 into
+the respective pin controller register.
+Fix the wrong value we had in our table so far.
+
+Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
+@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_p
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x2, "mmc0"), /* D3 */
+- SUNXI_FUNCTION(0x4, "uart0")), /* RX */
++ SUNXI_FUNCTION(0x3, "uart0")), /* RX */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andre Przywara <andre.przywara@arm.com>
+Date: Sat, 25 Nov 2017 12:19:48 +0000
+Subject: pinctrl: sunxi: Fix A80 interrupt pin bank
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+
+[ Upstream commit 6ad4cc8d1ac483e0fd33f605fb2788b0ecf51ed4 ]
+
+On the A80 the pins on port B can trigger interrupts, and those are
+assigned to the second interrupt bank.
+Having two pins assigned to the same interrupt bank/pin combination does
+not look healthy (instead more like a copy&paste bug from pins PA14-PA16),
+so fix the interrupt bank for pins PB14-PB16, which is actually 1.
+
+I don't have any A80 board, so could not test this.
+
+Fixes: d5e9fb31baa2 ("pinctrl: sunxi: Add A80 pinctrl muxing options")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
+@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */
+
+ /* Hole */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0),
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: "Pali Rohár" <pali.rohar@gmail.com>
+Date: Thu, 2 Nov 2017 21:25:24 +0100
+Subject: platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
+
+From: "Pali Rohár" <pali.rohar@gmail.com>
+
+
+[ Upstream commit 68a213d325c23d39f109f4c7c824b906a7d209de ]
+
+This machine reports number of keyboard backlight led levels, instead of
+value of the last led level index. Therefore max_brightness properly needs
+to be subtracted by 1 to match led max_brightness API.
+
+Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
+Reported-by: Gabriel M. Elder <gabriel@tekgnowsys.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=196913
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell-laptop.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -49,6 +49,7 @@
+
+ struct quirk_entry {
+ u8 touchpad_led;
++ u8 kbd_led_levels_off_1;
+
+ int needs_kbd_timeouts;
+ /*
+@@ -79,6 +80,10 @@ static struct quirk_entry quirk_dell_xps
+ .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
+ };
+
++static struct quirk_entry quirk_dell_latitude_e6410 = {
++ .kbd_led_levels_off_1 = 1,
++};
++
+ static struct platform_driver platform_driver = {
+ .driver = {
+ .name = "dell-laptop",
+@@ -280,6 +285,15 @@ static const struct dmi_system_id dell_q
+ },
+ .driver_data = &quirk_dell_xps13_9333,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Latitude E6410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
++ },
++ .driver_data = &quirk_dell_latitude_e6410,
++ },
+ { }
+ };
+
+@@ -1200,6 +1214,9 @@ static int kbd_get_info(struct kbd_info
+ units = (buffer->output[2] >> 8) & 0xFF;
+ info->levels = (buffer->output[2] >> 16) & 0xFF;
+
++ if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
++ info->levels--;
++
+ if (units & BIT(0))
+ info->seconds = (buffer->output[3] >> 0) & 0xFF;
+ if (units & BIT(1))
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Fri, 1 Dec 2017 14:58:34 +0100
+Subject: PM / runtime: Fix handling of suppliers with disabled runtime PM
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+
+[ Upstream commit 31eb7431805493e10f4731f366cf4d4e3e952035 ]
+
+Prevent rpm_get_suppliers() from returning an error code if runtime
+PM is disabled for one or more of the supplier devices it wants to
+runtime-resume, so as to make runtime PM work for devices with links
+to suppliers that don't use runtime PM (such links may be created
+during device enumeration even before it is known whether or not
+runtime PM will be enabled for the devices in question, for example).
+
+Fixes: 21d5c57b3726 (PM / runtime: Use device links)
+Reported-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Tested-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/runtime.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -276,7 +276,8 @@ static int rpm_get_suppliers(struct devi
+ continue;
+
+ retval = pm_runtime_get_sync(link->supplier);
+- if (retval < 0) {
++ /* Ignore suppliers with disabled runtime PM. */
++ if (retval < 0 && retval != -EACCES) {
+ pm_runtime_put_noidle(link->supplier);
+ return retval;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Thu, 30 Nov 2017 14:03:22 +0530
+Subject: powerpc/perf: Fix oops when grouping different pmu events
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+
+[ Upstream commit 5aa04b3eb6fca63d2e9827be656dcadc26d54e11 ]
+
+When user tries to group imc (In-Memory Collections) event with
+normal event, (sometime) kernel crashes with following log:
+
+ Faulting instruction address: 0x00000000
+ [link register ] c00000000010ce88 power_check_constraints+0x128/0x980
+ ...
+ c00000000010e238 power_pmu_event_init+0x268/0x6f0
+ c0000000002dc60c perf_try_init_event+0xdc/0x1a0
+ c0000000002dce88 perf_event_alloc+0x7b8/0xac0
+ c0000000002e92e0 SyS_perf_event_open+0x530/0xda0
+ c00000000000b004 system_call+0x38/0xe0
+
+'event_base' field of 'struct hw_perf_event' is used as flags for
+normal hw events and used as memory address for imc events. While
+grouping these two types of events, collect_events() tries to
+interpret imc 'event_base' as a flag, which causes a corruption
+resulting in a crash.
+
+Consider only those events which belongs to 'perf_hw_context' in
+collect_events().
