--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 13 Apr 2018 14:54:17 +0200
+Subject: ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c975e472ec12392a0c34de1350e634310f8a1dea ]
+
+The Point of View mobii wintab p800w Bay Trail tablet comes with a Crystal
+Cove PMIC, yet uses the LPSS PWM for backlight control, rather then the
+Crystal Cove's PWM, so we need to call pwm_add_table() to add a
+pwm_backlight mapping for the LPSS pwm despite there being an INT33FD
+ACPI device present.
+
+On all Bay Trail devices the _HRV object of the INT33FD ACPI device
+will normally return 2, to indicate the Bay Trail variant of the CRC
+PMIC is present, except on this tablet where _HRV is 0xffff. I guess this
+is a hack to make the windows Crystal Cove PWM driver not bind.
+
+Out of the 44 DSTDs with an INT33FD device in there which I have (from
+different model devices) only the pov mobii wintab p800w uses 0xffff for
+the HRV.
+
+The byt_pwm_setup code calls acpi_dev_present to check for the presence
+of a INT33FD ACPI device which indicates that a CRC PMIC is present and
+if the INT33FD ACPI device is present then byt_pwm_setup will not add
+a pwm_backlight mapping for the LPSS pwm, so that the CRC PWM will get
+used instead.
+
+acpi_dev_present has a hrv parameter, this commit make us pass 2 instead
+of -1, so that things still match on normal tablets, but on this special
+case with its _HRV of 0xffff, the check will now fail so that the
+pwm_backlight mapping for the LPSS pwm gets added fixing backlight
+brightness control on this device.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_lpss.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -70,6 +70,10 @@ ACPI_MODULE_NAME("acpi_lpss");
+ #define LPSS_SAVE_CTX BIT(4)
+ #define LPSS_NO_D3_DELAY BIT(5)
+
++/* Crystal Cove PMIC shares same ACPI ID between different platforms */
++#define BYT_CRC_HRV 2
++#define CHT_CRC_HRV 3
++
+ struct lpss_private_data;
+
+ struct lpss_device_desc {
+@@ -163,7 +167,7 @@ static void byt_pwm_setup(struct lpss_pr
+ if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
+ return;
+
+- if (!acpi_dev_present("INT33FD", NULL, -1))
++ if (!acpi_dev_present("INT33FD", NULL, BYT_CRC_HRV))
+ pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup));
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Mon, 11 Jun 2018 16:18:40 +0800
+Subject: ALSA: emu10k1: add error handling for snd_ctl_add
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ]
+
+When snd_ctl_add fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling snd_ctl_add.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/emu10k1/emupcm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -1858,7 +1858,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10
+ if (!kctl)
+ return -ENOMEM;
+ kctl->id.device = device;
+- snd_ctl_add(emu->card, kctl);
++ err = snd_ctl_add(emu->card, kctl);
++ if (err < 0)
++ return err;
+
+ snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 17 May 2018 20:02:23 +0200
+Subject: ALSA: emu10k1: Rate-limit error messages about page errors
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ]
+
+The error messages at sanity checks of memory pages tend to repeat too
+many times once when it hits, and without the rate limit, it may flood
+and become unreadable. Replace such messages with the *_ratelimited()
+variant.
+
+Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/emu10k1/memory.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -248,13 +248,13 @@ __found_pages:
+ static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr)
+ {
+ if (addr & ~emu->dma_mask) {
+- dev_err(emu->card->dev,
++ dev_err_ratelimited(emu->card->dev,
+ "max memory size is 0x%lx (addr = 0x%lx)!!\n",
+ emu->dma_mask, (unsigned long)addr);
+ return 0;
+ }
+ if (addr & (EMUPAGESIZE-1)) {
+- dev_err(emu->card->dev, "page is not aligned\n");
++ dev_err_ratelimited(emu->card->dev, "page is not aligned\n");
+ return 0;
+ }
+ return 1;
+@@ -345,7 +345,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10
+ else
+ addr = snd_pcm_sgbuf_get_addr(substream, ofs);
+ if (! is_valid_page(emu, addr)) {
+- dev_err(emu->card->dev,
++ dev_err_ratelimited(emu->card->dev,
+ "emu: failure page = %d\n", idx);
+ mutex_unlock(&hdr->block_mutex);
+ return NULL;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Mon, 11 Jun 2018 16:04:06 +0800
+Subject: ALSA: fm801: add error handling for snd_ctl_add
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ]
+
+When snd_ctl_add fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling snd_ctl_add.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/fm801.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/fm801.c
++++ b/sound/pci/fm801.c
+@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801
+ if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0)
+ return err;
+ }
+- for (i = 0; i < FM801_CONTROLS; i++)
+- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip));
++ for (i = 0; i < FM801_CONTROLS; i++) {
++ err = snd_ctl_add(chip->card,
++ snd_ctl_new1(&snd_fm801_controls[i], chip));
++ if (err < 0)
++ return err;
++ }
+ if (chip->multichannel) {
+- for (i = 0; i < FM801_CONTROLS_MULTI; i++)
+- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
++ for (i = 0; i < FM801_CONTROLS_MULTI; i++) {
++ err = snd_ctl_add(chip->card,
++ snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
++ if (err < 0)
++ return err;
++ }
+ }
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Wed, 2 May 2018 22:48:16 +0900
+Subject: ALSA: hda/ca0132: fix build failure when a local macro is defined
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 8e142e9e628975b0dddd05cf1b095331dff6e2de ]
+
+DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but
+tlv.h is not included. This causes build failure when local macro is
+defined by comment-out.
+
+This commit fixes the bug. At the same time, the alias macro is replaced
+with a destination macro added at a commit 46e860f76804 ("ALSA: rename
+TLV-related macros so that they're friendly to user applications")
+
+Reported-by: Connor McAdams <conmanx360@gmail.com>
+Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_ca0132.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -39,6 +39,10 @@
+ /* Enable this to see controls for tuning purpose. */
+ /*#define ENABLE_TUNING_CONTROLS*/
+
++#ifdef ENABLE_TUNING_CONTROLS
++#include <sound/tlv.h>
++#endif
++
+ #define FLOAT_ZERO 0x00000000
+ #define FLOAT_ONE 0x3f800000
+ #define FLOAT_TWO 0x40000000
+@@ -3068,8 +3072,8 @@ static int equalizer_ctl_put(struct snd_
+ return 1;
+ }
+
+-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
+-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0);
+
+ static int add_tuning_control(struct hda_codec *codec,
+ hda_nid_t pnid, hda_nid_t nid,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 16 May 2018 20:07:18 +0200
+Subject: ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ]
+
+retire_capture_urb() may print warning messages when the given URB
+doesn't align, and this may flood the system log easily.
+Put the rate limit to the message for avoiding it.
+
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct sn
+ if (bytes % (runtime->sample_bits >> 3) != 0) {
+ int oldbytes = bytes;
+ bytes = frames * stride;
+- dev_warn(&subs->dev->dev,
++ dev_warn_ratelimited(&subs->dev->dev,
+ "Corrected urb data len. %d->%d\n",
+ oldbytes, bytes);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 7 May 2018 15:40:05 +0200
+Subject: ARM: dts: emev2: Add missing interrupt-affinity to PMU node
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7207b94754b6f503b278b5b200faaf662ffa1da8 ]
+
+The PMU node references two interrupts, but lacks the interrupt-affinity
+property, which is required in that case:
+
+ hw perfevents: no interrupt-affinity property for /pmu, guessing.
+
+Add the missing property to fix this.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/emev2.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/emev2.dtsi
++++ b/arch/arm/boot/dts/emev2.dtsi
+@@ -31,13 +31,13 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- cpu@0 {
++ cpu0: cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0>;
+ clock-frequency = <533000000>;
+ };
+- cpu@1 {
++ cpu1: cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <1>;
+@@ -57,6 +57,7 @@
+ compatible = "arm,cortex-a9-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>;
+ };
+
+ clocks@e0110000 {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Rob Herring <robh@kernel.org>
+Date: Tue, 8 May 2018 08:59:27 -0500
+Subject: ARM: dts: imx53: Fix LDB OF graph warning
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 77dd4bd0c0db8e4856e7abc2192f126e226e14c5 ]
+
+Single child nodes in OF graph don't need an address and now dtc will
+warn about this:
+
+Warning (graph_child_address): /soc/aips@50000000/ldb@53fa8008/lvds-channel@0: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
+
+Since the LDB should always have an output port, fix the warning by
+adding the output port, 2, to the DT.
+
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
+Cc: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx53-ppd.dts | 2 --
+ arch/arm/boot/dts/imx53.dtsi | 8 ++++++++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -559,8 +559,6 @@
+ status = "okay";
+
+ port@2 {
+- reg = <2>;
+-
+ lvds0_out: endpoint {
+ remote-endpoint = <&panel_in_lvds0>;
+ };
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -488,6 +488,10 @@
+ remote-endpoint = <&ipu_di0_lvds0>;
+ };
+ };
++
++ port@2 {
++ reg = <2>;
++ };
+ };
+
+ lvds-channel@1 {
+@@ -503,6 +507,10 @@
+ remote-endpoint = <&ipu_di1_lvds1>;
+ };
+ };
++
++ port@2 {
++ reg = <2>;
++ };
+ };
+ };
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Wed, 14 Mar 2018 17:36:26 -0300
+Subject: ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 6e1386b2ee6822b00ae944a3de2c3304d2d422e6 ]
+
+sgtl5000 codec needs MCLK clock to be present so that it can
+successfully read/write via I2C.
+
+In the case of wandboard, MCLK is provided via
+MX6QDL_PAD_GPIO_0__CCM_CLKO1 pad.
+
+Move the MCLK pinctrl from hog group to the codec group, so that the
+codec clock can be present prior to reading the codec ID.
+
+This avoids the following error that happens from time to time:
+
+[ 2.484443] sgtl5000 1-000a: Error reading chip id -6
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi | 1 -
+ arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi | 1 -
+ arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi | 1 -
+ arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 8 ++++++++
+ 4 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi
+@@ -17,7 +17,6 @@
+ imx6qdl-wandboard {
+ pinctrl_hog: hoggrp {
+ fsl,pins = <
+- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 /* GPIO_0_CLKO */
+ MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* uSDHC1 CD */
+ MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */
+ MX6QDL_PAD_EIM_EB1__GPIO2_IO29 0x0f0b0 /* WL_REF_ON */
+--- a/arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi
+@@ -17,7 +17,6 @@
+ imx6qdl-wandboard {
+ pinctrl_hog: hoggrp {
+ fsl,pins = <
+- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 /* GPIO_0_CLKO */
+ MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* uSDHC1 CD */
+ MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */
+ MX6QDL_PAD_CSI0_DAT14__GPIO6_IO00 0x0f0b0 /* WIFI_ON (reset, active low) */
+--- a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
+@@ -147,7 +147,6 @@
+ imx6qdl-wandboard {
+ pinctrl_hog: hoggrp {
+ fsl,pins = <
+- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0
+ MX6QDL_PAD_EIM_D22__USB_OTG_PWR 0x80000000 /* USB Power Enable */
+ MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* USDHC1 CD */
+ MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */
+--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+@@ -83,6 +83,8 @@
+ status = "okay";
+
+ codec: sgtl5000@a {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_mclk>;
+ compatible = "fsl,sgtl5000";
+ reg = <0x0a>;
+ clocks = <&clks IMX6QDL_CLK_CKO>;
+@@ -142,6 +144,12 @@
+ >;
+ };
+
++ pinctrl_mclk: mclkgrp {
++ fsl,pins = <
++ MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0
++ >;
++ };
++
+ pinctrl_spdif: spdifgrp {
+ fsl,pins = <
+ MX6QDL_PAD_ENET_RXD0__SPDIF_OUT 0x1b0b0
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 7 May 2018 15:40:04 +0200
+Subject: ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 57a66497e1b7486609250a482f05935eae5035e9 ]
+
+The PMU node references two interrupts, but lacks the interrupt-affinity
+property, which is required in that case:
+
+ hw perfevents: no interrupt-affinity property for /pmu, guessing.
+
+Add the missing property to fix this.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/sh73a0.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/sh73a0.dtsi
++++ b/arch/arm/boot/dts/sh73a0.dtsi
+@@ -22,7 +22,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- cpu@0 {
++ cpu0: cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0>;
+@@ -31,7 +31,7 @@
+ power-domains = <&pd_a2sl>;
+ next-level-cache = <&L2>;
+ };
+- cpu@1 {
++ cpu1: cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <1>;
+@@ -91,6 +91,7 @@
+ compatible = "arm,cortex-a9-pmu";
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>;
+ };
+
+ cmt1: timer@e6138000 {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Patrice Chotard <patrice.chotard@st.com>
+Date: Fri, 20 Apr 2018 17:41:31 +0200
+Subject: ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage
+
+From: Patrice Chotard <patrice.chotard@st.com>
+
+[ Upstream commit e95b8e718f9bd2386a29639dd21c633b4951dc21 ]
+
+Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE")
+kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't
+be used.
+
+Use IRQ_TYPE_LEVEL_HIGH instead.
+
+Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/stih407-pinctrl.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/stih407-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stih407-pinctrl.dtsi
+@@ -52,7 +52,7 @@
+ st,syscfg = <&syscfg_sbc>;
+ reg = <0x0961f080 0x4>;
+ reg-names = "irqmux";
+- interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irqmux";
+ ranges = <0 0x09610000 0x6000>;
+
+@@ -376,7 +376,7 @@
+ st,syscfg = <&syscfg_front>;
+ reg = <0x0920f080 0x4>;
+ reg-names = "irqmux";
+- interrupts = <GIC_SPI 189 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irqmux";
+ ranges = <0 0x09200000 0x10000>;
+
+@@ -936,7 +936,7 @@
+ st,syscfg = <&syscfg_front>;
+ reg = <0x0921f080 0x4>;
+ reg-names = "irqmux";
+- interrupts = <GIC_SPI 190 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irqmux";
+ ranges = <0 0x09210000 0x10000>;
+
+@@ -969,7 +969,7 @@
+ st,syscfg = <&syscfg_rear>;
+ reg = <0x0922f080 0x4>;
+ reg-names = "irqmux";
+- interrupts = <GIC_SPI 191 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irqmux";
+ ranges = <0 0x09220000 0x6000>;
+
+@@ -1164,7 +1164,7 @@
+ st,syscfg = <&syscfg_flash>;
+ reg = <0x0923f080 0x4>;
+ reg-names = "irqmux";
+- interrupts = <GIC_SPI 192 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irqmux";
+ ranges = <0 0x09230000 0x3000>;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Patrice Chotard <patrice.chotard@st.com>
+Date: Fri, 20 Apr 2018 17:41:54 +0200
+Subject: ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage
+
+From: Patrice Chotard <patrice.chotard@st.com>
+
+[ Upstream commit fd827d0ec86bce8d421423ad2c4add84aa23e1b9 ]
+
+Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE")
+kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't
+be used.
+
+Use IRQ_TYPE_LEVEL_HIGH instead.
+
+Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/stih410.dtsi | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/boot/dts/stih410.dtsi
++++ b/arch/arm/boot/dts/stih410.dtsi
+@@ -43,7 +43,7 @@
+ ohci0: usb@9a03c00 {
+ compatible = "st,st-ohci-300x";
+ reg = <0x9a03c00 0x100>;
+- interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+ <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
+@@ -58,7 +58,7 @@
+ ehci0: usb@9a03e00 {
+ compatible = "st,st-ehci-300x";
+ reg = <0x9a03e00 0x100>;
+- interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 151 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb0>;
+ clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+@@ -75,7 +75,7 @@
+ ohci1: usb@9a83c00 {
+ compatible = "st,st-ohci-300x";
+ reg = <0x9a83c00 0x100>;
+- interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 181 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+ <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
+@@ -90,7 +90,7 @@
+ ehci1: usb@9a83e00 {
+ compatible = "st,st-ehci-300x";
+ reg = <0x9a83e00 0x100>;
+- interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb1>;
+ clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+@@ -202,7 +202,7 @@
+ reg = <0x8d04000 0x1000>;
+ reg-names = "hdmi-reg";
+ #sound-dai-cells = <0>;
+- interrupts = <GIC_SPI 106 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "irq";
+ clock-names = "pix",
+ "tmds",
+@@ -254,7 +254,7 @@
+ bdisp0:bdisp@9f10000 {
+ compatible = "st,stih407-bdisp";
+ reg = <0x9f10000 0x1000>;
+- interrupts = <GIC_SPI 38 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "bdisp";
+ clocks = <&clk_s_c0_flexgen CLK_IC_BDISP_0>;
+ };
+@@ -263,8 +263,8 @@
+ compatible = "st,st-hva";
+ reg = <0x8c85000 0x400>, <0x6000000 0x40000>;
+ reg-names = "hva_registers", "hva_esram";
+- interrupts = <GIC_SPI 58 IRQ_TYPE_NONE>,
+- <GIC_SPI 59 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 59 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "clk_hva";
+ clocks = <&clk_s_c0_flexgen CLK_HVA>;
+ };
+@@ -292,7 +292,7 @@
+ reg = <0x94a087c 0x64>;
+ clocks = <&clk_sysin>;
+ clock-names = "cec-clk";
+- interrupts = <GIC_SPI 140 IRQ_TYPE_NONE>;
++ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "cec-irq";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_cec0_default>;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 30 Apr 2018 13:56:32 +0100
+Subject: arm64: cmpwait: Clear event register before arming exclusive monitor
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 1cfc63b5ae60fe7e01773f38132f98d8b13a99a0 ]
+
+When waiting for a cacheline to change state in cmpwait, we may immediately
+wake-up the first time around the outer loop if the event register was
+already set (for example, because of the event stream).
+
+Avoid these spurious wakeups by explicitly clearing the event register
+before loading the cacheline and setting the exclusive monitor.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cmpxchg.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -204,7 +204,9 @@ static inline void __cmpwait_case_##name
+ unsigned long tmp; \
+ \
+ asm volatile( \
+- " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \
++ " sevl\n" \
++ " wfe\n" \
++ " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \
+ " eor %" #w "[tmp], %" #w "[tmp], %" #w "[val]\n" \
+ " cbnz %" #w "[tmp], 1f\n" \
+ " wfe\n" \
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Date: Mon, 16 Apr 2018 11:39:57 -0300
+Subject: arm64: defconfig: Enable Rockchip io-domain driver
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 7c8b77f81552c2b0e5d9c560da70bc4149ce66a5 ]
+
+Heiko Stübner justified pretty well the change in commit e330eb86ba0b
+("ARM: multi_v7_defconfig: enable Rockchip io-domain driver"). This
+change is also needed for arm64 rockchip boards, so, do the same for arm64.
+
+The io-domain driver is necessary to notify the soc about voltages
+changes happening on supplying regulators. Probably the most important
+user right now is the mmc tuning code, where the soc needs to get
+notified when the voltage is dropped to the 1.8V point.
+
+As this option is necessary to successfully tune UHS cards etc, it
+should get built in. Otherwise, tuning will fail with,
+
+ dwmmc_rockchip fe320000.dwmmc: All phases bad!
+ mmc0: tuning execution failed: -5
+
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/configs/defconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -333,6 +333,8 @@ CONFIG_GPIO_XGENE_SB=y
+ CONFIG_GPIO_PCA953X=y
+ CONFIG_GPIO_PCA953X_IRQ=y
+ CONFIG_GPIO_MAX77620=y
++CONFIG_POWER_AVS=y
++CONFIG_ROCKCHIP_IODOMAIN=y
+ CONFIG_POWER_RESET_MSM=y
+ CONFIG_POWER_RESET_XGENE=y
+ CONFIG_POWER_RESET_SYSCON=y
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Mon, 23 Apr 2018 01:40:16 +0000
+Subject: arm64: dts: renesas: salvator-common: use audio-graph-card for Sound
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 06a574c7ef69bd0bd26ed08e35967acb76622ab3 ]
+
+Current Sound is using simple-audio-card which can't support HDMI.
+To use HDMI sound, we need to use audio-graph-card.
+But, one note is that r8a7795 has 2 HDMI ports, but r8a7796 has 1.
+Because of this mismatch, supporting HDMI on salvator-common is
+impossible.
+Thus, this patch exchange sound card to audio-graph-card and keep
+supporting ak4613 as 1st sound node.
+r8a7795/r8a7796 salvator-x{s} need to add HDMI sound individually.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Nguyen Viet Dung <nv-dung@jinso.co.jp>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/salvator-common.dtsi | 38 +++++++++++++----------
+ 1 file changed, 22 insertions(+), 16 deletions(-)
+
+--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+@@ -93,20 +93,12 @@
+ regulator-always-on;
+ };
+
+- rsnd_ak4613: sound {
+- compatible = "simple-audio-card";
++ sound_card: sound {
++ compatible = "audio-graph-card";
+
+- simple-audio-card,format = "left_j";
+- simple-audio-card,bitclock-master = <&sndcpu>;
+- simple-audio-card,frame-master = <&sndcpu>;
++ label = "rcar-sound";
+
+- sndcpu: simple-audio-card,cpu {
+- sound-dai = <&rcar_sound>;
+- };
+-
+- sndcodec: simple-audio-card,codec {
+- sound-dai = <&ak4613>;
+- };
++ dais = <&rsnd_port0>;
+ };
+
+ vbus0_usb2: regulator-vbus0-usb2 {
+@@ -322,6 +314,12 @@
+ asahi-kasei,out4-single-end;
+ asahi-kasei,out5-single-end;
+ asahi-kasei,out6-single-end;
++
++ port {
++ ak4613_endpoint: endpoint {
++ remote-endpoint = <&rsnd_endpoint0>;
++ };
++ };
+ };
+
+ cs2000: clk_multiplier@4f {
+@@ -581,10 +579,18 @@
+ <&audio_clk_c>,
+ <&cpg CPG_CORE CPG_AUDIO_CLK_I>;
+
+- rcar_sound,dai {
+- dai0 {
+- playback = <&ssi0 &src0 &dvc0>;
+- capture = <&ssi1 &src1 &dvc1>;
++ ports {
++ rsnd_port0: port@0 {
++ rsnd_endpoint0: endpoint {
++ remote-endpoint = <&ak4613_endpoint>;
++
++ dai-format = "left_j";
++ bitclock-master = <&rsnd_endpoint0>;
++ frame-master = <&rsnd_endpoint0>;
++
++ playback = <&ssi0 &src0 &dvc0>;
++ capture = <&ssi1 &src1 &dvc1>;
++ };
+ };
+ };
+ };
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 24 Apr 2018 16:39:01 +0100
+Subject: ASoC: compress: Only call free for components which have been opened
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 572e6c8dd174bc6fc7ba5d9b6935e9ec8d2660f5 ]
+
+The core should only call free on a component if said component has
+already had open called on it. This is not presently the case and most
+compressed drivers in the kernel assume it will be. This causes null
+pointer dereferences in the drivers as they attempt clean up for stuff
+that was never put in place.
+
+This is fixed by aborting calling open callbacks once a failure is
+encountered and then during clean up only iterating through the
+component list to that point.
+
+This is a fairly quick fix to the issue, to allow backporting. There
+is more refactoring to follow to tidy the code up a little.
+
+Fixes: 9e7e3738ab0e ("ASoC: snd_soc_component_driver has snd_compr_ops")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-compress.c | 52 +++++++++++++++++++++++++----------------------
+ 1 file changed, 28 insertions(+), 24 deletions(-)
+
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -33,7 +33,7 @@ static int soc_compr_open(struct snd_com
+ struct snd_soc_component *component;
+ struct snd_soc_rtdcom_list *rtdcom;
+ struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+- int ret = 0, __ret;
++ int ret;
+
+ mutex_lock_nested(&rtd->pcm_mutex, rtd->pcm_subclass);
+
+@@ -68,16 +68,15 @@ static int soc_compr_open(struct snd_com
+ !component->driver->compr_ops->open)
+ continue;
+
+- __ret = component->driver->compr_ops->open(cstream);
+- if (__ret < 0) {
++ ret = component->driver->compr_ops->open(cstream);
++ if (ret < 0) {
+ dev_err(component->dev,
+ "Compress ASoC: can't open platform %s: %d\n",
+- component->name, __ret);
+- ret = __ret;
++ component->name, ret);
++ goto machine_err;
+ }
+ }
+- if (ret < 0)
+- goto machine_err;
++ component = NULL;
+
+ if (rtd->dai_link->compr_ops && rtd->dai_link->compr_ops->startup) {
+ ret = rtd->dai_link->compr_ops->startup(cstream);
+@@ -97,17 +96,20 @@ static int soc_compr_open(struct snd_com
+
+ machine_err:
+ for_each_rtdcom(rtd, rtdcom) {
+- component = rtdcom->component;
++ struct snd_soc_component *err_comp = rtdcom->component;
++
++ if (err_comp == component)
++ break;
+
+ /* ignore duplication for now */
+- if (platform && (component == &platform->component))
++ if (platform && (err_comp == &platform->component))
+ continue;
+
+- if (!component->driver->compr_ops ||
+- !component->driver->compr_ops->free)
++ if (!err_comp->driver->compr_ops ||
++ !err_comp->driver->compr_ops->free)
+ continue;
+
+- component->driver->compr_ops->free(cstream);
++ err_comp->driver->compr_ops->free(cstream);
+ }
+
+ if (platform && platform->driver->compr_ops && platform->driver->compr_ops->free)
+@@ -132,7 +134,7 @@ static int soc_compr_open_fe(struct snd_
+ struct snd_soc_dpcm *dpcm;
+ struct snd_soc_dapm_widget_list *list;
+ int stream;
+- int ret = 0, __ret;
++ int ret;
+
+ if (cstream->direction == SND_COMPRESS_PLAYBACK)
+ stream = SNDRV_PCM_STREAM_PLAYBACK;
+@@ -172,16 +174,15 @@ static int soc_compr_open_fe(struct snd_
+ !component->driver->compr_ops->open)
+ continue;
+
+- __ret = component->driver->compr_ops->open(cstream);
+- if (__ret < 0) {
++ ret = component->driver->compr_ops->open(cstream);
++ if (ret < 0) {
+ dev_err(component->dev,
+ "Compress ASoC: can't open platform %s: %d\n",
+- component->name, __ret);
+- ret = __ret;
++ component->name, ret);
++ goto machine_err;
+ }
+ }
+- if (ret < 0)
+- goto machine_err;
++ component = NULL;
+
+ if (fe->dai_link->compr_ops && fe->dai_link->compr_ops->startup) {
+ ret = fe->dai_link->compr_ops->startup(cstream);
+@@ -236,17 +237,20 @@ fe_err:
+ fe->dai_link->compr_ops->shutdown(cstream);
+ machine_err:
+ for_each_rtdcom(fe, rtdcom) {
+- component = rtdcom->component;
++ struct snd_soc_component *err_comp = rtdcom->component;
++
++ if (err_comp == component)
++ break;
+
+ /* ignore duplication for now */
+- if (platform && (component == &platform->component))
++ if (platform && (err_comp == &platform->component))
+ continue;
+
+- if (!component->driver->compr_ops ||
+- !component->driver->compr_ops->free)
++ if (!err_comp->driver->compr_ops ||
++ !err_comp->driver->compr_ops->free)
+ continue;
+
+- component->driver->compr_ops->free(cstream);
++ err_comp->driver->compr_ops->free(cstream);
+ }
+
+ if (platform && platform->driver->compr_ops && platform->driver->compr_ops->free)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kai Chieh Chuang <kaichieh.chuang@mediatek.com>
+Date: Mon, 28 May 2018 10:18:18 +0800
+Subject: ASoC: dpcm: fix BE dai not hw_free and shutdown
+
+From: Kai Chieh Chuang <kaichieh.chuang@mediatek.com>
+
+[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ]
+
+In case, one BE is used by two FE1/FE2
+FE1--->BE-->
+ |
+FE2----]
+when FE1/FE2 call dpcm_be_dai_hw_free() together
+the BE users will be 2 (> 1), hence cannot be hw_free
+the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP
+
+later FE1/FE2 call dpcm_be_dai_shutdown(),
+will be skip due to wrong state.
+leaving the BE not being hw_free and shutdown.
+
+The BE dai will be hw_free later when calling
+dpcm_be_dai_shutdown() if still in invalid state.
+
+Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-pcm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1965,8 +1965,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_
+ continue;
+
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN))
+- continue;
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) {
++ soc_pcm_hw_free(be_substream);
++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
++ }
+
+ dev_dbg(be->dev, "ASoC: close BE %s\n",
+ be->dai_link->name);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Wed, 25 Apr 2018 19:53:52 -0300
+Subject: ASoC: fsl_ssi: Use u32 variable type when using regmap_read()
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 671f8204b12fae98dcc6fc5a5703a5c62cbea187 ]
+
+Convert the sisr and sisr2 variable types to u32 to avoid the following
+sparse warnings:
+
+sound/soc/fsl/fsl_ssi.c:391:42: warning: incorrect type in argument 3 (different base types)
+sound/soc/fsl/fsl_ssi.c:391:42: expected unsigned int *val
+sound/soc/fsl/fsl_ssi.c:391:42: got restricted __be32 *<noident>
+sound/soc/fsl/fsl_ssi.c:393:17: warning: restricted __be32 degrades to integer
+sound/soc/fsl/fsl_ssi.c:393:15: warning: incorrect type in assignment (different base types)
+sound/soc/fsl/fsl_ssi.c:393:15: expected restricted __be32 [usertype] sisr2
+sound/soc/fsl/fsl_ssi.c:393:15: got unsigned int
+sound/soc/fsl/fsl_ssi.c:396:50: warning: incorrect type in argument 3 (different base types)
+sound/soc/fsl/fsl_ssi.c:396:50: expected unsigned int [unsigned] val
+sound/soc/fsl/fsl_ssi.c:396:50: got restricted __be32 [usertype] sisr2
+sound/soc/fsl/fsl_ssi.c:398:42: warning: incorrect type in argument 2 (different base types)
+sound/soc/fsl/fsl_ssi.c:398:42: expected unsigned int [unsigned] [usertype] sisr
+sound/soc/fsl/fsl_ssi.c:398:42: got restricted __be32 [addressable] [usertype] sisr
+
+In other places where regmap_read() is used a u32 variable is passed
+to store the register read value, so do the same here as well.
+
+regmap API already takes care of endianness, so the usage of u32 is safe.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/fsl/fsl_ssi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -385,8 +385,7 @@ static irqreturn_t fsl_ssi_isr(int irq,
+ {
+ struct fsl_ssi *ssi = dev_id;
+ struct regmap *regs = ssi->regs;
+- __be32 sisr;
+- __be32 sisr2;
++ u32 sisr, sisr2;
+
+ regmap_read(regs, REG_SSI_SISR, &sisr);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+Date: Wed, 4 Apr 2018 06:19:38 +0200
+Subject: ASoC: topology: Add missing clock gating parameter when parsing hw_configs
+
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+
+[ Upstream commit 933e1c4a667103c4d10ebdc9505a0a6abd8c3fbd ]
+
+Clock gating parameter is a part of `dai_fmt`. It is supported by
+`alsa-lib` when creating a topology binary file, but ignored by kernel
+when loading this topology file.
+
+After applying this commit, the clock gating parameter is not ignored any
+more. This solution is backwards compatible. The existing behaviour is
+not broken, because by default the parameter value is 0 and is ignored.
+
+snd_soc_tplg_hw_config.clock_gated = 0 => no effect
+snd_soc_tplg_hw_config.clock_gated = 1 => SND_SOC_DAIFMT_GATED
+snd_soc_tplg_hw_config.clock_gated = 2 => SND_SOC_DAIFMT_CONT
+
+For example, the following config, based on
+alsa-lib/src/conf/topology/broadwell/broadwell.conf, is now supported:
+
+~~~~
+SectionHWConfig."CodecHWConfig" {
+ id "1"
+ format "I2S" # physical audio format.
+ pm_gate_clocks "true" # clock can be gated
+}
+
+SectionLink."Codec" {
+
+ # used for binding to the physical link
+ id "0"
+
+ hw_configs [
+ "CodecHWConfig"
+ ]
+
+ default_hw_conf_id "1"
+}
+~~~~
+
+Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Pan Xiuli <xiuli.pan@linux.intel.com>
+Cc: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/sound/asoc.h | 7 ++++++-
+ sound/soc/soc-topology.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/include/uapi/sound/asoc.h
++++ b/include/uapi/sound/asoc.h
+@@ -139,6 +139,11 @@
+ #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS (1 << 1)
+ #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2)
+
++/* DAI clock gating */
++#define SND_SOC_TPLG_DAI_CLK_GATE_UNDEFINED 0
++#define SND_SOC_TPLG_DAI_CLK_GATE_GATED 1
++#define SND_SOC_TPLG_DAI_CLK_GATE_CONT 2
++
+ /* DAI physical PCM data formats.
+ * Add new formats to the end of the list.
+ */
+@@ -324,7 +329,7 @@ struct snd_soc_tplg_hw_config {
+ __le32 size; /* in bytes of this structure */
+ __le32 id; /* unique ID - - used to match */
+ __le32 fmt; /* SND_SOC_DAI_FORMAT_ format value */
+- __u8 clock_gated; /* 1 if clock can be gated to save power */
++ __u8 clock_gated; /* SND_SOC_TPLG_DAI_CLK_GATE_ value */
+ __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */
+ __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */
+ __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2006,6 +2006,13 @@ static void set_link_hw_format(struct sn
+
+ link->dai_fmt = hw_config->fmt & SND_SOC_DAIFMT_FORMAT_MASK;
+
++ /* clock gating */
++ if (hw_config->clock_gated == SND_SOC_TPLG_DAI_CLK_GATE_GATED)
++ link->dai_fmt |= SND_SOC_DAIFMT_GATED;
++ else if (hw_config->clock_gated ==
++ SND_SOC_TPLG_DAI_CLK_GATE_CONT)
++ link->dai_fmt |= SND_SOC_DAIFMT_CONT;
++
+ /* clock signal polarity */
+ invert_bclk = hw_config->invert_bclk;
+ invert_fsync = hw_config->invert_fsync;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+Date: Wed, 4 Apr 2018 06:19:37 +0200
+Subject: ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format()
+
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+
+[ Upstream commit a941e2fab3207cb0d57dc4ec47b1b12c8ea78b84 ]
+
+The values of bclk and fsync are inverted WRT the codec. But the existing
+solution already works for Broadwell, see the alsa-lib config:
+
+`alsa-lib/src/conf/topology/broadwell/broadwell.conf`
+
+This commit provides the backwards-compatible solution to fix this misuse.
+
+Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Tested-by: Pan Xiuli <xiuli.pan@linux.intel.com>
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/sound/asoc.h | 16 ++++++++++++++--
+ sound/soc/soc-topology.c | 12 +++++++-----
+ 2 files changed, 21 insertions(+), 7 deletions(-)
+
+--- a/include/uapi/sound/asoc.h
++++ b/include/uapi/sound/asoc.h
+@@ -160,6 +160,18 @@
+ #define SND_SOC_TPLG_LNK_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2)
+ #define SND_SOC_TPLG_LNK_FLGBIT_VOICE_WAKEUP (1 << 3)
+
++/* DAI topology BCLK parameter
++ * For the backwards capability, by default codec is bclk master
++ */
++#define SND_SOC_TPLG_BCLK_CM 0 /* codec is bclk master */
++#define SND_SOC_TPLG_BCLK_CS 1 /* codec is bclk slave */
++
++/* DAI topology FSYNC parameter
++ * For the backwards capability, by default codec is fsync master
++ */
++#define SND_SOC_TPLG_FSYNC_CM 0 /* codec is fsync master */
++#define SND_SOC_TPLG_FSYNC_CS 1 /* codec is fsync slave */
++
+ /*
+ * Block Header.
+ * This header precedes all object and object arrays below.