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Reviewed-By: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/perf/core-book3s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -1419,7 +1419,7 @@ static int collect_events(struct perf_ev
+ int n = 0;
+ struct perf_event *event;
+
+- if (!is_software_event(group)) {
++ if (group->pmu->task_ctx_nr == perf_hw_context) {
+ if (n >= max_count)
+ return -1;
+ ctrs[n] = group;
+@@ -1427,7 +1427,7 @@ static int collect_events(struct perf_ev
+ events[n++] = group->hw.config;
+ }
+ list_for_each_entry(event, &group->sibling_list, group_entry) {
+- if (!is_software_event(event) &&
++ if (event->pmu->task_ctx_nr == perf_hw_context &&
+ event->state != PERF_EVENT_STATE_OFF) {
+ if (n >= max_count)
+ return -1;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Date: Tue, 5 Dec 2017 11:00:38 +0530
+Subject: powerpc/perf/imc: Fix nest-imc cpuhotplug callback failure
+
+From: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+
+
+[ Upstream commit ad2b6e01024ef23bddc3ce0bcb115ecd8c520b7e ]
+
+Oops is observed during boot:
+
+ Faulting instruction address: 0xc000000000248340
+ cpu 0x0: Vector: 380 (Data Access Out of Range) at [c000000ff66fb850]
+ pc: c000000000248340: event_function_call+0x50/0x1f0
+ lr: c00000000024878c: perf_remove_from_context+0x3c/0x100
+ sp: c000000ff66fbad0
+ msr: 9000000000009033
+ dar: 7d20e2a6f92d03c0
+ pid = 14, comm = cpuhp/0
+
+While registering the cpuhotplug callbacks for nest-imc, if we fail in
+the cpuhotplug online path for any random node in a multi node
+system (because the opal call to stop nest-imc counters fails for that
+node), ppc_nest_imc_cpu_offline() will get invoked for other nodes who
+successfully returned from cpuhotplug online path.
+
+This call trace is generated since in the ppc_nest_imc_cpu_offline()
+path we are trying to migrate the event context, when nest-imc
+counters are not even initialized.
+
+Patch to add a check to ensure that nest-imc is registered before
+migrating the event context.
+
+Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support")
+Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -309,6 +309,19 @@ static int ppc_nest_imc_cpu_offline(unsi
+ return 0;
+
+ /*
++ * Check whether nest_imc is registered. We could end up here if the
++ * cpuhotplug callback registration fails. i.e, callback invokes the
++ * offline path for all successfully registered nodes. At this stage,
++ * nest_imc pmu will not be registered and we should return here.
++ *
++ * We return with a zero since this is not an offline failure. And
++ * cpuhp_setup_state() returns the actual failure reason to the caller,
++ * which in turn will call the cleanup routine.
++ */
++ if (!nest_pmus)
++ return 0;
++
++ /*
+ * Now that this cpu is one of the designated,
+ * find a next cpu a) which is online and b) in same chip.
+ */
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Moni Shoua <monis@mellanox.com>
+Date: Sun, 26 Nov 2017 20:23:54 +0200
+Subject: RDMA/cma: Make sure that PSN is not over max allowed
+
+From: Moni Shoua <monis@mellanox.com>
+
+
+[ Upstream commit 23a9cd2ad90543e9da3786878d2b2729c095439d ]
+
+This patch limits the initial value for PSN to 24 bits as
+spec requires.
+
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Mukesh Kacker <mukesh.kacker@oracle.com>
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/cma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -801,6 +801,7 @@ struct rdma_cm_id *rdma_create_id(struct
+ INIT_LIST_HEAD(&id_priv->mc_list);
+ get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num);
+ id_priv->id.route.addr.dev_addr.net = get_net(net);
++ id_priv->seq_num &= 0x00ffffff;
+
+ return &id_priv->id;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Thu, 26 Oct 2017 14:37:35 +0200
+Subject: s390/dasd: prevent prefix I/O error
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit da340f921d3454f1521671c7a5a43ad3331fbe50 ]
+
+Prevent that a prefix flag is set based on invalid configuration data.
+The validity.verify_base flag should only be set for alias devices.
+Usually the unit address type is either one of base, PAV alias or
+HyperPAV alias. But in cases where the unit address type is not set or
+any other value the validity.verify_base flag might be set as well.
+This would lead to follow on errors.
+Explicitly check for alias devices and set the validity flag only for
+them.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_eckd.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -530,10 +530,12 @@ static int prefix_LRE(struct ccw1 *ccw,
+ pfxdata->validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
+ pfxdata->validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata->validity.hyper_pav = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
++ pfxdata->validity.verify_base = 1;
++ pfxdata->validity.hyper_pav = 1;
+ }
+
+ rc = define_extent(NULL, dedata, trk, totrk, cmd, basedev, blksize);
+@@ -3414,10 +3416,12 @@ static int prepare_itcw(struct itcw *itc
+ pfxdata.validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
++ pfxdata.validity.verify_base = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
+ pfxdata.validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata.validity.hyper_pav = 1;
++ pfxdata.validity.hyper_pav = 1;
+ }
+
+ switch (cmd) {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Tue, 28 Nov 2017 16:11:29 +0200
+Subject: s390/virtio: add BSD license to virtio-ccw
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+
+[ Upstream commit edfb8d8fcb94a75b2e61c63549d4a5f6474ad3d2 ]
+
+The original intent of the virtio header relicensing
+from 2008 was to make sure anyone can implement compatible
+devices/drivers. The virtio-ccw was omitted by mistake.
+
+We have an ack from the only contributor as well as the
+maintainer from IBM, so it's not too late to fix that.
+
+Make it dual-licensed with GPLv2, as the whole kernel is GPL2.
+
+Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/include/uapi/asm/virtio-ccw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/include/uapi/asm/virtio-ccw.h
++++ b/arch/s390/include/uapi/asm/virtio-ccw.h
+@@ -1,4 +1,4 @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+ /*
+ * Definitions for virtio-ccw devices.
+ *
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 29 Nov 2017 15:20:03 +0000
+Subject: scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
+
+From: Will Deacon <will.deacon@arm.com>
+
+
+[ Upstream commit e814bccbafece52a24e152d2395b5d49eef55841 ]
+
+My bisect scripts starting running into build failures when trying to
+compile 4.15-rc1 with the builds failing with things like:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+
+The line in question is actually just a #define, but after some digging
+it turns out that my scripts pass W=1 and since commit 3a025e1d1c2ea
+("Add optional check for bad kernel-doc comments") that results in
+kernel-doc running on each source file. The file in question has a
+badly formatted comment immediately before the #define:
+
+/**
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
+
+which causes the regex in dump_struct to fail (lack of braces following
+struct declaration) and kernel-doc returns 1, which causes the build
+to fail.
+
+Fix the issue by always returning 0 from kernel-doc when invoked with
+-none. It successfully generates no documentation, and prints out any
+issues.