+@@ -315,8 +327,8 @@ struct snd_soc_tplg_hw_config {
+ __u8 clock_gated; /* 1 if clock can be gated to save power */
+ __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */
+ __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */
+- __u8 bclk_master; /* 1 for master of BCLK, 0 for slave */
+- __u8 fsync_master; /* 1 for master of FSYNC, 0 for slave */
++ __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */
++ __u8 fsync_master; /* SND_SOC_TPLG_FSYNC_ value */
+ __u8 mclk_direction; /* 0 for input, 1 for output */
+ __le16 reserved; /* for 32bit alignment */
+ __le32 mclk_rate; /* MCLK or SYSCLK freqency in Hz */
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2019,13 +2019,15 @@ static void set_link_hw_format(struct sn
+ link->dai_fmt |= SND_SOC_DAIFMT_IB_IF;
+
+ /* clock masters */
+- bclk_master = hw_config->bclk_master;
+- fsync_master = hw_config->fsync_master;
+- if (!bclk_master && !fsync_master)
++ bclk_master = (hw_config->bclk_master ==
++ SND_SOC_TPLG_BCLK_CM);
++ fsync_master = (hw_config->fsync_master ==
++ SND_SOC_TPLG_FSYNC_CM);
++ if (bclk_master && fsync_master)
+ link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM;
+- else if (bclk_master && !fsync_master)
+- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM;
+ else if (!bclk_master && fsync_master)
++ link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM;
++ else if (bclk_master && !fsync_master)
+ link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFS;
+ else
+ link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:11:14 +0300
+Subject: ath: Add regulatory mapping for APL13_WORLD
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ]
+
+The regdomain code is used to select the correct the correct conformance
+test limits (CTL) for a country. If the regdomain code isn't available and
+it is still programmed in the EEPROM then it will cause an error and stop
+the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this regdomain code are:
+
+* 2.4GHz: ETSI
+* 5GHz: ETSI
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd_common.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -69,6 +69,7 @@ enum EnumRd {
+ APL1_ETSIC = 0x55,
+ APL2_ETSIC = 0x56,
+ APL5_WORLD = 0x58,
++ APL13_WORLD = 0x5A,
+ APL6_WORLD = 0x5B,
+ APL7_FCCA = 0x5C,
+ APL8_WORLD = 0x5D,
+@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo
+ {APL3_WORLD, CTL_FCC, CTL_ETSI},
+ {APL4_WORLD, CTL_FCC, CTL_ETSI},
+ {APL5_WORLD, CTL_FCC, CTL_ETSI},
++ {APL13_WORLD, CTL_ETSI, CTL_ETSI},
+ {APL6_WORLD, CTL_ETSI, CTL_ETSI},
+ {APL8_WORLD, CTL_ETSI, CTL_ETSI},
+ {APL9_WORLD, CTL_ETSI, CTL_ETSI},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:11:05 +0300
+Subject: ath: Add regulatory mapping for APL2_FCCA
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ]
+
+The regdomain code is used to select the correct the correct conformance
+test limits (CTL) for a country. If the regdomain code isn't available and
+it is still programmed in the EEPROM then it will cause an error and stop
+the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this regdomain code are:
+
+* 2.4GHz: FCC
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd_common.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -61,6 +61,7 @@ enum EnumRd {
+ MKK1_MKKA1 = 0x4A,
+ MKK1_MKKA2 = 0x4B,
+ MKK1_MKKC = 0x4C,
++ APL2_FCCA = 0x4D,
+
+ APL3_FCCA = 0x50,
+ APL1_WORLD = 0x52,
+@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo
+ {FCC1_FCCA, CTL_FCC, CTL_FCC},
+ {APL1_WORLD, CTL_FCC, CTL_ETSI},
+ {APL2_WORLD, CTL_FCC, CTL_ETSI},
++ {APL2_FCCA, CTL_FCC, CTL_FCC},
+ {APL3_WORLD, CTL_FCC, CTL_ETSI},
+ {APL4_WORLD, CTL_FCC, CTL_ETSI},
+ {APL5_WORLD, CTL_FCC, CTL_ETSI},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:09:53 +0300
+Subject: ath: Add regulatory mapping for Bahamas
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ]
+
+The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
+and to select the correct conformance test limits (CTL) for a country. If
+the country isn't available and it is still programmed in the EEPROM then
+it will cause an error and stop the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this country are:
+
+* 2.4GHz: ETSI
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd.h | 1 +
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -68,6 +68,7 @@ enum CountryCode {
+ CTRY_AUSTRALIA = 36,
+ CTRY_AUSTRIA = 40,
+ CTRY_AZERBAIJAN = 31,
++ CTRY_BAHAMAS = 44,
+ CTRY_BAHRAIN = 48,
+ CTRY_BANGLADESH = 50,
+ CTRY_BARBADOS = 52,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al
+ {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
+ {CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
+ {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
++ {CTRY_BAHAMAS, FCC3_WORLD, "BS"},
+ {CTRY_BAHRAIN, APL6_WORLD, "BH"},
+ {CTRY_BANGLADESH, NULL1_WORLD, "BD"},
+ {CTRY_BARBADOS, FCC2_WORLD, "BB"},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:09:59 +0300
+Subject: ath: Add regulatory mapping for Bermuda
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ]
+
+The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
+and to select the correct conformance test limits (CTL) for a country. If
+the country isn't available and it is still programmed in the EEPROM then
+it will cause an error and stop the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this country are:
+
+* 2.4GHz: FCC
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd.h | 1 +
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -74,6 +74,7 @@ enum CountryCode {
+ CTRY_BELARUS = 112,
+ CTRY_BELGIUM = 56,
+ CTRY_BELIZE = 84,
++ CTRY_BERMUDA = 60,
+ CTRY_BOLIVIA = 68,
+ CTRY_BOSNIA_HERZ = 70,
+ CTRY_BRAZIL = 76,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al
+ {CTRY_BELGIUM, ETSI1_WORLD, "BE"},
+ {CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
+ {CTRY_BELIZE, APL1_ETSIC, "BZ"},
++ {CTRY_BERMUDA, FCC3_FCCA, "BM"},
+ {CTRY_BOLIVIA, APL1_ETSIC, "BO"},
+ {CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"},
+ {CTRY_BRAZIL, FCC3_WORLD, "BR"},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:11:18 +0300
+Subject: ath: Add regulatory mapping for ETSI8_WORLD
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ]
+
+The regdomain code is used to select the correct the correct conformance
+test limits (CTL) for a country. If the regdomain code isn't available and
+it is still programmed in the EEPROM then it will cause an error and stop
+the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this regdomain code are:
+
+* 2.4GHz: ETSI
+* 5GHz: ETSI
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd_common.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -45,6 +45,7 @@ enum EnumRd {
+ ETSI4_ETSIC = 0x38,
+ ETSI5_WORLD = 0x39,
+ ETSI6_WORLD = 0x34,
++ ETSI8_WORLD = 0x3D,
+ ETSI_RESERVED = 0x33,
+
+ MKK1_MKKA = 0x40,
+@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo
+ {ETSI4_WORLD, CTL_ETSI, CTL_ETSI},
+ {ETSI5_WORLD, CTL_ETSI, CTL_ETSI},
+ {ETSI6_WORLD, CTL_ETSI, CTL_ETSI},
++ {ETSI8_WORLD, CTL_ETSI, CTL_ETSI},
+
+ /* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */
+ {ETSI3_ETSIA, CTL_ETSI, CTL_ETSI},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:11:30 +0300
+Subject: ath: Add regulatory mapping for FCC3_ETSIC
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ]
+
+The regdomain code is used to select the correct the correct conformance
+test limits (CTL) for a country. If the regdomain code isn't available and
+it is still programmed in the EEPROM then it will cause an error and stop
+the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this regdomain code are:
+
+* 2.4GHz: ETSI
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd_common.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -35,6 +35,7 @@ enum EnumRd {
+ FRANCE_RES = 0x31,
+ FCC3_FCCA = 0x3A,
+ FCC3_WORLD = 0x3B,
++ FCC3_ETSIC = 0x3F,
+
+ ETSI1_WORLD = 0x37,
+ ETSI3_ETSIA = 0x32,
+@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo
+ {FCC2_ETSIC, CTL_FCC, CTL_ETSI},
+ {FCC3_FCCA, CTL_FCC, CTL_FCC},
+ {FCC3_WORLD, CTL_FCC, CTL_ETSI},
++ {FCC3_ETSIC, CTL_FCC, CTL_ETSI},
+ {FCC4_FCCA, CTL_FCC, CTL_FCC},
+ {FCC5_FCCA, CTL_FCC, CTL_FCC},
+ {FCC6_FCCA, CTL_FCC, CTL_FCC},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:10:43 +0300
+Subject: ath: Add regulatory mapping for Serbia
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ]
+
+The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
+and to select the correct conformance test limits (CTL) for a country. If
+the country isn't available and it is still programmed in the EEPROM then
+it will cause an error and stop the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this country are:
+
+* 2.4GHz: ETSI
+* 5GHz: ETSI
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd.h | 1 +
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -159,6 +159,7 @@ enum CountryCode {
+ CTRY_ROMANIA = 642,
+ CTRY_RUSSIA = 643,
+ CTRY_SAUDI_ARABIA = 682,
++ CTRY_SERBIA = 688,
+ CTRY_SERBIA_MONTENEGRO = 891,
+ CTRY_SINGAPORE = 702,
+ CTRY_SLOVAKIA = 703,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al
+ {CTRY_ROMANIA, NULL1_WORLD, "RO"},
+ {CTRY_RUSSIA, NULL1_WORLD, "RU"},
+ {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
++ {CTRY_SERBIA, ETSI1_WORLD, "RS"},
+ {CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"},
+ {CTRY_SINGAPORE, APL6_WORLD, "SG"},
+ {CTRY_SLOVAKIA, ETSI1_WORLD, "SK"},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:10:48 +0300
+Subject: ath: Add regulatory mapping for Tanzania
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ]
+
+The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
+and to select the correct conformance test limits (CTL) for a country. If
+the country isn't available and it is still programmed in the EEPROM then
+it will cause an error and stop the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this country are:
+
+* 2.4GHz: ETSI
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd.h | 1 +
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -170,6 +170,7 @@ enum CountryCode {
+ CTRY_SWITZERLAND = 756,
+ CTRY_SYRIA = 760,
+ CTRY_TAIWAN = 158,
++ CTRY_TANZANIA = 834,
+ CTRY_THAILAND = 764,
+ CTRY_TRINIDAD_Y_TOBAGO = 780,
+ CTRY_TUNISIA = 788,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al
+ {CTRY_SWITZERLAND, ETSI1_WORLD, "CH"},
+ {CTRY_SYRIA, NULL1_WORLD, "SY"},
+ {CTRY_TAIWAN, APL3_FCCA, "TW"},
++ {CTRY_TANZANIA, APL1_WORLD, "TZ"},
+ {CTRY_THAILAND, FCC3_WORLD, "TH"},
+ {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
+ {CTRY_TUNISIA, ETSI3_WORLD, "TN"},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Wed, 23 May 2018 11:10:54 +0300
+Subject: ath: Add regulatory mapping for Uganda
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ]
+
+The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
+and to select the correct conformance test limits (CTL) for a country. If
+the country isn't available and it is still programmed in the EEPROM then
+it will cause an error and stop the initialization with:
+
+ Invalid EEPROM contents
+
+The current CTL mappings for this country are:
+
+* 2.4GHz: ETSI
+* 5GHz: FCC
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/regd.h | 1 +
+ drivers/net/wireless/ath/regd_common.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -175,6 +175,7 @@ enum CountryCode {
+ CTRY_TUNISIA = 788,
+ CTRY_TURKEY = 792,
+ CTRY_UAE = 784,
++ CTRY_UGANDA = 800,
+ CTRY_UKRAINE = 804,
+ CTRY_UNITED_KINGDOM = 826,
+ CTRY_UNITED_STATES = 840,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al
+ {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
+ {CTRY_TUNISIA, ETSI3_WORLD, "TN"},
+ {CTRY_TURKEY, ETSI3_WORLD, "TR"},
++ {CTRY_UGANDA, FCC3_WORLD, "UG"},
+ {CTRY_UKRAINE, NULL1_WORLD, "UA"},
+ {CTRY_UAE, NULL1_WORLD, "AE"},
+ {CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Tamizh Chelvam <tamizhr@codeaurora.org>
+Date: Wed, 25 Apr 2018 11:36:44 +0300
+Subject: ath10k: fix kernel panic while reading tpc_stats
+
+From: Tamizh Chelvam <tamizhr@codeaurora.org>
+
+[ Upstream commit 4b190675ad06f5a6ecbeef0b01890c5fb372e3eb ]
+
+When attempt to read tpc_stats for the chipsets which support
+more than 3 tx chain will trigger kernel panic(kernel stack is corrupted)
+due to writing values on rate_code array out of range.
+This patch changes the array size depends on the WMI_TPC_TX_N_CHAIN and
+added check to avoid write values on the array if the num tx chain
+get in tpc config event is greater than WMI_TPC_TX_N_CHAIN.
+
+Tested on QCA9984 with firmware-5.bin_10.4-3.5.3-00057
+
+Kernel panic log :
+
+[ 323.510944] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf90c654
+[ 323.510944]
+[ 323.524390] CPU: 0 PID: 1908 Comm: cat Not tainted 3.14.77 #31
+[ 323.530224] [<c021db48>] (unwind_backtrace) from [<c021ac08>] (show_stack+0x10/0x14)
+[ 323.537941] [<c021ac08>] (show_stack) from [<c03c53c0>] (dump_stack+0x80/0xa0)
+[ 323.545146] [<c03c53c0>] (dump_stack) from [<c022e4ac>] (panic+0x84/0x1e4)
+[ 323.552000] [<c022e4ac>] (panic) from [<c022e61c>] (__stack_chk_fail+0x10/0x14)
+[ 323.559350] [<c022e61c>] (__stack_chk_fail) from [<bf90c654>] (ath10k_wmi_event_pdev_tpc_config+0x424/0x438 [ath10k_core])
+[ 323.570471] [<bf90c654>] (ath10k_wmi_event_pdev_tpc_config [ath10k_core]) from [<bf90d800>] (ath10k_wmi_10_4_op_rx+0x2f0/0x39c [ath10k_core])
+[ 323.583047] [<bf90d800>] (ath10k_wmi_10_4_op_rx [ath10k_core]) from [<bf8fcc18>] (ath10k_htc_rx_completion_handler+0x170/0x1a0 [ath10k_core])
+[ 323.595702] [<bf8fcc18>] (ath10k_htc_rx_completion_handler [ath10k_core]) from [<bf961f44>] (ath10k_pci_hif_send_complete_check+0x1f0/0x220 [ath10k_pci])
+[ 323.609421] [<bf961f44>] (ath10k_pci_hif_send_complete_check [ath10k_pci]) from [<bf96562c>] (ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci])
+[ 323.622490] [<bf96562c>] (ath10k_ce_per_engine_service [ath10k_pci]) from [<bf9656f0>] (ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci])
+[ 323.635423] [<bf9656f0>] (ath10k_ce_per_engine_service_any [ath10k_pci]) from [<bf96365c>] (ath10k_pci_napi_poll+0x44/0xe8 [ath10k_pci])
+[ 323.647665] [<bf96365c>] (ath10k_pci_napi_poll [ath10k_pci]) from [<c0599994>] (net_rx_action+0xac/0x160)
+[ 323.657208] [<c0599994>] (net_rx_action) from [<c02324a4>] (__do_softirq+0x104/0x294)
+[ 323.665017] [<c02324a4>] (__do_softirq) from [<c0232920>] (irq_exit+0x9c/0x11c)
+[ 323.672314] [<c0232920>] (irq_exit) from [<c0217fc0>] (handle_IRQ+0x6c/0x90)
+[ 323.679341] [<c0217fc0>] (handle_IRQ) from [<c02084e0>] (gic_handle_irq+0x3c/0x60)
+[ 323.686893] [<c02084e0>] (gic_handle_irq) from [<c02095c0>] (__irq_svc+0x40/0x70)
+[ 323.694349] Exception stack(0xdd489c58 to 0xdd489ca0)
+[ 323.699384] 9c40: 00000000 a0000013
+[ 323.707547] 9c60: 00000000 dc4bce40 60000013 ddc1d800 dd488000 00000990 00000000 c085c800
+[ 323.715707] 9c80: 00000000 dd489d44 0000092d dd489ca0 c026e664 c026e668 60000013 ffffffff
+[ 323.723877] [<c02095c0>] (__irq_svc) from [<c026e668>] (rcu_note_context_switch+0x170/0x184)
+[ 323.732298] [<c026e668>] (rcu_note_context_switch) from [<c020e928>] (__schedule+0x50/0x4d4)
+[ 323.740716] [<c020e928>] (__schedule) from [<c020e490>] (schedule_timeout+0x148/0x178)
+[ 323.748611] [<c020e490>] (schedule_timeout) from [<c020f804>] (wait_for_common+0x114/0x154)
+[ 323.756972] [<c020f804>] (wait_for_common) from [<bf8f6ef0>] (ath10k_tpc_stats_open+0xc8/0x340 [ath10k_core])
+[ 323.766873] [<bf8f6ef0>] (ath10k_tpc_stats_open [ath10k_core]) from [<c02bb598>] (do_dentry_open+0x1ac/0x274)
+[ 323.776741] [<c02bb598>] (do_dentry_open) from [<c02c838c>] (do_last+0x8c0/0xb08)
+[ 323.784201] [<c02c838c>] (do_last) from [<c02c87e4>] (path_openat+0x210/0x598)
+[ 323.791408] [<c02c87e4>] (path_openat) from [<c02c9d1c>] (do_filp_open+0x2c/0x78)
+[ 323.798873] [<c02c9d1c>] (do_filp_open) from [<c02bc85c>] (do_sys_open+0x114/0x1b4)
+[ 323.806509] [<c02bc85c>] (do_sys_open) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
+[ 323.814241] CPU1: stopping
+[ 323.816927] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.77 #31
+[ 323.823008] [<c021db48>] (unwind_backtrace) from [<c021ac08>] (show_stack+0x10/0x14)
+[ 323.830731] [<c021ac08>] (show_stack) from [<c03c53c0>] (dump_stack+0x80/0xa0)
+[ 323.837934] [<c03c53c0>] (dump_stack) from [<c021cfac>] (handle_IPI+0xb8/0x140)
+[ 323.845224] [<c021cfac>] (handle_IPI) from [<c02084fc>] (gic_handle_irq+0x58/0x60)
+[ 323.852774] [<c02084fc>] (gic_handle_irq) from [<c02095c0>] (__irq_svc+0x40/0x70)
+[ 323.860233] Exception stack(0xdd499fa0 to 0xdd499fe8)
+[ 323.865273] 9fa0: ffffffed 00000000 1d3c9000 00000000 dd498000 dd498030 10c0387d c08b62c8
+[ 323.873432] 9fc0: 4220406a 512f04d0 00000000 00000000 00000001 dd499fe8 c021838c c0218390
+[ 323.881588] 9fe0: 60000013 ffffffff
+[ 323.885070] [<c02095c0>] (__irq_svc) from [<c0218390>] (arch_cpu_idle+0x30/0x50)
+[ 323.892454] [<c0218390>] (arch_cpu_idle) from [<c026500c>] (cpu_startup_entry+0xa4/0x108)
+[ 323.900690] [<c026500c>] (cpu_startup_entry) from [<422085a4>] (0x422085a4)
+
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/debug.c | 8 +++++++-
+ drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++++
+ drivers/net/wireless/ath/ath10k/wmi.h | 2 +-
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/debug.c
++++ b/drivers/net/wireless/ath/ath10k/debug.c
+@@ -1519,7 +1519,13 @@ static void ath10k_tpc_stats_print(struc
+ *len += scnprintf(buf + *len, buf_len - *len,
+ "********************************\n");
+ *len += scnprintf(buf + *len, buf_len - *len,
+- "No. Preamble Rate_code tpc_value1 tpc_value2 tpc_value3\n");
++ "No. Preamble Rate_code ");
++
++ for (i = 0; i < WMI_TPC_TX_N_CHAIN; i++)
++ *len += scnprintf(buf + *len, buf_len - *len,
++ "tpc_value%d ", i);
++
++ *len += scnprintf(buf + *len, buf_len - *len, "\n");
+
+ for (i = 0; i < tpc_stats->rate_max; i++) {
+ *len += scnprintf(buf + *len, buf_len - *len,
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -4479,6 +4479,12 @@ void ath10k_wmi_event_pdev_tpc_config(st
+
+ num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
+
++ if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
++ ath10k_warn(ar, "number of tx chain is %d greater than TPC configured tx chain %d\n",
++ num_tx_chain, WMI_TPC_TX_N_CHAIN);
++ return;
++ }
++
+ ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
+ num_tx_chain);
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -4008,9 +4008,9 @@ struct wmi_pdev_get_tpc_config_cmd {
+ } __packed;
+
+ #define WMI_TPC_CONFIG_PARAM 1
+-#define WMI_TPC_RATE_MAX 160
+ #define WMI_TPC_FINAL_RATE_MAX 240
+ #define WMI_TPC_TX_N_CHAIN 4
++#define WMI_TPC_RATE_MAX (WMI_TPC_TX_N_CHAIN * 65)
+ #define WMI_TPC_PREAM_TABLE_MAX 10
+ #define WMI_TPC_FLAG 3
+ #define WMI_TPC_BUF_SIZE 10
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Fri, 13 Apr 2018 17:40:26 +0300
+Subject: ath10k: search all IEs for variant before falling back
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit c8489668065a283d3027e86e877b103a87f99d22 ]
+
+commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file
+extension") added a feature to ath10k that allows Board Data File
+(BDF) conflicts between multiple devices that use the same device IDs
+but have different calibration requirements to be resolved by allowing
+a "variant" string to be stored in SMBIOS [and later device tree, added
+by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration-
+variant")] that gets appended to the ID stored in board-2.bin.
+
+This original patch had a regression, however. Namely that devices with
+a variant present in SMBIOS that didn't need custom BDFs could no longer
+find the default BDF, which has no variant appended. The patch was
+reverted and re-applied with a fix for this issue in commit 1657b8f84ed9
+("search SMBIOS for OEM board file extension").
+
+But the fix to fall back to a default BDF introduced another issue: the
+driver currently parses IEs in board-2.bin one by one, and for each one
+it first checks to see if it matches the ID with the variant appended.
+If it doesn't, it checks to see if it matches the "fallback" ID with no
+variant. If a matching BDF is found at any point during this search, the
+search is terminated and that BDF is used. The issue is that it's very
+possible (and is currently the case for board-2.bin files present in the
+ath10k-firmware repository) for the default BDF to occur in an earlier
+IE than the variant-specific BDF. In this case, the current code will
+happily choose the default BDF even though a better-matching BDF is
+present later in the file.
+
+This patch fixes the issue by first searching the entire file for the ID
+with variant, and searching for the fallback ID only if that search
+fails. It also includes some code cleanup in the area, as
+ath10k_core_fetch_board_data_api_n() no longer does its own string
+mangling to remove the variant from an ID, instead leaving that job to a
+new flag passed to ath10k_core_create_board_name().
+
+I've tested this patch on a QCA4019 and verified that the driver behaves
+correctly for 1) both fallback and variant BDFs present, 2) only fallback
+BDF present, and 3) no matching BDFs present.
+
+Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension")
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 134 +++++++++++++++++----------------
+ 1 file changed, 72 insertions(+), 62 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1253,14 +1253,61 @@ out:
+ return ret;
+ }
+
++static int ath10k_core_search_bd(struct ath10k *ar,
++ const char *boardname,
++ const u8 *data,
++ size_t len)
++{
++ size_t ie_len;
++ struct ath10k_fw_ie *hdr;
++ int ret = -ENOENT, ie_id;
++
++ while (len > sizeof(struct ath10k_fw_ie)) {
++ hdr = (struct ath10k_fw_ie *)data;
++ ie_id = le32_to_cpu(hdr->id);
++ ie_len = le32_to_cpu(hdr->len);
++
++ len -= sizeof(*hdr);
++ data = hdr->data;
++
++ if (len < ALIGN(ie_len, 4)) {
++ ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
++ ie_id, ie_len, len);
++ return -EINVAL;
++ }
++
++ switch (ie_id) {
++ case ATH10K_BD_IE_BOARD:
++ ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
++ boardname);
++ if (ret == -ENOENT)
++ /* no match found, continue */
++ break;
++
++ /* either found or error, so stop searching */
++ goto out;
++ }
++
++ /* jump over the padding */
++ ie_len = ALIGN(ie_len, 4);
++
++ len -= ie_len;
++ data += ie_len;
++ }
++
++out:
++ /* return result of parse_bd_ie_board() or -ENOENT */
++ return ret;
++}
++
+ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
+ const char *boardname,
++ const char *fallback_boardname,
+ const char *filename)
+ {
+- size_t len, magic_len, ie_len;
+- struct ath10k_fw_ie *hdr;
++ size_t len, magic_len;
+ const u8 *data;
+- int ret, ie_id;
++ int ret;
+
+ ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ ar->hw_params.fw.dir,
+@@ -1298,69 +1345,23 @@ static int ath10k_core_fetch_board_data_
+ data += magic_len;
+ len -= magic_len;
+
+- while (len > sizeof(struct ath10k_fw_ie)) {
+- hdr = (struct ath10k_fw_ie *)data;
+- ie_id = le32_to_cpu(hdr->id);
+- ie_len = le32_to_cpu(hdr->len);
+-
+- len -= sizeof(*hdr);
+- data = hdr->data;
+-
+- if (len < ALIGN(ie_len, 4)) {
+- ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
+- ie_id, ie_len, len);
+- ret = -EINVAL;
+- goto err;
+- }
++ /* attempt to find boardname in the IE list */
++ ret = ath10k_core_search_bd(ar, boardname, data, len);
+
+- switch (ie_id) {
+- case ATH10K_BD_IE_BOARD:
+- ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
+- boardname);
+- if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
+- /* try default bdf if variant was not found */
+- char *s, *v = ",variant=";
+- char boardname2[100];
+-
+- strlcpy(boardname2, boardname,
+- sizeof(boardname2));
+-
+- s = strstr(boardname2, v);
+- if (s)
+- *s = '\0'; /* strip ",variant=%s" */
+-
+- ret = ath10k_core_parse_bd_ie_board(ar, data,
+- ie_len,
+- boardname2);
+- }
++ /* if we didn't find it and have a fallback name, try that */
++ if (ret == -ENOENT && fallback_boardname)
++ ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
+
+- if (ret == -ENOENT)
+- /* no match found, continue */
+- break;
+- else if (ret)
+- /* there was an error, bail out */
+- goto err;
+-
+- /* board data found */
+- goto out;
+- }
+-
+- /* jump over the padding */
+- ie_len = ALIGN(ie_len, 4);
+-
+- len -= ie_len;
+- data += ie_len;
+- }
+-
+-out:
+- if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
++ if (ret == -ENOENT) {
+ ath10k_err(ar,
+ "failed to fetch board data for %s from %s/%s\n",
+ boardname, ar->hw_params.fw.dir, filename);
+ ret = -ENODATA;
+- goto err;
+ }
+
++ if (ret)
++ goto err;
++
+ return 0;
+
+ err:
+@@ -1369,12 +1370,12 @@ err:
+ }
+
+ static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
+- size_t name_len)
++ size_t name_len, bool with_variant)
+ {
+ /* strlen(',variant=') + strlen(ar->id.bdf_ext) */
+ char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
+
+- if (ar->id.bdf_ext[0] != '\0')
++ if (with_variant && ar->id.bdf_ext[0] != '\0')
+ scnprintf(variant, sizeof(variant), ",variant=%s",
+ ar->id.bdf_ext);
+
+@@ -1400,17 +1401,26 @@ out:
+
+ static int ath10k_core_fetch_board_file(struct ath10k *ar)
+ {
+- char boardname[100];
++ char boardname[100], fallback_boardname[100];
+ int ret;
+
+- ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
++ ret = ath10k_core_create_board_name(ar, boardname,
++ sizeof(boardname), true);
+ if (ret) {
+ ath10k_err(ar, "failed to create board name: %d", ret);
+ return ret;
+ }
+
++ ret = ath10k_core_create_board_name(ar, fallback_boardname,
++ sizeof(boardname), false);
++ if (ret) {
++ ath10k_err(ar, "failed to create fallback board name: %d", ret);
++ return ret;
++ }
++
+ ar->bd_api = 2;
+ ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
++ fallback_boardname,
+ ATH10K_BOARD_API2_FILE);
+ if (!ret)
+ goto success;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Ondrej Mosnáček" <omosnace@redhat.com>
+Date: Mon, 9 Apr 2018 10:00:06 +0200
+Subject: audit: allow not equal op for audit by executable
+
+From: "Ondrej Mosnáček" <omosnace@redhat.com>
+
+[ Upstream commit 23bcc480dac204c7dbdf49d96b2c918ed98223c2 ]
+
+Current implementation of auditing by executable name only implements
+the 'equal' operator. This patch extends it to also support the 'not
+equal' operator.
+
+See: https://github.com/linux-audit/audit-kernel/issues/53
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/auditfilter.c | 2 +-
+ kernel/auditsc.c | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -426,7 +426,7 @@ static int audit_field_valid(struct audi
+ return -EINVAL;
+ break;
+ case AUDIT_EXE:
+- if (f->op != Audit_equal)
++ if (f->op != Audit_not_equal && f->op != Audit_equal)
+ return -EINVAL;
+ if (entry->rule.listnr != AUDIT_FILTER_EXIT)
+ return -EINVAL;
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -471,6 +471,8 @@ static int audit_filter_rules(struct tas
+ break;
+ case AUDIT_EXE:
+ result = audit_exe_compare(tsk, rule->exe);
++ if (f->op == Audit_not_equal)
++ result = !result;
+ break;
+ case AUDIT_UID:
+ result = audit_uid_comparator(cred->uid, f->op, f->uid);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sun, 14 Jan 2018 22:07:10 +0100
+Subject: backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit bb084c0f61d659f0e6d371b096e0e57998f191d6 ]
+
+The documentation was wrong, gpiod_get_direction() returns 0/1 instead
+of the GPIOF_* flags. The docs were fixed with commit 94fc73094abe47
+("gpio: correct docs about return value of gpiod_get_direction"). Now,
+fix this user (until a better, system-wide solution is in place).
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/backlight/pwm_bl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -301,14 +301,14 @@ static int pwm_backlight_probe(struct pl
+
+ /*
+ * If the GPIO is not known to be already configured as output, that
+- * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL,
+- * change the direction to output and set the GPIO as active.
++ * is, if gpiod_get_direction returns either 1 or -EINVAL, change the
++ * direction to output and set the GPIO as active.
+ * Do not force the GPIO to active when it was already output as it
+ * could cause backlight flickering or we would enable the backlight too
+ * early. Leave the decision of the initial backlight state for later.
+ */
+ if (pb->enable_gpio &&
+- gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT)
++ gpiod_get_direction(pb->enable_gpio) != 0)
+ gpiod_direction_output(pb->enable_gpio, 1);
+
+ pb->power_supply = devm_regulator_get(&pdev->dev, "power");
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Filippo Muzzini <filippo.muzzini@outlook.it>
+Date: Thu, 31 May 2018 15:23:11 +0200
+Subject: block, bfq: remove wrong lock in bfq_requests_merged
+
+From: Filippo Muzzini <filippo.muzzini@outlook.it>
+
+[ Upstream commit a12bffebc0c9d6a5851f062aaea3aa7c4adc6042 ]
+
+In bfq_requests_merged(), there is a deadlock because the lock on
+bfqq->bfqd->lock is held by the calling function, but the code of
+this function tries to grab the lock again.
+
+This deadlock is currently hidden by another bug (fixed by next commit
+for this source file), which causes the body of bfq_requests_merged()
+to be never executed.
+
+This commit removes the deadlock by removing the lock/unlock pair.
+
+Signed-off-by: Filippo Muzzini <filippo.muzzini@outlook.it>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bfq-iosched.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -1898,7 +1898,6 @@ static void bfq_requests_merged(struct r
+
+ if (!RB_EMPTY_NODE(&rq->rb_node))
+ goto end;
+- spin_lock_irq(&bfqq->bfqd->lock);
+
+ /*
+ * If next and rq belong to the same bfq_queue and next is older
+@@ -1923,7 +1922,6 @@ static void bfq_requests_merged(struct r
+ bfq_remove_request(q, next);
+ bfqg_stats_update_io_remove(bfqq_group(bfqq), next->cmd_flags);
+
+- spin_unlock_irq(&bfqq->bfqd->lock);
+ end:
+ bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Mon, 21 May 2018 18:09:20 +0800
+Subject: Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+[ Upstream commit 66d9975c5a7c40aa7e4bb0ec0b0c37ba1f190923 ]
+
+Without this patch we cannot turn on the Bluethooth adapter on ASUS
+E406MA.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2ff8 ProdID=b011 Rev= 2.00
+S: Manufacturer=Realtek
+S: Product=802.11n WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -371,6 +371,9 @@ static const struct usb_device_id blackl
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
+
++ /* Additional Realtek 8723DE Bluetooth devices */
++ { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
++
+ /* Additional Realtek 8821AE Bluetooth devices */
+ { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Vic Wei <vwei@codeaurora.org>
+Date: Mon, 23 Apr 2018 15:17:07 -0700
+Subject: Bluetooth: btusb: add ID for LiteOn 04ca:301a
+
+From: Vic Wei <vwei@codeaurora.org>
+
+[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ]
+
+Contains a QCA6174A chipset, with USB BT. Let's support loading
+firmware on it.
+
+>From usb-devices:
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=04ca ProdID=301a Rev= 0.01
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+Signed-off-by: Vic Wei <vwei@codeaurora.org>
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -276,6 +276,7 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
++ { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
+
+ /* Broadcom BCM2035 */
+ { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thierry Escande <thierry.escande@linaro.org>
+Date: Tue, 29 May 2018 18:37:16 +0200
+Subject: Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
+
+From: Thierry Escande <thierry.escande@linaro.org>
+
+[ Upstream commit 9960521c44a5d828f29636ceac0600603ecbddbf ]
+
+This patch fixes the following warning during boot:
+
+ do not call blocking ops when !TASK_RUNNING; state=1 set at
+ [<(ptrval)>] qca_setup+0x194/0x750 [hci_uart]
+ WARNING: CPU: 2 PID: 1878 at kernel/sched/core.c:6135
+ __might_sleep+0x7c/0x88
+
+In qca_set_baudrate(), the current task state is set to
+TASK_UNINTERRUPTIBLE before going to sleep for 300ms. It was then
+restored to TASK_INTERRUPTIBLE. This patch sets the current task state
+back to TASK_RUNNING instead.
+
+Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/hci_qca.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -880,7 +880,7 @@ static int qca_set_baudrate(struct hci_d
+ */
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS));
+- set_current_state(TASK_INTERRUPTIBLE);
++ set_current_state(TASK_RUNNING);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Tue, 8 May 2018 03:18:41 -0400
+Subject: bnxt_en: Always forward VF MAC address to the PF.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 707e7e96602675beb5e09bb994195663da6eb56d ]
+
+The current code already forwards the VF MAC address to the PF, except
+in one case. If the VF driver gets a valid MAC address from the firmware
+during probe time, it will not forward the MAC address to the PF,
+incorrectly assuming that the PF already knows the MAC address. This
+causes "ip link show" to show zero VF MAC addresses for this case.
+
+This assumption is not correct. Newer firmware remembers the VF MAC
+address last used by the VF and provides it to the VF driver during
+probe. So we need to always forward the VF MAC address to the PF.
+
+The forwarded MAC address may now be the PF assigned MAC address and so we
+need to make sure we approve it for this case.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8617,8 +8617,8 @@ static int bnxt_init_mac_addr(struct bnx
+ memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+ } else {
+ eth_hw_addr_random(bp->dev);
+- rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+ }
++ rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+ #endif
+ }
+ return rc;
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -914,7 +914,8 @@ static int bnxt_vf_configure_mac(struct
+ if (req->enables & cpu_to_le32(FUNC_VF_CFG_REQ_ENABLES_DFLT_MAC_ADDR)) {
+ if (is_valid_ether_addr(req->dflt_mac_addr) &&
+ ((vf->flags & BNXT_VF_TRUST) ||
+- (!is_valid_ether_addr(vf->mac_addr)))) {
++ !is_valid_ether_addr(vf->mac_addr) ||
++ ether_addr_equal(req->dflt_mac_addr, vf->mac_addr))) {
+ ether_addr_copy(vf->vf_mac_addr, req->dflt_mac_addr);
+ return bnxt_hwrm_exec_fwd_resp(bp, vf, msg_size);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Tue, 8 May 2018 03:18:39 -0400
+Subject: bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit dac0490718bd17df5e3995ffca14255e5f9ed22d ]
+
+Only non-NPAR PFs need to actively check and manage unsupported link
+speeds. NPAR functions and VFs do not control the link speed and
+should skip the unsupported speed detection logic, to avoid warning
+messages from firmware rejecting the unsupported firmware calls.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6457,6 +6457,9 @@ static int bnxt_update_link(struct bnxt
+ }
+ mutex_unlock(&bp->hwrm_cmd_lock);
+
++ if (!BNXT_SINGLE_PF(bp))
++ return 0;
++
+ diff = link_info->support_auto_speeds ^ link_info->advertising;
+ if ((link_info->support_auto_speeds | diff) !=
+ link_info->support_auto_speeds) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wang YanQing <udknight@gmail.com>
+Date: Fri, 11 May 2018 10:52:17 +0800
+Subject: bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64}
+
+From: Wang YanQing <udknight@gmail.com>
+
+[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ]
+
+The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*,
+the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but
+the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*.
+
+For consistence reason, let's rename emit_a32_lsr_* to
+emit_a32_rsh_*.
+
+This patch also corrects a wrong comment.
+
+Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
+Signed-off-by: Wang YanQing <udknight@gmail.com>
+Cc: Shubham Bansal <illusionist.neo@gmail.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux@armlinux.org.uk
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/net/bpf_jit_32.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -708,7 +708,7 @@ static inline void emit_a32_arsh_r64(con
+ }
+
+ /* dst = dst >> src */
+-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk,
++static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
+ bool sstk, struct jit_ctx *ctx) {
+ const u8 *tmp = bpf2a32[TMP_REG_1];
+ const u8 *tmp2 = bpf2a32[TMP_REG_2];
+@@ -724,7 +724,7 @@ static inline void emit_a32_lsr_r64(cons
+ emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx);
+ }
+
+- /* Do LSH operation */
++ /* Do RSH operation */
+ emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
+ emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
+ emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);
+@@ -774,7 +774,7 @@ static inline void emit_a32_lsh_i64(cons
+ }
+
+ /* dst = dst >> val */
+-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk,
++static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk,
+ const u32 val, struct jit_ctx *ctx) {
+ const u8 *tmp = bpf2a32[TMP_REG_1];
+ const u8 *tmp2 = bpf2a32[TMP_REG_2];
+@@ -1330,7 +1330,7 @@ static int build_insn(const struct bpf_i
+ case BPF_ALU64 | BPF_RSH | BPF_K:
+ if (unlikely(imm > 63))
+ return -EINVAL;
+- emit_a32_lsr_i64(dst, dstk, imm, ctx);
++ emit_a32_rsh_i64(dst, dstk, imm, ctx);
+ break;
+ /* dst = dst << src */
+ case BPF_ALU64 | BPF_LSH | BPF_X:
+@@ -1338,7 +1338,7 @@ static int build_insn(const struct bpf_i
+ break;
+ /* dst = dst >> src */
+ case BPF_ALU64 | BPF_RSH | BPF_X:
+- emit_a32_lsr_r64(dst, src, dstk, sstk, ctx);
++ emit_a32_rsh_r64(dst, src, dstk, sstk, ctx);
+ break;
+ /* dst = dst >> src (signed) */
+ case BPF_ALU64 | BPF_ARSH | BPF_X:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Date: Thu, 24 May 2018 12:26:51 +0530
+Subject: bpf: fix multi-function JITed dump obtained via syscall
+
+From: Sandipan Das <sandipan@linux.vnet.ibm.com>
+
+[ Upstream commit 4d56a76ead2fcd856e677cdc9445ad331a409b8c ]
+
+Currently, for multi-function programs, we cannot get the JITed
+instructions using the bpf system call's BPF_OBJ_GET_INFO_BY_FD
+command. Because of this, userspace tools such as bpftool fail
+to identify a multi-function program as being JITed or not.
+
+With the JIT enabled and the test program running, this can be
+verified as follows:
+
+ # cat /proc/sys/net/core/bpf_jit_enable
+ 1
+
+Before applying this patch:
+
+ # bpftool prog list
+ 1: kprobe name foo tag b811aab41a39ad3d gpl
+ loaded_at 2018-05-16T11:43:38+0530 uid 0
+ xlated 216B not jited memlock 65536B
+ ...
+
+ # bpftool prog dump jited id 1
+ no instructions returned
+
+After applying this patch:
+
+ # bpftool prog list
+ 1: kprobe name foo tag b811aab41a39ad3d gpl
+ loaded_at 2018-05-16T12:13:01+0530 uid 0
+ xlated 216B jited 308B memlock 65536B
+ ...
+
+ # bpftool prog dump jited id 1
+ 0: nop
+ 4: nop
+ 8: mflr r0
+ c: std r0,16(r1)
+ 10: stdu r1,-112(r1)
+ 14: std r31,104(r1)
+ 18: addi r31,r1,48
+ 1c: li r3,10
+ ...
+
+Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/syscall.c | 37 ++++++++++++++++++++++++++++++++++---
+ 1 file changed, 34 insertions(+), 3 deletions(-)
+
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1946,13 +1946,44 @@ static int bpf_prog_get_info_by_fd(struc
+ * for offload.
+ */
+ ulen = info.jited_prog_len;
+- info.jited_prog_len = prog->jited_len;
++ if (prog->aux->func_cnt) {
++ u32 i;
++
++ info.jited_prog_len = 0;
++ for (i = 0; i < prog->aux->func_cnt; i++)
++ info.jited_prog_len += prog->aux->func[i]->jited_len;
++ } else {
++ info.jited_prog_len = prog->jited_len;
++ }
++
+ if (info.jited_prog_len && ulen) {
+ if (bpf_dump_raw_ok()) {
+ uinsns = u64_to_user_ptr(info.jited_prog_insns);
+ ulen = min_t(u32, info.jited_prog_len, ulen);
+- if (copy_to_user(uinsns, prog->bpf_func, ulen))
+- return -EFAULT;
++
++ /* for multi-function programs, copy the JITed
++ * instructions for all the functions
++ */
++ if (prog->aux->func_cnt) {
++ u32 len, free, i;
++ u8 *img;
++
++ free = ulen;
++ for (i = 0; i < prog->aux->func_cnt; i++) {
++ len = prog->aux->func[i]->jited_len;
++ len = min_t(u32, len, free);
++ img = (u8 *) prog->aux->func[i]->bpf_func;
++ if (copy_to_user(uinsns, img, len))
++ return -EFAULT;
++ uinsns += len;
++ free -= len;
++ if (!free)
++ break;
++ }
++ } else {
++ if (copy_to_user(uinsns, prog->bpf_func, ulen))
++ return -EFAULT;
++ }
+ } else {
+ info.jited_prog_insns = 0;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Thu, 3 May 2018 18:37:17 -0700
+Subject: bpf: fix references to free_bpf_prog_info() in comments
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit ab7f5bf0928be2f148d000a6eaa6c0a36e74750e ]
+
+Comments in the verifier refer to free_bpf_prog_info() which
+seems to have never existed in tree. Replace it with
+free_used_maps().
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5065,7 +5065,7 @@ static int replace_map_fd_with_map_ptr(s
+ /* hold the map. If the program is rejected by verifier,
+ * the map will be released by release_maps() or it
+ * will be used by the valid program until it's unloaded
+- * and all maps are released in free_bpf_prog_info()
++ * and all maps are released in free_used_maps()
+ */
+ map = bpf_map_inc(map, false);
+ if (IS_ERR(map)) {
+@@ -5856,7 +5856,7 @@ skip_full_check:
+ err_release_maps:
+ if (!env->prog->aux->used_maps)
+ /* if we didn't copy map pointers into bpf_prog_info, release
+- * them now. Otherwise free_bpf_prog_info() will release them.
++ * them now. Otherwise free_used_maps() will release them.
+ */
+ release_maps(env);
+ *prog = env->prog;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Date: Thu, 24 May 2018 12:26:46 +0530
+Subject: bpf: powerpc64: pad function address loads with NOPs
+
+From: Sandipan Das <sandipan@linux.vnet.ibm.com>
+
+[ Upstream commit 4ea69b2fd623dee2bbc77d3b6b7d8c0924e2026a ]
+
+For multi-function programs, loading the address of a callee
+function to a register requires emitting instructions whose
+count varies from one to five depending on the nature of the
+address.
+
+Since we come to know of the callee's address only before the
+extra pass, the number of instructions required to load this
+address may vary from what was previously generated. This can
+make the JITed image grow or shrink.
+
+To avoid this, we should generate a constant five-instruction
+when loading function addresses by padding the optimized load
+sequence with NOPs.
+
+Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/net/bpf_jit_comp64.c | 34 +++++++++++++++++++++++-----------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -202,25 +202,37 @@ static void bpf_jit_build_epilogue(u32 *
+
+ static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
+ {
++ unsigned int i, ctx_idx = ctx->idx;
++
++ /* Load function address into r12 */
++ PPC_LI64(12, func);
++
++ /* For bpf-to-bpf function calls, the callee's address is unknown
++ * until the last extra pass. As seen above, we use PPC_LI64() to
++ * load the callee's address, but this may optimize the number of
++ * instructions required based on the nature of the address.
++ *
++ * Since we don't want the number of instructions emitted to change,
++ * we pad the optimized PPC_LI64() call with NOPs to guarantee that
++ * we always have a five-instruction sequence, which is the maximum
++ * that PPC_LI64() can emit.
++ */
++ for (i = ctx->idx - ctx_idx; i < 5; i++)
++ PPC_NOP();
++
+ #ifdef PPC64_ELF_ABI_v1
+- /* func points to the function descriptor */
+- PPC_LI64(b2p[TMP_REG_2], func);
+- /* Load actual entry point from function descriptor */
+- PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
+- /* ... and move it to LR */
+- PPC_MTLR(b2p[TMP_REG_1]);
+ /*
+ * Load TOC from function descriptor at offset 8.
+ * We can clobber r2 since we get called through a
+ * function pointer (so caller will save/restore r2)
+ * and since we don't use a TOC ourself.
+ */
+- PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
+-#else
+- /* We can clobber r12 */
+- PPC_FUNC_ADDR(12, func);
+- PPC_MTLR(12);
++ PPC_BPF_LL(2, 12, 8);
++ /* Load actual entry point from function descriptor */
++ PPC_BPF_LL(12, 12, 0);
+ #endif
++
++ PPC_MTLR(12);
+ PPC_BLRL();
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sean Lanigan <sean@lano.id.au>
+Date: Fri, 4 May 2018 16:48:23 +1000
+Subject: brcmfmac: Add support for bcm43364 wireless chipset
+
+From: Sean Lanigan <sean@lano.id.au>
+
+[ Upstream commit 9c4a121e82634aa000a702c98cd6f05b27d6e186 ]
+
+Add support for the BCM43364 chipset via an SDIO interface, as used in
+e.g. the Murata 1FX module.
+
+The BCM43364 uses the same firmware as the BCM43430 (which is already
+included), the only difference is the omission of Bluetooth.
+
+However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
+of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
+load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
+triggers the brcmfmac driver to load, and then correctly use the
+firmware file 'brcmfmac43430-sdio.bin'.
+
+Signed-off-by: Sean Lanigan <sean@lano.id.au>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ include/linux/mmc/sdio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -35,6 +35,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4335_4339 0x4335
+ #define SDIO_DEVICE_ID_BROADCOM_4339 0x4339
+ #define SDIO_DEVICE_ID_BROADCOM_43362 0xa962
++#define SDIO_DEVICE_ID_BROADCOM_43364 0xa9a4
+ #define SDIO_DEVICE_ID_BROADCOM_43430 0xa9a6
+ #define SDIO_DEVICE_ID_BROADCOM_4345 0x4345
+ #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: David Sterba <dsterba@suse.com>
+Date: Tue, 24 Apr 2018 14:53:56 +0200
+Subject: btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 3d3a2e610ea5e7c6d4f9481ecce5d8e2d8317843 ]
+
+Currently the code assumes that there's an implied barrier by the
+sequence of code preceding the wakeup, namely the mutex unlock.
+
+As Nikolay pointed out:
+
+I think this is wrong (not your code) but the original assumption that
+the RELEASE semantics provided by mutex_unlock is sufficient.
+According to memory-barriers.txt:
+
+Section 'LOCK ACQUISITION FUNCTIONS' states:
+
+ (2) RELEASE operation implication:
+
+ Memory operations issued before the RELEASE will be completed before the
+ RELEASE operation has completed.
+
+ Memory operations issued after the RELEASE *may* be completed before the
+ RELEASE operation has completed.
+
+(I've bolded the may portion)
+
+The example given there:
+
+As an example, consider the following:
+
+ *A = a;
+ *B = b;
+ ACQUIRE
+ *C = c;
+ *D = d;
+ RELEASE
+ *E = e;
+ *F = f;
+
+The following sequence of events is acceptable:
+
+ ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE
+
+So if we assume that *C is modifying the flag which the waitqueue is checking,
+and *E is the actual wakeup, then those accesses can be re-ordered...
+
+IMHO this code should be considered broken...
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+
+To be on the safe side, add the barriers. The synchronization logic
+around log using the mutexes and several other threads does not make it
+easy to reason for/against the barrier.
+
+CC: Nikolay Borisov <nborisov@suse.com>
+Link: https://lkml.kernel.org/r/6ee068d8-1a69-3728-00d1-d86293d43c9f@suse.com
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/tree-log.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3116,8 +3116,11 @@ out_wake_log_root:
+ mutex_unlock(&log_root_tree->log_mutex);
+
+ /*
+- * The barrier before waitqueue_active is implied by mutex_unlock
++ * The barrier before waitqueue_active is needed so all the updates
++ * above are seen by the woken threads. It might not be necessary, but
++ * proving that seems to be hard.
+ */
++ smp_mb();
+ if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
+ wake_up(&log_root_tree->log_commit_wait[index2]);
+ out:
+@@ -3128,8 +3131,11 @@ out:
+ mutex_unlock(&root->log_mutex);
+
+ /*
+- * The barrier before waitqueue_active is implied by mutex_unlock
++ * The barrier before waitqueue_active is needed so all the updates
++ * above are seen by the woken threads. It might not be necessary, but
++ * proving that seems to be hard.
+ */
++ smp_mb();
+ if (waitqueue_active(&root->log_commit_wait[index1]))
+ wake_up(&root->log_commit_wait[index1]);
+ return ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ethan Lien <ethanlien@synology.com>
+Date: Mon, 28 May 2018 13:48:20 +0800
+Subject: btrfs: balance dirty metadata pages in btrfs_finish_ordered_io
+
+From: Ethan Lien <ethanlien@synology.com>
+
+[ Upstream commit e73e81b6d0114d4a303205a952ab2e87c44bd279 ]
+
+[Problem description and how we fix it]
+We should balance dirty metadata pages at the end of
+btrfs_finish_ordered_io, since a small, unmergeable random write can
+potentially produce dirty metadata which is multiple times larger than
+the data itself. For example, a small, unmergeable 4KiB write may
+produce:
+
+ 16KiB dirty leaf (and possibly 16KiB dirty node) in subvolume tree
+ 16KiB dirty leaf (and possibly 16KiB dirty node) in checksum tree
+ 16KiB dirty leaf (and possibly 16KiB dirty node) in extent tree
+
+Although we do call balance dirty pages in write side, but in the
+buffered write path, most metadata are dirtied only after we reach the
+dirty background limit (which by far only counts dirty data pages) and
+wakeup the flusher thread. If there are many small, unmergeable random
+writes spread in a large btree, we'll find a burst of dirty pages
+exceeds the dirty_bytes limit after we wakeup the flusher thread - which
+is not what we expect. In our machine, it caused out-of-memory problem
+since a page cannot be dropped if it is marked dirty.
+
+Someone may worry about we may sleep in btrfs_btree_balance_dirty_nodelay,
+but since we do btrfs_finish_ordered_io in a separate worker, it will not
+stop the flusher consuming dirty pages. Also, we use different worker for
+metadata writeback endio, sleep in btrfs_finish_ordered_io help us throttle
+the size of dirty metadata pages.
+
+[Reproduce steps]
+To reproduce the problem, we need to do 4KiB write randomly spread in a
+large btree. In our 2GiB RAM machine:
+
+1) Create 4 subvolumes.
+2) Run fio on each subvolume:
+
+ [global]
+ direct=0
+ rw=randwrite
+ ioengine=libaio
+ bs=4k
+ iodepth=16
+ numjobs=1
+ group_reporting
+ size=128G
+ runtime=1800
+ norandommap
+ time_based
+ randrepeat=0
+
+3) Take snapshot on each subvolume and repeat fio on existing files.
+4) Repeat step (3) until we get large btrees.
+ In our case, by observing btrfs_root_item->bytes_used, we have 2GiB of
+ metadata in each subvolume tree and 12GiB of metadata in extent tree.
+5) Stop all fio, take snapshot again, and wait until all delayed work is
+ completed.
+6) Start all fio. Few seconds later we hit OOM when the flusher starts
+ to work.
+
+It can be reproduced even when using nocow write.
+
+Signed-off-by: Ethan Lien <ethanlien@synology.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add comment ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3160,6 +3160,9 @@ out:
+ /* once for the tree */
+ btrfs_put_ordered_extent(ordered_extent);
+
++ /* Try to release some metadata so we don't get an OOM but don't wait */
++ btrfs_btree_balance_dirty_nodelay(fs_info);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Fri, 11 May 2018 13:13:31 -0700
+Subject: Btrfs: don't BUG_ON() in btrfs_truncate_inode_items()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 0552210997badb6a60740a26ff9d976a416510f0 ]
+
+btrfs_free_extent() can fail because of ENOMEM. There's no reason to
+panic here, we can just abort the transaction.
+
+Fixes: f4b9aa8d3b87 ("btrfs_truncate")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4671,7 +4671,10 @@ delete:
+ extent_num_bytes, 0,
+ btrfs_header_owner(leaf),
+ ino, extent_offset);
+- BUG_ON(ret);
++ if (ret) {
++ btrfs_abort_transaction(trans, ret);
++ break;
++ }
+ if (btrfs_should_throttle_delayed_refs(trans, fs_info))
+ btrfs_async_run_delayed_refs(fs_info,
+ trans->delayed_ref_updates * 2,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Fri, 11 May 2018 13:13:35 -0700
+Subject: Btrfs: don't return ino to ino cache if inode item removal fails
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit c08db7d8d295a4f3a10faaca376de011afff7950 ]
+
+In btrfs_evict_inode(), if btrfs_truncate_inode_items() fails, the inode
+item will still be in the tree but we still return the ino to the ino
+cache. That will blow up later when someone tries to allocate that ino,
+so don't return it to the cache.
+
+Fixes: 581bb050941b ("Btrfs: Cache free inode numbers in memory")
+Reviewed-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5426,13 +5426,18 @@ void btrfs_evict_inode(struct inode *ino
+ trans->block_rsv = rsv;
+
+ ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0);
+- if (ret != -ENOSPC && ret != -EAGAIN)
++ if (ret) {
++ trans->block_rsv = &fs_info->trans_block_rsv;
++ btrfs_end_transaction(trans);
++ btrfs_btree_balance_dirty(fs_info);
++ if (ret != -ENOSPC && ret != -EAGAIN) {
++ btrfs_orphan_del(NULL, BTRFS_I(inode));
++ btrfs_free_block_rsv(fs_info, rsv);
++ goto no_delete;
++ }
++ } else {
+ break;
+-
+- trans->block_rsv = &fs_info->trans_block_rsv;
+- btrfs_end_transaction(trans);
+- trans = NULL;
+- btrfs_btree_balance_dirty(fs_info);
++ }
+ }
+
+ btrfs_free_block_rsv(fs_info, rsv);
+@@ -5441,12 +5446,8 @@ void btrfs_evict_inode(struct inode *ino
+ * Errors here aren't a big deal, it just means we leave orphan items
+ * in the tree. They will be cleaned up on the next mount.
+ */
+- if (ret == 0) {
+- trans->block_rsv = root->orphan_block_rsv;
+- btrfs_orphan_del(trans, BTRFS_I(inode));
+- } else {
+- btrfs_orphan_del(NULL, BTRFS_I(inode));
+- }
++ trans->block_rsv = root->orphan_block_rsv;
++ btrfs_orphan_del(trans, BTRFS_I(inode));
+
+ trans->block_rsv = &fs_info->trans_block_rsv;
+ if (!(root == fs_info->tree_root ||
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Qu Wenruo <wqu@suse.com>
+Date: Mon, 14 May 2018 09:38:13 +0800
+Subject: btrfs: qgroup: Finish rescan when hit the last leaf of extent tree
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit ff3d27a048d926b3920ccdb75d98788c567cae0d ]
+
+Under the following case, qgroup rescan can double account cowed tree
+blocks:
+
+In this case, extent tree only has one tree block.
+
+-
+| transid=5 last committed=4
+| btrfs_qgroup_rescan_worker()
+| |- btrfs_start_transaction()
+| | transid = 5
+| |- qgroup_rescan_leaf()
+| |- btrfs_search_slot_for_read() on extent tree
+| Get the only extent tree block from commit root (transid = 4).
+| Scan it, set qgroup_rescan_progress to the last
+| EXTENT/META_ITEM + 1
+| now qgroup_rescan_progress = A + 1.
+|
+| fs tree get CoWed, new tree block is at A + 16K
+| transid 5 get committed
+-
+| transid=6 last committed=5
+| btrfs_qgroup_rescan_worker()
+| btrfs_qgroup_rescan_worker()
+| |- btrfs_start_transaction()
+| | transid = 5
+| |- qgroup_rescan_leaf()
+| |- btrfs_search_slot_for_read() on extent tree
+| Get the only extent tree block from commit root (transid = 5).
+| scan it using qgroup_rescan_progress (A + 1).
+| found new tree block beyong A, and it's fs tree block,
+| account it to increase qgroup numbers.
+-
+
+In above case, tree block A, and tree block A + 16K get accounted twice,
+while qgroup rescan should stop when it already reach the last leaf,
+other than continue using its qgroup_rescan_progress.
+
+Such case could happen by just looping btrfs/017 and with some
+possibility it can hit such double qgroup accounting problem.
+
+Fix it by checking the path to determine if we should finish qgroup
+rescan, other than relying on next loop to exit.
+
+Reported-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/qgroup.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2580,6 +2580,21 @@ out:
+ }
+
+ /*
++ * Check if the leaf is the last leaf. Which means all node pointers
++ * are at their last position.
++ */
++static bool is_last_leaf(struct btrfs_path *path)
++{
++ int i;
++
++ for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) {
++ if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1)
++ return false;
++ }
++ return true;
++}
++
++/*
+ * returns < 0 on error, 0 when more leafs are to be scanned.
+ * returns 1 when done.
+ */
+@@ -2592,6 +2607,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
+ struct ulist *roots = NULL;
+ struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem);
+ u64 num_bytes;
++ bool done;
+ int slot;
+ int ret;
+
+@@ -2620,6 +2636,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info
+ mutex_unlock(&fs_info->qgroup_rescan_lock);
+ return ret;
+ }
++ done = is_last_leaf(path);
+
+ btrfs_item_key_to_cpu(path->nodes[0], &found,
+ btrfs_header_nritems(path->nodes[0]) - 1);
+@@ -2666,6 +2683,8 @@ out:
+ }
+ btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
+
++ if (done && !ret)
++ ret = 1;
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chengguang Xu <cgxu519@gmx.com>
+Date: Wed, 30 May 2018 10:13:11 +0800
+Subject: ceph: fix alignment of rasize
+
+From: Chengguang Xu <cgxu519@gmx.com>
+
+[ Upstream commit c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7 ]
+
+On currently logic:
+when I specify rasize=0~1 then it will be 4096.
+when I specify rasize=2~4097 then it will be 8192.
+
+Make it the same as rsize & wsize.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -268,7 +268,7 @@ static int parse_fsopt_token(char *c, vo
+ case Opt_rasize:
+ if (intval < 0)
+ return -EINVAL;
+- fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE);
++ fsopt->rasize = ALIGN(intval, PAGE_SIZE);
+ break;
+ case Opt_caps_wanted_delay_min:
+ if (intval < 1)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Luis Henriques <lhenriques@suse.com>
+Date: Mon, 28 May 2018 18:37:40 +0100
+Subject: ceph: fix use-after-free in ceph_statfs()
+
+From: Luis Henriques <lhenriques@suse.com>
+
+[ Upstream commit 73fb0949cf246b212ff63d692a0ec88db954bb35 ]
+
+KASAN found an UAF in ceph_statfs. This was a one-off bug but looking at
+the code it looks like the monmap access needs to be protected as it can
+be modified while we're accessing it. Fix this by protecting the access
+with the monc->mutex.
+
+ BUG: KASAN: use-after-free in ceph_statfs+0x21d/0x2c0
+ Read of size 8 at addr ffff88006844f2e0 by task trinity-c5/304
+
+ CPU: 0 PID: 304 Comm: trinity-c5 Not tainted 4.17.0-rc6+ #172
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
+ Call Trace:
+ dump_stack+0xa5/0x11b
+ ? show_regs_print_info+0x5/0x5
+ ? kmsg_dump_rewind+0x118/0x118
+ ? ceph_statfs+0x21d/0x2c0
+ print_address_description+0x73/0x2b0
+ ? ceph_statfs+0x21d/0x2c0
+ kasan_report+0x243/0x360
+ ceph_statfs+0x21d/0x2c0
+ ? ceph_umount_begin+0x80/0x80
+ ? kmem_cache_alloc+0xdf/0x1a0
+ statfs_by_dentry+0x79/0xb0
+ vfs_statfs+0x28/0x110
+ user_statfs+0x8c/0xe0
+ ? vfs_statfs+0x110/0x110
+ ? __fdget_raw+0x10/0x10
+ __se_sys_statfs+0x5d/0xa0
+ ? user_statfs+0xe0/0xe0
+ ? mutex_unlock+0x1d/0x40
+ ? __x64_sys_statfs+0x20/0x30
+ do_syscall_64+0xee/0x290
+ ? syscall_return_slowpath+0x1c0/0x1c0
+ ? page_fault+0x1e/0x30
+ ? syscall_return_slowpath+0x13c/0x1c0
+ ? prepare_exit_to_usermode+0xdb/0x140
+ ? syscall_trace_enter+0x330/0x330
+ ? __put_user_4+0x1c/0x30
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ Allocated by task 130:
+ __kmalloc+0x124/0x210
+ ceph_monmap_decode+0x1c1/0x400
+ dispatch+0x113/0xd20
+ ceph_con_workfn+0xa7e/0x44e0
+ process_one_work+0x5f0/0xa30
+ worker_thread+0x184/0xa70
+ kthread+0x1a0/0x1c0
+ ret_from_fork+0x35/0x40
+
+ Freed by task 130:
+ kfree+0xb8/0x210
+ dispatch+0x15a/0xd20
+ ceph_con_workfn+0xa7e/0x44e0
+ process_one_work+0x5f0/0xa30
+ worker_thread+0x184/0xa70
+ kthread+0x1a0/0x1c0
+ ret_from_fork+0x35/0x40
+
+Signed-off-by: Luis Henriques <lhenriques@suse.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/super.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -45,7 +45,7 @@ static void ceph_put_super(struct super_
+ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+ {
+ struct ceph_fs_client *fsc = ceph_inode_to_client(d_inode(dentry));
+- struct ceph_monmap *monmap = fsc->client->monc.monmap;
++ struct ceph_mon_client *monc = &fsc->client->monc;
+ struct ceph_statfs st;
+ u64 fsid;
+ int err;
+@@ -58,7 +58,7 @@ static int ceph_statfs(struct dentry *de
+ }
+
+ dout("statfs\n");
+- err = ceph_monc_do_statfs(&fsc->client->monc, data_pool, &st);
++ err = ceph_monc_do_statfs(monc, data_pool, &st);
+ if (err < 0)
+ return err;
+
+@@ -94,8 +94,11 @@ static int ceph_statfs(struct dentry *de
+ buf->f_namelen = NAME_MAX;
+
+ /* Must convert the fsid, for consistent values across arches */
+- fsid = le64_to_cpu(*(__le64 *)(&monmap->fsid)) ^
+- le64_to_cpu(*((__le64 *)&monmap->fsid + 1));
++ mutex_lock(&monc->mutex);
++ fsid = le64_to_cpu(*(__le64 *)(&monc->monmap->fsid)) ^
++ le64_to_cpu(*((__le64 *)&monc->monmap->fsid + 1));
++ mutex_unlock(&monc->mutex);
++
+ buf->f_fsid.val[0] = fsid & 0xffffffff;
+ buf->f_fsid.val[1] = fsid >> 32;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Mon, 7 May 2018 17:04:57 +0530
+Subject: clk: davinci: psc-da830: fix USB0 48MHz PHY clock registration
+
+From: Sekhar Nori <nsekhar@ti.com>
+
+[ Upstream commit a714dceb721407c2a5d2887938f37e34ed00669c ]
+
+USB0 48MHz PHY clock registration fails on DA830 because the
+da8xx-cfgchip clock driver cannot get a reference to USB0
+LPSC clock.
+
+The USB0 LPSC needs to be enabled during PHY clock enable. Setup
+the clock lookup correctly to fix this.
+
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Reviewed-by: David Lechner <david@lechnology.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/davinci/psc-da830.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/davinci/psc-da830.c
++++ b/drivers/clk/davinci/psc-da830.c
+@@ -55,7 +55,8 @@ const struct davinci_psc_init_data da830
+ .psc_init = &da830_psc0_init,
+ };
+
+-LPSC_CLKDEV2(usb0_clkdev, NULL, "musb-da8xx",
++LPSC_CLKDEV3(usb0_clkdev, "fck", "da830-usb-phy-clks",
++ NULL, "musb-da8xx",
+ NULL, "cppi41-dmaengine");
+ LPSC_CLKDEV1(usb1_clkdev, NULL, "ohci-da8xx");
+ /* REVISIT: gpio-davinci.c should be modified to drop con_id */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 20 May 2018 16:31:15 +0000
+Subject: clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 45ba63a29fd9b8a461110185e3abc5b4c90b806a ]
+
+When the main processor goes idle, by default its clock is stopped.
+However, this also stops the clock of the co-processor.
+
+Here, if the C1CLK clock is enabled, we disable this functionality.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/ingenic/jz4770-cgu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/ingenic/jz4770-cgu.c
++++ b/drivers/clk/ingenic/jz4770-cgu.c
+@@ -194,9 +194,10 @@ static const struct ingenic_cgu_clk_info
+ .div = { CGU_REG_CPCCR, 16, 1, 4, 22, -1, -1 },
+ },
+ [JZ4770_CLK_C1CLK] = {
+- "c1clk", CGU_CLK_DIV,
++ "c1clk", CGU_CLK_DIV | CGU_CLK_GATE,
+ .parents = { JZ4770_CLK_PLL0, },
+ .div = { CGU_REG_CPCCR, 12, 1, 4, 22, -1, -1 },
++ .gate = { CGU_REG_OPCR, 31, true }, // disable CCLK stop on idle
+ },
+ [JZ4770_CLK_PCLK] = {
+ "pclk", CGU_CLK_DIV,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mike Looijmans <mike.looijmans@topic.nl>
+Date: Thu, 31 May 2018 16:03:55 +0200
+Subject: clk-si544: Properly round requested frequency to nearest match
+
+From: Mike Looijmans <mike.looijmans@topic.nl>
+
+[ Upstream commit 4d3f36c5e9ca0f947eed71660239c529c501141a ]
+
+The si544 driver had a rounding problem that using the result of clk_round_rate
+may set the clock to yet another rate, for example:
+clk_round_rate(195000000) = 194999999
+clk_round_rate(194999999) = 194999998
+
+Clients would expect that after clk_set_rate(clk, freq2=clk_round_rate(clk, freq)) the
+chip will be running at exactly freq2.
+
+The problem was in the calculation of the feedback divider, it was always rounded
+down instead of to the nearest possible VCO value.
+
+After this change, the following holds true for any supported frequency:
+actual_freq = clk_round_rate(clk, freq);
+clk_set_rate(clk, actual_freq);
+clk_round_rate(clk, actual_freq) == actual_freq && clk_get_rate(clk) == actual_freq
+
+Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
+Fixes: 953cc3e81170 ("clk: Add driver for the si544 clock generator chip")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk-si544.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/clk-si544.c
++++ b/drivers/clk/clk-si544.c
+@@ -207,6 +207,7 @@ static int si544_calc_muldiv(struct clk_
+
+ /* And the fractional bits using the remainder */
+ vco = (u64)tmp << 32;
++ vco += FXO / 2; /* Round to nearest multiple */
+ do_div(vco, FXO);
+ settings->fb_div_frac = vco;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Wed, 16 May 2018 21:59:43 +0200
+Subject: clocksource: Move inline keyword to the beginning of function declarations
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit db6f9e55c8d80a4a1a329b9b68a1d370bffb6aad ]
+
+The inline keyword was not at the beginning of the function declarations.
+Fix the following warnings triggered when using W=1:
+
+ kernel/time/clocksource.c:456:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]
+ kernel/time/clocksource.c:457:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: John Stultz <john.stultz@linaro.org>
+Link: https://lkml.kernel.org/r/20180516195943.31924-1-malat@debian.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/clocksource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -453,8 +453,8 @@ static inline int __clocksource_watchdog
+ static bool clocksource_is_watchdog(struct clocksource *cs) { return false; }
+ void clocksource_mark_unstable(struct clocksource *cs) { }
+
+-static void inline clocksource_watchdog_lock(unsigned long *flags) { }
+-static void inline clocksource_watchdog_unlock(unsigned long *flags) { }
++static inline void clocksource_watchdog_lock(unsigned long *flags) { }
++static inline void clocksource_watchdog_unlock(unsigned long *flags) { }
+
+ #endif /* CONFIG_CLOCKSOURCE_WATCHDOG */
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
+Date: Tue, 3 Apr 2018 09:39:00 +0300
+Subject: crypto: authenc - don't leak pointers to authenc keys
+
+From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
+
+[ Upstream commit ad2fdcdf75d169e7a5aec6c7cb421c0bec8ec711 ]
+
+In crypto_authenc_setkey we save pointers to the authenc keys in
+a local variable of type struct crypto_authenc_keys and we don't
+zeroize it after use. Fix this and don't leak pointers to the
+authenc keys.
+
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/authenc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -108,6 +108,7 @@ static int crypto_authenc_setkey(struct
+ CRYPTO_TFM_RES_MASK);
+
+ out:
++ memzero_explicit(&keys, sizeof(keys));
+ return err;
+
+ badkey:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
+Date: Tue, 3 Apr 2018 09:39:01 +0300
+Subject: crypto: authencesn - don't leak pointers to authenc keys
+
+From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
+
+[ Upstream commit 31545df391d58a3bb60e29b1192644a6f2b5a8dd ]
+
+In crypto_authenc_esn_setkey we save pointers to the authenc keys
+in a local variable of type struct crypto_authenc_keys and we don't
+zeroize it after use. Fix this and don't leak pointers to the
+authenc keys.
+
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/authencesn.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/authencesn.c
++++ b/crypto/authencesn.c
+@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(str
+ CRYPTO_TFM_RES_MASK);
+
+ out:
++ memzero_explicit(&keys, sizeof(keys));
+ return err;
+
+ badkey:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Mon, 23 Apr 2018 18:10:23 +0200
+Subject: delayacct: Use raw_spinlocks
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 02acc80d19edb0d5684c997b2004ad19f9f5236e ]
+
+try_to_wake_up() might invoke delayacct_blkio_end() while holding the
+pi_lock (which is a raw_spinlock_t). delayacct_blkio_end() acquires
+task_delay_info.lock which is a spinlock_t. This causes a might sleep splat
+on -RT where non raw spinlocks are converted to 'sleeping' spinlocks.
+
+task_delay_info.lock is only held for a short amount of time so it's not a
+problem latency wise to make convert it to a raw spinlock.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Link: https://lkml.kernel.org/r/20180423161024.6710-1-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/delayacct.h | 2 +-
+ kernel/delayacct.c | 17 +++++++++--------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/include/linux/delayacct.h
++++ b/include/linux/delayacct.h
+@@ -29,7 +29,7 @@
+
+ #ifdef CONFIG_TASK_DELAY_ACCT
+ struct task_delay_info {
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ unsigned int flags; /* Private per-task flags */
+
+ /* For each stat XXX, add following, aligned appropriately
+--- a/kernel/delayacct.c
++++ b/kernel/delayacct.c
+@@ -44,23 +44,24 @@ void __delayacct_tsk_init(struct task_st
+ {
+ tsk->delays = kmem_cache_zalloc(delayacct_cache, GFP_KERNEL);
+ if (tsk->delays)
+- spin_lock_init(&tsk->delays->lock);
++ raw_spin_lock_init(&tsk->delays->lock);
+ }
+
+ /*
+ * Finish delay accounting for a statistic using its timestamps (@start),
+ * accumalator (@total) and @count
+ */
+-static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count)
++static void delayacct_end(raw_spinlock_t *lock, u64 *start, u64 *total,
++ u32 *count)
+ {
+ s64 ns = ktime_get_ns() - *start;
+ unsigned long flags;
+
+ if (ns > 0) {
+- spin_lock_irqsave(lock, flags);
++ raw_spin_lock_irqsave(lock, flags);
+ *total += ns;
+ (*count)++;
+- spin_unlock_irqrestore(lock, flags);
++ raw_spin_unlock_irqrestore(lock, flags);
+ }
+ }
+
+@@ -127,7 +128,7 @@ int __delayacct_add_tsk(struct taskstats
+
+ /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */
+
+- spin_lock_irqsave(&tsk->delays->lock, flags);
++ raw_spin_lock_irqsave(&tsk->delays->lock, flags);
+ tmp = d->blkio_delay_total + tsk->delays->blkio_delay;
+ d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp;
+ tmp = d->swapin_delay_total + tsk->delays->swapin_delay;
+@@ -137,7 +138,7 @@ int __delayacct_add_tsk(struct taskstats
+ d->blkio_count += tsk->delays->blkio_count;
+ d->swapin_count += tsk->delays->swapin_count;
+ d->freepages_count += tsk->delays->freepages_count;
+- spin_unlock_irqrestore(&tsk->delays->lock, flags);
++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags);
+
+ return 0;
+ }
+@@ -147,10 +148,10 @@ __u64 __delayacct_blkio_ticks(struct tas
+ __u64 ret;
+ unsigned long flags;
+
+- spin_lock_irqsave(&tsk->delays->lock, flags);
++ raw_spin_lock_irqsave(&tsk->delays->lock, flags);
+ ret = nsec_to_clock_t(tsk->delays->blkio_delay +
+ tsk->delays->swapin_delay);
+- spin_unlock_irqrestore(&tsk->delays->lock, flags);
++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Anatoly Pugachev <matorola@gmail.com>
+Date: Mon, 28 May 2018 02:06:37 +0300
+Subject: disable loading f2fs module on PAGE_SIZE > 4KB
+
+From: Anatoly Pugachev <matorola@gmail.com>
+
+[ Upstream commit 4071e67cffcc5c2a007116a02437471351f550eb ]
+
+The following patch disables loading of f2fs module on architectures
+which have PAGE_SIZE > 4096 , since it is impossible to mount f2fs on
+such architectures , log messages are:
+
+mount: /mnt: wrong fs type, bad option, bad superblock on
+/dev/vdiskb1, missing codepage or helper program, or other error.
+/dev/vdiskb1: F2FS filesystem,
+UUID=1d8b9ca4-2389-4910-af3b-10998969f09c, volume name ""
+
+May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
+page_cache_size (8192), supports only 4KB
+May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
+filesystem in 1th superblock
+May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
+page_cache_size (8192), supports only 4KB
+May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS
+filesystem in 2th superblock
+May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid
+page_cache_size (8192), supports only 4KB
+
+which was introduced by git commit 5c9b469295fb6b10d98923eab5e79c4edb80ed20
+
+tested on git kernel 4.17.0-rc6-00309-gec30dcf7f425
+
+with patch applied:
+
+modprobe: ERROR: could not insert 'f2fs': Invalid argument
+May 28 01:40:28 v215 kernel: F2FS not supported on PAGE_SIZE(8192) != 4096
+
+Signed-off-by: Anatoly Pugachev <matorola@gmail.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3063,6 +3063,12 @@ static int __init init_f2fs_fs(void)
+ {
+ int err;
+
++ if (PAGE_SIZE != F2FS_BLKSIZE) {
++ printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n",
++ PAGE_SIZE, F2FS_BLKSIZE);
++ return -EINVAL;
++ }
++
+ f2fs_build_trace_ios();
+
+ err = init_inodecache();
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 16 Apr 2018 17:18:19 +0200
+Subject: dma-direct: try reallocation with GFP_DMA32 if possible
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit de7eab301de78869322104ea13e124c936ad3e1f ]
+
+As the recent swiotlb bug revealed, we seem to have given up the direct
+DMA allocation too early and felt back to swiotlb allocation. The reason
+is that swiotlb allocator expected that dma_direct_alloc() would try
+harder to get pages even below 64bit DMA mask with GFP_DMA32, but the
+function doesn't do that but only deals with GFP_DMA case.
+
+This patch adds a similar fallback reallocation with GFP_DMA32 as we've
+done with GFP_DMA. The condition is that the coherent mask is smaller
+than 64bit (i.e. some address limitation), and neither GFP_DMA nor
+GFP_DMA32 is set beforehand.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/dma-direct.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/lib/dma-direct.c
++++ b/lib/dma-direct.c
+@@ -84,6 +84,13 @@ again:
+ __free_pages(page, page_order);
+ page = NULL;
+
++ if (IS_ENABLED(CONFIG_ZONE_DMA32) &&
++ dev->coherent_dma_mask < DMA_BIT_MASK(64) &&
++ !(gfp & (GFP_DMA32 | GFP_DMA))) {
++ gfp |= GFP_DMA32;
++ goto again;
++ }
++
+ if (IS_ENABLED(CONFIG_ZONE_DMA) &&
+ dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
+ !(gfp & GFP_DMA)) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Tue, 8 May 2018 13:14:33 +0100
+Subject: dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 8a22a3e1e768c309b718f99bd86f9f25a453e0dc ]
+
+Inclusion of include/dma-iommu.h when CONFIG_IOMMU_DMA is not selected
+results in the following splat:
+
+In file included from drivers/irqchip/irq-gic-v3-mbi.c:20:0:
+./include/linux/dma-iommu.h:95:69: error: unknown type name ‘dma_addr_t’
+ static inline int iommu_get_msi_cookie(struct iommu_domain *domain, dma_addr_t base)
+ ^~~~~~~~~~
+./include/linux/dma-iommu.h:108:74: warning: ‘struct list_head’ declared inside parameter list will not be visible outside of this definition or declaration
+ static inline void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list)
+ ^~~~~~~~~
+scripts/Makefile.build:312: recipe for target 'drivers/irqchip/irq-gic-v3-mbi.o' failed
+
+Fix it by including linux/types.h.
+
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Rob Herring <robh@kernel.org>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lkml.kernel.org/r/20180508121438.11301-5-marc.zyngier@arm.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/dma-iommu.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/dma-iommu.h
++++ b/include/linux/dma-iommu.h
+@@ -17,6 +17,7 @@
+ #define __DMA_IOMMU_H
+
+ #ifdef __KERNEL__
++#include <linux/types.h>
+ #include <asm/errno.h>
+
+ #ifdef CONFIG_IOMMU_DMA
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 28 May 2018 17:41:47 +0200
+Subject: drivers/bus: arm-cci: fix build warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 984e9cf1b9eaab08e4f1f082ce49ed2670e99d90 ]
+
+When the arm-cci driver is enabled, but both CONFIG_ARM_CCI5xx_PMU and
+CONFIG_ARM_CCI400_PMU are not, we get a warning about how parts of
+the driver are never used:
+
+drivers/perf/arm-cci.c:1454:29: error: 'cci_pmu_models' defined but not used [-Werror=unused-variable]
+drivers/perf/arm-cci.c:693:16: error: 'cci_pmu_event_show' defined but not used [-Werror=unused-function]
+drivers/perf/arm-cci.c:685:16: error: 'cci_pmu_format_show' defined but not used [-Werror=unused-function]
+
+Marking all three functions as __maybe_unused avoids the warnings in
+randconfig builds. I'm doing this lacking any ideas for a better fix.
+
+Fixes: 3de6be7a3dd8 ("drivers/bus: Split Arm CCI driver")
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/perf/arm-cci.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/perf/arm-cci.c
++++ b/drivers/perf/arm-cci.c
+@@ -120,9 +120,9 @@ enum cci_models {
+
+ static void pmu_write_counters(struct cci_pmu *cci_pmu,
+ unsigned long *mask);
+-static ssize_t cci_pmu_format_show(struct device *dev,
++static ssize_t __maybe_unused cci_pmu_format_show(struct device *dev,
+ struct device_attribute *attr, char *buf);
+-static ssize_t cci_pmu_event_show(struct device *dev,
++static ssize_t __maybe_unused cci_pmu_event_show(struct device *dev,
+ struct device_attribute *attr, char *buf);
+
+ #define CCI_EXT_ATTR_ENTRY(_name, _func, _config) \
+@@ -1466,7 +1466,7 @@ static int cci_pmu_offline_cpu(unsigned
+ return 0;
+ }
+
+-static struct cci_pmu_model cci_pmu_models[] = {
++static __maybe_unused struct cci_pmu_model cci_pmu_models[] = {
+ #ifdef CONFIG_ARM_CCI400_PMU
+ [CCI400_R0] = {
+ .name = "CCI_400",
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Mon, 21 May 2018 18:19:49 +0100
+Subject: drivers/perf: arm-ccn: don't log to dmesg in event_init
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 1898eb61fbc9703efee886d3abec27a388cf28c3 ]
+
+The ARM CCN PMU driver uses dev_warn() to complain about parameters in
+the user-provided perf_event_attr. This means that under normal
+operation (e.g. a single invocation of the perf tool), a number of
+messages warnings may be logged to dmesg.
+
+Tools may issue multiple syscalls to probe for feature support, and
+multiple applications (from multiple users) can attempt to open events
+simultaneously, so this is not very helpful, even if a user happens to
+have access to dmesg. Worse, this can push important information out of
+the dmesg ring buffer, and can significantly slow down syscall fuzzers,
+vastly increasing the time it takes to find critical bugs.