+
+Cc: Matthew Wilcox <mawilcox@microsoft.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/kernel-doc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -3216,4 +3216,4 @@ if ($verbose && $warnings) {
+ print STDERR "$warnings warnings\n";
+ }
+
+-exit($errors);
++exit($output_mode eq "none" ? 0 : $errors);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Tue, 28 Nov 2017 16:26:57 +0100
+Subject: scsi: bfa: fix access to bfad_im_port_s
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+
+[ Upstream commit 45349821ab3a8d378b8f37e52c6fe1aa1b870c47 ]
+
+Commit 'cd21c605b2cf ("scsi: fc: provide fc_bsg_to_shost() helper")'
+changed access to bfa's 'struct bfad_im_port_s' by using shost_priv()
+instead of shost->hostdata[0].
+
+This lead to crashes like in the following back-trace:
+
+task: ffff880046375300 ti: ffff8800a2ef8000 task.ti: ffff8800a2ef8000
+RIP: e030:[<ffffffffa04c8252>] [<ffffffffa04c8252>] bfa_fcport_get_attr+0x82/0x260 [bfa]
+RSP: e02b:ffff8800a2efba10 EFLAGS: 00010046
+RAX: 575f415441536432 RBX: ffff8800a2efba28 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff8800a2efba28 RDI: ffff880004dc31d8
+RBP: ffff880004dc31d8 R08: 0000000000000000 R09: 0000000000000001
+R10: ffff88011fadc468 R11: 0000000000000001 R12: ffff880004dc31f0
+R13: 0000000000000200 R14: ffff880004dc61d0 R15: ffff880004947a10
+FS: 00007feb1e489700(0000) GS:ffff88011fac0000(0000) knlGS:0000000000000000
+CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 00007ffe14e46c10 CR3: 00000000957b8000 CR4: 0000000000000660
+Stack:
+ ffff88001d4da000 ffff880004dc31c0 ffffffffa048a9df ffffffff81e56380
+ 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[] bfad_iocmd_ioc_get_info+0x4f/0x220 [bfa]
+[] bfad_iocmd_handler+0xa00/0xd40 [bfa]
+[] bfad_im_bsg_request+0xee/0x1b0 [bfa]
+[] fc_bsg_dispatch+0x10b/0x1b0 [scsi_transport_fc]
+[] bsg_request_fn+0x11d/0x1c0
+[] __blk_run_queue+0x2f/0x40
+[] blk_execute_rq_nowait+0xa8/0x160
+[] blk_execute_rq+0x77/0x120
+[] bsg_ioctl+0x1b6/0x200
+[] do_vfs_ioctl+0x2cd/0x4a0
+[] SyS_ioctl+0x74/0x80
+[] entry_SYSCALL_64_fastpath+0x12/0x6d
+
+Fixes: cd21c605b2cf ("scsi: fc: provide fc_bsg_to_shost() helper")
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Michal Koutný <mkoutny@suse.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/bfa/bfad_bsg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_jo
+ struct fc_bsg_request *bsg_request = job->request;
+ struct fc_bsg_reply *bsg_reply = job->reply;
+ uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
+- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
++ struct Scsi_Host *shost = fc_bsg_to_shost(job);
++ struct bfad_im_port_s *im_port = shost->hostdata[0];
+ struct bfad_s *bfad = im_port->bfad;
+ struct request_queue *request_q = job->req->q;
+ void *payload_kbuf;
+@@ -3357,7 +3358,8 @@ int
+ bfad_im_bsg_els_ct_request(struct bsg_job *job)
+ {
+ struct bfa_bsg_data *bsg_data;
+- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
++ struct Scsi_Host *shost = fc_bsg_to_shost(job);
++ struct bfad_im_port_s *im_port = shost->hostdata[0];
+ struct bfad_s *bfad = im_port->bfad;
+ bfa_bsg_fcpt_t *bsg_fcpt;
+ struct bfad_fcxp *drv_fcxp;
--- /dev/null
+From 48d83282db077f93b2cf40de120f4d6f29eb293b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 6 Dec 2017 15:14:18 +0100
+Subject: scsi: bfa: fix type conversion warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 48d83282db077f93b2cf40de120f4d6f29eb293b upstream.
+
+A regression fix introduced a harmless type mismatch warning:
+
+drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_vendor_request':
+drivers/scsi/bfa/bfad_bsg.c:3137:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion]
+ struct bfad_im_port_s *im_port = shost->hostdata[0];
+ ^~~~~
+drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_els_ct_request':
+drivers/scsi/bfa/bfad_bsg.c:3353:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion]
+ struct bfad_im_port_s *im_port = shost->hostdata[0];
+
+This changes the code back to shost_priv() once more, but encapsulates
+it in an inline function to document the rather unusual way of
+using the private data only as a pointer to the previously allocated
+structure.
+
+I did not try to get rid of the extra indirection level entirely,
+which would have been rather invasive and required reworking the entire
+initialization sequence.
+
+Fixes: 45349821ab3a ("scsi: bfa: fix access to bfad_im_port_s")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Sasha Levin <Alexander.Levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/bfa/bfad_bsg.c | 4 ++--
+ drivers/scsi/bfa/bfad_im.c | 6 ++++--
+ drivers/scsi/bfa/bfad_im.h | 10 ++++++++++
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -3136,7 +3136,7 @@ bfad_im_bsg_vendor_request(struct bsg_jo
+ struct fc_bsg_reply *bsg_reply = job->reply;
+ uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
+ struct Scsi_Host *shost = fc_bsg_to_shost(job);
+- struct bfad_im_port_s *im_port = shost->hostdata[0];
++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
+ struct bfad_s *bfad = im_port->bfad;
+ struct request_queue *request_q = job->req->q;
+ void *payload_kbuf;
+@@ -3359,7 +3359,7 @@ bfad_im_bsg_els_ct_request(struct bsg_jo
+ {
+ struct bfa_bsg_data *bsg_data;
+ struct Scsi_Host *shost = fc_bsg_to_shost(job);
+- struct bfad_im_port_s *im_port = shost->hostdata[0];
++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
+ struct bfad_s *bfad = im_port->bfad;
+ bfa_bsg_fcpt_t *bsg_fcpt;
+ struct bfad_fcxp *drv_fcxp;
+--- a/drivers/scsi/bfa/bfad_im.c
++++ b/drivers/scsi/bfa/bfad_im.c
+@@ -546,6 +546,7 @@ int
+ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
+ struct device *dev)
+ {
++ struct bfad_im_port_pointer *im_portp;
+ int error = 1;
+
+ mutex_lock(&bfad_mutex);
+@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *b
+ goto out_free_idr;
+ }
+
+- im_port->shost->hostdata[0] = (unsigned long)im_port;
++ im_portp = shost_priv(im_port->shost);
++ im_portp->p = im_port;
+ im_port->shost->unique_id = im_port->idr_id;
+ im_port->shost->this_id = -1;
+ im_port->shost->max_id = MAX_FCP_TARGET;
+@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port
+
+ sht->sg_tablesize = bfad->cfg_data.io_max_sge;
+
+- return scsi_host_alloc(sht, sizeof(unsigned long));
++ return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
+ }
+
+ void
+--- a/drivers/scsi/bfa/bfad_im.h
++++ b/drivers/scsi/bfa/bfad_im.h
+@@ -69,6 +69,16 @@ struct bfad_im_port_s {
+ struct fc_vport *fc_vport;
+ };
+
++struct bfad_im_port_pointer {
++ struct bfad_im_port_s *p;
++};
++
++static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
++{
++ struct bfad_im_port_pointer *im_portp = shost_priv(host);
++ return im_portp->p;
++}
++
+ enum bfad_itnim_state {
+ ITNIM_STATE_NONE,
+ ITNIM_STATE_ONLINE,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 22 Nov 2017 11:58:03 +0300
+Subject: scsi: lpfc: Use after free in lpfc_rq_buf_free()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 9816ef6ecbc102b9bcbb1d83e12c7fb19924f38c ]
+
+The error message dereferences "rqb_entry" so we need to print it first
+and then free the buffer.
+
+Fixes: 6c621a2229b0 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_mem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_mem.c
++++ b/drivers/scsi/lpfc/lpfc_mem.c
+@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
+ drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
+ rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
+ if (rc < 0) {
+- (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+ "6409 Cannot post to RQ %d: %x %x\n",
+ rqb_entry->hrq->queue_id,
+ rqb_entry->hrq->host_index,
+ rqb_entry->hrq->hba_index);
++ (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ } else {
+ list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
+ rqbp->buffer_count++;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 25 Nov 2017 21:18:34 +0800
+Subject: sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ]
+
+Now outstanding_bytes is only increased when appending chunks into one
+packet and sending it at 1st time, while decreased when it is about to
+move into retransmit queue. It means outstanding_bytes value is already
+decreased for all chunks in retransmit queue.
+
+However sctp_prsctp_prune_sent is a common function to check the chunks
+in both transmitted and retransmit queue, it decrease outstanding_bytes
+when moving a chunk into abandoned queue from either of them.
+
+It could cause outstanding_bytes underflow, as it also decreases it's
+value for the chunks in retransmit queue.
+
+This patch fixes it by only updating outstanding_bytes for transmitted
+queue when pruning queues for prsctp prio policy, the same fix is also
+needed in sctp_check_transmitted.
+
+Fixes: 8dbdf1f5b09c ("sctp: implement prsctp PRIO policy")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/outqueue.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -368,7 +368,8 @@ static int sctp_prsctp_prune_sent(struct
+ asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+ streamout->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+
+- if (!chk->tsn_gap_acked) {
++ if (queue != &asoc->outqueue.retransmit &&
++ !chk->tsn_gap_acked) {
+ if (chk->transport)
+ chk->transport->flight_size -=
+ sctp_data_size(chk);
+@@ -1429,7 +1430,8 @@ static void sctp_check_transmitted(struc
+ /* If this chunk has not been acked, stop
+ * considering it as 'outstanding'.
+ */
+- if (!tchunk->tsn_gap_acked) {
++ if (transmitted_queue != &q->retransmit &&
++ !tchunk->tsn_gap_acked) {
+ if (tchunk->transport)
+ tchunk->transport->flight_size -=
+ sctp_data_size(tchunk);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Nov 2017 15:30:53 +0100
+Subject: serdev: fix receive_buf return value when no callback
+
+From: Johan Hovold <johan@kernel.org>
+
+
+[ Upstream commit fd00cf81a9a84776ba58e56bd042c726dcf75cf3 ]
+
+The receive_buf callback is supposed to return the number of bytes
+processed and should specifically not return a negative errno.
+
+Due to missing sanity checks in the serdev tty-port controller, a driver
+not providing a receive_buf callback could cause the flush_to_ldisc()
+worker to spin in a tight loop when the tty buffer pointers are
+incremented with -EINVAL (-22).
+
+The missing sanity checks have now been added to the tty-port
+controller, but let's fix up the serdev-controller helper as well.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/serdev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/serdev.h
++++ b/include/linux/serdev.h
+@@ -184,7 +184,7 @@ static inline int serdev_controller_rece
+ struct serdev_device *serdev = ctrl->serdev;
+
+ if (!serdev || !serdev->ops->receive_buf)
+- return -EINVAL;
++ return 0;
+
+ return serdev->ops->receive_buf(serdev, data, count);
+ }
staging-iio-adc-ad7192-fix-external-frequency-setting.patch
staging-iio-ad5933-switch-buffer-mode-to-software.patch
usbip-keep-usbip_device-sockfd-state-in-sync-with-tcp_socket.patch
+usb-build-drivers-usb-common-when-usb_support-is-set.patch
+serdev-fix-receive_buf-return-value-when-no-callback.patch
+arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch
+arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch
+arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch
+arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch
+arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch
+arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch
+arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch
+perf-record-fix-c-f-options-for-cpu-event-aliases.patch
+perf-help-fix-a-bug-during-strstart-conversion.patch
+perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch
+perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch
+perf-fix-header.size-for-namespace-events.patch
+perf-top-fix-window-dimensions-change-handling.patch
+perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch
+perf-test-fix-test-21-for-s390x.patch
+pinctrl-denverton-fix-uart2-rts-pin-mode.patch
+kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch
+trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch
+media-s5k6aa-describe-some-function-parameters.patch
+media-ov13858-select-v4l2_fwnode.patch
+net-mvpp2-allocate-zeroed-tx-descriptors.patch
+gpio-74x164-fix-crash-during-.remove.patch
+gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch
+pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch
+pinctrl-sunxi-fix-a64-uart-mux-value.patch
+ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch
+meson-gx-socinfo-fix-package-id-parsing.patch
+kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch
+i40iw-allocate-a-sdbuf-per-cqp-wqe.patch
+i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch
+i40iw-correct-arp-index-mask.patch
+rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch
+ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch
+md-raid5-correct-degraded-calculation-in-raid5_error.patch
+sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch
+sfp-fix-rx_los-signal-handling.patch
+phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch
+md-raid1-10-add-missed-blk-plug.patch
+iio-proximity-sx9500-assign-interrupt-from-gpioio.patch
+iio-fix-kernel-doc-build-errors.patch
+scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch
+bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch
+ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch
+m68k-add-missing-softirqentry_text-linker-section.patch
+powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch
+pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch
+s390-virtio-add-bsd-license-to-virtio-ccw.patch
+s390-dasd-prevent-prefix-i-o-error.patch
+arm-dts-fix-elm-interrupt-compiler-warning.patch
+nfp-fix-port-stats-for-mac-representors.patch
+gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch
+net_sched-red-avoid-devision-by-zero.patch
+net_sched-red-avoid-illegal-values.patch
+vsock-fix-outdated-sk_state-value-in-hvs_release.patch
+kvm-vmx-fix-page-leak-in-hardware_setup.patch
+net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch
+locking-lockdep-fix-possible-null-deref.patch
+btrfs-fix-quota-reservation-leak-on-preallocated-files.patch
+btrfs-disable-fua-if-mounted-with-nobarrier.patch
+btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch
+brcmfmac-avoid-build-error-with-make-w-1.patch
+virtio_net-fix-return-value-check-in-receive_mergeable.patch
+net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch
+net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch
+net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch
+509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch
+gianfar-disable-eee-autoneg-by-default.patch
+scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch
+scsi-bfa-fix-access-to-bfad_im_port_s.patch
+scsi-bfa-fix-type-conversion-warning.patch
+dmaengine-ioat-fix-error-handling-path.patch
+dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch
+xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch
+netfilter-xt_bpf-add-overflow-checks.patch
+clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch
+staging-ccree-uninitialized-return-in-ssi_ahash_import.patch
+asoc-rockchip-disable-clock-on-error.patch
+spi-sun4i-disable-clocks-in-the-remove-function.patch
+ib-mlx4-fix-rss-hash-fields-restrictions.patch
+xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch
+drm-armada-fix-leak-of-crtc-structure.patch
+asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch
+drm-vc4-release-fence-after-signalling.patch
+dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch
+usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch
+usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch
+mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch
+x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch
+platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch
+xen-xen_acpi_processor-is-dom0-only.patch
+pci-rcar-fix-use-after-free-in-probe-error-path.patch
+powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch
+hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 30 Nov 2017 13:59:11 +0000
+Subject: sfp: fix RX_LOS signal handling
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit acf1c02f023926b8b04672a9e81b1711ae681619 ]
+
+The options word is a be16 quantity, so we need to test the flags
+having converted the endian-ness. Convert the flag bits to be16,
+which can be optimised by the compiler, rather than converting a
+variable at runtime.
+
+Reported-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/sfp.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -358,7 +358,7 @@ static void sfp_sm_link_check_los(struct
+ * SFP_OPTIONS_LOS_NORMAL are set? For now, we assume
+ * the same as SFP_OPTIONS_LOS_NORMAL set.
+ */
+- if (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED)
++ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED))
+ los ^= SFP_F_LOS;
+
+ if (los)
+@@ -583,7 +583,8 @@ static void sfp_sm_event(struct sfp *sfp
+ if (event == SFP_E_TX_FAULT)
+ sfp_sm_fault(sfp, true);
+ else if (event ==
+- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
++ (sfp->id.ext.options &
++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
+ SFP_E_LOS_HIGH : SFP_E_LOS_LOW))
+ sfp_sm_link_up(sfp);
+ break;
+@@ -593,7 +594,8 @@ static void sfp_sm_event(struct sfp *sfp
+ sfp_sm_link_down(sfp);
+ sfp_sm_fault(sfp, true);
+ } else if (event ==
+- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
++ (sfp->id.ext.options &
++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
+ SFP_E_LOS_LOW : SFP_E_LOS_HIGH)) {
+ sfp_sm_link_down(sfp);
+ sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Takuo Koguchi <takuo.koguchi@gmail.com>
+Date: Thu, 7 Dec 2017 16:20:14 +0900
+Subject: spi: sun4i: disable clocks in the remove function
+
+From: Takuo Koguchi <takuo.koguchi@gmail.com>
+
+
+[ Upstream commit c810daba0ab5226084a56893a789af427a801146 ]
+
+mclk and hclk need to be disabled. Since pm_runtime_disable does
+not disable the clocks, use pm_runtime_force_suspend instead.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Takuo Koguchi <takuo.koguchi.sw@hitachi.com>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-sun4i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sun4i.c
++++ b/drivers/spi/spi-sun4i.c
+@@ -525,7 +525,7 @@ err_free_master:
+
+ static int sun4i_spi_remove(struct platform_device *pdev)
+ {
+- pm_runtime_disable(&pdev->dev);
++ pm_runtime_force_suspend(&pdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 5 Dec 2017 17:37:17 +0300
+Subject: staging: ccree: Uninitialized return in ssi_ahash_import()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit aece09024414b54158e03aa45f4a4436e7cb996c ]
+
+The return value isn't initialized on some success paths.
+
+Fixes: c5f39d07860c ("staging: ccree: fix leak of import() after init()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/ccree/ssi_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/ccree/ssi_hash.c
++++ b/drivers/staging/ccree/ssi_hash.c
+@@ -1781,7 +1781,7 @@ static int ssi_ahash_import(struct ahash
+ struct device *dev = &ctx->drvdata->plat_dev->dev;
+ struct ahash_req_ctx *state = ahash_request_ctx(req);
+ u32 tmp;
+- int rc;
++ int rc = 0;
+
+ memcpy(&tmp, in, sizeof(u32));
+ if (tmp != CC_EXPORT_MAGIC) {
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Xie XiuQi <xiexiuqi@huawei.com>
+Date: Thu, 30 Nov 2017 09:41:29 +0800
+Subject: trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
+
+From: Xie XiuQi <xiexiuqi@huawei.com>
+
+
+[ Upstream commit 23721a755f98ac846897a013c92cccb281c1bcc8 ]
+
+We meet this compile warning, which caused by missing bpf.h in xdp.h.