+
+Demote the dev_warn() instances to dev_dbg(), as is the case for all
+other PMU drivers under drivers/perf/. Users who wish to debug PMU event
+initialisation can enable dynamic debug to receive these messages.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Pawel Moll <pawel.moll@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/perf/arm-ccn.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/perf/arm-ccn.c
++++ b/drivers/perf/arm-ccn.c
+@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct
+ ccn = pmu_to_arm_ccn(event->pmu);
+
+ if (hw->sample_period) {
+- dev_warn(ccn->dev, "Sampling not supported!\n");
++ dev_dbg(ccn->dev, "Sampling not supported!\n");
+ return -EOPNOTSUPP;
+ }
+
+@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct
+ event->attr.exclude_kernel || event->attr.exclude_hv ||
+ event->attr.exclude_idle || event->attr.exclude_host ||
+ event->attr.exclude_guest) {
+- dev_warn(ccn->dev, "Can't exclude execution levels!\n");
++ dev_dbg(ccn->dev, "Can't exclude execution levels!\n");
+ return -EINVAL;
+ }
+
+ if (event->cpu < 0) {
+- dev_warn(ccn->dev, "Can't provide per-task data!\n");
++ dev_dbg(ccn->dev, "Can't provide per-task data!\n");
+ return -EOPNOTSUPP;
+ }
+ /*
+@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct
+ switch (type) {
+ case CCN_TYPE_MN:
+ if (node_xp != ccn->mn_id) {
+- dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
++ dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+ return -EINVAL;
+ }
+ break;
+ case CCN_TYPE_XP:
+ if (node_xp >= ccn->num_xps) {
+- dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
++ dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+ return -EINVAL;
+ }
+ break;
+@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct
+ break;
+ default:
+ if (node_xp >= ccn->num_nodes) {
+- dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp);
++ dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp);
+ return -EINVAL;
+ }
+ if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) {
+- dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n",
++ dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n",
+ type, node_xp);
+ return -EINVAL;
+ }
+@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct
+ if (event_id != e->event)
+ continue;
+ if (e->num_ports && port >= e->num_ports) {
+- dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n",
++ dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n",
+ port, node_xp);
+ return -EINVAL;
+ }
+ if (e->num_vcs && vc >= e->num_vcs) {
+- dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n",
++ dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n",
+ vc, node_xp);
+ return -EINVAL;
+ }
+ valid = 1;
+ }
+ if (!valid) {
+- dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
++ dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
+ event_id, node_xp);
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: "José Roberto de Souza" <jose.souza@intel.com>
+Date: Wed, 28 Mar 2018 15:30:37 -0700
+Subject: drm: Add DP PSR2 sink enable bit
+
+From: "José Roberto de Souza" <jose.souza@intel.com>
+
+[ Upstream commit 4f212e40468650e220c1770876c7f25b8e0c1ff5 ]
+
+To comply with eDP1.4a this bit should be set when enabling PSR2.
+
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180328223046.16125-1-jose.souza@intel.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/drm/drm_dp_helper.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/drm_dp_helper.h
++++ b/include/drm/drm_dp_helper.h
+@@ -478,6 +478,7 @@
+ # define DP_PSR_FRAME_CAPTURE (1 << 3)
+ # define DP_PSR_SELECTIVE_UPDATE (1 << 4)
+ # define DP_PSR_IRQ_HPD_WITH_CRC_ERRORS (1 << 5)
++# define DP_PSR_ENABLE_PSR2 (1 << 6) /* eDP 1.4a */
+
+ #define DP_ADAPTER_CTRL 0x1a0
+ # define DP_ADAPTER_CTRL_FORCE_LOAD_SENSE (1 << 0)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mikita Lipski <mikita.lipski@amd.com>
+Date: Thu, 3 May 2018 17:08:51 -0400
+Subject: drm/amd/display: Do not program interrupt status on disabled crtc
+
+From: Mikita Lipski <mikita.lipski@amd.com>
+
+[ Upstream commit 4ea7fc09539bd2399c1fa7acea14529406120d9e ]
+
+Prevent interrupt programming of a crtc on which the stream is disabled and
+it doesn't have an OTG to reference.
+
+Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
+Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+@@ -555,6 +555,9 @@ static inline int dm_irq_state(struct am
+ return 0;
+ }
+
++ if (acrtc->otg_inst == -1)
++ return 0;
++
+ irq_source = dal_irq_type + acrtc->otg_inst;
+
+ st = (state == AMDGPU_IRQ_STATE_ENABLE);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Leo (Sunpeng) Li" <sunpeng.li@amd.com>
+Date: Thu, 29 Mar 2018 17:04:12 -0400
+Subject: drm/amd/display: Fix dim display on DCE11
+
+From: "Leo (Sunpeng) Li" <sunpeng.li@amd.com>
+
+[ Upstream commit 84ffa80123f56f80145dc638f21dfcbedda5610d ]
+
+Before programming the input gamma, check that we're not using the
+identity correction.
+
+Signed-off-by: Leo (Sunpeng) Li <sunpeng.li@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -279,7 +279,9 @@ dce110_set_input_transfer_func(struct pi
+ build_prescale_params(&prescale_params, plane_state);
+ ipp->funcs->ipp_program_prescale(ipp, &prescale_params);
+
+- if (plane_state->gamma_correction && dce_use_lut(plane_state->format))
++ if (plane_state->gamma_correction &&
++ !plane_state->gamma_correction->is_identity &&
++ dce_use_lut(plane_state->format))
+ ipp->funcs->ipp_program_input_lut(ipp, plane_state->gamma_correction);
+
+ if (tf == NULL) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Shirish S <shirish.s@amd.com>
+Date: Fri, 27 Apr 2018 15:47:21 +0530
+Subject: drm/amd/display: remove need of modeset flag for overlay planes (V2)
+
+From: Shirish S <shirish.s@amd.com>
+
+[ Upstream commit a2a330ad66313084c9432b32862aa7e1255da9b4 ]
+
+This patch is in continuation to the
+"843e3c7 drm/amd/display: defer modeset check in dm_update_planes_state"
+where we started to eliminate the dependency on
+DRM_MODE_ATOMIC_ALLOW_MODESET to be set by the user space,
+which as such is not mandatory.
+
+After deferring, this patch eliminates the dependency on the flag
+for overlay planes.
+
+This has to be done in stages as its a pretty complex and requires thorough
+testing before we free primary planes as well from dependency on modeset
+flag.
+
+V2: Simplified the plane type check.
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4037,7 +4037,7 @@ static void amdgpu_dm_commit_planes(stru
+ }
+ spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+
+- if (!pflip_needed) {
++ if (!pflip_needed || plane->type == DRM_PLANE_TYPE_OVERLAY) {
+ WARN_ON(!dm_new_plane_state->dc_state);
+
+ plane_states_constructed[planes_count] = dm_new_plane_state->dc_state;
+@@ -4783,7 +4783,8 @@ static int dm_update_planes_state(struct
+
+ /* Remove any changed/removed planes */
+ if (!enable) {
+- if (pflip_needed)
++ if (pflip_needed &&
++ plane->type != DRM_PLANE_TYPE_OVERLAY)
+ continue;
+
+ if (!old_plane_crtc)
+@@ -4830,7 +4831,8 @@ static int dm_update_planes_state(struct
+ if (!dm_new_crtc_state->stream)
+ continue;
+
+- if (pflip_needed)
++ if (pflip_needed &&
++ plane->type != DRM_PLANE_TYPE_OVERLAY)
+ continue;
+
+ WARN_ON(dm_new_plane_state->dc_state);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Tue, 12 Jun 2018 15:07:37 +0800
+Subject: drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2)
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+[ Upstream commit 5c16f36f6f003b4415237acca59384a074cd8030 ]
+
+Fix the issue that SCLK&MCLK can't be set higher than dpm7 when
+OD is enabled in SMU7.
+
+v2: fix warning (Alex)
+
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Acked-by: Rex Zhu<rezhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3715,14 +3715,17 @@ static int smu7_trim_dpm_states(struct p
+ static int smu7_generate_dpm_level_enable_mask(
+ struct pp_hwmgr *hwmgr, const void *input)
+ {
+- int result;
++ int result = 0;
+ const struct phm_set_power_state_input *states =
+ (const struct phm_set_power_state_input *)input;
+ struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+ const struct smu7_power_state *smu7_ps =
+ cast_const_phw_smu7_power_state(states->pnew_state);
+
+- result = smu7_trim_dpm_states(hwmgr, smu7_ps);
++ /*skip the trim if od is enabled*/
++ if (!hwmgr->od_enabled)
++ result = smu7_trim_dpm_states(hwmgr, smu7_ps);
++
+ if (result)
+ return result;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Fri, 23 Mar 2018 15:32:30 -0400
+Subject: drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 6e08e0995b8f339fd2a7ee4fa11f17396405ef60 ]
+
+When an MMU notifier runs in memory reclaim context, it can deadlock
+trying to take locks that are already held in the thread causing the
+memory reclaim. The solution is to avoid memory reclaim while holding
+locks that are taken in MMU notifiers.
+
+This commit fixes kmalloc while holding rmn->lock by moving the call
+outside the lock. The GFX MMU notifier also locks reservation objects.
+I have no good solution for avoiding reclaim while holding reservation
+objects. The HSA MMU notifier will not lock any reservation objects.
+
+v2: Moved allocation outside lock instead of using GFP_NOIO
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Acked-by: Oded Gabbay <oded.gabbay@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
+@@ -316,7 +316,7 @@ int amdgpu_mn_register(struct amdgpu_bo
+ unsigned long end = addr + amdgpu_bo_size(bo) - 1;
+ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
+ struct amdgpu_mn *rmn;
+- struct amdgpu_mn_node *node = NULL;
++ struct amdgpu_mn_node *node = NULL, *new_node;
+ struct list_head bos;
+ struct interval_tree_node *it;
+
+@@ -324,6 +324,10 @@ int amdgpu_mn_register(struct amdgpu_bo
+ if (IS_ERR(rmn))
+ return PTR_ERR(rmn);
+
++ new_node = kmalloc(sizeof(*new_node), GFP_KERNEL);
++ if (!new_node)
++ return -ENOMEM;
++
+ INIT_LIST_HEAD(&bos);
+
+ down_write(&rmn->lock);
+@@ -337,13 +341,10 @@ int amdgpu_mn_register(struct amdgpu_bo
+ list_splice(&node->bos, &bos);
+ }
+
+- if (!node) {
+- node = kmalloc(sizeof(struct amdgpu_mn_node), GFP_KERNEL);
+- if (!node) {
+- up_write(&rmn->lock);
+- return -ENOMEM;
+- }
+- }
++ if (!node)
++ node = new_node;
++ else
++ kfree(new_node);
+
+ bo->mn = rmn;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Samuel Li <Samuel.Li@amd.com>
+Date: Wed, 18 Apr 2018 16:26:18 -0400
+Subject: drm/amdgpu: Remove VRAM from shared bo domains.
+
+From: Samuel Li <Samuel.Li@amd.com>
+
+[ Upstream commit 9b3f217faf48603c91d4ca44a18e6ff74c3c1c0c ]
+
+This fixes an issue introduced by change "allow framebuffer in GART
+memory as well" which could lead to a shared buffer ending up
+pinned in vram. Use GTT if it is included in the domain, otherwise
+return an error.
+
+Signed-off-by: Samuel Li <Samuel.Li@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -689,8 +689,12 @@ int amdgpu_bo_pin_restricted(struct amdg
+ return -EINVAL;
+
+ /* A shared bo cannot be migrated to VRAM */
+- if (bo->prime_shared_count && (domain == AMDGPU_GEM_DOMAIN_VRAM))
+- return -EINVAL;
++ if (bo->prime_shared_count) {
++ if (domain & AMDGPU_GEM_DOMAIN_GTT)
++ domain = AMDGPU_GEM_DOMAIN_GTT;
++ else
++ return -EINVAL;
++ }
+
+ if (bo->pin_count) {
+ uint32_t mem_type = bo->tbo.mem.mem_type;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Satendra Singh Thakur <satendra.t@samsung.com>
+Date: Thu, 3 May 2018 11:19:32 +0530
+Subject: drm/atomic: Handling the case when setting old crtc for plane
+
+From: Satendra Singh Thakur <satendra.t@samsung.com>
+
+[ Upstream commit fc2a69f3903dfd97cd47f593e642b47918c949df ]
+
+In the func drm_atomic_set_crtc_for_plane, with the current code,
+if crtc of the plane_state and crtc passed as argument to the func
+are same, entire func will executed in vein.
+It will get state of crtc and clear and set the bits in plane_mask.
+All these steps are not required for same old crtc.
+Ideally, we should do nothing in this case, this patch handles the same,
+and causes the program to return without doing anything in such scenario.
+
+Signed-off-by: Satendra Singh Thakur <satendra.t@samsung.com>
+Cc: Madhur Verma <madhur.verma@samsung.com>
+Cc: Hemanshu Srivastava <hemanshu.s@samsung.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/1525326572-25854-1-git-send-email-satendra.t@samsung.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1429,7 +1429,9 @@ drm_atomic_set_crtc_for_plane(struct drm
+ {
+ struct drm_plane *plane = plane_state->plane;
+ struct drm_crtc_state *crtc_state;
+-
++ /* Nothing to do for same crtc*/
++ if (plane_state->crtc == crtc)
++ return 0;
+ if (plane_state->crtc) {
+ crtc_state = drm_atomic_get_crtc_state(plane_state->state,
+ plane_state->crtc);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+Date: Thu, 22 Mar 2018 17:22:51 +0200
+Subject: drm/atomic-helper: Drop plane->fb references only for drm_atomic_helper_shutdown()
+
+From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 5e9cfeba6abb7e1a3f240bd24eb29178f0b83716 ]
+
+drm_atomic_helper_shutdown() needs to release the reference held by
+plane->fb. Since commit 49d70aeaeca8 ("drm/atomic-helper: Fix leak in
+disable_all") we're doing that by calling drm_atomic_clean_old_fb() in
+drm_atomic_helper_disable_all(). This also leaves plane->fb == NULL
+afterwards. However, since drm_atomic_helper_disable_all() is also
+used by the i915 gpu reset code
+drm_atomic_helper_commit_duplicated_state() then has to undo the
+damage and put the correct plane->fb pointers back in (and also
+adjust the ref counts to match again as well).
+
+That approach doesn't work so well for load detection as nothing
+sets up the plane->old_fb pointers for us. This causes us to
+leak an extra reference for each plane->fb when
+drm_atomic_helper_commit_duplicated_state() calls
+drm_atomic_clean_old_fb() after load detection.
+
+To fix this let's call drm_atomic_clean_old_fb() only for
+drm_atomic_helper_shutdown() as that's the only time we need to
+actually drop the plane->fb references. In all the other cases
+(load detection, gpu reset) we want to leave plane->fb alone.
+
+v2: Don't inflict the clean_old_fbs bool to drivers (Daniel)
+v3: Squash in the revert and rewrite the commit msg (Daniel)
+
+Cc: martin.peres@free.fr
+Cc: chris@chris-wilson.co.uk
+Cc: Dave Airlie <airlied@gmail.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180322152313.6561-3-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> #pre-squash
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 78 ++++++++++++++++++------------------
+ 1 file changed, 39 insertions(+), 39 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -2881,31 +2881,9 @@ commit:
+ return 0;
+ }
+
+-/**
+- * drm_atomic_helper_disable_all - disable all currently active outputs
+- * @dev: DRM device
+- * @ctx: lock acquisition context
+- *
+- * Loops through all connectors, finding those that aren't turned off and then
+- * turns them off by setting their DPMS mode to OFF and deactivating the CRTC
+- * that they are connected to.
+- *
+- * This is used for example in suspend/resume to disable all currently active
+- * functions when suspending. If you just want to shut down everything at e.g.
+- * driver unload, look at drm_atomic_helper_shutdown().
+- *
+- * Note that if callers haven't already acquired all modeset locks this might
+- * return -EDEADLK, which must be handled by calling drm_modeset_backoff().
+- *
+- * Returns:
+- * 0 on success or a negative error code on failure.
+- *
+- * See also:
+- * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and
+- * drm_atomic_helper_shutdown().
+- */
+-int drm_atomic_helper_disable_all(struct drm_device *dev,
+- struct drm_modeset_acquire_ctx *ctx)
++static int __drm_atomic_helper_disable_all(struct drm_device *dev,
++ struct drm_modeset_acquire_ctx *ctx,
++ bool clean_old_fbs)
+ {
+ struct drm_atomic_state *state;
+ struct drm_connector_state *conn_state;
+@@ -2957,8 +2935,11 @@ int drm_atomic_helper_disable_all(struct
+ goto free;
+
+ drm_atomic_set_fb_for_plane(plane_state, NULL);
+- plane_mask |= BIT(drm_plane_index(plane));
+- plane->old_fb = plane->fb;
++
++ if (clean_old_fbs) {
++ plane->old_fb = plane->fb;
++ plane_mask |= BIT(drm_plane_index(plane));
++ }
+ }
+
+ ret = drm_atomic_commit(state);
+@@ -2969,6 +2950,34 @@ free:
+ return ret;
+ }
+
++/**
++ * drm_atomic_helper_disable_all - disable all currently active outputs
++ * @dev: DRM device
++ * @ctx: lock acquisition context
++ *
++ * Loops through all connectors, finding those that aren't turned off and then
++ * turns them off by setting their DPMS mode to OFF and deactivating the CRTC
++ * that they are connected to.
++ *
++ * This is used for example in suspend/resume to disable all currently active
++ * functions when suspending. If you just want to shut down everything at e.g.
++ * driver unload, look at drm_atomic_helper_shutdown().
++ *
++ * Note that if callers haven't already acquired all modeset locks this might
++ * return -EDEADLK, which must be handled by calling drm_modeset_backoff().
++ *
++ * Returns:
++ * 0 on success or a negative error code on failure.
++ *
++ * See also:
++ * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and
++ * drm_atomic_helper_shutdown().
++ */
++int drm_atomic_helper_disable_all(struct drm_device *dev,
++ struct drm_modeset_acquire_ctx *ctx)
++{
++ return __drm_atomic_helper_disable_all(dev, ctx, false);
++}
+ EXPORT_SYMBOL(drm_atomic_helper_disable_all);
+
+ /**
+@@ -2991,7 +3000,7 @@ void drm_atomic_helper_shutdown(struct d
+ while (1) {
+ ret = drm_modeset_lock_all_ctx(dev, &ctx);
+ if (!ret)
+- ret = drm_atomic_helper_disable_all(dev, &ctx);
++ ret = __drm_atomic_helper_disable_all(dev, &ctx, true);
+
+ if (ret != -EDEADLK)
+ break;
+@@ -3095,16 +3104,11 @@ int drm_atomic_helper_commit_duplicated_
+ struct drm_connector_state *new_conn_state;
+ struct drm_crtc *crtc;
+ struct drm_crtc_state *new_crtc_state;
+- unsigned plane_mask = 0;
+- struct drm_device *dev = state->dev;
+- int ret;
+
+ state->acquire_ctx = ctx;
+
+- for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+- plane_mask |= BIT(drm_plane_index(plane));
++ for_each_new_plane_in_state(state, plane, new_plane_state, i)
+ state->planes[i].old_state = plane->state;
+- }
+
+ for_each_new_crtc_in_state(state, crtc, new_crtc_state, i)
+ state->crtcs[i].old_state = crtc->state;
+@@ -3112,11 +3116,7 @@ int drm_atomic_helper_commit_duplicated_
+ for_each_new_connector_in_state(state, connector, new_conn_state, i)
+ state->connectors[i].old_state = connector->state;
+
+- ret = drm_atomic_commit(state);
+- if (plane_mask)
+- drm_atomic_clean_old_fb(dev, plane_mask, ret);
+-
+- return ret;
++ return drm_atomic_commit(state);
+ }
+ EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Mon, 19 Mar 2018 16:19:32 +0200
+Subject: drm/dp/mst: Fix off-by-one typo when dump payload table
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7056a2bccc3b5afc51f9b35b30a46f0d9219968d ]
+
+It seems there is a classical off-by-one typo from the beginning
+when commit
+
+ ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+
+introduced a new helper.
+
+Fix a typo by introducing a macro constant.
+
+Cc: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180319141932.37290-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2941,12 +2941,14 @@ static void drm_dp_mst_dump_mstb(struct
+ }
+ }
+
++#define DP_PAYLOAD_TABLE_SIZE 64
++
+ static bool dump_dp_payload_table(struct drm_dp_mst_topology_mgr *mgr,
+ char *buf)
+ {
+ int i;
+
+- for (i = 0; i < 64; i += 16) {
++ for (i = 0; i < DP_PAYLOAD_TABLE_SIZE; i += 16) {
+ if (drm_dp_dpcd_read(mgr->aux,
+ DP_PAYLOAD_TABLE_UPDATE_STATUS + i,
+ &buf[i], 16) != 16)
+@@ -3015,7 +3017,7 @@ void drm_dp_mst_dump_topology(struct seq
+
+ mutex_lock(&mgr->lock);
+ if (mgr->mst_primary) {
+- u8 buf[64];
++ u8 buf[DP_PAYLOAD_TABLE_SIZE];
+ int ret;
+
+ ret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, buf, DP_RECEIVER_CAP_SIZE);
+@@ -3033,8 +3035,7 @@ void drm_dp_mst_dump_topology(struct seq
+ seq_printf(m, " revision: hw: %x.%x sw: %x.%x\n",
+ buf[0x9] >> 4, buf[0x9] & 0xf, buf[0xa], buf[0xb]);
+ if (dump_dp_payload_table(mgr, buf))
+- seq_printf(m, "payload table: %*ph\n", 63, buf);
+-
++ seq_printf(m, "payload table: %*ph\n", DP_PAYLOAD_TABLE_SIZE, buf);
+ }
+
+ mutex_unlock(&mgr->lock);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Date: Tue, 24 Apr 2018 15:14:57 +0200
+Subject: drm/gma500: fix psb_intel_lvds_mode_valid()'s return type
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2ea009095c6e7396915a1d0dd480c41f02985f79 ]
+
+The method struct drm_connector_helper_funcs::mode_valid is defined
+as returning an 'enum drm_mode_status' but the driver implementation
+for this method, psb_intel_lvds_mode_valid(), uses an 'int' for it.
+
+Fix this by using 'enum drm_mode_status' for psb_intel_lvds_mode_valid().
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180424131458.2060-1-luc.vanoostenryck@gmail.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/psb_intel_drv.h | 2 +-
+ drivers/gpu/drm/gma500/psb_intel_lvds.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/psb_intel_drv.h
++++ b/drivers/gpu/drm/gma500/psb_intel_drv.h
+@@ -255,7 +255,7 @@ extern int intelfb_remove(struct drm_dev
+ extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder,
+ const struct drm_display_mode *mode,
+ struct drm_display_mode *adjusted_mode);
+-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector,
++extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode);
+ extern int psb_intel_lvds_set_property(struct drm_connector *connector,
+ struct drm_property *property,
+--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
+@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struc
+ }
+ }
+
+-int psb_intel_lvds_mode_valid(struct drm_connector *connector,
++enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ struct drm_psb_private *dev_priv = connector->dev->dev_private;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 8 May 2018 20:39:46 +1000
+Subject: drm/nouveau/fifo/gk104-: poll for runlist update completion
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 4f2fc25c0f8bcc8db1b8a7b21e88c3d7f35c5acb ]
+
+Newer HW doesn't appear to send this event, which will cause long delays
+in runlist updates if they don't complete immediately.
+
+RM doesn't use these events anywhere, and an NVGPU commit message notes
+that polling is the preferred method even on HW that supports the event.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_f
+ (target << 28));
+ nvkm_wr32(device, 0x002274, (runl << 20) | nr);
+
+- if (wait_event_timeout(fifo->runlist[runl].wait,
+- !(nvkm_rd32(device, 0x002284 + (runl * 0x08))
+- & 0x00100000),
+- msecs_to_jiffies(2000)) == 0)
++ if (nvkm_msec(device, 2000,
++ if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000))
++ break;
++ ) < 0)
+ nvkm_error(subdev, "runlist %d update timeout\n", runl);
+ unlock:
+ mutex_unlock(&subdev->mutex);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 8 May 2018 20:39:47 +1000
+Subject: drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 19ca10d82e33bcfe92412c461fc3534ec1e14747 ]
+
+We previously only did this for push buffers, but an upcoming patch will
+need to attach fences to all VMAs to resolve another issue.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_dma.c | 10 +---------
+ drivers/gpu/drm/nouveau/nouveau_dma.h | 5 ++---
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 19 ++++++++++++++++---
+ 3 files changed, 19 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
+@@ -80,18 +80,10 @@ READ_GET(struct nouveau_channel *chan, u
+ }
+
+ void
+-nv50_dma_push(struct nouveau_channel *chan, struct nouveau_bo *bo,
+- int delta, int length)
++nv50_dma_push(struct nouveau_channel *chan, u64 offset, int length)
+ {
+- struct nouveau_cli *cli = (void *)chan->user.client;
+ struct nouveau_bo *pb = chan->push.buffer;
+- struct nouveau_vma *vma;
+ int ip = (chan->dma.ib_put * 2) + chan->dma.ib_base;
+- u64 offset;
+-
+- vma = nouveau_vma_find(bo, &cli->vmm);
+- BUG_ON(!vma);
+- offset = vma->addr + delta;
+
+ BUG_ON(chan->dma.ib_free < 1);
+
+--- a/drivers/gpu/drm/nouveau/nouveau_dma.h
++++ b/drivers/gpu/drm/nouveau/nouveau_dma.h
+@@ -31,8 +31,7 @@
+ #include "nouveau_chan.h"
+
+ int nouveau_dma_wait(struct nouveau_channel *, int slots, int size);
+-void nv50_dma_push(struct nouveau_channel *, struct nouveau_bo *,
+- int delta, int length);
++void nv50_dma_push(struct nouveau_channel *, u64 addr, int length);
+
+ /*
+ * There's a hw race condition where you can't jump to your PUT offset,
+@@ -151,7 +150,7 @@ FIRE_RING(struct nouveau_channel *chan)
+ chan->accel_done = true;
+
+ if (chan->dma.ib_max) {
+- nv50_dma_push(chan, chan->push.buffer, chan->dma.put << 2,
++ nv50_dma_push(chan, chan->push.addr + (chan->dma.put << 2),
+ (chan->dma.cur - chan->dma.put) << 2);
+ } else {
+ WRITE_PUT(chan->dma.cur);
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -432,7 +432,20 @@ retry:
+ }
+ }
+
+- b->user_priv = (uint64_t)(unsigned long)nvbo;
++ if (cli->vmm.vmm.object.oclass >= NVIF_CLASS_VMM_NV50) {
++ struct nouveau_vmm *vmm = &cli->vmm;
++ struct nouveau_vma *vma = nouveau_vma_find(nvbo, vmm);
++ if (!vma) {
++ NV_PRINTK(err, cli, "vma not found!\n");
++ ret = -EINVAL;
++ break;
++ }
++
++ b->user_priv = (uint64_t)(unsigned long)vma;
++ } else {
++ b->user_priv = (uint64_t)(unsigned long)nvbo;
++ }
++
+ nvbo->reserved_by = file_priv;
+ nvbo->pbbo_index = i;
+ if ((b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+@@ -763,10 +776,10 @@ nouveau_gem_ioctl_pushbuf(struct drm_dev
+ }
+
+ for (i = 0; i < req->nr_push; i++) {
+- struct nouveau_bo *nvbo = (void *)(unsigned long)
++ struct nouveau_vma *vma = (void *)(unsigned long)
+ bo[push[i].bo_index].user_priv;
+
+- nv50_dma_push(chan, nvbo, push[i].offset,
++ nv50_dma_push(chan, vma->addr + push[i].offset,
+ push[i].length);
+ }
+ } else
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 8 May 2018 20:39:47 +1000
+Subject: drm/nouveau: remove fence wait code from deferred client work handler
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 11e451e74050d9e9030581ce40337838acfcea5b ]
+
+Fences attached to deferred client work items now originate from channels
+belonging to the client, meaning we can be certain they've been signalled
+before we destroy a client.
+
+This closes a race that could happen if the dma_fence_wait_timeout() call
+didn't succeed. When the fence was later signalled, a use-after-free was
+possible.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_drm.c | 30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -116,24 +116,22 @@ nouveau_name(struct drm_device *dev)
+ }
+
+ static inline bool
+-nouveau_cli_work_ready(struct dma_fence *fence, bool wait)
++nouveau_cli_work_ready(struct dma_fence *fence)
+ {
+- if (!dma_fence_is_signaled(fence)) {
+- if (!wait)
+- return false;
+- WARN_ON(dma_fence_wait_timeout(fence, false, 2 * HZ) <= 0);
+- }
++ if (!dma_fence_is_signaled(fence))
++ return false;
+ dma_fence_put(fence);
+ return true;
+ }
+
+ static void
+-nouveau_cli_work_flush(struct nouveau_cli *cli, bool wait)
++nouveau_cli_work(struct work_struct *w)
+ {
++ struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
+ struct nouveau_cli_work *work, *wtmp;
+ mutex_lock(&cli->lock);
+ list_for_each_entry_safe(work, wtmp, &cli->worker, head) {
+- if (!work->fence || nouveau_cli_work_ready(work->fence, wait)) {
++ if (!work->fence || nouveau_cli_work_ready(work->fence)) {
+ list_del(&work->head);
+ work->func(work);
+ }
+@@ -162,16 +160,16 @@ nouveau_cli_work_queue(struct nouveau_cl
+ }
+
+ static void
+-nouveau_cli_work(struct work_struct *w)
+-{
+- struct nouveau_cli *cli = container_of(w, typeof(*cli), work);
+- nouveau_cli_work_flush(cli, false);
+-}
+-
+-static void
+ nouveau_cli_fini(struct nouveau_cli *cli)
+ {
+- nouveau_cli_work_flush(cli, true);
++ /* All our channels are dead now, which means all the fences they
++ * own are signalled, and all callback functions have been called.
++ *
++ * So, after flushing the workqueue, there should be nothing left.
++ */
++ flush_work(&cli->work);
++ WARN_ON(!list_empty(&cli->worker));
++
+ usif_client_fini(cli);
+ nouveau_vmm_fini(&cli->vmm);
+ nvif_mmu_fini(&cli->mmu);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Date: Tue, 24 Apr 2018 15:15:13 +0200
+Subject: drm/radeon: fix mode_valid's return type
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 7a47f20eb1fb8fa8d7a8fe3a4fd8c721f04c2174 ]
+
+The method struct drm_connector_helper_funcs::mode_valid is defined
+as returning an 'enum drm_mode_status' but the driver implementation
+for this method uses an 'int' for it.
+
+Fix this by using 'enum drm_mode_status' in the driver too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -852,7 +852,7 @@ static int radeon_lvds_get_modes(struct
+ return ret;
+ }
+
+-static int radeon_lvds_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ struct drm_encoder *encoder = radeon_best_single_encoder(connector);
+@@ -1012,7 +1012,7 @@ static int radeon_vga_get_modes(struct d
+ return ret;
+ }
+
+-static int radeon_vga_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ struct drm_device *dev = connector->dev;
+@@ -1156,7 +1156,7 @@ static int radeon_tv_get_modes(struct dr
+ return 1;
+ }
+
+-static int radeon_tv_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ if ((mode->hdisplay > 1024) || (mode->vdisplay > 768))
+@@ -1498,7 +1498,7 @@ static void radeon_dvi_force(struct drm_
+ radeon_connector->use_digital = true;
+ }
+
+-static int radeon_dvi_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ struct drm_device *dev = connector->dev;
+@@ -1800,7 +1800,7 @@ out:
+ return ret;
+ }
+
+-static int radeon_dp_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ struct drm_device *dev = connector->dev;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Tomasz Figa <tfiga@chromium.org>
+Date: Mon, 23 Apr 2018 12:49:59 +0200
+Subject: drm/rockchip: analogix_dp: Do not call Analogix code before bind
+
+From: Tomasz Figa <tfiga@chromium.org>
+
+[ Upstream commit a4169609def769c66f88140678970b2be6f64ac7 ]
+
+Driver callbacks, such as system suspend or resume can be called any
+time, specifically they can be called before the component bind
+callback. Let's use dp->adp pointer as a safeguard and skip calling
+Analogix entry points if it is an ERR_PTR().
+
+Signed-off-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Archit Taneja <architt@codeaurora.org>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180423105003.9004-24-enric.balletbo@collabora.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -358,6 +358,8 @@ static void rockchip_dp_unbind(struct de
+ analogix_dp_unbind(dp->adp);
+ rockchip_drm_psr_unregister(&dp->encoder);
+ dp->encoder.funcs->destroy(&dp->encoder);
++
++ dp->adp = ERR_PTR(-ENODEV);
+ }
+
+ static const struct component_ops rockchip_dp_component_ops = {
+@@ -381,6 +383,7 @@ static int rockchip_dp_probe(struct plat
+ return -ENOMEM;
+
+ dp->dev = dev;
++ dp->adp = ERR_PTR(-ENODEV);
+ dp->plat_data.panel = panel;
+
+ ret = rockchip_dp_of_probe(dp);
+@@ -404,6 +407,9 @@ static int rockchip_dp_suspend(struct de
+ {
+ struct rockchip_dp_device *dp = dev_get_drvdata(dev);
+
++ if (IS_ERR(dp->adp))
++ return 0;
++
+ return analogix_dp_suspend(dp->adp);
+ }
+
+@@ -411,6 +417,9 @@ static int rockchip_dp_resume(struct dev
+ {
+ struct rockchip_dp_device *dp = dev_get_drvdata(dev);
+
++ if (IS_ERR(dp->adp))
++ return 0;
++
+ return analogix_dp_resume(dp->adp);
+ }
+ #endif
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Philippe CORNU <philippe.cornu@st.com>
+Date: Tue, 10 Apr 2018 15:53:12 +0200
+Subject: drm/stm: ltdc: fix warning in ltdc_crtc_update_clut()
+
+From: Philippe CORNU <philippe.cornu@st.com>
+
+[ Upstream commit c20f5f69c898899027c3e573afaab837195895b6 ]
+
+Fix the warning
+"warn: variable dereferenced before check 'crtc' (see line 390)"
+by removing unnecessary checks as ltdc_crtc_update_clut() is
+only called from ltdc_crtc_atomic_flush() where crtc and
+crtc->state are not NULL.
+
+Many thanks to Dan Carpenter for the bug report
+https://lists.freedesktop.org/archives/dri-devel/2018-February/166918.html
+
+Signed-off-by: Philippe Cornu <philippe.cornu@st.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: yannick fertre <yannick.fertre@st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180410135312.3553-1-philippe.cornu@st.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -392,9 +392,6 @@ static void ltdc_crtc_update_clut(struct
+ u32 val;
+ int i;
+
+- if (!crtc || !crtc->state)
+- return;
+-
+ if (!crtc->state->color_mgmt_changed || !crtc->state->gamma_lut)
+ return;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: David Lechner <david@lechnology.com>
+Date: Wed, 14 Mar 2018 17:58:45 -0500
+Subject: drm/tilcdc: Fix setting clock divider for omap-l138
+
+From: David Lechner <david@lechnology.com>
+
+[ Upstream commit a88ad3ded15daa0389106779c60b8a5e76d4b20a ]
+
+This fixes setting the clock divider on the TI OMAP-L138 LCDK board.
+
+The clock drivers for OMAP-L138 are being covernted to the common clock
+framework. When this happens, clk_set_rate() will no longer return an
+error. However, on this SoC, the clock rate cannot actually be changed
+because the clock has to maintain a fixed ratio to the ARM clock. So
+after attempting to set the clock rate, we need to check to see if the
+new rate is actually close enough. If not, then follow the previous
+error path to adjust the divider in LCDC IP block to compensate for not
+being able to change the parent clock rate.
+
+Tested working on a TI OMAP-L138 LCDK board.
+
+Signed-off-by: David Lechner <david@lechnology.com>
+Signed-off-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+@@ -224,7 +224,7 @@ static void tilcdc_crtc_set_clk(struct d
+
+ ret = clk_set_rate(priv->clk, req_rate * clkdiv);
+ clk_rate = clk_get_rate(priv->clk);
+- if (ret < 0) {
++ if (ret < 0 || tilcdc_pclk_diff(req_rate, clk_rate) > 5) {
+ /*
+ * If we fail to set the clock rate (some architectures don't
+ * use the common clock framework yet and may not implement
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yixun Lan <yixun.lan@amlogic.com>
+Date: Sat, 28 Apr 2018 10:21:10 +0000
+Subject: dt-bindings: net: meson-dwmac: new compatible name for AXG SoC
+
+From: Yixun Lan <yixun.lan@amlogic.com>
+
+[ Upstream commit 7e5d05e18ba1ed491c6f836edee7f0b90f3167bc ]
+
+We need to introduce a new compatible name for the Meson-AXG SoC
+in order to support the RMII 100M ethernet PHY, since the PRG_ETH0
+register of the dwmac glue layer is changed from previous old SoC.
+
+Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/net/meson-dwmac.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt
++++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt
+@@ -11,6 +11,7 @@ Required properties on all platforms:
+ - "amlogic,meson8b-dwmac"
+ - "amlogic,meson8m2-dwmac"
+ - "amlogic,meson-gxbb-dwmac"
++ - "amlogic,meson-axg-dwmac"
+ Additionally "snps,dwmac" and any applicable more
+ detailed version number described in net/stmmac.txt
+ should be used.
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 22 Apr 2018 12:53:28 +0200
+Subject: dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 03d9fbc39730b3e6b2e7047dc85f0f70de8fb97d ]
+
+The Meson8m2 SoC is a variant of Meson8 with some updates from Meson8b
+(such as the Gigabit capable DesignWare MAC).
+It is mostly pin compatible with Meson8, only 10 (existing) CBUS pins
+get an additional function (four of these are Ethernet RXD2, RXD3, TXD2
+and TXD3 which are required when the board uses an RGMII PHY).
+The AOBUS pins seem to be identical on Meson8 and Meson8m2.
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
+@@ -3,8 +3,10 @@
+ Required properties for the root node:
+ - compatible: one of "amlogic,meson8-cbus-pinctrl"
+ "amlogic,meson8b-cbus-pinctrl"
++ "amlogic,meson8m2-cbus-pinctrl"
+ "amlogic,meson8-aobus-pinctrl"
+ "amlogic,meson8b-aobus-pinctrl"
++ "amlogic,meson8m2-aobus-pinctrl"
+ "amlogic,meson-gxbb-periphs-pinctrl"
+ "amlogic,meson-gxbb-aobus-pinctrl"
+ "amlogic,meson-gxl-periphs-pinctrl"
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Benjamin Poirier <bpoirier@suse.com>
+Date: Thu, 10 May 2018 16:28:35 +0900
+Subject: e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes
+
+From: Benjamin Poirier <bpoirier@suse.com>
+
+[ Upstream commit fff200caf6f9179dd9a7fc67acd659e614c3f72f ]
+
+There have been multiple reports of crashes that look like
+kernel: RIP: 0010:[<ffffffff8110303f>] timecounter_read+0xf/0x50
+[...]
+kernel: Call Trace:
+kernel: [<ffffffffa0806b0f>] e1000e_phc_gettime+0x2f/0x60 [e1000e]
+kernel: [<ffffffffa0806c5d>] e1000e_systim_overflow_work+0x1d/0x80 [e1000e]
+kernel: [<ffffffff810992c5>] process_one_work+0x155/0x440
+kernel: [<ffffffff81099e16>] worker_thread+0x116/0x4b0
+kernel: [<ffffffff8109f422>] kthread+0xd2/0xf0
+kernel: [<ffffffff8163184f>] ret_from_fork+0x3f/0x70
+
+These can be traced back to the fact that e1000e_systim_reset() skips the
+timecounter_init() call if e1000e_get_base_timinca() returns -EINVAL, which
+leads to a null deref in timecounter_read().
+
+Commit 83129b37ef35 ("e1000e: fix systim issues", v4.2-rc1) reworked
+e1000e_get_base_timinca() in such a way that it can return -EINVAL for
+e1000_pch_spt if the SYSCFI bit is not set in TSYNCRXCTL.
+
+Some experimentation has shown that on I219 (e1000_pch_spt, "MAC: 12")
+adapters, the E1000_TSYNCRXCTL_SYSCFI flag is unstable; TSYNCRXCTL reads
+sometimes don't have the SYSCFI bit set. Retrying the read shortly after
+finds the bit to be set. This was observed at boot (probe) but also link up
+and link down.
+
+Moreover, the phc (PTP Hardware Clock) seems to operate normally even after
+reads where SYSCFI=0. Therefore, remove this register read and
+unconditionally set the clock parameters.