+
+In file included from ./include/trace/events/xdp.h:10:0,
+ from ./include/linux/bpf_trace.h:6,
+ from drivers/net/ethernet/intel/i40e/i40e_txrx.c:29:
+./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration
+ const struct bpf_map *map, u32 map_index),
+ ^
+./include/linux/tracepoint.h:187:34: note: in definition of macro ‘__DECLARE_TRACE’
+ static inline void trace_##name(proto) \
+ ^~~~~
+./include/linux/tracepoint.h:352:24: note: in expansion of macro ‘PARAMS’
+ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
+ ^~~~~~
+./include/linux/tracepoint.h:477:2: note: in expansion of macro ‘DECLARE_TRACE’
+ DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
+ ^~~~~~~~~~~~~
+./include/linux/tracepoint.h:477:22: note: in expansion of macro ‘PARAMS’
+ DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
+ ^~~~~~
+./include/trace/events/xdp.h:89:1: note: in expansion of macro ‘DEFINE_EVENT’
+ DEFINE_EVENT(xdp_redirect_template, xdp_redirect,
+ ^~~~~~~~~~~~
+./include/trace/events/xdp.h:90:2: note: in expansion of macro ‘TP_PROTO’
+ TP_PROTO(const struct net_device *dev,
+ ^~~~~~~~
+./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration
+ const struct bpf_map *map, u32 map_index),
+ ^
+./include/linux/tracepoint.h:203:38: note: in definition of macro ‘__DECLARE_TRACE’
+ register_trace_##name(void (*probe)(data_proto), void *data) \
+ ^~~~~~~~~~
+./include/linux/tracepoint.h:354:4: note: in expansion of macro ‘PARAMS’
+ PARAMS(void *__data, proto), \
+ ^~~~~~
+
+Reported-by: Huang Daode <huangdaode@hisilicon.com>
+Cc: Hanjun Guo <guohanjun@huawei.com>
+Fixes: 8d3b778ff544 ("xdp: tracepoint xdp_redirect also need a map argument")
+Signed-off-by: Xie XiuQi <xiexiuqi@huawei.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/events/xdp.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/trace/events/xdp.h
++++ b/include/trace/events/xdp.h
+@@ -8,6 +8,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/filter.h>
+ #include <linux/tracepoint.h>
++#include <linux/bpf.h>
+
+ #define __XDP_ACT_MAP(FN) \
+ FN(ABORTED) \
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 17 Nov 2017 11:00:45 -0800
+Subject: usb: build drivers/usb/common/ when USB_SUPPORT is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+
+[ Upstream commit c9d24f78268be444e803fb2bb138a2f598de9c23 ]
+
+PHY drivers can use ULPI interfaces when CONFIG_USB (which is host side
+support) is not enabled, so also build drivers/usb/ when CONFIG_USB_SUPPORT
+is enabled so that drivers/usb/common/ is built.
+
+ERROR: "ulpi_unregister_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "__ulpi_register_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_read" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_write" [drivers/phy/ti/phy-tusb1210.ko] undefined!
+ERROR: "ulpi_unregister_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+ERROR: "__ulpi_register_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+ERROR: "ulpi_write" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined!
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_TC) += tc/
+ obj-$(CONFIG_UWB) += uwb/
+ obj-$(CONFIG_USB_PHY) += usb/
+ obj-$(CONFIG_USB) += usb/
++obj-$(CONFIG_USB_SUPPORT) += usb/
+ obj-$(CONFIG_PCI) += usb/
+ obj-$(CONFIG_USB_GADGET) += usb/
+ obj-$(CONFIG_OF) += usb/
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Vincent Pelletier <plr.vincent@gmail.com>
+Date: Thu, 30 Nov 2017 15:31:06 +0000
+Subject: usb: dwc3: gadget: Wait longer for controller to end command processing
+
+From: Vincent Pelletier <plr.vincent@gmail.com>
+
+
+[ Upstream commit 8722e095f5a44d0e409e45c5ddc2ee9cf589c777 ]
+
+DWC3_DEPCMD_ENDTRANSFER has been witnessed to require around 600 iterations
+before controller would become idle again after unplugging the USB cable
+with AIO reads submitted.
+Bump timeout from 500 iterations to 1000 so dwc3_stop_active_transfer does
+not receive -ETIMEDOUT and does not WARN:
+
+[ 81.326273] ------------[ cut here ]------------
+[ 81.335341] WARNING: CPU: 0 PID: 1874 at drivers/usb/dwc3/gadget.c:2627 dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3]
+[ 81.347094] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil dwc3 intel_powerclamp coretemp ulpi kvm_intel udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd basincove_gpadc industrialio gpio_keys usbcore usb_common
+[ 81.378142] CPU: 0 PID: 1874 Comm: irq/34-dwc3 Not tainted 4.14.0-edison+ #119
+[ 81.385545] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
+[ 81.394548] task: f5b1be00 task.stack: f420a000
+[ 81.399219] EIP: dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3]
+[ 81.406086] EFLAGS: 00010086 CPU: 0
+[ 81.409672] EAX: 0000001f EBX: f5729800 ECX: c132a2a2 EDX: 00000000
+[ 81.416096] ESI: f4054014 EDI: f41cf400 EBP: f420be10 ESP: f420bdf4
+[ 81.422521] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+[ 81.428061] CR0: 80050033 CR2: b7a3f000 CR3: 01d94000 CR4: 001006d0
+[ 81.434483] Call Trace:
+[ 81.437063] __dwc3_gadget_ep_disable+0xa3/0x2b0 [dwc3]
+[ 81.442438] ? _raw_spin_lock_irqsave+0x32/0x40
+[ 81.447135] dwc3_gadget_ep_disable+0xbf/0xe0 [dwc3]
+[ 81.452269] usb_ep_disable+0x1c/0xd0 [udc_core]
+[ 81.457048] ffs_func_eps_disable.isra.15+0x3b/0x90 [usb_f_fs]
+[ 81.463070] ffs_func_set_alt+0x7d/0x310 [usb_f_fs]
+[ 81.468132] ffs_func_disable+0x14/0x20 [usb_f_fs]
+[ 81.473075] reset_config+0x5b/0x90 [libcomposite]
+[ 81.478023] composite_disconnect+0x2b/0x50 [libcomposite]
+[ 81.483685] dwc3_disconnect_gadget+0x39/0x50 [dwc3]
+[ 81.488808] dwc3_gadget_disconnect_interrupt+0x21b/0x250 [dwc3]