+
+Reported-by: Achim Mildenberger <admin@fph.physik.uni-karlsruhe.de>
+Message-Id: <20180425065243.g5mqewg5irkwgwgv@f2>
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1075876
+Fixes: 83129b37ef35 ("e1000e: fix systim issues")
+Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -3546,15 +3546,12 @@ s32 e1000e_get_base_timinca(struct e1000
+ }
+ break;
+ case e1000_pch_spt:
+- if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
+- /* Stable 24MHz frequency */
+- incperiod = INCPERIOD_24MHZ;
+- incvalue = INCVALUE_24MHZ;
+- shift = INCVALUE_SHIFT_24MHZ;
+- adapter->cc.shift = shift;
+- break;
+- }
+- return -EINVAL;
++ /* Stable 24MHz frequency */
++ incperiod = INCPERIOD_24MHZ;
++ incvalue = INCVALUE_24MHZ;
++ shift = INCVALUE_SHIFT_24MHZ;
++ adapter->cc.shift = shift;
++ break;
+ case e1000_pch_cnp:
+ if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) {
+ /* Stable 24MHz frequency */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thor Thayer <thor.thayer@linux.intel.com>
+Date: Mon, 14 May 2018 12:04:01 -0500
+Subject: EDAC, altera: Fix ARM64 build warning
+
+From: Thor Thayer <thor.thayer@linux.intel.com>
+
+[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ]
+
+The kbuild test robot reported the following warning:
+
+ drivers/edac/altera_edac.c: In function 'ocram_free_mem':
+ drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer
+ of different size [-Wpointer-to-int-cast]
+ gen_pool_free((struct gen_pool *)other, (u32)p, size);
+ ^
+
+After adding support for ARM64 architectures, the unsigned long
+parameter is 64 bits and causes a build warning on 64-bit configs. Fix
+by casting to the correct size (unsigned long) instead of u32.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support")
+Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer@linux.intel.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/altera_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size
+
+ static void ocram_free_mem(void *p, size_t size, void *other)
+ {
+- gen_pool_free((struct gen_pool *)other, (u32)p, size);
++ gen_pool_free((struct gen_pool *)other, (unsigned long)p, size);
+ }
+
+ static const struct edac_device_prv_data ocramecc_data = {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Thu, 3 May 2018 23:26:02 -0700
+Subject: f2fs: avoid fsync() failure caused by EAGAIN in writepage()
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 5b19d284f5195a925dd015a6397bfce184097378 ]
+
+pageout() in MM traslates EAGAIN, so calls handle_write_error()
+ -> mapping_set_error() -> set_bit(AS_EIO, ...).
+ file_write_and_wait_range() will see EIO error, which is critical
+ to return value of fsync() followed by atomic_write failure to user.
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1848,7 +1848,13 @@ out:
+
+ redirty_out:
+ redirty_page_for_writepage(wbc, page);
+- if (!err)
++ /*
++ * pageout() in MM traslates EAGAIN, so calls handle_write_error()
++ * -> mapping_set_error() -> set_bit(AS_EIO, ...).
++ * file_write_and_wait_range() will see EIO error, which is critical
++ * to return value of fsync() followed by atomic_write failure to user.
++ */
++ if (!err || wbc->for_reclaim)
+ return AOP_WRITEPAGE_ACTIVATE;
+ unlock_page(page);
+ return err;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Fri, 20 Apr 2018 23:44:59 -0700
+Subject: f2fs: check cap_resource only for data blocks
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit a90a0884ac75f825157470a1c17e707d487bceb6 ]
+
+This patch changes the rule to check cap_resource for data blocks, not inode
+or node blocks in order to avoid selinux denial.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/f2fs.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1602,7 +1602,7 @@ static inline bool f2fs_has_xattr_block(
+ }
+
+ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+- struct inode *inode)
++ struct inode *inode, bool cap)
+ {
+ if (!inode)
+ return true;
+@@ -1615,7 +1615,7 @@ static inline bool __allow_reserved_bloc
+ if (!gid_eq(F2FS_OPTION(sbi).s_resgid, GLOBAL_ROOT_GID) &&
+ in_group_p(F2FS_OPTION(sbi).s_resgid))
+ return true;
+- if (capable(CAP_SYS_RESOURCE))
++ if (cap && capable(CAP_SYS_RESOURCE))
+ return true;
+ return false;
+ }
+@@ -1650,7 +1650,7 @@ static inline int inc_valid_block_count(
+ avail_user_block_count = sbi->user_block_count -
+ sbi->current_reserved_blocks;
+
+- if (!__allow_reserved_blocks(sbi, inode))
++ if (!__allow_reserved_blocks(sbi, inode, true))
+ avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(sbi->total_valid_block_count > avail_user_block_count)) {
+@@ -1857,7 +1857,7 @@ static inline int inc_valid_node_count(s
+ valid_block_count = sbi->total_valid_block_count +
+ sbi->current_reserved_blocks + 1;
+
+- if (!__allow_reserved_blocks(sbi, inode))
++ if (!__allow_reserved_blocks(sbi, inode, false))
+ valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(valid_block_count > sbi->user_block_count)) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Mon, 28 May 2018 16:59:26 +0800
+Subject: f2fs: don't drop dentry pages after fs shutdown
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 1174abfd8309f4c47d454734233aa3b694560e10 ]
+
+As description in commit "f2fs: don't drop any page on f2fs_cp_error()
+case":
+
+"We still provide readdir() after shtudown, so we should keep pages to
+avoid additional IOs."
+
+In order to provider lastest directory structure, let's keep dentry
+pages in cache after fs shutdown.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1745,6 +1745,12 @@ static int __write_data_page(struct page
+ /* we should bypass data pages to proceed the kworkder jobs */
+ if (unlikely(f2fs_cp_error(sbi))) {
+ mapping_set_error(page->mapping, -EIO);
++ /*
++ * don't drop any dirty dentry pages for keeping lastest
++ * directory structure.
++ */
++ if (S_ISDIR(inode->i_mode))
++ goto redirty_out;
+ goto out;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sahitya Tummala <stummala@codeaurora.org>
+Date: Fri, 18 May 2018 11:51:52 +0530
+Subject: f2fs: Fix deadlock in shutdown ioctl
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit 60b2b4ee2bc01dd052f99fa9d65da2232102ef8e ]
+
+f2fs_ioc_shutdown() ioctl gets stuck in the below path
+when issued with F2FS_GOING_DOWN_FULLSYNC option.
+
+__switch_to+0x90/0xc4
+percpu_down_write+0x8c/0xc0
+freeze_super+0xec/0x1e4
+freeze_bdev+0xc4/0xcc
+f2fs_ioctl+0xc0c/0x1ce0
+f2fs_compat_ioctl+0x98/0x1f0
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1851,9 +1851,11 @@ static int f2fs_ioc_shutdown(struct file
+ if (get_user(in, (__u32 __user *)arg))
+ return -EFAULT;
+
+- ret = mnt_want_write_file(filp);
+- if (ret)
+- return ret;
++ if (in != F2FS_GOING_DOWN_FULLSYNC) {
++ ret = mnt_want_write_file(filp);
++ if (ret)
++ return ret;
++ }
+
+ switch (in) {
+ case F2FS_GOING_DOWN_FULLSYNC:
+@@ -1894,7 +1896,8 @@ static int f2fs_ioc_shutdown(struct file
+
+ f2fs_update_time(sbi, REQ_TIME);
+ out:
+- mnt_drop_write_file(filp);
++ if (in != F2FS_GOING_DOWN_FULLSYNC)
++ mnt_drop_write_file(filp);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Mon, 28 May 2018 16:59:27 +0800
+Subject: f2fs: fix error path of move_data_page
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 14a28559f43ac7c0b98dd1b0e73ec9ec8ab4fc45 ]
+
+This patch fixes error path of move_data_page:
+- clear cold data flag if it fails to write page.
+- redirty page for non-ENOMEM case.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/gc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -778,9 +778,14 @@ retry:
+ set_cold_data(page);
+
+ err = do_write_data_page(&fio);
+- if (err == -ENOMEM && is_dirty) {
+- congestion_wait(BLK_RW_ASYNC, HZ/50);
+- goto retry;
++ if (err) {
++ clear_cold_data(page);
++ if (err == -ENOMEM) {
++ congestion_wait(BLK_RW_ASYNC, HZ/50);
++ goto retry;
++ }
++ if (is_dirty)
++ set_page_dirty(page);
+ }
+ }
+ out:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yunlei He <heyunlei@huawei.com>
+Date: Tue, 24 Apr 2018 11:40:19 +0800
+Subject: f2fs: fix missing clear FI_NO_PREALLOC in some error case
+
+From: Yunlei He <heyunlei@huawei.com>
+
+[ Upstream commit cba41be08cb182476fec4d318a8a8f2f8361a901 ]
+
+This patch fix missing clear FI_NO_PREALLOC in some error case
+
+Signed-off-by: Yunlei He <heyunlei@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2927,6 +2927,8 @@ static ssize_t f2fs_file_write_iter(stru
+ iov_iter_count(from)) ||
+ f2fs_has_inline_data(inode) ||
+ f2fs_force_buffered_io(inode, WRITE)) {
++ clear_inode_flag(inode,
++ FI_NO_PREALLOC);
+ inode_unlock(inode);
+ return -EAGAIN;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Tue, 17 Apr 2018 17:51:28 +0800
+Subject: f2fs: fix race in between GC and atomic open
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 27319ba4044c0c67d62ae39e53c0118c89f0a029 ]
+
+Thread GC thread
+- f2fs_ioc_start_atomic_write
+ - get_dirty_pages
+ - filemap_write_and_wait_range
+ - f2fs_gc
+ - do_garbage_collect
+ - gc_data_segment
+ - move_data_page
+ - f2fs_is_atomic_file
+ - set_page_dirty
+ - set_inode_flag(, FI_ATOMIC_FILE)
+
+Dirty data page can still be generated by GC in race condition as
+above call stack.
+
+This patch adds fi->dio_rwsem[WRITE] in f2fs_ioc_start_atomic_write
+to avoid such race.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1670,6 +1670,8 @@ static int f2fs_ioc_start_atomic_write(s
+
+ inode_lock(inode);
+
++ down_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
++
+ if (f2fs_is_atomic_file(inode))
+ goto out;
+
+@@ -1699,6 +1701,7 @@ inc_stat:
+ stat_inc_atomic_write(inode);
+ stat_update_max_atomic_write(inode);
+ out:
++ up_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
+ inode_unlock(inode);
+ mnt_drop_write_file(filp);
+ return ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Sat, 21 Apr 2018 17:53:52 +0800
+Subject: f2fs: fix to detect failure of dquot_initialize
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit c22aecd75919511abea872b201751e0be1add898 ]
+
+dquot_initialize() can fail due to any exception inside quota subsystem,
+f2fs needs to be aware of it, and return correct return value to caller.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2571,7 +2571,9 @@ static int f2fs_ioc_setproject(struct fi
+ }
+ f2fs_put_page(ipage, 1);
+
+- dquot_initialize(inode);
++ err = dquot_initialize(inode);
++ if (err)
++ goto out_unlock;
+
+ transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+ if (!IS_ERR(transfer_to[PRJQUOTA])) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Sat, 26 May 2018 18:03:34 +0800
+Subject: f2fs: fix to don't trigger writeback during recovery
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 64c74a7ab505ea40d1b3e5d02735ecab08ae1b14 ]
+
+- f2fs_fill_super
+ - recover_fsync_data
+ - recover_data
+ - del_fsync_inode
+ - iput
+ - iput_final
+ - write_inode_now
+ - f2fs_write_inode
+ - f2fs_balance_fs
+ - f2fs_balance_fs_bg
+ - sync_dirty_inodes
+
+With data_flush mount option, during recovery, in order to avoid entering
+above writeback flow, let's detect recovery status and do skip in
+f2fs_balance_fs_bg.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Yunlei He <heyunlei@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/segment.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -478,6 +478,9 @@ void f2fs_balance_fs(struct f2fs_sb_info
+
+ void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
+ {
++ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
++ return;
++
+ /* try to shrink extent cache when there is no enough memory */
+ if (!available_free_memory(sbi, EXTENT_CACHE))
+ f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Mon, 23 Apr 2018 10:36:13 +0800
+Subject: f2fs: fix to wait page writeback during revoking atomic write
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit e5e5732d8120654159254c16834bc8663d8be124 ]
+
+After revoking atomic write, related LBA can be reused by others, so we
+need to wait page writeback before reusing the LBA, in order to avoid
+interference between old atomic written in-flight IO and new IO.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/segment.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -230,6 +230,8 @@ static int __revoke_inmem_pages(struct i
+
+ lock_page(page);
+
++ f2fs_wait_on_page_writeback(page, DATA, true);
++
+ if (recover) {
+ struct dnode_of_data dn;
+ struct node_info ni;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+Date: Thu, 5 Apr 2018 14:58:06 +0300
+Subject: fasync: Fix deadlock between task-context and interrupt-context kill_fasync()
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+[ Upstream commit 7a107c0f55a3b4c6f84a4323df5610360bde1684 ]
+
+I observed the following deadlock between them:
+
+[task 1] [task 2] [task 3]
+kill_fasync() mm_update_next_owner() copy_process()
+ spin_lock_irqsave(&fa->fa_lock) read_lock(&tasklist_lock) write_lock_irq(&tasklist_lock)
+ send_sigio() <IRQ> ...
+ read_lock(&fown->lock) kill_fasync() ...
+ read_lock(&tasklist_lock) spin_lock_irqsave(&fa->fa_lock) ...
+
+Task 1 can't acquire read locked tasklist_lock, since there is
+already task 3 expressed its wish to take the lock exclusive.
+Task 2 holds the read locked lock, but it can't take the spin lock.
+
+Also, there is possible another deadlock (which I haven't observed):
+
+[task 1] [task 2]
+f_getown() kill_fasync()
+ read_lock(&f_own->lock) spin_lock_irqsave(&fa->fa_lock,)
+ <IRQ> send_sigio() write_lock_irq(&f_own->lock)
+ kill_fasync() read_lock(&fown->lock)
+ spin_lock_irqsave(&fa->fa_lock,)
+
+Actually, we do not need exclusive fa->fa_lock in kill_fasync_rcu(),
+as it guarantees fa->fa_file->f_owner integrity only. It may seem,
+that it used to give a task a small possibility to receive two sequential
+signals, if there are two parallel kill_fasync() callers, and task
+handles the first signal fastly, but the behaviour won't become
+different, since there is exclusive sighand lock in do_send_sig_info().
+
+The patch converts fa_lock into rwlock_t, and this fixes two above
+deadlocks, as rwlock is allowed to be taken from interrupt handler
+by qrwlock design.
+
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fcntl.c | 15 +++++++--------
+ include/linux/fs.h | 2 +-
+ 2 files changed, 8 insertions(+), 9 deletions(-)
+
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -871,9 +871,9 @@ int fasync_remove_entry(struct file *fil
+ if (fa->fa_file != filp)
+ continue;
+
+- spin_lock_irq(&fa->fa_lock);
++ write_lock_irq(&fa->fa_lock);
+ fa->fa_file = NULL;
+- spin_unlock_irq(&fa->fa_lock);
++ write_unlock_irq(&fa->fa_lock);
+
+ *fp = fa->fa_next;
+ call_rcu(&fa->fa_rcu, fasync_free_rcu);
+@@ -918,13 +918,13 @@ struct fasync_struct *fasync_insert_entr
+ if (fa->fa_file != filp)
+ continue;
+
+- spin_lock_irq(&fa->fa_lock);
++ write_lock_irq(&fa->fa_lock);
+ fa->fa_fd = fd;
+- spin_unlock_irq(&fa->fa_lock);
++ write_unlock_irq(&fa->fa_lock);
+ goto out;
+ }
+
+- spin_lock_init(&new->fa_lock);
++ rwlock_init(&new->fa_lock);
+ new->magic = FASYNC_MAGIC;
+ new->fa_file = filp;
+ new->fa_fd = fd;
+@@ -987,14 +987,13 @@ static void kill_fasync_rcu(struct fasyn
+ {
+ while (fa) {
+ struct fown_struct *fown;
+- unsigned long flags;
+
+ if (fa->magic != FASYNC_MAGIC) {
+ printk(KERN_ERR "kill_fasync: bad magic number in "
+ "fasync_struct!\n");
+ return;
+ }
+- spin_lock_irqsave(&fa->fa_lock, flags);
++ read_lock(&fa->fa_lock);
+ if (fa->fa_file) {
+ fown = &fa->fa_file->f_owner;
+ /* Don't send SIGURG to processes which have not set a
+@@ -1003,7 +1002,7 @@ static void kill_fasync_rcu(struct fasyn
+ if (!(sig == SIGURG && fown->signum == 0))
+ send_sigio(fown, fa->fa_fd, band);
+ }
+- spin_unlock_irqrestore(&fa->fa_lock, flags);
++ read_unlock(&fa->fa_lock);
+ fa = rcu_dereference(fa->fa_next);
+ }
+ }
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1250,7 +1250,7 @@ static inline int locks_lock_file_wait(s
+ }
+
+ struct fasync_struct {
+- spinlock_t fa_lock;
++ rwlock_t fa_lock;
+ int magic;
+ int fa_fd;
+ struct fasync_struct *fa_next; /* singly linked list */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Eric Biggers <ebiggers@google.com>
+Date: Fri, 20 Apr 2018 16:30:02 -0700
+Subject: fscrypt: use unbound workqueue for decryption
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 36dd26e0c8d42699eeba87431246c07c28075bae ]
+
+Improve fscrypt read performance by switching the decryption workqueue
+from bound to unbound. With the bound workqueue, when multiple bios
+completed on the same CPU, they were decrypted on that same CPU. But
+with the unbound queue, they are now decrypted in parallel on any CPU.
+
+Although fscrypt read performance can be tough to measure due to the
+many sources of variation, this change is most beneficial when
+decryption is slow, e.g. on CPUs without AES instructions. For example,
+I timed tarring up encrypted directories on f2fs. On x86 with AES-NI
+instructions disabled, the unbound workqueue improved performance by
+about 25-35%, using 1 to NUM_CPUs jobs with 4 or 8 CPUs available. But
+with AES-NI enabled, performance was unchanged to within ~2%.
+
+I also did the same test on a quad-core ARM CPU using xts-speck128-neon
+encryption. There performance was usually about 10% better with the
+unbound workqueue, bringing it closer to the unencrypted speed.
+
+The unbound workqueue may be worse in some cases due to worse locality,
+but I think it's still the better default. dm-crypt uses an unbound
+workqueue by default too, so this change makes fscrypt match.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/crypto/crypto.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -427,8 +427,17 @@ fail:
+ */
+ static int __init fscrypt_init(void)
+ {
++ /*
++ * Use an unbound workqueue to allow bios to be decrypted in parallel
++ * even when they happen to complete on the same CPU. This sacrifices
++ * locality, but it's worthwhile since decryption is CPU-intensive.
++ *
++ * Also use a high-priority workqueue to prioritize decryption work,
++ * which blocks reads from completing, over regular application tasks.
++ */
+ fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue",
+- WQ_HIGHPRI, 0);
++ WQ_UNBOUND | WQ_HIGHPRI,
++ num_online_cpus());
+ if (!fscrypt_read_workqueue)
+ goto fail;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thierry Reding <treding@nvidia.com>
+Date: Mon, 14 May 2018 11:14:00 +0200
+Subject: gpu: host1x: Acquire a reference to the IOVA cache
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit f40e1590c5270e5559fb95a5a0a7c1f5266a522d ]
+
+The IOVA API uses a memory cache to allocate IOVA nodes from. To make
+sure that this cache is available, obtain a reference to it and release
+the reference when the cache is no longer needed.
+
+On 64-bit ARM this is hidden by the fact that the DMA mapping API gets
+that reference and never releases it. On 32-bit ARM, this is papered
+over by the Tegra DRM driver (the sole user of the host1x API requiring
+the cache) acquiring a reference to the IOVA cache for its own purposes.
+However, there may be additional users of this API in the future, so fix
+this upfront to avoid surprises.
+
+Fixes: 404bfb78daf3 ("gpu: host1x: Add IOMMU support")
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/host1x/dev.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -223,10 +223,14 @@ static int host1x_probe(struct platform_
+ struct iommu_domain_geometry *geometry;
+ unsigned long order;
+
++ err = iova_cache_get();
++ if (err < 0)
++ goto put_group;
++
+ host->domain = iommu_domain_alloc(&platform_bus_type);
+ if (!host->domain) {
+ err = -ENOMEM;
+- goto put_group;
++ goto put_cache;
+ }
+
+ err = iommu_attach_group(host->domain, host->group);
+@@ -234,6 +238,7 @@ static int host1x_probe(struct platform_
+ if (err == -ENODEV) {
+ iommu_domain_free(host->domain);
+ host->domain = NULL;
++ iova_cache_put();
+ iommu_group_put(host->group);
+ host->group = NULL;
+ goto skip_iommu;
+@@ -308,6 +313,9 @@ fail_detach_device:
+ fail_free_domain:
+ if (host->domain)
+ iommu_domain_free(host->domain);
++put_cache:
++ if (host->group)
++ iova_cache_put();
+ put_group:
+ iommu_group_put(host->group);
+
+@@ -328,6 +336,7 @@ static int host1x_remove(struct platform
+ put_iova_domain(&host->iova);
+ iommu_detach_group(host->domain, host->group);
+ iommu_domain_free(host->domain);
++ iova_cache_put();
+ iommu_group_put(host->group);
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Terry Junge <terry.junge@plantronics.com>
+Date: Mon, 30 Apr 2018 13:32:46 -0700
+Subject: HID: hid-plantronics: Re-resend Update to map button for PTT products
+
+From: Terry Junge <terry.junge@plantronics.com>
+
+[ Upstream commit 37e376df5f4993677c33968a0c19b0c5acbf1108 ]
+
+Add a mapping for Push-To-Talk joystick trigger button.
+
+Tested on ChromeBox/ChromeBook with various Plantronics devices.
+
+Signed-off-by: Terry Junge <terry.junge@plantronics.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-plantronics.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -2,7 +2,7 @@
+ * Plantronics USB HID Driver
+ *
+ * Copyright (c) 2014 JD Cole <jd.cole@plantronics.com>
+- * Copyright (c) 2015 Terry Junge <terry.junge@plantronics.com>
++ * Copyright (c) 2015-2018 Terry Junge <terry.junge@plantronics.com>
+ */
+
+ /*
+@@ -48,6 +48,10 @@ static int plantronics_input_mapping(str
+ unsigned short mapped_key;
+ unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
+
++ /* special case for PTT products */
++ if (field->application == HID_GD_JOYSTICK)
++ goto defaulted;
++
+ /* handle volume up/down mapping */
+ /* non-standard types or multi-HID interfaces - plt_type is PID */
+ if (!(plt_type & HID_USAGE_PAGE)) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Dmitry Torokhov <dtor@chromium.org>
+Date: Wed, 9 May 2018 12:12:15 -0700
+Subject: HID: i2c-hid: check if device is there before really probing
+
+From: Dmitry Torokhov <dtor@chromium.org>
+
+[ Upstream commit b3a81b6c4fc6730ac49e20d789a93c0faabafc98 ]
+
+On many Chromebooks touch devices are multi-sourced; the components are
+electrically compatible and one can be freely swapped for another without
+changing the OS image or firmware.
+
+To avoid bunch of scary messages when device is not actually present in the
+system let's try testing basic communication with it and if there is no
+response terminate probe early with -ENXIO.
+
+Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/i2c-hid/i2c-hid.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -1054,6 +1054,14 @@ static int i2c_hid_probe(struct i2c_clie
+ pm_runtime_enable(&client->dev);
+ device_enable_async_suspend(&client->dev);
+
++ /* Make sure there is something at this address */
++ ret = i2c_smbus_read_byte(client);
++ if (ret < 0) {
++ dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
++ ret = -ENXIO;
++ goto err_pm;
++ }
++
+ ret = i2c_hid_fetch_hid_descriptor(ihid);
+ if (ret < 0)
+ goto err_pm;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Mon, 11 Jun 2018 12:44:55 -0700
+Subject: hv_netvsc: fix network namespace issues with VF support
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 7bf7bb37f16a80465ee3bd7c6c966f96f5a075a6 ]
+
+When finding the parent netvsc device, the search needs to be across
+all netvsc device instances (independent of network namespace).
+
+Find parent device of VF using upper_dev_get routine which
+searches only adjacent list.
+
+Fixes: e8ff40d4bff1 ("hv_netvsc: improve VF device matching")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+
+netns aware byref
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/hyperv_net.h | 2 +
+ drivers/net/hyperv/netvsc_drv.c | 45 ++++++++++++++++++----------------------
+ 2 files changed, 23 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -738,6 +738,8 @@ struct net_device_context {
+ struct hv_device *device_ctx;
+ /* netvsc_device */
+ struct netvsc_device __rcu *nvdev;
++ /* list of netvsc net_devices */
++ struct list_head list;
+ /* reconfigure work */
+ struct delayed_work dwork;
+ /* last reconfig time */
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -69,6 +69,8 @@ static int debug = -1;
+ module_param(debug, int, 0444);
+ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
+
++static LIST_HEAD(netvsc_dev_list);
++
+ static void netvsc_change_rx_flags(struct net_device *net, int change)
+ {
+ struct net_device_context *ndev_ctx = netdev_priv(net);
+@@ -1779,13 +1781,10 @@ out_unlock:
+
+ static struct net_device *get_netvsc_bymac(const u8 *mac)
+ {
+- struct net_device *dev;
+-
+- ASSERT_RTNL();
++ struct net_device_context *ndev_ctx;
+
+- for_each_netdev(&init_net, dev) {
+- if (dev->netdev_ops != &device_ops)
+- continue; /* not a netvsc device */
++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
++ struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
+
+ if (ether_addr_equal(mac, dev->perm_addr))
+ return dev;
+@@ -1796,25 +1795,18 @@ static struct net_device *get_netvsc_bym
+
+ static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
+ {
++ struct net_device_context *net_device_ctx;
+ struct net_device *dev;
+
+- ASSERT_RTNL();
+-
+- for_each_netdev(&init_net, dev) {
+- struct net_device_context *net_device_ctx;
+-
+- if (dev->netdev_ops != &device_ops)
+- continue; /* not a netvsc device */
+-
+- net_device_ctx = netdev_priv(dev);
+- if (!rtnl_dereference(net_device_ctx->nvdev))
+- continue; /* device is removed */
++ dev = netdev_master_upper_dev_get(vf_netdev);
++ if (!dev || dev->netdev_ops != &device_ops)
++ return NULL; /* not a netvsc device */
++
++ net_device_ctx = netdev_priv(dev);
++ if (!rtnl_dereference(net_device_ctx->nvdev))
++ return NULL; /* device is removed */
+
+- if (rtnl_dereference(net_device_ctx->vf_netdev) == vf_netdev)
+- return dev; /* a match */
+- }
+-
+- return NULL;
++ return dev;
+ }
+
+ /* Called when VF is injecting data into network stack.
+@@ -2094,15 +2086,19 @@ static int netvsc_probe(struct hv_device
+ else
+ net->max_mtu = ETH_DATA_LEN;
+
+- ret = register_netdev(net);
++ rtnl_lock();
++ ret = register_netdevice(net);
+ if (ret != 0) {
+ pr_err("Unable to register netdev.\n");
+ goto register_failed;
+ }
+
+- return ret;
++ list_add(&net_device_ctx->list, &netvsc_dev_list);
++ rtnl_unlock();
++ return 0;
+
+ register_failed:
++ rtnl_unlock();
+ rndis_filter_device_remove(dev, nvdev);
+ rndis_failed:
+ free_percpu(net_device_ctx->vf_stats);
+@@ -2148,6 +2144,7 @@ static int netvsc_remove(struct hv_devic
+ rndis_filter_device_remove(dev, nvdev);
+
+ unregister_netdevice(net);
++ list_del(&ndev_ctx->list);
+
+ rtnl_unlock();
+ rcu_read_unlock();
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Stewart Smith <stewart@linux.ibm.com>
+Date: Thu, 29 Mar 2018 17:02:46 +1100
+Subject: hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()
+
+From: Stewart Smith <stewart@linux.ibm.com>
+
+[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ]
+
+time_init() will set up tb_ticks_per_usec based on reality.
+time_init() is called *after* udbg_init_opal_common() during boot.
+
+from arch/powerpc/kernel/time.c:
+ unsigned long tb_ticks_per_usec = 100; /* sane default */
+
+Currently, all powernv systems have a timebase frequency of 512mhz
+(512000000/1000000 == 0x200) - although there's nothing written
+down anywhere that I can find saying that we couldn't make that
+different based on the requirements in the ISA.
+
+So, we've been (accidentally) thwacking the (currently) correct
+(for powernv at least) value for tb_ticks_per_usec earlier than
+we otherwise would have.
+
+The "sane default" seems to be adequate for our purposes between
+udbg_init_opal_common() and time_init() being called, and if it isn't,
+then we should probably be setting it somewhere that isn't hvc_opal.c!
+
+Signed-off-by: Stewart Smith <stewart@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/hvc/hvc_opal.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/tty/hvc/hvc_opal.c
++++ b/drivers/tty/hvc/hvc_opal.c
+@@ -318,7 +318,6 @@ static void udbg_init_opal_common(void)
+ udbg_putc = udbg_opal_putc;
+ udbg_getc = udbg_opal_getc;
+ udbg_getc_poll = udbg_opal_getc_poll;
+- tb_ticks_per_usec = 0x200; /* Make udelay not suck */
+ }
+
+ void __init hvc_opal_init_early(void)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jakub Pawlak <jakub.pawlak@intel.com>
+Date: Fri, 20 Apr 2018 01:41:35 -0700
+Subject: i40e: Add advertising 10G LR mode
+
+From: Jakub Pawlak <jakub.pawlak@intel.com>
+
+[ Upstream commit 6ee4d32255865fc4b383355a8354603d60ab9f8a ]
+
+The advertising 10G LR mode should be possible to set
+but in the function i40e_set_link_ksettings() check for this
+is missed. This patch adds check for 10000baseLR_Full
+flag for 10G modes.
+
+Signed-off-by: Jakub Pawlak <jakub.pawlak@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -977,7 +977,9 @@ static int i40e_set_link_ksettings(struc
+ ethtool_link_ksettings_test_link_mode(ks, advertising,
+ 10000baseCR_Full) ||
+ ethtool_link_ksettings_test_link_mode(ks, advertising,
+- 10000baseSR_Full))
++ 10000baseSR_Full) ||
++ ethtool_link_ksettings_test_link_mode(ks, advertising,
++ 10000baseLR_Full))
+ config.link_speed |= I40E_LINK_SPEED_10GB;
+ if (ethtool_link_ksettings_test_link_mode(ks, advertising,
+ 20000baseKR2_Full))
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Fri, 20 Apr 2018 01:41:38 -0700
+Subject: i40e: avoid overflow in i40e_ptp_adjfreq()
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 830e0dd9996c4644e42412aa6c46ed8f8eab0cca ]
+
+When operating at 1GbE, the base incval for the PTP clock is so large
+that multiplying it by numbers close to the max_adj can overflow the
+u64.
+
+Rather than attempting to limit the max_adj to a value small enough to
+avoid overflow, instead calculate the incvalue adjustment based on the
+40GbE incvalue, and then multiply that by the scaling factor for the
+link speed.
+
+This sacrifices a small amount of precision in the adjustment but we
+avoid erratic behavior of the clock due to the overflow caused if ppb is
+very near the maximum adjustment.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 2 -
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 41 +++++++++++++++++++----------
+ 2 files changed, 28 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -608,7 +608,7 @@ struct i40e_pf {
+ unsigned long ptp_tx_start;
+ struct hwtstamp_config tstamp_config;
+ struct mutex tmreg_lock; /* Used to protect the SYSTIME registers. */
+- u64 ptp_base_adj;
++ u32 ptp_adj_mult;
+ u32 tx_hwtstamp_timeouts;
+ u32 tx_hwtstamp_skipped;
+ u32 rx_hwtstamp_cleared;
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -40,9 +40,9 @@
+ * At 1Gb link, the period is multiplied by 20. (32ns)
+ * 1588 functionality is not supported at 100Mbps.
+ */
+-#define I40E_PTP_40GB_INCVAL 0x0199999999ULL
+-#define I40E_PTP_10GB_INCVAL 0x0333333333ULL
+-#define I40E_PTP_1GB_INCVAL 0x2000000000ULL
++#define I40E_PTP_40GB_INCVAL 0x0199999999ULL
++#define I40E_PTP_10GB_INCVAL_MULT 2
++#define I40E_PTP_1GB_INCVAL_MULT 20
+
+ #define I40E_PRTTSYN_CTL1_TSYNTYPE_V1 BIT(I40E_PRTTSYN_CTL1_TSYNTYPE_SHIFT)
+ #define I40E_PRTTSYN_CTL1_TSYNTYPE_V2 (2 << \
+@@ -130,17 +130,24 @@ static int i40e_ptp_adjfreq(struct ptp_c
+ ppb = -ppb;
+ }
+
+- smp_mb(); /* Force any pending update before accessing. */
+- adj = READ_ONCE(pf->ptp_base_adj);
+-
+- freq = adj;
++ freq = I40E_PTP_40GB_INCVAL;
+ freq *= ppb;
+ diff = div_u64(freq, 1000000000ULL);
+
+ if (neg_adj)
+- adj -= diff;
++ adj = I40E_PTP_40GB_INCVAL - diff;
+ else
+- adj += diff;
++ adj = I40E_PTP_40GB_INCVAL + diff;
++
++ /* At some link speeds, the base incval is so large that directly
++ * multiplying by ppb would result in arithmetic overflow even when
++ * using a u64. Avoid this by instead calculating the new incval
++ * always in terms of the 40GbE clock rate and then multiplying by the
++ * link speed factor afterwards. This does result in slightly lower
++ * precision at lower link speeds, but it is fairly minor.
++ */
++ smp_mb(); /* Force any pending update before accessing. */
++ adj *= READ_ONCE(pf->ptp_adj_mult);
+
+ wr32(hw, I40E_PRTTSYN_INC_L, adj & 0xFFFFFFFF);
+ wr32(hw, I40E_PRTTSYN_INC_H, adj >> 32);
+@@ -467,6 +474,7 @@ void i40e_ptp_set_increment(struct i40e_
+ struct i40e_link_status *hw_link_info;
+ struct i40e_hw *hw = &pf->hw;
+ u64 incval;
++ u32 mult;
+
+ hw_link_info = &hw->phy.link_info;
+
+@@ -474,10 +482,10 @@ void i40e_ptp_set_increment(struct i40e_
+
+ switch (hw_link_info->link_speed) {
+ case I40E_LINK_SPEED_10GB:
+- incval = I40E_PTP_10GB_INCVAL;
++ mult = I40E_PTP_10GB_INCVAL_MULT;
+ break;
+ case I40E_LINK_SPEED_1GB:
+- incval = I40E_PTP_1GB_INCVAL;
++ mult = I40E_PTP_1GB_INCVAL_MULT;
+ break;
+ case I40E_LINK_SPEED_100MB:
+ {
+@@ -488,15 +496,20 @@ void i40e_ptp_set_increment(struct i40e_
+ "1588 functionality is not supported at 100 Mbps. Stopping the PHC.\n");
+ warn_once++;
+ }
+- incval = 0;
++ mult = 0;
+ break;
+ }
+ case I40E_LINK_SPEED_40GB:
+ default:
+- incval = I40E_PTP_40GB_INCVAL;
++ mult = 1;
+ break;
+ }
+
++ /* The increment value is calculated by taking the base 40GbE incvalue
++ * and multiplying it by a factor based on the link speed.
++ */
++ incval = I40E_PTP_40GB_INCVAL * mult;
++
+ /* Write the new increment value into the increment register. The
+ * hardware will not update the clock until both registers have been
+ * written.
+@@ -505,7 +518,7 @@ void i40e_ptp_set_increment(struct i40e_
+ wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32);
+
+ /* Update the base adjustement value. */
+- WRITE_ONCE(pf->ptp_base_adj, incval);
++ WRITE_ONCE(pf->ptp_adj_mult, mult);
+ smp_mb(); /* Force the above update. */
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Thu, 10 May 2018 05:59:48 -0700
+Subject: i40e: free the skb after clearing the bitlock
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit c79756cb5f084736b138da9319a02f7c72644548 ]
+
+In commit bbc4e7d273b5 ("i40e: fix race condition with PTP_TX_IN_PROGRESS
+bits") we modified the code which handles Tx timestamps so that we would
+clear the progress bit as soon as possible.
+
+A later commit 0bc0706b46cd ("i40e: check for Tx timestamp timeouts during
+watchdog") introduced similar code for detecting and handling cleanup of
+a blocked Tx timestamp. This code did not use the same pattern for cleaning
+up the skb.
+
+Update this code to wait to free the skb until after the bit lock is
+free, by first setting the ptp_tx_skb to NULL and clearing the lock.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -338,6 +338,8 @@ void i40e_ptp_rx_hang(struct i40e_pf *pf
+ **/
+ void i40e_ptp_tx_hang(struct i40e_pf *pf)
+ {
++ struct sk_buff *skb;
++
+ if (!(pf->flags & I40E_FLAG_PTP) || !pf->ptp_tx)
+ return;
+
+@@ -350,9 +352,12 @@ void i40e_ptp_tx_hang(struct i40e_pf *pf
+ * within a second it is reasonable to assume that we never will.
+ */
+ if (time_is_before_jiffies(pf->ptp_tx_start + HZ)) {
+- dev_kfree_skb_any(pf->ptp_tx_skb);
++ skb = pf->ptp_tx_skb;
+ pf->ptp_tx_skb = NULL;
+ clear_bit_unlock(__I40E_PTP_TX_IN_PROGRESS, pf->state);
++
++ /* Free the skb after we clear the bitlock */
++ dev_kfree_skb_any(skb);
+ pf->tx_hwtstamp_timeouts++;
+ }
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 9 May 2018 22:48:41 +0100
+Subject: IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit e02637e97d68a54b1527bc654bf8377eda310226 ]
+
+DMA_VIRT_OPS requires that dma_addr_t is at least as wide as a
+pointer, which is expressed as a dependency on !64BIT ||
+ARCH_DMA_ADDR_T_64BIT.
+
+For parisc64 this is not true, and if these IB modules are enabled,
+kconfig warns:
+
+WARNING: unmet direct dependencies detected for DMA_VIRT_OPS
+ Depends on [n]: HAS_DMA [=y] && (!64BIT [=y] || ARCH_DMA_ADDR_T_64BIT)
+ Selected by [m]:
+ - INFINIBAND_RDMAVT [=m] && INFINIBAND [=m] && 64BIT [=y] && PCI [=y]
+ - RDMA_RXE [=m] && INET [=y] && PCI [=y] && INFINIBAND [=m]
+
+Add dependencies to fix this.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rdmavt/Kconfig | 2 +-
+ drivers/infiniband/sw/rxe/Kconfig | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/sw/rdmavt/Kconfig
++++ b/drivers/infiniband/sw/rdmavt/Kconfig
+@@ -1,6 +1,6 @@
+ config INFINIBAND_RDMAVT
+ tristate "RDMA verbs transport library"
+- depends on 64BIT
++ depends on 64BIT && ARCH_DMA_ADDR_T_64BIT
+ depends on PCI
+ select DMA_VIRT_OPS
+ ---help---
+--- a/drivers/infiniband/sw/rxe/Kconfig
++++ b/drivers/infiniband/sw/rxe/Kconfig
+@@ -1,6 +1,7 @@
+ config RDMA_RXE
+ tristate "Software RDMA over Ethernet (RoCE) driver"
+ depends on INET && PCI && INFINIBAND
++ depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
+ select NET_UDP_TUNNEL
+ select CRYPTO_CRC32
+ select DMA_VIRT_OPS
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Date: Tue, 10 Apr 2018 10:49:51 -0700
+Subject: igb: Fix queue selection on MAC filters on i210
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit 4dc93fcf0b95dc3fda4db917effae31fbb8ad2a8 ]
+
+On the RAH registers there are semantic differences on the meaning of
+the "queue" parameter for traffic steering depending on the controller
+model: there is the 82575 meaning, which "queue" means a RX Hardware
+Queue, and the i350 meaning, where it is a reception pool.
+
+The previous behaviour was having no effect for i210 based controllers
+because the QSEL bit of the RAH register wasn't being set.
+
+This patch separates the condition in discrete cases, so the different
+handling is clearer.
+
+Fixes: 83c21335c876 ("igb: improve MAC filter handling")
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -8763,12 +8763,17 @@ static void igb_rar_set_index(struct igb
+ if (is_valid_ether_addr(addr))
+ rar_high |= E1000_RAH_AV;
+
+- if (hw->mac.type == e1000_82575)
++ switch (hw->mac.type) {
++ case e1000_82575:
++ case e1000_i210:
+ rar_high |= E1000_RAH_POOL_1 *
+ adapter->mac_table[index].queue;
+- else
++ break;
++ default:
+ rar_high |= E1000_RAH_POOL_1 <<
+ adapter->mac_table[index].queue;
++ break;
++ }
+ }
+
+ wr32(E1000_RAL(index), rar_low);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Date: Fri, 27 Apr 2018 14:31:40 -0400
+Subject: ima: based on policy verify firmware signatures (pre-allocated buffer)
+
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+[ Upstream commit fd90bc559bfba743ae8de87ff23b92a5e4668062 ]
+
+Don't differentiate, for now, between kernel_read_file_id READING_FIRMWARE
+and READING_FIRMWARE_PREALLOC_BUFFER enumerations.
+
+Fixes: a098ecd firmware: support loading into a pre-allocated buffer (since 4.8)
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Cc: Luis R. Rodriguez <mcgrof@suse.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Serge E. Hallyn <serge@hallyn.com>
+Cc: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/ima_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -449,6 +449,7 @@ int ima_read_file(struct file *file, enu
+
+ static int read_idmap[READING_MAX_ID] = {
+ [READING_FIRMWARE] = FIRMWARE_CHECK,
++ [READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK,
+ [READING_MODULE] = MODULE_CHECK,
+ [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
+ [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Fri, 1 Jun 2018 11:31:44 -0700
+Subject: infiniband: fix a possible use-after-free bug
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]
+
+ucma_process_join() will free the new allocated "mc" struct,
+if there is any error after that, especially the copy_to_user().
+
+But in parallel, ucma_leave_multicast() could find this "mc"
+through idr_find() before ucma_process_join() frees it, since it
+is already published.
+
+So "mc" could be used in ucma_leave_multicast() after it is been
+allocated and freed in ucma_process_join(), since we don't refcnt
+it.
+
+Fix this by separating "publish" from ID allocation, so that we
+can get an ID first and publish it later after copy_to_user().
+
+Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
+Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/ucma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc
+ return NULL;
+
+ mutex_lock(&mut);
+- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
+ mutex_unlock(&mut);
+ if (mc->id < 0)
+ goto error;
+@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct
+ goto err3;
+ }
+
++ mutex_lock(&mut);
++ idr_replace(&multicast_idr, mc, mc->id);
++ mutex_unlock(&mut);
++
+ mutex_unlock(&file->mut);
+ ucma_put_ctx(ctx);
+ return 0;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chris Novakovic <chris@chrisn.me.uk>
+Date: Tue, 24 Apr 2018 03:56:37 +0100
+Subject: ipconfig: Correctly initialise ic_nameservers
+
+From: Chris Novakovic <chris@chrisn.me.uk>
+
+[ Upstream commit 300eec7c0a2495f771709c7642aa15f7cc148b83 ]
+
+ic_nameservers, which stores the list of name servers discovered by
+ipconfig, is initialised (i.e. has all of its elements set to NONE, or
+0xffffffff) by ic_nameservers_predef() in the following scenarios:
+
+ - before the "ip=" and "nfsaddrs=" kernel command line parameters are
+ parsed (in ip_auto_config_setup());
+ - before autoconfiguring via DHCP or BOOTP (in ic_bootp_init()), in
+ order to clear any values that may have been set after parsing "ip="
+ or "nfsaddrs=" and are no longer needed.
+
+This means that ic_nameservers_predef() is not called when neither "ip="
+nor "nfsaddrs=" is specified on the kernel command line. In this
+scenario, every element in ic_nameservers remains set to 0x00000000,
+which is indistinguishable from ANY and causes pnp_seq_show() to write
+the following (bogus) information to /proc/net/pnp:
+
+ #MANUAL
+ nameserver 0.0.0.0
+ nameserver 0.0.0.0
+ nameserver 0.0.0.0
+
+This is potentially problematic for systems that blindly link
+/etc/resolv.conf to /proc/net/pnp.
+
+Ensure that ic_nameservers is also initialised when neither "ip=" nor
+"nfsaddrs=" are specified by calling ic_nameservers_predef() in
+ip_auto_config(), but only when ip_auto_config_setup() was not called
+earlier. This causes the following to be written to /proc/net/pnp, and
+is consistent with what gets written when ipconfig is configured
+manually but no name servers are specified on the kernel command line:
+
+ #MANUAL
+
+Signed-off-by: Chris Novakovic <chris@chrisn.me.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ipconfig.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -748,6 +748,11 @@ static void __init ic_bootp_init_ext(u8
+ */
+ static inline void __init ic_bootp_init(void)
+ {
++ /* Re-initialise all name servers to NONE, in case any were set via the
++ * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses
++ * specified there will already have been decoded but are no longer
++ * needed
++ */
+ ic_nameservers_predef();
+
+ dev_add_pack(&bootp_packet_type);
+@@ -1368,6 +1373,13 @@ static int __init ip_auto_config(void)
+ int err;
+ unsigned int i;
+
++ /* Initialise all name servers to NONE (but only if the "ip=" or
++ * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise
++ * we'll overwrite the IP addresses specified there)
++ */
++ if (ic_set_manually == 0)
++ ic_nameservers_predef();
++
+ #ifdef CONFIG_PROC_FS
+ proc_create("pnp", 0444, init_net.proc_net, &pnp_seq_fops);
+ #endif /* CONFIG_PROC_FS */
+@@ -1588,6 +1600,7 @@ static int __init ip_auto_config_setup(c
+ return 1;
+ }
+
++ /* Initialise all name servers to NONE */
+ ic_nameservers_predef();
+
+ /* Parse string for static IP assignment. */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Date: Tue, 5 Jun 2018 15:27:27 +0300
+Subject: irqchip/ls-scfg-msi: Map MSIs in the iommu
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 0cdd431c337e99177e68597f3de34bedd3a20a74 ]
+
+Add the required iommu_dma_map_msi_msg() when composing the MSI message,
+otherwise the interrupts will not work.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: jason@lakedaemon.net
+Cc: marc.zyngier@arm.com
+Cc: zhiqiang.hou@nxp.com
+Cc: minghuan.lian@nxp.com
+Link: https://lkml.kernel.org/r/20180605122727.12831-1-laurentiu.tudor@nxp.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-ls-scfg-msi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/irqchip/irq-ls-scfg-msi.c
++++ b/drivers/irqchip/irq-ls-scfg-msi.c
+@@ -21,6 +21,7 @@
+ #include <linux/of_pci.h>
+ #include <linux/of_platform.h>
+ #include <linux/spinlock.h>
++#include <linux/dma-iommu.h>
+
+ #define MSI_IRQS_PER_MSIR 32
+ #define MSI_MSIR_OFFSET 4
+@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(stru
+
+ if (msi_affinity_flag)
+ msg->data |= cpumask_first(data->common->affinity);
++
++ iommu_dma_map_msi_msg(data->irq, msg);
+ }
+
+ static int ls_scfg_msi_set_affinity(struct irq_data *irq_data,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Gregory Greenman <gregory.greenman@intel.com>
+Date: Tue, 24 Apr 2018 06:26:41 +0300
+Subject: iwlwifi: mvm: open BA session only when sta is authorized
+
+From: Gregory Greenman <gregory.greenman@intel.com>
+
+[ Upstream commit d94c5a820d107fdde711ec72c16848876027713d ]
+
+Currently, a BA session is opened when the tx traffic exceeds
+10 frames per second. As a result of inter-op problems with some
+APs, add a condition to open BA session only when station is
+already authorized.
+
+Fixes: 482e48440a0e ("iwlwifi: mvm: change open and close criteria of a BA session")
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 38 +++++++++++-----------
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 7 +---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 -
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 10 ++---
+ 5 files changed, 29 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -2652,7 +2652,7 @@ static int iwl_mvm_mac_sta_state(struct
+
+ mutex_lock(&mvm->mutex);
+ /* track whether or not the station is associated */
+- mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC;
++ mvm_sta->sta_state = new_state;
+
+ if (old_state == IEEE80211_STA_NOTEXIST &&
+ new_state == IEEE80211_STA_NONE) {
+@@ -2704,8 +2704,7 @@ static int iwl_mvm_mac_sta_state(struct
+ iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
+ }
+
+- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+- true);
++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
+ ret = iwl_mvm_update_sta(mvm, vif, sta);
+ } else if (old_state == IEEE80211_STA_ASSOC &&
+ new_state == IEEE80211_STA_AUTHORIZED) {
+@@ -2721,8 +2720,7 @@ static int iwl_mvm_mac_sta_state(struct
+ /* enable beacon filtering */
+ WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
+
+- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+- false);
++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
+
+ ret = 0;
+ } else if (old_state == IEEE80211_STA_AUTHORIZED &&
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -3,6 +3,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+@@ -13,10 +14,6 @@
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+- * You should have received a copy of the GNU General Public License along with
+- * this program; if not, write to the Free Software Foundation, Inc.,
+- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+- *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+@@ -651,9 +648,10 @@ static void rs_tl_turn_on_agg(struct iwl
+ }
+
+ tid_data = &mvmsta->tid_data[tid];
+- if ((tid_data->state == IWL_AGG_OFF) &&
++ if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED &&
++ tid_data->state == IWL_AGG_OFF &&
+ (lq_sta->tx_agg_tid_en & BIT(tid)) &&
+- (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
++ tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD) {
+ IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
+ if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
+ tid_data->state = IWL_AGG_QUEUED;
+@@ -1257,7 +1255,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm
+ (unsigned long)(lq_sta->last_tx +
+ (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
+ IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+- iwl_mvm_rs_rate_init(mvm, sta, info->band, false);
++ iwl_mvm_rs_rate_init(mvm, sta, info->band);
+ return;
+ }
+ lq_sta->last_tx = jiffies;
+@@ -2684,9 +2682,9 @@ static void rs_get_initial_rate(struct i
+ struct ieee80211_sta *sta,
+ struct iwl_lq_sta *lq_sta,
+ enum nl80211_band band,
+- struct rs_rate *rate,
+- bool init)
++ struct rs_rate *rate)
+ {
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ int i, nentries;
+ unsigned long active_rate;
+ s8 best_rssi = S8_MIN;
+@@ -2748,7 +2746,8 @@ static void rs_get_initial_rate(struct i
+ * bandwidth rate, and after authorization, when the phy context
+ * is already up-to-date, re-init rs with the correct bw.
+ */
+- u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
++ u32 bw = mvmsta->sta_state < IEEE80211_STA_AUTHORIZED ?
++ RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
+
+ switch (bw) {
+ case RATE_MCS_CHAN_WIDTH_40:
+@@ -2833,9 +2832,9 @@ void rs_update_last_rssi(struct iwl_mvm
+ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ struct ieee80211_sta *sta,
+ struct iwl_lq_sta *lq_sta,
+- enum nl80211_band band,
+- bool init)
++ enum nl80211_band band)
+ {
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ struct iwl_scale_tbl_info *tbl;
+ struct rs_rate *rate;
+ u8 active_tbl = 0;
+@@ -2851,7 +2850,7 @@ static void rs_initialize_lq(struct iwl_
+ tbl = &(lq_sta->lq_info[active_tbl]);
+ rate = &tbl->rate;
+
+- rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
++ rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
+ rs_init_optimal_rate(mvm, sta, lq_sta);
+
+ WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B,
+@@ -2864,7 +2863,8 @@ static void rs_initialize_lq(struct iwl_
+ rs_set_expected_tpt_table(lq_sta, tbl);
+ rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
+ /* TODO restore station should remember the lq cmd */
+- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);
++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq,
++ mvmsta->sta_state < IEEE80211_STA_AUTHORIZED);
+ }
+
+ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
+@@ -3117,7 +3117,7 @@ void iwl_mvm_update_frame_stats(struct i
+ * Called after adding a new station to initialize rate scaling
+ */
+ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band, bool init)
++ enum nl80211_band band)
+ {
+ int i, j;
+ struct ieee80211_hw *hw = mvm->hw;
+@@ -3196,7 +3196,7 @@ static void rs_drv_rate_init(struct iwl_
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ iwl_mvm_reset_frame_stats(mvm);
+ #endif
+- rs_initialize_lq(mvm, sta, lq_sta, band, init);
++ rs_initialize_lq(mvm, sta, lq_sta, band);
+ }
+
+ static void rs_drv_rate_update(void *mvm_r,
+@@ -3216,7 +3216,7 @@ static void rs_drv_rate_update(void *mvm
+ for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
+ ieee80211_stop_tx_ba_session(sta, tid);
+
+- iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
++ iwl_mvm_rs_rate_init(mvm, sta, sband->band);
+ }
+
+ #ifdef CONFIG_MAC80211_DEBUGFS
+@@ -4062,12 +4062,12 @@ static const struct rate_control_ops rs_
+ };
+
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band, bool init)
++ enum nl80211_band band)
+ {
+ if (iwl_mvm_has_tlc_offload(mvm))
+ rs_fw_rate_init(mvm, sta, band);
+ else
+- rs_drv_rate_init(mvm, sta, band, init);
++ rs_drv_rate_init(mvm, sta, band);
+ }
+
+ int iwl_mvm_rate_control_register(void)
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+@@ -3,6 +3,7 @@
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+@@ -13,10 +14,6 @@
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+- * You should have received a copy of the GNU General Public License along with
+- * this program; if not, write to the Free Software Foundation, Inc.,
+- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+- *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+@@ -410,7 +407,7 @@ struct iwl_lq_sta {
+
+ /* Initialize station's rate scaling information after adding station */
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band, bool init);
++ enum nl80211_band band);
+
+ /* Notify RS about Tx status */
+ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -214,7 +214,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mv
+ cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT);
+ add_sta_cmd.station_flags |=
+ cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT);
+- if (mvm_sta->associated)
++ if (mvm_sta->sta_state >= IEEE80211_STA_ASSOC)
+ add_sta_cmd.assoc_id = cpu_to_le16(sta->aid);
+
+ if (sta->wme) {
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -18,11 +19,6 @@
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+- * USA
+- *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+@@ -35,6 +31,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -376,6 +373,7 @@ struct iwl_mvm_rxq_dup_data {
+ * tid.
+ * @max_agg_bufsize: the maximal size of the AGG buffer for this station
+ * @sta_type: station type
++ * @sta_state: station state according to enum %ieee80211_sta_state
+ * @bt_reduced_txpower: is reduced tx power enabled for this station
+ * @next_status_eosp: the next reclaimed packet is a PS-Poll response and
+ * we need to signal the EOSP
+@@ -414,6 +412,7 @@ struct iwl_mvm_sta {
+ u16 tid_disable_agg;
+ u8 max_agg_bufsize;
+ enum iwl_sta_type sta_type;
++ enum ieee80211_sta_state sta_state;
+ bool bt_reduced_txpower;
+ bool next_status_eosp;
+ spinlock_t lock;
+@@ -438,7 +437,6 @@ struct iwl_mvm_sta {
+ bool disable_tx;
+ bool tlc_amsdu;
+ bool sleeping;
+- bool associated;
+ u8 agg_tids;
+ u8 sleep_tx_count;
+ u8 avg_energy;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Shaul Triebitz <shaul.triebitz@intel.com>
+Date: Thu, 22 Mar 2018 14:14:45 +0200
+Subject: iwlwifi: pcie: fix race in Rx buffer allocator
+
+From: Shaul Triebitz <shaul.triebitz@intel.com>
+
+[ Upstream commit 0f22e40053bd5378ad1e3250e65c574fd61c0cd6 ]
+
+Make sure the rx_allocator worker is canceled before running the
+rx_init routine. rx_init frees and re-allocates all rxb's pages. The
+rx_allocator worker also allocates pages for the used rxb's. Running
+rx_init and rx_allocator simultaniously causes a kernel panic. Fix
+that by canceling the work in rx_init.
+
+Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_
+ }
+ def_rxq = trans_pcie->rxq;
+
++ cancel_work_sync(&rba->rx_alloc);
++
+ spin_lock(&rba->lock);
+ atomic_set(&rba->req_pending, 0);
+ atomic_set(&rba->req_ready, 0);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Mon, 4 Jun 2018 11:07:24 -0400
+Subject: ixgbe: Fix setting of TC configuration for macvlan case
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+[ Upstream commit 646bb57ce86e4d7b0bd9d33244450ae009411e48 ]
+
+When we were enabling macvlan interfaces we weren't correctly configuring
+things until ixgbe_setup_tc was called a second time either by tweaking the
+number of queues or increasing the macvlan count past 15.
+
+The issue came down to the fact that num_rx_pools is not populated until
+after the queues and interrupts are reinitialized.
+
+Instead of trying to set it sooner we can just move the call to setup at
+least 1 traffic class to the SR-IOV/VMDq setup function so that we just set
+it for this one case. We already had a spot that was configuring the queues
+for TC 0 in the code here anyway so it makes sense to also set the number
+of TCs here as well.
+
+Fixes: 49cfbeb7a95c ("ixgbe: Fix handling of macvlan Tx offload")
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 8 ++++++++
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 --------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+@@ -618,6 +618,14 @@ static bool ixgbe_set_sriov_queues(struc
+ }
+
+ #endif
++ /* To support macvlan offload we have to use num_tc to
++ * restrict the queues that can be used by the device.
++ * By doing this we can avoid reporting a false number of
++ * queues.
++ */
++ if (vmdq_i > 1)
++ netdev_set_num_tc(adapter->netdev, 1);
++
+ /* populate TC0 for use by pool 0 */
+ netdev_set_tc_queue(adapter->netdev, 0,
+ adapter->num_rx_queues_per_pool, 0);
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8875,14 +8875,6 @@ int ixgbe_setup_tc(struct net_device *de
+ } else {
+ netdev_reset_tc(dev);
+
+- /* To support macvlan offload we have to use num_tc to
+- * restrict the queues that can be used by the device.
+- * By doing this we can avoid reporting a false number of
+- * queues.
+- */
+- if (!tc && adapter->num_rx_pools > 1)
+- netdev_set_num_tc(dev, 1);
+-
+ if (adapter->hw.mac.type == ixgbe_mac_82598EB)
+ adapter->hw.fc.requested_mode = adapter->last_lfc_mode;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+Date: Mon, 14 May 2018 11:16:16 -0700
+Subject: ixgbevf: fix MAC address changes through ixgbevf_set_mac()
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 6e7d0ba1e59b1a306761a731e67634c0f2efea2a ]
+
+Set hw->mac.perm_addr in ixgbevf_set_mac() in order to avoid losing the
+custom MAC on reset. This can happen in the following case:
+
+>ip link set $vf address $mac
+>ethtool -r $vf
+
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -4187,6 +4187,7 @@ static int ixgbevf_set_mac(struct net_de
+ return -EPERM;
+
+ ether_addr_copy(hw->mac.addr, addr->sa_data);
++ ether_addr_copy(hw->mac.perm_addr, addr->sa_data);
+ ether_addr_copy(netdev->dev_addr, addr->sa_data);
+
+ return 0;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Thu, 14 Jun 2018 15:27:34 -0700
+Subject: kcov: ensure irq code sees a valid area
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit c9484b986ef03492357fddd50afbdd02929cfa72 ]
+
+Patch series "kcov: fix unexpected faults".
+
+These patches fix a few issues where KCOV code could trigger recursive
+faults, discovered while debugging a patch enabling KCOV for arch/arm:
+
+* On CONFIG_PREEMPT kernels, there's a small race window where
+ __sanitizer_cov_trace_pc() can see a bogus kcov_area.
+
+* Lazy faulting of the vmalloc area can cause mutual recursion between
+ fault handling code and __sanitizer_cov_trace_pc().
+
+* During the context switch, switching the mm can cause the kcov_area to
+ be transiently unmapped.
+
+These are prerequisites for enabling KCOV on arm, but the issues
+themsevles are generic -- we just happen to avoid them by chance rather
+than design on x86-64 and arm64.
+
+This patch (of 3):
+
+For kernels built with CONFIG_PREEMPT, some C code may execute before or
+after the interrupt handler, while the hardirq count is zero. In these
+cases, in_task() can return true.
+
+A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it
+resets the task's kcov data via kcov_task_init(). Instrumented code
+executed during this period will call __sanitizer_cov_trace_pc(), and as
+in_task() returns true, will inspect t->kcov_mode before trying to write
+to t->kcov_area.
+
+In kcov_init_task() we update t->kcov_{mode,area,size} with plain stores,
+which may be re-ordered, torn, etc. Thus __sanitizer_cov_trace_pc() may
+see bogus values for any of these fields, and may attempt to write to
+memory which is not mapped.
+
+Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a
+barrier() to ensure this is ordered before we clear t->kov_{area,size}.
+This ensures that any code execute while kcov_init_task() is preempted
+will either see valid values for t->kcov_{area,size}, or will see that
+t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching
+t->kcov_area.
+
+Link: http://lkml.kernel.org/r/20180504135535.53744-2-mark.rutland@arm.com
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kcov.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -241,7 +241,8 @@ static void kcov_put(struct kcov *kcov)
+
+ void kcov_task_init(struct task_struct *t)
+ {
+- t->kcov_mode = KCOV_MODE_DISABLED;
++ WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED);
++ barrier();
+ t->kcov_size = 0;
+ t->kcov_area = NULL;
+ t->kcov = NULL;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 7 Jun 2018 17:10:34 -0700
+Subject: kernel/hung_task.c: show all hung tasks before panic
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 401c636a0eeb0d51862fce222da1bf08e3a0ffd0 ]
+
+When we get a hung task it can often be valuable to see _all_ the hung
+tasks on the system before calling panic().
+
+Quoting from https://syzkaller.appspot.com/text?tag=CrashReport&id=5316056503549952
+----------------------------------------
+INFO: task syz-executor0:6540 blocked for more than 120 seconds.
+ Not tainted 4.16.0+ #13
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+syz-executor0 D23560 6540 4521 0x80000004
+Call Trace:
+ context_switch kernel/sched/core.c:2848 [inline]
+ __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490
+ schedule+0xf5/0x430 kernel/sched/core.c:3549
+ schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3607
+ __mutex_lock_common kernel/locking/mutex.c:833 [inline]
+ __mutex_lock+0xb7f/0x1810 kernel/locking/mutex.c:893
+ mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
+ lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355
+ __blkdev_driver_ioctl block/ioctl.c:303 [inline]
+ blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601
+ ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2060
+ isofs_get_last_session fs/isofs/inode.c:567 [inline]
+ isofs_fill_super+0x2ba9/0x3bc0 fs/isofs/inode.c:660
+ mount_bdev+0x2b7/0x370 fs/super.c:1119
+ isofs_mount+0x34/0x40 fs/isofs/inode.c:1560
+ mount_fs+0x66/0x2d0 fs/super.c:1222
+ vfs_kern_mount.part.26+0xc6/0x4a0 fs/namespace.c:1037
+ vfs_kern_mount fs/namespace.c:2514 [inline]
+ do_new_mount fs/namespace.c:2517 [inline]
+ do_mount+0xea4/0x2b90 fs/namespace.c:2847
+ ksys_mount+0xab/0x120 fs/namespace.c:3063
+ SYSC_mount fs/namespace.c:3077 [inline]
+ SyS_mount+0x39/0x50 fs/namespace.c:3074
+ do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
+ entry_SYSCALL_64_after_hwframe+0x42/0xb7
+(...snipped...)
+Showing all locks held in the system:
+(...snipped...)
+2 locks held by syz-executor0/6540:
+ #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:211 [inline]
+ #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x3b2/0xe60 fs/super.c:502 /* down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); */
+ #1: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */
+(...snipped...)
+3 locks held by syz-executor7/6541:
+ #0: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */
+ #1: 000000007bf3d3f9 (&bdev->bd_mutex){+.+.}, at: blkdev_reread_part+0x1e/0x40 block/ioctl.c:192
+ #2: 00000000566d4c39 (&type->s_umount_key#50){.+.+}, at: __get_super.part.10+0x1d3/0x280 fs/super.c:663 /* down_read(&sb->s_umount); */
+----------------------------------------
+
+When reporting an AB-BA deadlock like shown above, it would be nice if
+trace of PID=6541 is printed as well as trace of PID=6540 before calling
+panic().
+
+Showing hung tasks up to /proc/sys/kernel/hung_task_warnings could delay
+calling panic() but normally there should not be so many hung tasks.
+
+Link: http://lkml.kernel.org/r/201804050705.BHE57833.HVFOFtSOMQJFOL@I-love.SAKURA.ne.jp
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Acked-by: Dmitry Vyukov <dvyukov@google.com>
+Cc: Vegard Nossum <vegard.nossum@oracle.com>
+Cc: Mandeep Singh Baines <msb@chromium.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/hung_task.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/kernel/hung_task.c
++++ b/kernel/hung_task.c
+@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warni
+
+ static int __read_mostly did_panic;
+ static bool hung_task_show_lock;
++static bool hung_task_call_panic;
+
+ static struct task_struct *watchdog_task;
+
+@@ -127,10 +128,8 @@ static void check_hung_task(struct task_
+ touch_nmi_watchdog();
+
+ if (sysctl_hung_task_panic) {
+- if (hung_task_show_lock)
+- debug_show_all_locks();
+- trigger_all_cpu_backtrace();
+- panic("hung_task: blocked tasks");
++ hung_task_show_lock = true;
++ hung_task_call_panic = true;
+ }
+ }
+
+@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_t
+ rcu_read_unlock();
+ if (hung_task_show_lock)
+ debug_show_all_locks();
++ if (hung_task_call_panic) {
++ trigger_all_cpu_backtrace();
++ panic("hung_task: blocked tasks");
++ }
+ }
+
+ static long hung_timeout_jiffies(unsigned long last_checked,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 19 May 2018 09:01:36 +0300
+Subject: KVM: x86: prevent integer overflows in KVM_MEMORY_ENCRYPT_REG_REGION
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 86bf20cb57b9570262338752c9df580328bc5632 ]
+
+This is a fix from reviewing the code, but it looks like it might be
+able to lead to an Oops. It affects 32bit systems.
+
+The KVM_MEMORY_ENCRYPT_REG_REGION ioctl uses a u64 for range->addr and
+range->size but the high 32 bits would be truncated away on a 32 bit
+system. This is harmless but it's also harmless to prevent it.
+
+Then in sev_pin_memory() the "uaddr + ulen" calculation can wrap around.
+The wrap around can happen on 32 bit or 64 bit systems, but I was only
+able to figure out a problem for 32 bit systems. We would pick a number
+which results in "npages" being zero. The sev_pin_memory() would then
+return ZERO_SIZE_PTR without allocating anything.
+
+I made it illegal to call sev_pin_memory() with "ulen" set to zero.
+Hopefully, that doesn't cause any problems. I also changed the type of
+"first" and "last" to long, just for cosmetic reasons. Otherwise on a
+64 bit system you're saving "uaddr >> 12" in an int and it truncates the
+high 20 bits away. The math works in the current code so far as I can
+see but it's just weird.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+[Brijesh noted that the code is only reachable on X86_64.]
+Reviewed-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1768,7 +1768,10 @@ static struct page **sev_pin_memory(stru
+ unsigned long npages, npinned, size;
+ unsigned long locked, lock_limit;
+ struct page **pages;
+- int first, last;
++ unsigned long first, last;
++
++ if (ulen == 0 || uaddr + ulen < uaddr)
++ return NULL;
+
+ /* Calculate number of pages. */
+ first = (uaddr & PAGE_MASK) >> PAGE_SHIFT;
+@@ -6947,6 +6950,9 @@ static int svm_register_enc_region(struc
+ if (!sev_guest(kvm))
+ return -ENOTTY;
+
++ if (range->addr > ULONG_MAX || range->size > ULONG_MAX)
++ return -EINVAL;
++
+ region = kzalloc(sizeof(*region), GFP_KERNEL);
+ if (!region)
+ return -ENOMEM;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thierry Escande <thierry.escande@linaro.org>
+Date: Thu, 14 Jun 2018 15:28:15 -0700
+Subject: lib/test_printf.c: call wait_for_random_bytes() before plain %p tests
+
+From: Thierry Escande <thierry.escande@linaro.org>
+
+[ Upstream commit ee410f15b1418f2f4428e79980674c979081bcb7 ]
+
+If the test_printf module is loaded before the crng is initialized, the
+plain 'p' tests will fail because the printed address will not be hashed
+and the buffer will contain '(ptrval)' instead.
+
+This patch adds a call to wait_for_random_bytes() before plain 'p' tests
+to make sure the crng is initialized.
+
+Link: http://lkml.kernel.org/r/20180604113708.11554-1-thierry.escande@linaro.org
+Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
+Acked-by: Tobin C. Harding <me@tobin.cc>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Miller <davem@davemloft.net>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/test_printf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/lib/test_printf.c
++++ b/lib/test_printf.c
+@@ -260,6 +260,13 @@ plain(void)
+ {
+ int err;
+
++ /*
++ * Make sure crng is ready. Otherwise we get "(ptrval)" instead
++ * of a hashed address when printing '%p' in plain_hash() and
++ * plain_format().
++ */
++ wait_for_random_bytes();
++
+ err = plain_hash();
+ if (err) {
+ pr_warn("plain 'p' does not appear to be hashed\n");
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Wed, 9 May 2018 09:28:12 +0900
+Subject: libata: Fix command retry decision
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+[ Upstream commit 804689ad2d9b66d0d3920b48cf05881049d44589 ]
+
+For failed commands with valid sense data (e.g. NCQ commands),
+scsi_check_sense() is used in ata_analyze_tf() to determine if the
+command can be retried. In such case, rely on this decision and ignore
+the command error mask based decision done in ata_worth_retry().
+
+This fixes useless retries of commands such as unaligned writes on zoned
+disks (TYPE_ZAC).
+
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-eh.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2218,12 +2218,16 @@ static void ata_eh_link_autopsy(struct a
+ if (qc->err_mask & ~AC_ERR_OTHER)
+ qc->err_mask &= ~AC_ERR_OTHER;
+
+- /* SENSE_VALID trumps dev/unknown error and revalidation */
++ /*
++ * SENSE_VALID trumps dev/unknown error and revalidation. Upper
++ * layers will determine whether the command is worth retrying
++ * based on the sense data and device class/type. Otherwise,
++ * determine directly if the command is worth retrying using its
++ * error mask and flags.
++ */
+ if (qc->flags & ATA_QCFLAG_SENSE_VALID)
+ qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
+-
+- /* determine whether the command is worth retrying */
+- if (ata_eh_worth_retry(qc))
++ else if (ata_eh_worth_retry(qc))
+ qc->flags |= ATA_QCFLAG_RETRY;
+
+ /* accumulate error info */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Igor Konopko <igor.j.konopko@intel.com>
+Date: Fri, 1 Jun 2018 16:41:09 +0200
+Subject: lightnvm: fix partial read error path
+
+From: Igor Konopko <igor.j.konopko@intel.com>
+
+[ Upstream commit fbadca7396b97d95e2390c97506358f4f9dce7c7 ]
+
+When error occurs during bio_add_page on partial read path, pblk
+tries to free pages twice.
+
+Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
+Signed-off-by: Marcin Dziegielewski <marcin.dziegielewski@intel.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-read.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/lightnvm/pblk-read.c
++++ b/drivers/lightnvm/pblk-read.c
+@@ -219,7 +219,7 @@ static int pblk_partial_read_bio(struct
+ new_bio = bio_alloc(GFP_KERNEL, nr_holes);
+
+ if (pblk_bio_add_pages(pblk, new_bio, GFP_KERNEL, nr_holes))
+- goto err;
++ goto err_add_pages;
+
+ if (nr_holes != new_bio->bi_vcnt) {
+ pr_err("pblk: malformed bio\n");
+@@ -310,10 +310,10 @@ static int pblk_partial_read_bio(struct
+ return NVM_IO_OK;
+
+ err:
+- pr_err("pblk: failed to perform partial read\n");
+-
+ /* Free allocated pages in new bio */
+- pblk_bio_free_pages(pblk, bio, 0, new_bio->bi_vcnt);
++ pblk_bio_free_pages(pblk, new_bio, 0, new_bio->bi_vcnt);
++err_add_pages:
++ pr_err("pblk: failed to perform partial read\n");
+ __pblk_end_io_read(pblk, rqd, false);
+ return NVM_IO_ERR;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Javier González" <javier@javigon.com>
+Date: Fri, 1 Jun 2018 15:04:19 +0200
+Subject: lightnvm: pblk: warn in case of corrupted write buffer
+
+From: "Javier González" <javier@javigon.com>
+
+[ Upstream commit e37d07983af9068de0303054542d2652ca917f58 ]
+
+When cleaning up buffer entries as we wrap up, their state should be
+"completed". If any of the entries is in "submitted" state, it means
+that something bad has happened. Trigger a warning immediately instead of
+waiting for the state flag to eventually be updated, thus hiding the
+issue.
+
+Signed-off-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-rb.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/lightnvm/pblk-rb.c
++++ b/drivers/lightnvm/pblk-rb.c
+@@ -142,10 +142,9 @@ static void clean_wctx(struct pblk_w_ctx
+ {
+ int flags;
+
+-try:
+ flags = READ_ONCE(w_ctx->flags);
+- if (!(flags & PBLK_SUBMITTED_ENTRY))
+- goto try;
++ WARN_ONCE(!(flags & PBLK_SUBMITTED_ENTRY),
++ "pblk: overwriting unsubmitted data\n");
+
+ /* Release flags on context. Protect from writes and reads */
+ smp_store_release(&w_ctx->flags, PBLK_WRITABLE_ENTRY);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Igor Konopko <igor.j.konopko@intel.com>
+Date: Fri, 1 Jun 2018 16:41:08 +0200
+Subject: lightnvm: proper error handling for pblk_bio_add_pages
+
+From: Igor Konopko <igor.j.konopko@intel.com>
+
+[ Upstream commit f142ac0b5d18547a9614a697f86820ee35fd7bf0 ]
+
+Currently in case of error caused by bio_pc_add_page in
+pblk_bio_add_pages two issues occur when calling from
+pblk_rb_read_to_bio(). First one is in pblk_bio_free_pages, since we
+are trying to free pages not allocated from our mempool. Second one
+is the warn from dma_pool_free, that we are trying to free NULL
+pointer dma.
+
+This commit fix both issues.
+
+Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
+Signed-off-by: Marcin Dziegielewski <marcin.dziegielewski@intel.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -278,7 +278,9 @@ void pblk_free_rqd(struct pblk *pblk, st
+ return;
+ }
+
+- nvm_dev_dma_free(dev->parent, rqd->meta_list, rqd->dma_meta_list);
++ if (rqd->meta_list)
++ nvm_dev_dma_free(dev->parent, rqd->meta_list,
++ rqd->dma_meta_list);
+ mempool_free(rqd, pool);
+ }
+
+@@ -316,7 +318,7 @@ int pblk_bio_add_pages(struct pblk *pblk
+
+ return 0;
+ err:
+- pblk_bio_free_pages(pblk, bio, 0, i - 1);
++ pblk_bio_free_pages(pblk, bio, (bio->bi_vcnt - i), i);
+ return -1;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Fri, 4 May 2018 18:08:10 +0800
+Subject: md: fix NULL dereference of mddev->pers in remove_and_add_spares()
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ]
+
+We met NULL pointer BUG as follow:
+
+[ 151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060
+[ 151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0
+[ 151.762039] Oops: 0000 [#1] SMP PTI
+[ 151.762406] Modules linked in:
+[ 151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238
+[ 151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
+[ 151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0
+[ 151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246
+[ 151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000
+[ 151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000
+[ 151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051
+[ 151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600
+[ 151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000
+[ 151.769160] FS: 00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000
+[ 151.769971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0
+[ 151.771272] Call Trace:
+[ 151.771542] md_ioctl+0x1df2/0x1e10
+[ 151.771906] ? __switch_to+0x129/0x440
+[ 151.772295] ? __schedule+0x244/0x850
+[ 151.772672] blkdev_ioctl+0x4bd/0x970
+[ 151.773048] block_ioctl+0x39/0x40
+[ 151.773402] do_vfs_ioctl+0xa4/0x610
+[ 151.773770] ? dput.part.23+0x87/0x100
+[ 151.774151] ksys_ioctl+0x70/0x80
+[ 151.774493] __x64_sys_ioctl+0x16/0x20
+[ 151.774877] do_syscall_64+0x5b/0x180
+[ 151.775258] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+For raid6, when two disk of the array are offline, two spare disks can
+be added into the array. Before spare disks recovery completing,
+system reboot and mdadm thinks it is ok to restart the degraded
+array by md_ioctl(). Since disks in raid6 is not only_parity(),
+raid5_run() will abort, when there is no PPL feature or not setting
+'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL.
+
+But, mddev->raid_disks has been set and it will not be cleared when
+raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to
+remove a disk by mdadm, which will cause NULL pointer dereference
+in remove_and_add_spares() finally.
+
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6525,6 +6525,9 @@ static int hot_remove_disk(struct mddev
+ char b[BDEVNAME_SIZE];
+ struct md_rdev *rdev;
+
++ if (!mddev->pers)
++ return -ENODEV;
++
+ rdev = find_rdev(mddev, dev);
+ if (!rdev)
+ return -ENXIO;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Gioh Kim <gi-oh.kim@profitbricks.com>
+Date: Wed, 2 May 2018 13:08:11 +0200
+Subject: md/raid1: add error handling of read error from FailFast device
+
+From: Gioh Kim <gi-oh.kim@profitbricks.com>
+
+[ Upstream commit b33d10624fdc15cdf1495f3f00481afccec76783 ]
+
+Current handle_read_error() function calls fix_read_error()
+only if md device is RW and rdev does not include FailFast flag.
+It does not handle a read error from a RW device including
+FailFast flag.
+
+I am not sure it is intended. But I found that write IO error
+sets rdev faulty. The md module should handle the read IO error and
+write IO error equally. So I think read IO error should set rdev faulty.
+
+Signed-off-by: Gioh Kim <gi-oh.kim@profitbricks.com>
+Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid1.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2474,6 +2474,8 @@ static void handle_read_error(struct r1c
+ fix_read_error(conf, r1_bio->read_disk,
+ r1_bio->sector, r1_bio->sectors);
+ unfreeze_array(conf);
++ } else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) {
++ md_error(mddev, rdev);
+ } else {
+ r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Date: Wed, 30 May 2018 05:13:24 -0400
+Subject: media: arch: sh: migor: Fix TW9910 PDN gpio
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 2b787b66bcb03ec3bd97e950464e0452f459e2ca ]
+
+The TW9910 PDN gpio (power down) is listed as active high in the chip
+manual. It turns out it is actually active low as when set to physical
+level 0 it actually turns the video decoder power off.