+[ 81.495014] dwc3_thread_interrupt+0x2a8/0xf70 [dwc3]
+[ 81.500219] ? __schedule+0x78c/0x7e0
+[ 81.504027] irq_thread_fn+0x18/0x30
+[ 81.507715] ? irq_thread+0xb7/0x180
+[ 81.511400] irq_thread+0x111/0x180
+[ 81.515000] ? irq_finalize_oneshot+0xe0/0xe0
+[ 81.519490] ? wake_threads_waitq+0x30/0x30
+[ 81.523806] kthread+0x107/0x110
+[ 81.527131] ? disable_percpu_irq+0x50/0x50
+[ 81.531439] ? kthread_stop+0x150/0x150
+[ 81.535397] ret_from_fork+0x19/0x24
+[ 81.539136] Code: 89 d8 c7 45 ec 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 f4 00 00 00 00 e8 56 ef ff ff 85 c0 74 12 50 68 b9 1c 14 f8 e8 64 0f f7 c8 <0f> ff 58 5a 8d 76 00 8b 83 98 00 00 00 c6 83 a0 00 00 00 00 83
+[ 81.559295] ---[ end trace f3133eec81a473b8 ]---
+
+Number of iterations measured on 4 consecutive unplugs:
+[ 1088.799777] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 605 times
+[ 1222.024986] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 580 times
+[ 1317.590452] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 598 times
+[ 1453.218314] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 594 times
+
+Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -267,7 +267,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
+ {
+ const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
+ struct dwc3 *dwc = dep->dwc;
+- u32 timeout = 500;
++ u32 timeout = 1000;
+ u32 reg;
+
+ int cmd_status = 0;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Andreas Platschek <andreas.platschek@opentech.at>
+Date: Thu, 7 Dec 2017 11:32:20 +0100
+Subject: usb: dwc3: of-simple: fix missing clk_disable_unprepare
+
+From: Andreas Platschek <andreas.platschek@opentech.at>
+
+
+[ Upstream commit ded600ea9fb51a495d2fcd21e90351df876488e8 ]
+
+If of_clk_get() fails, the clean-up of already initialized clocks should be
+the same as when clk_prepare_enable() fails. Thus a clk_disable_unprepare()
+for each clock should be called before the clk_put().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 16adc674d0d6 ("usb: dwc3: ep0: fix setup_packet_pending initialization")
+
+Signed-off-by: Andreas Platschek <andreas.platschek@opentech.at>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-of-simple.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -57,8 +57,10 @@ static int dwc3_of_simple_clk_init(struc
+
+ clk = of_clk_get(np, i);
+ if (IS_ERR(clk)) {
+- while (--i >= 0)
++ while (--i >= 0) {
++ clk_disable_unprepare(simple->clks[i]);
+ clk_put(simple->clks[i]);
++ }
+ return PTR_ERR(clk);
+ }
+
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Mon, 4 Dec 2017 14:02:19 +0800
+Subject: virtio_net: fix return value check in receive_mergeable()
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+
+[ Upstream commit 03e9f8a05bce7330bcd9c5cc54c8e42d0fcbf993 ]
+
+The function virtqueue_get_buf_ctx() could return NULL, the return
+value 'buf' need to be checked with NULL, not value 'ctx'.
+
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -714,7 +714,7 @@ static struct sk_buff *receive_mergeable
+ int num_skb_frags;
+
+ buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx);
+- if (unlikely(!ctx)) {
++ if (unlikely(!buf)) {
+ pr_debug("%s: rx error: %d buffers out of %d missing\n",
+ dev->name, num_buf,
+ virtio16_to_cpu(vi->vdev,
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 5 Dec 2017 11:31:14 +0000
+Subject: VSOCK: fix outdated sk_state value in hvs_release()
+
+From: Stefan Hajnoczi <stefanha@redhat.com>
+
+
+[ Upstream commit c9d3fe9da094a9a7a3d3cd365b334b822e05f5e8 ]
+
+Since commit 3b4477d2dcf2709d0be89e2a8dced3d0f4a017f2 ("VSOCK: use TCP
+state constants for sk_state") VSOCK has used TCP_* constants for
+sk_state.
+
+Commit b4562ca7925a3bedada87a3dd072dd5bad043288 ("hv_sock: add locking
+in the open/close/release code paths") reintroduced the SS_DISCONNECTING
+constant.
+
+This patch replaces the old SS_DISCONNECTING with the new TCP_CLOSING
+constant.
+
+CC: Dexuan Cui <decui@microsoft.com>
+CC: Cathy Avery <cavery@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/vmw_vsock/hyperv_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -488,7 +488,7 @@ static void hvs_release(struct vsock_soc
+
+ lock_sock(sk);
+
+- sk->sk_state = SS_DISCONNECTING;
++ sk->sk_state = TCP_CLOSING;
+ vsock_remove_sock(vsk);
+
+ release_sock(sk);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Karol Herbst <kherbst@redhat.com>
+Date: Mon, 27 Nov 2017 08:51:39 +0100
+Subject: x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
+
+From: Karol Herbst <kherbst@redhat.com>
+
+
+[ Upstream commit 6d60ce384d1d5ca32b595244db4077a419acc687 ]
+
+If something calls ioremap() with an address not aligned to PAGE_SIZE, the
+returned address might be not aligned as well. This led to a probe
+registered on exactly the returned address, but the entire page was armed
+for mmiotracing.
+
+On calling iounmap() the address passed to unregister_kmmio_probe() was
+PAGE_SIZE aligned by the caller leading to a complete freeze of the
+machine.
+
+We should always page align addresses while (un)registerung mappings,
+because the mmiotracer works on top of pages, not mappings. We still keep
+track of the probes based on their real addresses and lengths though,
+because the mmiotrace still needs to know what are mapped memory regions.
+
+Also move the call to mmiotrace_iounmap() prior page aligning the address,
+so that all probes are unregistered properly, otherwise the kernel ends up
+failing memory allocations randomly after disabling the mmiotracer.