+
+Without this patch applied:
+tw9910 0-0045: Product ID error 1f:2
+
+With this patch applied:
+tw9910 0-0045: tw9910 Product ID b:0
+
+Fixes: commit "186c446f4b840bd77b79d3dc951ca436cb8abe79"
+
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sh/boards/mach-migor/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sh/boards/mach-migor/setup.c
++++ b/arch/sh/boards/mach-migor/setup.c
+@@ -359,7 +359,7 @@ static struct gpiod_lookup_table ov7725_
+ static struct gpiod_lookup_table tw9910_gpios = {
+ .dev_id = "0-0045",
+ .table = {
+- GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_HIGH),
++ GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_LOW),
+ GPIO_LOOKUP("sh7722_pfc", GPIO_PTT3, "rstb", GPIO_ACTIVE_LOW),
+ },
+ };
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Thu, 12 Apr 2018 05:31:59 -0400
+Subject: media: atomisp: compat32: fix __user annotations
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit ad4222a0e29664666a71685a6e732923ca7c7e45 ]
+
+The __user annotations at the compat32 code is not right:
+
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: expected void *base
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: expected unsigned int [usertype] *xcoords_y
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: expected unsigned int [usertype] *ycoords_y
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: expected unsigned int [usertype] *xcoords_uv
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: expected unsigned int [usertype] *ycoords_uv
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: expected unsigned int [usertype] *effective_width
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: expected unsigned int [usertype] *effective_width
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: expected struct v4l2_framebuffer *frame
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: expected unsigned short *calb_grp_values
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:701:39: warning: cast removes address space of expression
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: warning: incorrect type in argument 1 (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: expected void const volatile [noderef] <asn:1>*<noident>
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: got unsigned int [usertype] *src
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: expected struct atomisp_shading_table *shading_table
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: warning: incorrect type in argument 1 (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: expected void [noderef] <asn:1>*to
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: got struct atomisp_shading_table *shading_table
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: expected struct atomisp_morph_table *morph_table
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: warning: incorrect type in argument 1 (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: expected void [noderef] <asn:1>*to
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: got struct atomisp_morph_table *morph_table
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: expected struct atomisp_dvs2_coefficients *dvs2_coefs
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: warning: incorrect type in argument 1 (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: expected void [noderef] <asn:1>*to
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: got struct atomisp_dvs2_coefficients *dvs2_coefs
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: expected struct atomisp_dvs_6axis_config *dvs_6axis_config
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: got void [noderef] <asn:1>*
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: warning: incorrect type in argument 1 (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: expected void [noderef] <asn:1>*to
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: got struct atomisp_dvs_6axis_config *dvs_6axis_config
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: warning: incorrect type in assignment (different address spaces)
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: expected struct atomisp_sensor_ae_bracketing_lut_entry *lut
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: got void [noderef] <asn:1>*
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c | 49 +++++-----
+ 1 file changed, 26 insertions(+), 23 deletions(-)
+
+--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c
++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c
+@@ -77,7 +77,7 @@ static int get_v4l2_framebuffer32(struct
+ get_user(kp->flags, &up->flags))
+ return -EFAULT;
+
+- kp->base = compat_ptr(tmp);
++ kp->base = (void __force *)compat_ptr(tmp);
+ get_v4l2_pix_format((struct v4l2_pix_format *)&kp->fmt, &up->fmt);
+ return 0;
+ }
+@@ -228,10 +228,10 @@ static int get_atomisp_dvs_6axis_config3
+ get_user(ycoords_uv, &up->ycoords_uv))
+ return -EFAULT;
+
+- kp->xcoords_y = compat_ptr(xcoords_y);
+- kp->ycoords_y = compat_ptr(ycoords_y);
+- kp->xcoords_uv = compat_ptr(xcoords_uv);
+- kp->ycoords_uv = compat_ptr(ycoords_uv);
++ kp->xcoords_y = (void __force *)compat_ptr(xcoords_y);
++ kp->ycoords_y = (void __force *)compat_ptr(ycoords_y);
++ kp->xcoords_uv = (void __force *)compat_ptr(xcoords_uv);
++ kp->ycoords_uv = (void __force *)compat_ptr(ycoords_uv);
+ return 0;
+ }
+
+@@ -292,7 +292,7 @@ static int get_atomisp_metadata_stat32(s
+ return -EFAULT;
+
+ kp->data = compat_ptr(data);
+- kp->effective_width = compat_ptr(effective_width);
++ kp->effective_width = (void __force *)compat_ptr(effective_width);
+ return 0;
+ }
+
+@@ -356,7 +356,7 @@ static int get_atomisp_metadata_by_type_
+ return -EFAULT;
+
+ kp->data = compat_ptr(data);
+- kp->effective_width = compat_ptr(effective_width);
++ kp->effective_width = (void __force *)compat_ptr(effective_width);
+ return 0;
+ }
+
+@@ -433,7 +433,7 @@ static int get_atomisp_overlay32(struct
+ get_user(kp->overlay_start_x, &up->overlay_start_y))
+ return -EFAULT;
+
+- kp->frame = compat_ptr(frame);
++ kp->frame = (void __force *)compat_ptr(frame);
+ return 0;
+ }
+
+@@ -477,7 +477,7 @@ static int get_atomisp_calibration_group
+ get_user(calb_grp_values, &up->calb_grp_values))
+ return -EFAULT;
+
+- kp->calb_grp_values = compat_ptr(calb_grp_values);
++ kp->calb_grp_values = (void __force *)compat_ptr(calb_grp_values);
+ return 0;
+ }
+
+@@ -699,8 +699,8 @@ static int get_atomisp_parameters32(stru
+ return -EFAULT;
+
+ while (n >= 0) {
+- compat_uptr_t *src = (compat_uptr_t *)up + n;
+- uintptr_t *dst = (uintptr_t *)kp + n;
++ compat_uptr_t __user *src = ((compat_uptr_t __user *)up) + n;
++ uintptr_t *dst = ((uintptr_t *)kp) + n;
+
+ if (get_user((*dst), src))
+ return -EFAULT;
+@@ -747,12 +747,12 @@ static int get_atomisp_parameters32(stru
+ #endif
+ return -EFAULT;
+
+- kp->shading_table = user_ptr + offset;
++ kp->shading_table = (void __force *)user_ptr + offset;
+ offset = sizeof(struct atomisp_shading_table);
+ if (!kp->shading_table)
+ return -EFAULT;
+
+- if (copy_to_user(kp->shading_table,
++ if (copy_to_user((void __user *)kp->shading_table,
+ &karg.shading_table,
+ sizeof(struct atomisp_shading_table)))
+ return -EFAULT;
+@@ -773,13 +773,14 @@ static int get_atomisp_parameters32(stru
+ #endif
+ return -EFAULT;
+
+- kp->morph_table = user_ptr + offset;
++ kp->morph_table = (void __force *)user_ptr + offset;
+ offset += sizeof(struct atomisp_morph_table);
+ if (!kp->morph_table)
+ return -EFAULT;
+
+- if (copy_to_user(kp->morph_table, &karg.morph_table,
+- sizeof(struct atomisp_morph_table)))
++ if (copy_to_user((void __user *)kp->morph_table,
++ &karg.morph_table,
++ sizeof(struct atomisp_morph_table)))
+ return -EFAULT;
+ }
+
+@@ -798,13 +799,14 @@ static int get_atomisp_parameters32(stru
+ #endif
+ return -EFAULT;
+
+- kp->dvs2_coefs = user_ptr + offset;
++ kp->dvs2_coefs = (void __force *)user_ptr + offset;
+ offset += sizeof(struct atomisp_dis_coefficients);
+ if (!kp->dvs2_coefs)
+ return -EFAULT;
+
+- if (copy_to_user(kp->dvs2_coefs, &karg.dvs2_coefs,
+- sizeof(struct atomisp_dis_coefficients)))
++ if (copy_to_user((void __user *)kp->dvs2_coefs,
++ &karg.dvs2_coefs,
++ sizeof(struct atomisp_dis_coefficients)))
+ return -EFAULT;
+ }
+ /* handle dvs 6axis configuration */
+@@ -822,13 +824,14 @@ static int get_atomisp_parameters32(stru
+ #endif
+ return -EFAULT;
+
+- kp->dvs_6axis_config = user_ptr + offset;
++ kp->dvs_6axis_config = (void __force *)user_ptr + offset;
+ offset += sizeof(struct atomisp_dvs_6axis_config);
+ if (!kp->dvs_6axis_config)
+ return -EFAULT;
+
+- if (copy_to_user(kp->dvs_6axis_config, &karg.dvs_6axis_config,
+- sizeof(struct atomisp_dvs_6axis_config)))
++ if (copy_to_user((void __user *)kp->dvs_6axis_config,
++ &karg.dvs_6axis_config,
++ sizeof(struct atomisp_dvs_6axis_config)))
+ return -EFAULT;
+ }
+ }
+@@ -887,7 +890,7 @@ static int get_atomisp_sensor_ae_bracket
+ get_user(lut, &up->lut))
+ return -EFAULT;
+
+- kp->lut = compat_ptr(lut);
++ kp->lut = (void __force *)compat_ptr(lut);
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Mon, 16 Apr 2018 12:37:09 -0400
+Subject: media: atomisp: ov2680: don't declare unused vars
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit e5c0680fd2c44252868fe4062558925b5506b179 ]
+
+drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘__ov2680_set_exposure’:
+drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:400:10: warning: variable ‘hts’ set but not used [-Wunused-but-set-variable]
+ u16 vts,hts;
+ ^~~
+drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘ov2680_detect’:
+drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:1164:5: warning: variable ‘revision’ set but not used [-Wunused-but-set-variable]
+ u8 revision;
+ ^~~~~~~~
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/atomisp/i2c/atomisp-ov2680.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c
++++ b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c
+@@ -397,14 +397,13 @@ static long __ov2680_set_exposure(struct
+ {
+ struct i2c_client *client = v4l2_get_subdevdata(sd);
+ struct ov2680_device *dev = to_ov2680_sensor(sd);
+- u16 vts,hts;
++ u16 vts;
+ int ret,exp_val;
+
+ dev_dbg(&client->dev,
+ "+++++++__ov2680_set_exposure coarse_itg %d, gain %d, digitgain %d++\n",
+ coarse_itg, gain, digitgain);
+
+- hts = ov2680_res[dev->fmt_idx].pixels_per_line;
+ vts = ov2680_res[dev->fmt_idx].lines_per_frame;
+
+ /* group hold */
+@@ -1185,7 +1184,8 @@ static int ov2680_detect(struct i2c_clie
+ OV2680_SC_CMMN_SUB_ID, &high);
+ revision = (u8) high & 0x0f;
+
+- dev_info(&client->dev, "sensor_revision id = 0x%x\n", id);
++ dev_info(&client->dev, "sensor_revision id = 0x%x, rev= %d\n",
++ id, revision);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Sat, 7 Apr 2018 05:38:52 -0400
+Subject: media: cec: fix smatch error
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit b66d448487a478c203368f2b72d7d9156a01f6be ]
+
+drivers/media/cec/cec-pin-error-inj.c:231
+cec_pin_error_inj_parse_line() error: uninitialized symbol 'pos'.
+
+The tx-add-bytes command didn't check for the presence of an argument, and
+also didn't check that it was > 0.
+
+This should fix this error.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/cec-pin-error-inj.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/cec/cec-pin-error-inj.c
++++ b/drivers/media/cec/cec-pin-error-inj.c
+@@ -204,16 +204,18 @@ bool cec_pin_error_inj_parse_line(struct
+ mode_mask = CEC_ERROR_INJ_MODE_MASK << mode_offset;
+ arg_idx = cec_error_inj_cmds[i].arg_idx;
+
+- if (mode_offset == CEC_ERROR_INJ_RX_ARB_LOST_OFFSET ||
+- mode_offset == CEC_ERROR_INJ_TX_ADD_BYTES_OFFSET)
+- is_bit_pos = false;
+-
+ if (mode_offset == CEC_ERROR_INJ_RX_ARB_LOST_OFFSET) {
+ if (has_op)
+ return false;
+ if (!has_pos)
+ pos = 0x0f;
++ is_bit_pos = false;
++ } else if (mode_offset == CEC_ERROR_INJ_TX_ADD_BYTES_OFFSET) {
++ if (!has_pos || !pos)
++ return false;
++ is_bit_pos = false;
+ }
++
+ if (arg_idx >= 0 && is_bit_pos) {
+ if (!has_pos || pos >= 160)
+ return false;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Tue, 15 May 2018 15:23:16 -0400
+Subject: media: cec-pin-error-inj: avoid a false-positive Spectre detection
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+[ Upstream commit a3d71f256c8a8b5d51ea0dfd09cd85ce3a09d9e1 ]
+
+The current logic makes Smatch to false-detect a Spectre variant 1
+vulnerability. The problem is that it initializes an u32 indirectly
+from user space input.
+
+After trying to write a fixup, after a while I realized that, in
+practice, this shouldn't be a problem, as an u32 is initialized
+from u8, but it took some time to discover it.
+
+So, do some code cleanup to make it clearer for both humans
+and machines about the valid range for "op".
+
+Fix this warning:
+ drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() warn: potential spectre issue 'pin->error_inj_args'
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/cec-pin-error-inj.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/cec/cec-pin-error-inj.c
++++ b/drivers/media/cec/cec-pin-error-inj.c
+@@ -81,10 +81,9 @@ bool cec_pin_error_inj_parse_line(struct
+ u64 *error;
+ u8 *args;
+ bool has_op;
+- u32 op;
++ u8 op;
+ u8 mode;
+ u8 pos;
+- u8 v;
+
+ p = skip_spaces(p);
+ token = strsep(&p, delims);
+@@ -146,12 +145,18 @@ bool cec_pin_error_inj_parse_line(struct
+ comma = strchr(token, ',');
+ if (comma)
+ *comma++ = '\0';
+- if (!strcmp(token, "any"))
+- op = CEC_ERROR_INJ_OP_ANY;
+- else if (!kstrtou8(token, 0, &v))
+- op = v;
+- else
++ if (!strcmp(token, "any")) {
++ has_op = false;
++ error = pin->error_inj + CEC_ERROR_INJ_OP_ANY;
++ args = pin->error_inj_args[CEC_ERROR_INJ_OP_ANY];
++ } else if (!kstrtou8(token, 0, &op)) {
++ has_op = true;
++ error = pin->error_inj + op;
++ args = pin->error_inj_args[op];
++ } else {
+ return false;
++ }
++
+ mode = CEC_ERROR_INJ_MODE_ONCE;
+ if (comma) {
+ if (!strcmp(comma, "off"))
+@@ -166,10 +171,6 @@ bool cec_pin_error_inj_parse_line(struct
+ return false;
+ }
+
+- error = pin->error_inj + op;
+- args = pin->error_inj_args[op];
+- has_op = op <= 0xff;
+-
+ token = strsep(&p, delims);
+ if (p) {
+ p = skip_spaces(p);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Fri, 9 Mar 2018 07:21:45 -0500
+Subject: media: em28xx: fix a regression with HVR-950
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit 509f89652f83e834b3ef7a083e2eeac812b055f0 ]
+
+Commit be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner
+functionality") removed the logic with sets the alternate for the DVB
+device. Without setting the right alternate, the device won't be
+able to submit URBs, and userspace fails with -EMSGSIZE:
+
+ ERROR DMX_SET_PES_FILTER failed (PID = 0x2000): 90 Message too long
+
+Tested with Hauppauge HVR-950 model A1C0.
+
+Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality")
+
+Cc: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/em28xx/em28xx-dvb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -199,6 +199,7 @@ static int em28xx_start_streaming(struct
+ int rc;
+ struct em28xx_i2c_bus *i2c_bus = dvb->adapter.priv;
+ struct em28xx *dev = i2c_bus->dev;
++ struct usb_device *udev = interface_to_usbdev(dev->intf);
+ int dvb_max_packet_size, packet_multiplier, dvb_alt;
+
+ if (dev->dvb_xfer_bulk) {
+@@ -217,6 +218,7 @@ static int em28xx_start_streaming(struct
+ dvb_alt = dev->dvb_alt_isoc;
+ }
+
++ usb_set_interface(udev, dev->ifnum, dvb_alt);
+ rc = em28xx_set_mode(dev, EM28XX_DIGITAL_MODE);
+ if (rc < 0)
+ return rc;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Wed, 2 May 2018 17:46:18 -0400
+Subject: media: em28xx: Fix DualHD broken second tuner
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 01affb000e00cfa0a9e9954476ef50962eb8b168 ]
+
+The use of a hard coded i2c address breaks the creation of the
+second tuner in DualHD 01595 models. The issue is compounded
+by lack of any error message stating that a driver failed
+initialization. Use addr, which contains the correct address
+for each tuner.
+
+Fixes: ad32495b1513 ("media: em28xx-dvb: simplify DVB module probing logic")
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/em28xx/em28xx-dvb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1392,7 +1392,7 @@ static int em28174_dvb_init_hauppauge_wi
+
+ dvb->i2c_client_tuner = dvb_module_probe("si2157", NULL,
+ adapter,
+- 0x60, &si2157_config);
++ addr, &si2157_config);
+ if (!dvb->i2c_client_tuner) {
+ dvb_module_release(dvb->i2c_client_demod);
+ return -ENODEV;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sami Tolvanen <samitolvanen@google.com>
+Date: Mon, 7 May 2018 14:09:46 -0400
+Subject: media: media-device: fix ioctl function types
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit daa36370b62428cca6d48d1b2530a8419f631c8c ]
+
+This change fixes function types for media device ioctls to avoid
+indirect call mismatches with Control-Flow Integrity checking.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/media-device.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -54,9 +54,10 @@ static int media_device_close(struct fil
+ return 0;
+ }
+
+-static int media_device_get_info(struct media_device *dev,
+- struct media_device_info *info)
++static long media_device_get_info(struct media_device *dev, void *arg)
+ {
++ struct media_device_info *info = arg;
++
+ memset(info, 0, sizeof(*info));
+
+ if (dev->driver_name[0])
+@@ -93,9 +94,9 @@ static struct media_entity *find_entity(
+ return NULL;
+ }
+
+-static long media_device_enum_entities(struct media_device *mdev,
+- struct media_entity_desc *entd)
++static long media_device_enum_entities(struct media_device *mdev, void *arg)
+ {
++ struct media_entity_desc *entd = arg;
+ struct media_entity *ent;
+
+ ent = find_entity(mdev, entd->id);
+@@ -146,9 +147,9 @@ static void media_device_kpad_to_upad(co
+ upad->flags = kpad->flags;
+ }
+
+-static long media_device_enum_links(struct media_device *mdev,
+- struct media_links_enum *links)
++static long media_device_enum_links(struct media_device *mdev, void *arg)
+ {
++ struct media_links_enum *links = arg;
+ struct media_entity *entity;
+
+ entity = find_entity(mdev, links->entity);
+@@ -195,9 +196,9 @@ static long media_device_enum_links(stru
+ return 0;
+ }
+
+-static long media_device_setup_link(struct media_device *mdev,
+- struct media_link_desc *linkd)
++static long media_device_setup_link(struct media_device *mdev, void *arg)
+ {
++ struct media_link_desc *linkd = arg;
+ struct media_link *link = NULL;
+ struct media_entity *source;
+ struct media_entity *sink;
+@@ -225,9 +226,9 @@ static long media_device_setup_link(stru
+ return __media_entity_setup_link(link, linkd->flags);
+ }
+
+-static long media_device_get_topology(struct media_device *mdev,
+- struct media_v2_topology *topo)
++static long media_device_get_topology(struct media_device *mdev, void *arg)
+ {
++ struct media_v2_topology *topo = arg;
+ struct media_entity *entity;
+ struct media_interface *intf;
+ struct media_pad *pad;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Suman Anna <s-anna@ti.com>
+Date: Wed, 14 Mar 2018 11:41:36 -0400
+Subject: media: omap3isp: fix unbalanced dma_iommu_mapping
+
+From: Suman Anna <s-anna@ti.com>
+
+[ Upstream commit b7e1e6859fbf60519fd82d7120cee106a6019512 ]
+
+The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware
+ARM DMA backend. The current code creates a dma_iommu_mapping and
+attaches this to the ISP device, but never detaches the mapping in
+either the probe failure paths or the driver remove path resulting
+in an unbalanced mapping refcount and a memory leak. Fix this properly.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Tested-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/omap3isp/isp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -1945,6 +1945,7 @@ error_csi2:
+
+ static void isp_detach_iommu(struct isp_device *isp)
+ {
++ arm_iommu_detach_device(isp->dev);
+ arm_iommu_release_mapping(isp->mapping);
+ isp->mapping = NULL;
+ }
+@@ -1961,8 +1962,7 @@ static int isp_attach_iommu(struct isp_d
+ mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G);
+ if (IS_ERR(mapping)) {
+ dev_err(isp->dev, "failed to create ARM IOMMU mapping\n");
+- ret = PTR_ERR(mapping);
+- goto error;
++ return PTR_ERR(mapping);
+ }
+
+ isp->mapping = mapping;
+@@ -1977,7 +1977,8 @@ static int isp_attach_iommu(struct isp_d
+ return 0;
+
+ error:
+- isp_detach_iommu(isp);
++ arm_iommu_release_mapping(isp->mapping);
++ isp->mapping = NULL;
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Sean Young <sean@mess.org>
+Date: Sun, 25 Mar 2018 11:45:40 -0400
+Subject: media: rc: mce_kbd decoder: low timeout values cause double keydowns
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit c421c62a4a08aba220ad7176ef4aa4b0ced9480a ]
+
+The mce keyboard repeats pressed keys every 100ms. If the IR timeout
+is set to less than that, we send key up events before the repeat
+arrives, so we have key up/key down for each IR repeat.
+
+The keyboard ends any sequence with a 0 scancode, in which case all keys
+are cleared so there is no need to run the timeout timer: it only exists
+for the case that the final 0 was not received.
+
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/ir-mce_kbd-decoder.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/rc/ir-mce_kbd-decoder.c
++++ b/drivers/media/rc/ir-mce_kbd-decoder.c
+@@ -324,11 +324,13 @@ again:
+ scancode = data->body & 0xffff;
+ dev_dbg(&dev->dev, "keyboard data 0x%08x\n",
+ data->body);
+- if (dev->timeout)
+- delay = usecs_to_jiffies(dev->timeout / 1000);
+- else
+- delay = msecs_to_jiffies(100);
+- mod_timer(&data->rx_timeout, jiffies + delay);
++ if (scancode) {
++ delay = nsecs_to_jiffies(dev->timeout) +
++ msecs_to_jiffies(100);
++ mod_timer(&data->rx_timeout, jiffies + delay);
++ } else {
++ del_timer(&data->rx_timeout);
++ }
+ /* Pass data to keyboard buffer parser */
+ ir_mce_kbd_process_keyboard_data(dev, scancode);
+ lsc.rc_proto = RC_PROTO_MCIR2_KBD;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Tue, 12 Jul 2016 07:21:46 -0400
+Subject: media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+[ Upstream commit 43d0d3c52787df0221d1c52494daabd824fe84f1 ]
+
+Add the missing clk_disable_unprepare() before return from
+jpu_open() in the software reset error handling case.
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Acked-by: Mikhail Ulyanov <mikhail.ulyanov@cogentembedded.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/rcar_jpu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/rcar_jpu.c
++++ b/drivers/media/platform/rcar_jpu.c
+@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file)
+ /* ...issue software reset */
+ ret = jpu_reset(jpu);
+ if (ret)
+- goto device_prepare_rollback;
++ goto jpu_reset_rollback;
+ }
+
+ jpu->ref_count++;
+@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file)
+ mutex_unlock(&jpu->mutex);
+ return 0;
+
++jpu_reset_rollback:
++ clk_disable_unprepare(jpu->clk);
+ device_prepare_rollback:
+ mutex_unlock(&jpu->mutex);
+ v4l_prepare_rollback:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Date: Fri, 4 May 2018 05:32:17 -0400
+Subject: media: renesas-ceu: Set mbus_fmt on subdev operations
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit d3a67f27471d4792caf84132228def2b18617932 ]
+
+The renesas-ceu driver intializes the desired mbus_format at 'complete'
+time, inspecting the supported subdevice ones, and tuning some
+parameters to produce the requested memory format from what the sensor
+can produce. Although, the initially selected mbus_format was not
+provided to the subdevice during set_fmt and try_fmt operations,
+providing instead a '0' mbus format code.
+
+As long as the sensor defaults to a compatible mbus_format when an
+invalid code as '0' is provided, capture operations work correctly. If
+the subdevice defaults to an unsupported format (eg. some RGB
+permutations) capture does not work properly due to a mismatch on the
+expected and received image format on the wire.
+
+Fix that by re-using the initially selected mbus_format code during
+set_fmt and try_fmt subdevice operation calls.
+
+Tested by printing out the format selection procedure with ov7670
+sensor.
+
+Before this patch:
+[ 0.866001] ov7670_try_fmt_internal -- Looking for mbus_code 0x0000
+[ 0.870882] ov7670_try_fmt_internal -- Try mbus_code 0x2008
+[ 0.876336] ov7670_try_fmt_internal -- Try mbus_code 0x1002
+[ 0.881387] ov7670_try_fmt_internal -- Try mbus_code 0x1008
+[ 0.886537] ov7670_try_fmt_internal -- Try mbus_code 0x3001
+[ 0.891584] ov7670_try_fmt_internal -- mbus_code defaulted to 0x2008
+
+With this patch applied:
+[ 0.867015] ov7670_try_fmt_internal -- Looking for mbus_code 0x2008
+[ 0.873205] ov7670_try_fmt_internal -- Try mbus_code 0x2008: match
+
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas-ceu.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/renesas-ceu.c
++++ b/drivers/media/platform/renesas-ceu.c
+@@ -777,8 +777,15 @@ static int ceu_try_fmt(struct ceu_device
+ const struct ceu_fmt *ceu_fmt;
+ int ret;
+
++ /*
++ * Set format on sensor sub device: bus format used to produce memory
++ * format is selected at initialization time.
++ */
+ struct v4l2_subdev_format sd_format = {
+- .which = V4L2_SUBDEV_FORMAT_TRY,
++ .which = V4L2_SUBDEV_FORMAT_TRY,
++ .format = {
++ .code = ceu_sd->mbus_fmt.mbus_code,
++ },
+ };
+
+ switch (pix->pixelformat) {
+@@ -800,10 +807,6 @@ static int ceu_try_fmt(struct ceu_device
+ v4l_bound_align_image(&pix->width, 2, CEU_MAX_WIDTH, 4,
+ &pix->height, 4, CEU_MAX_HEIGHT, 4, 0);
+
+- /*
+- * Set format on sensor sub device: bus format used to produce memory
+- * format is selected at initialization time.
+- */
+ v4l2_fill_mbus_format_mplane(&sd_format.format, pix);
+ ret = v4l2_subdev_call(v4l2_sd, pad, set_fmt, &pad_cfg, &sd_format);
+ if (ret)
+@@ -827,8 +830,15 @@ static int ceu_set_fmt(struct ceu_device
+ struct v4l2_subdev *v4l2_sd = ceu_sd->v4l2_sd;
+ int ret;
+
++ /*
++ * Set format on sensor sub device: bus format used to produce memory
++ * format is selected at initialization time.
++ */
+ struct v4l2_subdev_format format = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
++ .format = {
++ .code = ceu_sd->mbus_fmt.mbus_code,
++ },
+ };
+
+ ret = ceu_try_fmt(ceudev, v4l2_fmt);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Fri, 4 May 2018 17:53:35 -0400
+Subject: media: saa7164: Fix driver name in debug output
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 0cc4655cb57af0b7e105d075c4f83f8046efafe7 ]
+
+This issue was reported by a user who downloaded a corrupt saa7164
+firmware, then went looking for a valid xc5000 firmware to fix the
+error displayed...but the device in question has no xc5000, thus after
+much effort, the wild goose chase eventually led to a support call.
+
+The xc5000 has nothing to do with saa7164 (as far as I can tell),
+so replace the string with saa7164 as well as give a meaningful
+hint on the firmware mismatch.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/saa7164/saa7164-fw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/pci/saa7164/saa7164-fw.c
++++ b/drivers/media/pci/saa7164/saa7164-fw.c
+@@ -426,7 +426,8 @@ int saa7164_downloadfirmware(struct saa7
+ __func__, fw->size);
+
+ if (fw->size != fwlength) {
+- printk(KERN_ERR "xc5000: firmware incorrect size\n");
++ printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n",
++ fw->size, fwlength);
+ ret = -ENOMEM;
+ goto out;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Fri, 6 Apr 2018 07:54:51 -0400
+Subject: media: si470x: fix __be16 annotations
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit 90db5c829692a0a7845e977e45719b4699216bd4 ]
+
+The annotations there are wrong as warned:
+ drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: warning: incorrect type in assignment (different base types)
+ drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: expected unsigned short [unsigned] [short] <noident>
+ drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: got restricted __be16 [usertype] <noident>
+ drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
+ drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/radio/si470x/radio-si470x-i2c.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -91,7 +91,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS ma
+ */
+ int si470x_get_register(struct si470x_device *radio, int regnr)
+ {
+- u16 buf[READ_REG_NUM];
++ __be16 buf[READ_REG_NUM];
+ struct i2c_msg msgs[1] = {
+ {
+ .addr = radio->client->addr,
+@@ -116,7 +116,7 @@ int si470x_get_register(struct si470x_de
+ int si470x_set_register(struct si470x_device *radio, int regnr)
+ {
+ int i;
+- u16 buf[WRITE_REG_NUM];
++ __be16 buf[WRITE_REG_NUM];
+ struct i2c_msg msgs[1] = {
+ {
+ .addr = radio->client->addr,
+@@ -146,7 +146,7 @@ int si470x_set_register(struct si470x_de
+ static int si470x_get_all_registers(struct si470x_device *radio)
+ {
+ int i;
+- u16 buf[READ_REG_NUM];
++ __be16 buf[READ_REG_NUM];
+ struct i2c_msg msgs[1] = {
+ {
+ .addr = radio->client->addr,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Fri, 20 Apr 2018 08:32:16 -0400
+Subject: media: siano: get rid of __le32/__le16 cast warnings
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit e1b7f11b37def5f3021c06e8c2b4953e099357aa ]
+
+Those are all false-positives that appear with smatch when building for
+arm:
+
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
+ drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
+ drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
+
+Get rid of them by adding explicit forced casts.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/common/siano/smsendian.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/common/siano/smsendian.c
++++ b/drivers/media/common/siano/smsendian.c
+@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *b
+ switch (msg->x_msg_header.msg_type) {
+ case MSG_SMS_DATA_DOWNLOAD_REQ:
+ {
+- msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]);
++ msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0]));
+ break;
+ }
+
+@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *b
+ sizeof(struct sms_msg_hdr))/4;
+
+ for (i = 0; i < msg_words; i++)
+- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
+
+ break;
+ }
+@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *b
+ {
+ struct sms_version_res *ver =
+ (struct sms_version_res *) msg;
+- ver->chip_model = le16_to_cpu(ver->chip_model);
++ ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model);
+ break;
+ }
+
+@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *b
+ sizeof(struct sms_msg_hdr))/4;
+
+ for (i = 0; i < msg_words; i++)
+- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
+
+ break;
+ }
+@@ -95,9 +95,9 @@ void smsendian_handle_message_header(voi
+ #ifdef __BIG_ENDIAN
+ struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg;
+
+- phdr->msg_type = le16_to_cpu(phdr->msg_type);
+- phdr->msg_length = le16_to_cpu(phdr->msg_length);
+- phdr->msg_flags = le16_to_cpu(phdr->msg_flags);
++ phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type);
++ phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length);
++ phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags);
+ #endif /* __BIG_ENDIAN */
+ }
+ EXPORT_SYMBOL_GPL(smsendian_handle_message_header);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 25 Apr 2018 11:04:21 -0400
+Subject: media: smiapp: fix timeout checking in smiapp_read_nvm
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ]
+
+The current code decrements the timeout counter i and the end of
+each loop i is incremented, so the check for timeout will always
+be false and hence the timeout mechanism is just a dead code path.
+Potentially, if the RD_READY bit is not set, we could end up in
+an infinite loop.
+
+Fix this so the timeout starts from 1000 and decrements to zero,
+if at the end of the loop i is zero we have a timeout condition.
+
+Detected by CoverityScan, CID#1324008 ("Logically dead code")
+
+Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp
+ if (rval)
+ goto out;
+
+- for (i = 0; i < 1000; i++) {
++ for (i = 1000; i > 0; i--) {
+ rval = smiapp_read(
+ sensor,
+ SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s);
+@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp
+ if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
+ break;
+
+- if (--i == 0) {
+- rval = -ETIMEDOUT;
+- goto out;
+- }
+-
++ }
++ if (!i) {
++ rval = -ETIMEDOUT;
++ goto out;
+ }
+
+ for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Mon, 16 Apr 2018 12:37:08 -0400
+Subject: media: staging: atomisp: Comment out several unused sensor resolutions
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit db01f7ccfa6d4738e366077ce7423d1710b805f3 ]
+
+The register settings for several resolutions aren't used
+currently. So, comment them out.
+
+Fix those warnings:
+
+In file included from drivers/staging/media/atomisp/i2c/atomisp-gc2235.c:35:0:
+drivers/staging/media/atomisp/i2c/gc2235.h:340:32: warning: 'gc2235_960_640_30fps' defined but not used [-Wunused-const-variable=]
+ static struct gc2235_reg const gc2235_960_640_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/gc2235.h:287:32: warning: 'gc2235_1296_736_30fps' defined but not used [-Wunused-const-variable=]
+ static struct gc2235_reg const gc2235_1296_736_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~
+In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2722.c:35:0:
+drivers/staging/media/atomisp/i2c/ov2722.h:999:32: warning: 'ov2722_720p_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2722_reg const ov2722_720p_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2722.h:787:32: warning: 'ov2722_1M3_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2722_reg const ov2722_1M3_30fps[] = {
+ ^~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2722.h:476:32: warning: 'ov2722_VGA_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2722_reg const ov2722_VGA_30fps[] = {
+ ^~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2722.h:367:32: warning: 'ov2722_480P_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2722_reg const ov2722_480P_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2722.h:257:32: warning: 'ov2722_QVGA_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2722_reg const ov2722_QVGA_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function '__ov2680_set_exposure':
+In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:35:0:
+At top level:
+drivers/staging/media/atomisp/i2c/ov2680.h:736:33: warning: 'ov2680_1616x1082_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:649:33: warning: 'ov2680_1456x1096_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_1456x1096_30fps[]= {
+ ^~~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:606:33: warning: 'ov2680_1296x976_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_1296x976_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:563:33: warning: 'ov2680_720p_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_720p_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:520:33: warning: 'ov2680_800x600_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_800x600_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:475:33: warning: 'ov2680_720x592_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_720x592_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:433:33: warning: 'ov2680_656x496_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_656x496_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:389:33: warning: 'ov2680_QVGA_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_QVGA_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:346:33: warning: 'ov2680_CIF_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_CIF_30fps[] = {
+ ^~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov2680.h:301:33: warning: 'ov2680_QCIF_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov2680_reg const ov2680_QCIF_30fps[] = {
+ ^~~~~~~~~~~~~~~~~
+In file included from drivers/staging/media/atomisp/i2c/ov5693/atomisp-ov5693.c:36:0:
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:988:32: warning: 'ov5693_1424x1168_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:954:32: warning: 'ov5693_2592x1944_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:889:32: warning: 'ov5693_2592x1456_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_2592x1456_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:862:32: warning: 'ov5693_1940x1096' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_1940x1096[] = {
+ ^~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:796:32: warning: 'ov5693_1636p_30fps' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_1636p_30fps[] = {
+ ^~~~~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:758:32: warning: 'ov5693_1296x736' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_1296x736[] = {
+ ^~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:730:32: warning: 'ov5693_976x556' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_976x556[] = {
+ ^~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:672:32: warning: 'ov5693_736x496' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_736x496[] = {
+ ^~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:643:32: warning: 'ov5693_192x160' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_192x160[] = {
+ ^~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:616:32: warning: 'ov5693_368x304' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_368x304[] = {
+ ^~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:587:32: warning: 'ov5693_336x256' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_336x256[] = {
+ ^~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:540:32: warning: 'ov5693_1296x976' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_1296x976[] = {
+ ^~~~~~~~~~~~~~~
+drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:509:32: warning: 'ov5693_654x496' defined but not used [-Wunused-const-variable=]
+ static struct ov5693_reg const ov5693_654x496[] = {
+ ^~~~~~~~~~~~~~
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/atomisp/i2c/gc2235.h | 9 ++++++++-
+ drivers/staging/media/atomisp/i2c/ov2680.h | 5 ++++-
+ drivers/staging/media/atomisp/i2c/ov2722.h | 6 ++++++
+ drivers/staging/media/atomisp/i2c/ov5693/ov5693.h | 18 +++++++++++++++++-
+ 4 files changed, 35 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/media/atomisp/i2c/gc2235.h
++++ b/drivers/staging/media/atomisp/i2c/gc2235.h
+@@ -33,6 +33,11 @@
+
+ #include "../include/linux/atomisp_platform.h"
+
++/*
++ * FIXME: non-preview resolutions are currently broken
++ */
++#define ENABLE_NON_PREVIEW 0
++
+ /* Defines for register writes and register array processing */
+ #define I2C_MSG_LENGTH 0x2
+ #define I2C_RETRY_COUNT 5
+@@ -284,6 +289,7 @@ static struct gc2235_reg const gc2235_in
+ /*
+ * Register settings for various resolution
+ */
++#if ENABLE_NON_PREVIEW
+ static struct gc2235_reg const gc2235_1296_736_30fps[] = {
+ { GC2235_8BIT, 0x8b, 0xa0 },
+ { GC2235_8BIT, 0x8c, 0x02 },
+@@ -387,6 +393,7 @@ static struct gc2235_reg const gc2235_96
+ { GC2235_8BIT, 0xfe, 0x00 }, /* switch to P0 */
+ { GC2235_TOK_TERM, 0, 0 }
+ };
++#endif
+
+ static struct gc2235_reg const gc2235_1600_900_30fps[] = {
+ { GC2235_8BIT, 0x8b, 0xa0 },
+@@ -578,7 +585,7 @@ static struct gc2235_resolution gc2235_r
+ * Disable non-preview configurations until the configuration selection is
+ * improved.