+
+Tested-by: Lyude <lyude@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Acked-by: Pekka Paalanen <ppaalanen@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: nouveau@lists.freedesktop.org
+Link: http://lkml.kernel.org/r/20171127075139.4928-1-kherbst@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/ioremap.c | 4 ++--
+ arch/x86/mm/kmmio.c | 12 +++++++-----
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -349,11 +349,11 @@ void iounmap(volatile void __iomem *addr
+ return;
+ }
+
++ mmiotrace_iounmap(addr);
++
+ addr = (volatile void __iomem *)
+ (PAGE_MASK & (unsigned long __force)addr);
+
+- mmiotrace_iounmap(addr);
+-
+ /* Use the vm area unlocked, assuming the caller
+ ensures there isn't another iounmap for the same address
+ in parallel. Reuse of the virtual address is prevented by
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -435,17 +435,18 @@ int register_kmmio_probe(struct kmmio_pr
+ unsigned long flags;
+ int ret = 0;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ unsigned int l;
+ pte_t *pte;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+- if (get_kmmio_probe(p->addr)) {
++ if (get_kmmio_probe(addr)) {
+ ret = -EEXIST;
+ goto out;
+ }
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte) {
+ ret = -EINVAL;
+ goto out;
+@@ -454,7 +455,7 @@ int register_kmmio_probe(struct kmmio_pr
+ kmmio_count++;
+ list_add_rcu(&p->list, &kmmio_probes);
+ while (size < size_lim) {
+- if (add_kmmio_fault_page(p->addr + size))
++ if (add_kmmio_fault_page(addr + size))
+ pr_err("Unable to set page fault.\n");
+ size += page_level_size(l);
+ }
+@@ -528,19 +529,20 @@ void unregister_kmmio_probe(struct kmmio
+ {
+ unsigned long flags;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ struct kmmio_fault_page *release_list = NULL;
+ struct kmmio_delayed_release *drelease;
+ unsigned int l;
+ pte_t *pte;
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte)
+ return;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+ while (size < size_lim) {
+- release_kmmio_fault_page(p->addr + size, &release_list);
++ release_kmmio_fault_page(addr + size, &release_list);
+ size += page_level_size(l);
+ }
+ list_del_rcu(&p->list);
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Jan Beulich <JBeulich@suse.com>
+Date: Tue, 12 Dec 2017 03:18:11 -0700
+Subject: xen: XEN_ACPI_PROCESSOR is Dom0-only
+
+From: Jan Beulich <JBeulich@suse.com>
+
+
+[ Upstream commit c4f9d9cb2c29ff04c6b4bb09b72802d8aedfc7cb ]
+
+Add a respective dependency.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -258,7 +258,7 @@ config XEN_ACPI_HOTPLUG_CPU
+
+ config XEN_ACPI_PROCESSOR
+ tristate "Xen ACPI processor"
+- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
++ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
+ default m
+ help
+ This ACPI processor uploads Power Management information to the Xen
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Fri, 8 Dec 2017 08:07:25 +0100
+Subject: xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+
+[ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ]
+
+On policies with a transport mode template, we pass the addresses
+from the flowi to xfrm_state_find(), assuming that the IP addresses
+(and address family) don't change during transformation.
+
+Unfortunately our policy template validation is not strict enough.
+It is possible to configure policies with transport mode template
+where the address family of the template does not match the selectors
+address family. This lead to stack-out-of-bound reads because
+we compare arddesses of the wrong family. Fix this by refusing
+such a configuration, address family can not change on transport
+mode.
+
+We use the assumption that, on transport mode, the first templates
+address family must match the address family of the policy selector.
+Subsequent transport mode templates must mach the address family of
+the previous template.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_user.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1417,11 +1417,14 @@ static void copy_templates(struct xfrm_p
+
+ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ {
++ u16 prev_family;
+ int i;
+
+ if (nr > XFRM_MAX_DEPTH)
+ return -EINVAL;
+
++ prev_family = family;
++
+ for (i = 0; i < nr; i++) {
+ /* We never validated the ut->family value, so many
+ * applications simply leave it at zero. The check was
+@@ -1433,6 +1436,12 @@ static int validate_tmpl(int nr, struct
+ if (!ut[i].family)
+ ut[i].family = family;
+
++ if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
++ (ut[i].family != prev_family))
++ return -EINVAL;
++
++ prev_family = ut[i].family;
++
+ switch (ut[i].family) {
+ case AF_INET:
+ break;
--- /dev/null
+From foo@baz Fri Feb 23 11:45:09 CET 2018
+From: Aviv Heller <avivh@mellanox.com>
+Date: Tue, 28 Nov 2017 19:55:40 +0200
+Subject: xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
+
+From: Aviv Heller <avivh@mellanox.com>
+
+
+[ Upstream commit 4ce3dbe397d7b6b15f272ae757c78c35e9e4b61d ]
+
+Code path when (encap_type < 0) does not verify the state is valid
+before progressing.
+
+This will result in a crash if, for instance, x->km.state ==
+XFRM_STATE_ACQ.
+
+Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
+Signed-off-by: Aviv Heller <avivh@mellanox.com>
+Signed-off-by: Yevgeny Kliteynik <kliteyn@mellanox.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_input.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -207,7 +207,7 @@ int xfrm_input(struct sk_buff *skb, int
+ xfrm_address_t *daddr;
+ struct xfrm_mode *inner_mode;
+ u32 mark = skb->mark;
+- unsigned int family;
++ unsigned int family = AF_UNSPEC;
+ int decaps = 0;
+ int async = 0;
+ bool xfrm_gro = false;
+@@ -216,6 +216,16 @@ int xfrm_input(struct sk_buff *skb, int
+
+ if (encap_type < 0) {
+ x = xfrm_input_state(skb);
++
++ if (unlikely(x->km.state != XFRM_STATE_VALID)) {
++ if (x->km.state == XFRM_STATE_ACQ)
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
++ else
++ XFRM_INC_STATS(net,
++ LINUX_MIB_XFRMINSTATEINVALID);
++ goto drop;
++ }
++
+ family = x->outer_mode->afinfo->family;
+
+ /* An encap_type of -1 indicates async resumption. */
projects / thirdparty / kernel / stable-queue.git / commitdiff