+ */
+-#if 0
++#if ENABLE_NON_PREVIEW
+ static struct gc2235_resolution gc2235_res_still[] = {
+ {
+ .desc = "gc2235_1600_900_30fps",
+--- a/drivers/staging/media/atomisp/i2c/ov2680.h
++++ b/drivers/staging/media/atomisp/i2c/ov2680.h
+@@ -295,6 +295,7 @@ struct ov2680_format {
+ };
+
+
++#if 0 /* None of the definitions below are used currently */
+ /*
+ * 176x144 30fps VBlanking 1lane 10Bit (binning)
+ */
+@@ -513,7 +514,6 @@ struct ov2680_format {
+ {OV2680_8BIT, 0x5081, 0x41},
+ {OV2680_TOK_TERM, 0, 0}
+ };
+-
+ /*
+ * 800x600 30fps VBlanking 1lane 10Bit (binning)
+ */
+@@ -685,6 +685,7 @@ struct ov2680_format {
+ // {OV2680_8BIT, 0x5090, 0x0c},
+ {OV2680_TOK_TERM, 0, 0}
+ };
++#endif
+
+ /*
+ *1616x916 30fps VBlanking 1lane 10bit
+@@ -734,6 +735,7 @@ struct ov2680_format {
+ /*
+ * 1612x1212 30fps VBlanking 1lane 10Bit
+ */
++#if 0
+ static struct ov2680_reg const ov2680_1616x1082_30fps[] = {
+ {OV2680_8BIT, 0x3086, 0x00},
+ {OV2680_8BIT, 0x3501, 0x48},
+@@ -773,6 +775,7 @@ struct ov2680_format {
+ {OV2680_8BIT, 0x5081, 0x41},
+ {OV2680_TOK_TERM, 0, 0}
+ };
++#endif
+ /*
+ * 1616x1216 30fps VBlanking 1lane 10Bit
+ */
+--- a/drivers/staging/media/atomisp/i2c/ov2722.h
++++ b/drivers/staging/media/atomisp/i2c/ov2722.h
+@@ -254,6 +254,7 @@ struct ov2722_write_ctrl {
+ /*
+ * Register settings for various resolution
+ */
++#if 0
+ static struct ov2722_reg const ov2722_QVGA_30fps[] = {
+ {OV2722_8BIT, 0x3718, 0x10},
+ {OV2722_8BIT, 0x3702, 0x0c},
+@@ -581,6 +582,7 @@ static struct ov2722_reg const ov2722_VG
+ {OV2722_8BIT, 0x3509, 0x10},
+ {OV2722_TOK_TERM, 0, 0},
+ };
++#endif
+
+ static struct ov2722_reg const ov2722_1632_1092_30fps[] = {
+ {OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for
+@@ -784,6 +786,7 @@ static struct ov2722_reg const ov2722_14
+ {OV2722_8BIT, 0x3509, 0x00},
+ {OV2722_TOK_TERM, 0, 0}
+ };
++#if 0
+ static struct ov2722_reg const ov2722_1M3_30fps[] = {
+ {OV2722_8BIT, 0x3718, 0x10},
+ {OV2722_8BIT, 0x3702, 0x24},
+@@ -890,6 +893,7 @@ static struct ov2722_reg const ov2722_1M
+ {OV2722_8BIT, 0x3509, 0x10},
+ {OV2722_TOK_TERM, 0, 0},
+ };
++#endif
+
+ static struct ov2722_reg const ov2722_1080p_30fps[] = {
+ {OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for a whole
+@@ -996,6 +1000,7 @@ static struct ov2722_reg const ov2722_10
+ {OV2722_TOK_TERM, 0, 0}
+ };
+
++#if 0 /* Currently unused */
+ static struct ov2722_reg const ov2722_720p_30fps[] = {
+ {OV2722_8BIT, 0x3021, 0x03},
+ {OV2722_8BIT, 0x3718, 0x10},
+@@ -1095,6 +1100,7 @@ static struct ov2722_reg const ov2722_72
+ {OV2722_8BIT, 0x3509, 0x00},
+ {OV2722_TOK_TERM, 0, 0},
+ };
++#endif
+
+ static struct ov2722_resolution ov2722_res_preview[] = {
+ {
+--- a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
++++ b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h
+@@ -31,6 +31,12 @@
+
+ #include "../../include/linux/atomisp_platform.h"
+
++/*
++ * FIXME: non-preview resolutions are currently broken
++ */
++#define ENABLE_NON_PREVIEW 0
++
++
+ #define OV5693_POWER_UP_RETRY_NUM 5
+
+ /* Defines for register writes and register array processing */
+@@ -503,6 +509,7 @@ static struct ov5693_reg const ov5693_gl
+ {OV5693_TOK_TERM, 0, 0}
+ };
+
++#if ENABLE_NON_PREVIEW
+ /*
+ * 654x496 30fps 17ms VBlanking 2lane 10Bit (Scaling)
+ */
+@@ -695,6 +702,7 @@ static struct ov5693_reg const ov5693_73
+ {OV5693_8BIT, 0x0100, 0x01},
+ {OV5693_TOK_TERM, 0, 0}
+ };
++#endif
+
+ /*
+ static struct ov5693_reg const ov5693_736x496[] = {
+@@ -727,6 +735,7 @@ static struct ov5693_reg const ov5693_73
+ /*
+ * 976x556 30fps 8.8ms VBlanking 2lane 10Bit (Scaling)
+ */
++#if ENABLE_NON_PREVIEW
+ static struct ov5693_reg const ov5693_976x556[] = {
+ {OV5693_8BIT, 0x3501, 0x7b},
+ {OV5693_8BIT, 0x3502, 0x00},
+@@ -819,6 +828,7 @@ static struct ov5693_reg const ov5693_16
+ {OV5693_8BIT, 0x0100, 0x01},
+ {OV5693_TOK_TERM, 0, 0}
+ };
++#endif
+
+ static struct ov5693_reg const ov5693_1616x1216_30fps[] = {
+ {OV5693_8BIT, 0x3501, 0x7b},
+@@ -859,6 +869,7 @@ static struct ov5693_reg const ov5693_16
+ /*
+ * 1940x1096 30fps 8.8ms VBlanking 2lane 10bit (Scaling)
+ */
++#if ENABLE_NON_PREVIEW
+ static struct ov5693_reg const ov5693_1940x1096[] = {
+ {OV5693_8BIT, 0x3501, 0x7b},
+ {OV5693_8BIT, 0x3502, 0x00},
+@@ -916,6 +927,7 @@ static struct ov5693_reg const ov5693_25
+ {OV5693_8BIT, 0x5002, 0x00},
+ {OV5693_TOK_TERM, 0, 0}
+ };
++#endif
+
+ static struct ov5693_reg const ov5693_2576x1456_30fps[] = {
+ {OV5693_8BIT, 0x3501, 0x7b},
+@@ -951,6 +963,7 @@ static struct ov5693_reg const ov5693_25
+ /*
+ * 2592x1944 30fps 0.6ms VBlanking 2lane 10Bit
+ */
++#if ENABLE_NON_PREVIEW
+ static struct ov5693_reg const ov5693_2592x1944_30fps[] = {
+ {OV5693_8BIT, 0x3501, 0x7b},
+ {OV5693_8BIT, 0x3502, 0x00},
+@@ -977,6 +990,7 @@ static struct ov5693_reg const ov5693_25
+ {OV5693_8BIT, 0x0100, 0x01},
+ {OV5693_TOK_TERM, 0, 0}
+ };
++#endif
+
+ /*
+ * 11:9 Full FOV Output, expected FOV Res: 2346x1920
+@@ -985,6 +999,7 @@ static struct ov5693_reg const ov5693_25
+ *
+ * WA: Left Offset: 8, Hor scal: 64
+ */
++#if ENABLE_NON_PREVIEW
+ static struct ov5693_reg const ov5693_1424x1168_30fps[] = {
+ {OV5693_8BIT, 0x3501, 0x3b}, /* long exposure[15:8] */
+ {OV5693_8BIT, 0x3502, 0x80}, /* long exposure[7:0] */
+@@ -1019,6 +1034,7 @@ static struct ov5693_reg const ov5693_14
+ {OV5693_8BIT, 0x0100, 0x01},
+ {OV5693_TOK_TERM, 0, 0}
+ };
++#endif
+
+ /*
+ * 3:2 Full FOV Output, expected FOV Res: 2560x1706
+@@ -1151,7 +1167,7 @@ static struct ov5693_resolution ov5693_r
+ * Disable non-preview configurations until the configuration selection is
+ * improved.
+ */
+-#if 0
++#if ENABLE_NON_PREVIEW
+ struct ov5693_resolution ov5693_res_still[] = {
+ {
+ .desc = "ov5693_736x496_30fps",
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ezequiel Garcia <ezequiel@collabora.com>
+Date: Fri, 18 May 2018 17:07:48 -0400
+Subject: media: tw686x: Fix incorrect vb2_mem_ops GFP flags
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 636757ab6c93e19e2f58d3b3af1312e34eaffbab ]
+
+When the driver is configured in the "memcpy" dma-mode,
+it uses vb2_vmalloc_memops, which is backed by a SLAB
+allocator and so shouldn't be using GFP_DMA32.
+
+Fix it.
+
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/tw686x/tw686x-video.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/pci/tw686x/tw686x-video.c
++++ b/drivers/media/pci/tw686x/tw686x-video.c
+@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev
+ vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+ vc->vidq.min_buffers_needed = 2;
+ vc->vidq.lock = &vc->vb_mutex;
+- vc->vidq.gfp_flags = GFP_DMA32;
++ vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ?
++ GFP_DMA32 : 0;
+ vc->vidq.dev = &dev->pci_dev->dev;
+
+ err = vb2_queue_init(&vc->vidq);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Mon, 21 May 2018 08:43:02 -0400
+Subject: media: videobuf2-core: don't call memop 'finish' when queueing
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ]
+
+When a buffer is queued or requeued in vb2_buffer_done, then don't
+call the finish memop. In this case the buffer is only returned to vb2,
+not to userspace.
+
+Calling 'finish' here will cause an unbalance when the queue is
+canceled, since the core will call the same memop again.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/common/videobuf2/videobuf2-core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -916,9 +916,12 @@ void vb2_buffer_done(struct vb2_buffer *
+ dprintk(4, "done processing on buffer %d, state: %d\n",
+ vb->index, state);
+
+- /* sync buffers */
+- for (plane = 0; plane < vb->num_planes; ++plane)
+- call_void_memop(vb, finish, vb->planes[plane].mem_priv);
++ if (state != VB2_BUF_STATE_QUEUED &&
++ state != VB2_BUF_STATE_REQUEUEING) {
++ /* sync buffers */
++ for (plane = 0; plane < vb->num_planes; ++plane)
++ call_void_memop(vb, finish, vb->planes[plane].mem_priv);
++ }
+
+ spin_lock_irqsave(&q->done_lock, flags);
+ if (state == VB2_BUF_STATE_QUEUED ||
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Thu, 7 Jun 2018 17:09:44 -0700
+Subject: mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit e81bf9793b1861d74953ef041b4f6c7faecc2dbd ]
+
+The LKP robot found a 27% will-it-scale/page_fault3 performance
+regression regarding commit e27be240df53("mm: memcg: make sure
+memory.events is uptodate when waking pollers").
+
+What the test does is:
+ 1 mkstemp() a 128M file on a tmpfs;
+ 2 start $nr_cpu processes, each to loop the following:
+ 2.1 mmap() this file in shared write mode;
+ 2.2 write 0 to this file in a PAGE_SIZE step till the end of the file;
+ 2.3 unmap() this file and repeat this process.
+ 3 After 5 minutes, check how many loops they managed to complete, the
+ higher the better.
+
+The commit itself looks innocent enough as it merely changed some event
+counting mechanism and this test didn't trigger those events at all.
+Perf shows increased cycles spent on accessing root_mem_cgroup->stat_cpu
+in count_memcg_event_mm()(called by handle_mm_fault()) and in
+__mod_memcg_state() called by page_add_file_rmap(). So it's likely due
+to the changed layout of 'struct mem_cgroup' that either make stat_cpu
+falling into a constantly modifying cacheline or some hot fields stop
+being in the same cacheline.
+
+I verified this by moving memory_events[] back to where it was:
+
+: --- a/include/linux/memcontrol.h
+: +++ b/include/linux/memcontrol.h
+: @@ -205,7 +205,6 @@ struct mem_cgroup {
+: int oom_kill_disable;
+:
+: /* memory.events */
+: - atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
+: struct cgroup_file events_file;
+:
+: /* protect arrays of thresholds */
+: @@ -238,6 +237,7 @@ struct mem_cgroup {
+: struct mem_cgroup_stat_cpu __percpu *stat_cpu;
+: atomic_long_t stat[MEMCG_NR_STAT];
+: atomic_long_t events[NR_VM_EVENT_ITEMS];
+: + atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
+:
+: unsigned long socket_pressure;
+
+And performance restored.
+
+Later investigation found that as long as the following 3 fields
+moving_account, move_lock_task and stat_cpu are in the same cacheline,
+performance will be good. To avoid future performance surprise by other
+commits changing the layout of 'struct mem_cgroup', this patch makes
+sure the 3 fields stay in the same cacheline.
+
+One concern of this approach is, moving_account and move_lock_task could
+be modified when a process changes memory cgroup while stat_cpu is a
+always read field, it might hurt to place them in the same cacheline. I
+assume it is rare for a process to change memory cgroup so this should
+be OK.
+
+Link: https://lkml.kernel.org/r/20180528114019.GF9904@yexl-desktop
+Link: http://lkml.kernel.org/r/20180601071115.GA27302@intel.com
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Reported-by: kernel test robot <xiaolong.ye@intel.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Tejun Heo <tj@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/memcontrol.h | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -158,6 +158,15 @@ enum memcg_kmem_state {
+ KMEM_ONLINE,
+ };
+
++#if defined(CONFIG_SMP)
++struct memcg_padding {
++ char x[0];
++} ____cacheline_internodealigned_in_smp;
++#define MEMCG_PADDING(name) struct memcg_padding name;
++#else
++#define MEMCG_PADDING(name)
++#endif
++
+ /*
+ * The memory controller data structure. The memory controller controls both
+ * page cache and RSS per cgroup. We would eventually like to provide
+@@ -205,7 +214,6 @@ struct mem_cgroup {
+ int oom_kill_disable;
+
+ /* memory.events */
+- atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
+ struct cgroup_file events_file;
+
+ /* protect arrays of thresholds */
+@@ -225,19 +233,26 @@ struct mem_cgroup {
+ * mem_cgroup ? And what type of charges should we move ?
+ */
+ unsigned long move_charge_at_immigrate;
++ /* taken only while moving_account > 0 */
++ spinlock_t move_lock;
++ unsigned long move_lock_flags;
++
++ MEMCG_PADDING(_pad1_);
++
+ /*
+ * set > 0 if pages under this cgroup are moving to other cgroup.
+ */
+ atomic_t moving_account;
+- /* taken only while moving_account > 0 */
+- spinlock_t move_lock;
+ struct task_struct *move_lock_task;
+- unsigned long move_lock_flags;
+
+ /* memory.stat */
+ struct mem_cgroup_stat_cpu __percpu *stat_cpu;
++
++ MEMCG_PADDING(_pad2_);
++
+ atomic_long_t stat[MEMCG_NR_STAT];
+ atomic_long_t events[NR_VM_EVENT_ITEMS];
++ atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS];
+
+ unsigned long socket_pressure;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Mon, 9 Apr 2018 22:28:29 +0300
+Subject: memory: tegra: Apply interrupts mask per SoC
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 1c74d5c0de0c2cc29fef97a19251da2ad6f579bd ]
+
+Currently we are enabling handling of interrupts specific to Tegra124+
+which happen to overlap with previous generations. Let's specify
+interrupts mask per SoC generation for consistency and in a preparation
+of squashing of Tegra20 driver into the common one that will enable
+handling of GART faults which may be undesirable by newer generations.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memory/tegra/mc.c | 21 +++------------------
+ drivers/memory/tegra/mc.h | 9 +++++++++
+ drivers/memory/tegra/tegra114.c | 2 ++
+ drivers/memory/tegra/tegra124.c | 6 ++++++
+ drivers/memory/tegra/tegra210.c | 3 +++
+ drivers/memory/tegra/tegra30.c | 2 ++
+ include/soc/tegra/mc.h | 2 ++
+ 7 files changed, 27 insertions(+), 18 deletions(-)
+
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -20,14 +20,6 @@
+ #include "mc.h"
+
+ #define MC_INTSTATUS 0x000
+-#define MC_INT_DECERR_MTS (1 << 16)
+-#define MC_INT_SECERR_SEC (1 << 13)
+-#define MC_INT_DECERR_VPR (1 << 12)
+-#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11)
+-#define MC_INT_INVALID_SMMU_PAGE (1 << 10)
+-#define MC_INT_ARBITRATION_EMEM (1 << 9)
+-#define MC_INT_SECURITY_VIOLATION (1 << 8)
+-#define MC_INT_DECERR_EMEM (1 << 6)
+
+ #define MC_INTMASK 0x004
+
+@@ -248,13 +240,11 @@ static const char *const error_names[8]
+ static irqreturn_t tegra_mc_irq(int irq, void *data)
+ {
+ struct tegra_mc *mc = data;
+- unsigned long status, mask;
++ unsigned long status;
+ unsigned int bit;
+
+ /* mask all interrupts to avoid flooding */
+- mask = mc_readl(mc, MC_INTMASK);
+- status = mc_readl(mc, MC_INTSTATUS) & mask;
+-
++ status = mc_readl(mc, MC_INTSTATUS) & mc->soc->intmask;
+ if (!status)
+ return IRQ_NONE;
+
+@@ -349,7 +339,6 @@ static int tegra_mc_probe(struct platfor
+ const struct of_device_id *match;
+ struct resource *res;
+ struct tegra_mc *mc;
+- u32 value;
+ int err;
+
+ match = of_match_node(tegra_mc_of_match, pdev->dev.of_node);
+@@ -417,11 +406,7 @@ static int tegra_mc_probe(struct platfor
+
+ WARN(!mc->soc->client_id_mask, "Missing client ID mask for this SoC\n");
+
+- value = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
+- MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
+- MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM;
+-
+- mc_writel(mc, value, MC_INTMASK);
++ mc_writel(mc, mc->soc->intmask, MC_INTMASK);
+
+ return 0;
+ }
+--- a/drivers/memory/tegra/mc.h
++++ b/drivers/memory/tegra/mc.h
+@@ -14,6 +14,15 @@
+
+ #include <soc/tegra/mc.h>
+
++#define MC_INT_DECERR_MTS (1 << 16)
++#define MC_INT_SECERR_SEC (1 << 13)
++#define MC_INT_DECERR_VPR (1 << 12)
++#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11)
++#define MC_INT_INVALID_SMMU_PAGE (1 << 10)
++#define MC_INT_ARBITRATION_EMEM (1 << 9)
++#define MC_INT_SECURITY_VIOLATION (1 << 8)
++#define MC_INT_DECERR_EMEM (1 << 6)
++
+ static inline u32 mc_readl(struct tegra_mc *mc, unsigned long offset)
+ {
+ return readl(mc->regs + offset);
+--- a/drivers/memory/tegra/tegra114.c
++++ b/drivers/memory/tegra/tegra114.c
+@@ -945,4 +945,6 @@ const struct tegra_mc_soc tegra114_mc_so
+ .atom_size = 32,
+ .client_id_mask = 0x7f,
+ .smmu = &tegra114_smmu_soc,
++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION |
++ MC_INT_DECERR_EMEM,
+ };
+--- a/drivers/memory/tegra/tegra124.c
++++ b/drivers/memory/tegra/tegra124.c
+@@ -1035,6 +1035,9 @@ const struct tegra_mc_soc tegra124_mc_so
+ .smmu = &tegra124_smmu_soc,
+ .emem_regs = tegra124_mc_emem_regs,
+ .num_emem_regs = ARRAY_SIZE(tegra124_mc_emem_regs),
++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+ #endif /* CONFIG_ARCH_TEGRA_124_SOC */
+
+@@ -1059,5 +1062,8 @@ const struct tegra_mc_soc tegra132_mc_so
+ .atom_size = 32,
+ .client_id_mask = 0x7f,
+ .smmu = &tegra132_smmu_soc,
++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+ #endif /* CONFIG_ARCH_TEGRA_132_SOC */
+--- a/drivers/memory/tegra/tegra210.c
++++ b/drivers/memory/tegra/tegra210.c
+@@ -1092,4 +1092,7 @@ const struct tegra_mc_soc tegra210_mc_so
+ .atom_size = 64,
+ .client_id_mask = 0xff,
+ .smmu = &tegra210_smmu_soc,
++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+--- a/drivers/memory/tegra/tegra30.c
++++ b/drivers/memory/tegra/tegra30.c
+@@ -967,4 +967,6 @@ const struct tegra_mc_soc tegra30_mc_soc
+ .atom_size = 16,
+ .client_id_mask = 0x7f,
+ .smmu = &tegra30_smmu_soc,
++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION |
++ MC_INT_DECERR_EMEM,
+ };
+--- a/include/soc/tegra/mc.h
++++ b/include/soc/tegra/mc.h
+@@ -108,6 +108,8 @@ struct tegra_mc_soc {
+ u8 client_id_mask;
+
+ const struct tegra_smmu_soc *smmu;
++
++ u32 intmask;
+ };
+
+ struct tegra_mc {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Mon, 9 Apr 2018 22:28:27 +0300
+Subject: memory: tegra: Do not handle spurious interrupts
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit bf3fbdfbec947cdd04b2f2c4bce11534c8786eee ]
+
+The ISR reads interrupts-enable mask, but doesn't utilize it. Apply the
+mask to the interrupt status and don't handle interrupts that MC driver
+haven't asked for. Kernel would disable spurious MC IRQ and report the
+error. This would happen only in a case of a very severe bug.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memory/tegra/mc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -252,8 +252,11 @@ static irqreturn_t tegra_mc_irq(int irq,
+ unsigned int bit;
+
+ /* mask all interrupts to avoid flooding */
+- status = mc_readl(mc, MC_INTSTATUS);
+ mask = mc_readl(mc, MC_INTMASK);
++ status = mc_readl(mc, MC_INTSTATUS) & mask;
++
++ if (!status)
++ return IRQ_NONE;
+
+ for_each_set_bit(bit, &status, 32) {
+ const char *error = status_names[bit] ?: "unknown";
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Vincent Palatin <vpalatin@chromium.org>
+Date: Wed, 18 Apr 2018 12:23:58 +0200
+Subject: mfd: cros_ec: Fail early if we cannot identify the EC
+
+From: Vincent Palatin <vpalatin@chromium.org>
+
+[ Upstream commit 0dbbf25561b29ffab5ba6277429760abdf49ceff ]
+
+If we cannot communicate with the EC chip to detect the protocol version
+and its features, it's very likely useless to continue. Else we will
+commit all kind of uninformed mistakes (using the wrong protocol, the
+wrong buffer size, mixing the EC with other chips).
+
+Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
+Acked-by: Benson Leung <bleung@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/cros_ec.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/mfd/cros_ec.c
++++ b/drivers/mfd/cros_ec.c
+@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_devi
+
+ mutex_init(&ec_dev->lock);
+
+- cros_ec_query_all(ec_dev);
++ err = cros_ec_query_all(ec_dev);
++ if (err) {
++ dev_err(dev, "Cannot identify the EC: error %d\n", err);
++ return err;
++ }
+
+ if (ec_dev->irq) {
+ err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Tue, 10 Apr 2018 15:05:42 +0200
+Subject: microblaze: Fix simpleImage format generation
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+[ Upstream commit ece97f3a5fb50cf5f98886fbc63c9665f2bb199d ]
+
+simpleImage generation was broken for some time. This patch is fixing
+steps how simpleImage.*.ub file is generated. Steps are objdump of
+vmlinux and create .ub.
+Also make sure that there is striped elf version with .strip suffix.
+
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/microblaze/boot/Makefile | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -22,17 +22,19 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FO
+ quiet_cmd_cp = CP $< $@$2
+ cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+
+-quiet_cmd_strip = STRIP $@
++quiet_cmd_strip = STRIP $< $@$2
+ cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
+- -K _fdt_start vmlinux -o $@
++ -K _fdt_start $< -o $@$2
+
+ UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
++UIMAGE_IN = $@
++UIMAGE_OUT = $@.ub
+
+ $(obj)/simpleImage.%: vmlinux FORCE
+ $(call if_changed,cp,.unstrip)
+ $(call if_changed,objcopy)
+ $(call if_changed,uimage)
+- $(call if_changed,strip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
++ $(call if_changed,strip,.strip)
++ @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+ clean-files += simpleImage.*.unstrip linux.bin.ub
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Wed, 2 May 2018 10:17:34 +0300
+Subject: mlxsw: spectrum_router: Return an error for non-default FIB rules
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 6290182b2b3bda119ecb243fb3d6bcc98a74344f ]
+
+Since commit 9776d32537d2 ("net: Move call_fib_rule_notifiers up in
+fib_nl_newrule") it is possible to forbid the installation of
+unsupported FIB rules.
+
+Have mlxsw return an error for non-default FIB rules in addition to the
+existing extack message.
+
+Example:
+# ip rule add from 198.51.100.1 table 10
+Error: mlxsw_spectrum: FIB rules not supported.
+
+Note that offload is only aborted when non-default FIB rules are already
+installed and merely replayed during module initialization.
+
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -5882,24 +5882,24 @@ static int mlxsw_sp_router_fib_rule_even
+ switch (info->family) {
+ case AF_INET:
+ if (!fib4_rule_default(rule) && !rule->l3mdev)
+- err = -1;
++ err = -EOPNOTSUPP;
+ break;
+ case AF_INET6:
+ if (!fib6_rule_default(rule) && !rule->l3mdev)
+- err = -1;
++ err = -EOPNOTSUPP;
+ break;
+ case RTNL_FAMILY_IPMR:
+ if (!ipmr_rule_default(rule) && !rule->l3mdev)
+- err = -1;
++ err = -EOPNOTSUPP;
+ break;
+ case RTNL_FAMILY_IP6MR:
+ if (!ip6mr_rule_default(rule) && !rule->l3mdev)
+- err = -1;
++ err = -EOPNOTSUPP;
+ break;
+ }
+
+ if (err < 0)
+- NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported. Aborting offload");
++ NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported");
+
+ return err;
+ }
+@@ -5926,8 +5926,8 @@ static int mlxsw_sp_router_fib_event(str
+ case FIB_EVENT_RULE_DEL:
+ err = mlxsw_sp_router_fib_rule_event(event, info,
+ router->mlxsw_sp);
+- if (!err)
+- return NOTIFY_DONE;
++ if (!err || info->extack)
++ return notifier_from_errno(err);
+ }
+
+ fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Petr Machata <petrm@mellanox.com>
+Date: Fri, 15 Jun 2018 16:23:38 +0300
+Subject: mlxsw: spectrum_switchdev: Fix port_vlan refcounting
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ]
+
+Switchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are
+distributed not only on clean addition, but also when flags on an
+existing VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls
+mlxsw_sp_port_vlan_get() to get at the port_vlan in question, which
+implicitly references the object. This then leads to discrepancies in
+reference counting when the VLAN is removed. spectrum.c warns about the
+problem when the module is removed:
+
+[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum]
+[...]
+[13578.627106] Call Trace:
+[13578.629617] mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum]
+[13578.634748] mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core]
+[13578.641290] mlxsw_pci_remove+0x13/0x40 [mlxsw_pci]
+[13578.646238] pci_device_remove+0x31/0xb0
+[13578.650244] device_release_driver_internal+0x14f/0x220
+[13578.655562] driver_detach+0x32/0x70
+[13578.659183] bus_remove_driver+0x47/0xa0
+[13578.663134] pci_unregister_driver+0x1e/0x80
+[13578.667486] mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum]
+[13578.673207] __x64_sys_delete_module+0x13b/0x1e0
+[13578.677888] ? exit_to_usermode_loop+0x78/0x80
+[13578.682374] do_syscall_64+0x39/0xe0
+[13578.685976] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join()
+determines it's a flag-only change.
+
+Fixes: b3529af6bb0d ("spectrum: Reference count VLAN entries")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1013,8 +1013,10 @@ mlxsw_sp_port_vlan_bridge_join(struct ml
+ int err;
+
+ /* No need to continue if only VLAN flags were changed */
+- if (mlxsw_sp_port_vlan->bridge_port)
++ if (mlxsw_sp_port_vlan->bridge_port) {
++ mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan);
+ return 0;
++ }
+
+ err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port);
+ if (err)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 14 Jun 2018 15:26:34 -0700
+Subject: mm: check for SIGKILL inside dup_mmap() loop
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 655c79bb40a0870adcd0871057d01de11625882b ]
+
+As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas
+can loop while potentially allocating memory, with mm->mmap_sem held for
+write by current thread. This is bad if current thread was selected as
+an OOM victim, for current thread will continue allocations using memory
+reserves while OOM reaper is unable to reclaim memory.
+
+As an actually observable problem, it is not difficult to make OOM
+reaper unable to reclaim memory if the OOM victim is blocked at
+i_mmap_lock_write() in this loop. Unfortunately, since nobody can
+explain whether it is safe to use killable wait there, let's check for
+SIGKILL before trying to allocate memory. Even without an OOM event,
+there is no point with continuing the loop from the beginning if current
+thread is killed.
+
+I tested with debug printk(). This patch should be safe because we
+already fail if security_vm_enough_memory_mm() or
+kmem_cache_alloc(GFP_KERNEL) fails and exit_mmap() handles it.
+
+ ***** Aborting dup_mmap() due to SIGKILL *****
+ ***** Aborting dup_mmap() due to SIGKILL *****
+ ***** Aborting dup_mmap() due to SIGKILL *****
+ ***** Aborting dup_mmap() due to SIGKILL *****
+ ***** Aborting exit_mmap() due to NULL mmap *****
+
+[akpm@linux-foundation.org: add comment]
+Link: http://lkml.kernel.org/r/201804071938.CDE04681.SOFVQJFtMHOOLF@I-love.SAKURA.ne.jp
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -440,6 +440,14 @@ static __latent_entropy int dup_mmap(str
+ continue;
+ }
+ charge = 0;
++ /*
++ * Don't duplicate many vmas if we've been oom-killed (for
++ * example)
++ */
++ if (fatal_signal_pending(current)) {
++ retval = -EINTR;
++ goto out;
++ }
+ if (mpnt->vm_flags & VM_ACCOUNT) {
+ unsigned long len = vma_pages(mpnt);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ram Pai <linuxram@us.ibm.com>
+Date: Tue, 27 Mar 2018 02:09:26 -0700
+Subject: mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled
+
+From: Ram Pai <linuxram@us.ibm.com>
+
+[ Upstream commit 5212213aa5a2359dd0474c9dab22b6220b591fe1 ]
+
+VM_PKEY_BITx are defined only if CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+is enabled. Powerpc also needs these bits. Hence lets define the
+VM_PKEY_BITx bits for any architecture that enables
+CONFIG_ARCH_HAS_PKEYS.
+
+Reviewed-by: Dave Hansen <dave.hansen@intel.com>
+Signed-off-by: Ram Pai <linuxram@us.ibm.com>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/pkeys.h | 2 ++
+ fs/proc/task_mmu.c | 4 ++--
+ include/linux/mm.h | 9 +++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/pkeys.h
++++ b/arch/powerpc/include/asm/pkeys.h
+@@ -26,6 +26,8 @@ extern u32 initial_allocation_mask; /* b
+ # define VM_PKEY_BIT2 VM_HIGH_ARCH_2
+ # define VM_PKEY_BIT3 VM_HIGH_ARCH_3
+ # define VM_PKEY_BIT4 VM_HIGH_ARCH_4
++#elif !defined(VM_PKEY_BIT4)
++# define VM_PKEY_BIT4 VM_HIGH_ARCH_4
+ #endif
+
+ #define ARCH_VM_PKEY_FLAGS (VM_PKEY_BIT0 | VM_PKEY_BIT1 | VM_PKEY_BIT2 | \
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -673,13 +673,13 @@ static void show_smap_vma_flags(struct s
+ [ilog2(VM_MERGEABLE)] = "mg",
+ [ilog2(VM_UFFD_MISSING)]= "um",
+ [ilog2(VM_UFFD_WP)] = "uw",
+-#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
++#ifdef CONFIG_ARCH_HAS_PKEYS
+ /* These come out via ProtectionKey: */
+ [ilog2(VM_PKEY_BIT0)] = "",
+ [ilog2(VM_PKEY_BIT1)] = "",
+ [ilog2(VM_PKEY_BIT2)] = "",
+ [ilog2(VM_PKEY_BIT3)] = "",
+-#endif
++#endif /* CONFIG_ARCH_HAS_PKEYS */
+ };
+ size_t i;
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -228,15 +228,16 @@ extern unsigned int kobjsize(const void
+ #define VM_HIGH_ARCH_4 BIT(VM_HIGH_ARCH_BIT_4)
+ #endif /* CONFIG_ARCH_USES_HIGH_VMA_FLAGS */
+
+-#if defined(CONFIG_X86)
+-# define VM_PAT VM_ARCH_1 /* PAT reserves whole VMA at once (x86) */
+-#if defined (CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS)
++#ifdef CONFIG_ARCH_HAS_PKEYS
+ # define VM_PKEY_SHIFT VM_HIGH_ARCH_BIT_0
+ # define VM_PKEY_BIT0 VM_HIGH_ARCH_0 /* A protection key is a 4-bit value */
+ # define VM_PKEY_BIT1 VM_HIGH_ARCH_1
+ # define VM_PKEY_BIT2 VM_HIGH_ARCH_2
+ # define VM_PKEY_BIT3 VM_HIGH_ARCH_3
+-#endif
++#endif /* CONFIG_ARCH_HAS_PKEYS */
++
++#if defined(CONFIG_X86)
++# define VM_PAT VM_ARCH_1 /* PAT reserves whole VMA at once (x86) */
+ #elif defined(CONFIG_PPC)
+ # define VM_SAO VM_ARCH_1 /* Strong Access Ordering (powerpc) */
+ #elif defined(CONFIG_PARISC)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Huang Ying <ying.huang@intel.com>
+Date: Thu, 7 Jun 2018 17:07:39 -0700
+Subject: mm: /proc/pid/pagemap: hide swap entries from unprivileged users
+
+From: Huang Ying <ying.huang@intel.com>
+
+[ Upstream commit ab6ecf247a9321e3180e021a6a60164dee53ab2e ]
+
+In commit ab676b7d6fbf ("pagemap: do not leak physical addresses to
+non-privileged userspace"), the /proc/PID/pagemap is restricted to be
+readable only by CAP_SYS_ADMIN to address some security issue.
+
+In commit 1c90308e7a77 ("pagemap: hide physical addresses from
+non-privileged users"), the restriction is relieved to make
+/proc/PID/pagemap readable, but hide the physical addresses for
+non-privileged users.
+
+But the swap entries are readable for non-privileged users too. This
+has some security issues. For example, for page under migrating, the
+swap entry has physical address information. So, in this patch, the
+swap entries are hided for non-privileged users too.
+
+Link: http://lkml.kernel.org/r/20180508012745.7238-1-ying.huang@intel.com
+Fixes: 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")
+Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
+Suggested-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Cc: Andrei Vagin <avagin@openvz.org>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: Daniel Colascione <dancol@google.com>
+Cc: Zi Yan <zi.yan@cs.rutgers.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/task_mmu.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1259,8 +1259,9 @@ static pagemap_entry_t pte_to_pagemap_en
+ if (pte_swp_soft_dirty(pte))
+ flags |= PM_SOFT_DIRTY;
+ entry = pte_to_swp_entry(pte);
+- frame = swp_type(entry) |
+- (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
++ if (pm->show_pfn)
++ frame = swp_type(entry) |
++ (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+ flags |= PM_SWAP;
+ if (is_migration_entry(entry))
+ page = migration_entry_to_page(entry);
+@@ -1311,11 +1312,14 @@ static int pagemap_pmd_range(pmd_t *pmdp
+ #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
+ else if (is_swap_pmd(pmd)) {
+ swp_entry_t entry = pmd_to_swp_entry(pmd);
+- unsigned long offset = swp_offset(entry);
++ unsigned long offset;
+
+- offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
+- frame = swp_type(entry) |
+- (offset << MAX_SWAPFILES_SHIFT);
++ if (pm->show_pfn) {
++ offset = swp_offset(entry) +
++ ((addr & ~PMD_MASK) >> PAGE_SHIFT);
++ frame = swp_type(entry) |
++ (offset << MAX_SWAPFILES_SHIFT);
++ }
+ flags |= PM_SWAP;
+ if (pmd_swp_soft_dirty(pmd))
+ flags |= PM_SOFT_DIRTY;
+@@ -1333,10 +1337,12 @@ static int pagemap_pmd_range(pmd_t *pmdp
+ err = add_to_pagemap(addr, &pme, pm);
+ if (err)
+ break;
+- if (pm->show_pfn && (flags & PM_PRESENT))
+- frame++;
+- else if (flags & PM_SWAP)
+- frame += (1 << MAX_SWAPFILES_SHIFT);
++ if (pm->show_pfn) {
++ if (flags & PM_PRESENT)
++ frame++;
++ else if (flags & PM_SWAP)
++ frame += (1 << MAX_SWAPFILES_SHIFT);
++ }
+ }
+ spin_unlock(ptl);
+ return err;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 7 Jun 2018 17:05:17 -0700
+Subject: mm/slub.c: add __printf verification to slab_err()
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ]
+
+__printf is useful to verify format and arguments. Remove the following
+warning (with W=1):
+
+ mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format]
+
+Link: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/slub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -711,7 +711,7 @@ void object_err(struct kmem_cache *s, st
+ print_trailer(s, page, object);
+ }
+
+-static void slab_err(struct kmem_cache *s, struct page *page,
++static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,
+ const char *fmt, ...)
+ {
+ va_list args;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chintan Pandya <cpandya@codeaurora.org>
+Date: Thu, 7 Jun 2018 17:06:50 -0700
+Subject: mm: vmalloc: avoid racy handling of debugobjects in vunmap
+
+From: Chintan Pandya <cpandya@codeaurora.org>
+
+[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ]
+
+Currently, __vunmap flow is,
+ 1) Release the VM area
+ 2) Free the debug objects corresponding to that vm area.
+
+This leave some race window open.
+ 1) Release the VM area
+ 1.5) Some other client gets the same vm area
+ 1.6) This client allocates new debug objects on the same
+ vm area
+ 2) Free the debug objects corresponding to this vm area.
+
+Here, we actually free 'other' client's debug objects.
+
+Fix this by freeing the debug objects first and then releasing the VM
+area.
+
+Link: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org
+Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Byungchul Park <byungchul.park@lge.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Laura Abbott <labbott@redhat.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Wei Yang <richard.weiyang@gmail.com>
+Cc: Yisheng Xie <xieyisheng1@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/vmalloc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, i
+ addr))
+ return;
+
+- area = remove_vm_area(addr);
++ area = find_vmap_area((unsigned long)addr)->vm;
+ if (unlikely(!area)) {
+ WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+ addr);
+@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, i
+ debug_check_no_locks_freed(addr, get_vm_area_size(area));
+ debug_check_no_obj_freed(addr, get_vm_area_size(area));
+
++ remove_vm_area(addr);
+ if (deallocate_pages) {
+ int i;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Mon, 26 Mar 2018 17:26:25 +0800
+Subject: mmc: dw_mmc: update actual clock for mmc debugfs
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit ff178981bd5fd1667f373098740cb1c6d6efa1ba ]
+
+Respect the actual clock for mmc debugfs to help better debug
+the hardware.
+
+mmc_host mmc0: Bus speed (slot 0) = 135475200Hz (slot req 150000000Hz,
+actual 135475200HZ div = 0)
+
+cat /sys/kernel/debug/mmc0/ios
+clock: 150000000 Hz
+actual clock: 135475200 Hz
+vdd: 21 (3.3 ~ 3.4 V)
+bus mode: 2 (push-pull)
+chip select: 0 (don't care)
+power mode: 2 (on)
+bus width: 3 (8 bits)
+timing spec: 9 (mmc HS200)
+signal voltage: 0 (1.80 V)
+driver type: 0 (driver type B)
+
+Cc: Xiao Yao <xiaoyao@rock-chips.com>
+Cc: Ziyuan <xzy.xu@rock-chips.com>
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/dw_mmc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -1231,6 +1231,8 @@ static void dw_mci_setup_bus(struct dw_m
+ if (host->state == STATE_WAITING_CMD11_DONE)
+ sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH;
+
++ slot->mmc->actual_clock = 0;
++
+ if (!clock) {
+ mci_writel(host, CLKENA, 0);
+ mci_send_cmd(slot, sdmmc_cmd_bits, 0);
+@@ -1289,6 +1291,8 @@ static void dw_mci_setup_bus(struct dw_m
+
+ /* keep the last clock value that was requested from core */
+ slot->__clk_old = clock;
++ slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) :
++ host->bus_hz;
+ }
+
+ host->current_speed = clock;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Tobin C. Harding" <me@tobin.cc>
+Date: Mon, 26 Mar 2018 17:33:14 +1100
+Subject: mmc: pwrseq: Use kmalloc_array instead of stack VLA
+
+From: "Tobin C. Harding" <me@tobin.cc>
+
+[ Upstream commit 486e6661367b40f927aadbed73237693396cbf94 ]
+
+The use of stack Variable Length Arrays needs to be avoided, as they
+can be a vector for stack exhaustion, which can be both a runtime bug
+(kernel Oops) or a security flaw (overwriting memory beyond the
+stack). Also, in general, as code evolves it is easy to lose track of
+how big a VLA can get. Thus, we can end up having runtime failures
+that are hard to debug. As part of the directive[1] to remove all VLAs
+from the kernel, and build with -Wvla.
+
+Currently driver is using a VLA declared using the number of descriptors. This
+array is used to store integer values and is later used as an argument to
+`gpiod_set_array_value_cansleep()` This can be avoided by using
+`kmalloc_array()` to allocate memory for the array of integer values. Memory is
+free'd before return from function.
+
+>From the code it appears that it is safe to sleep so we can use GFP_KERNEL
+(based _cansleep() suffix of function `gpiod_set_array_value_cansleep()`.
+
+It can be expected that this patch will result in a small increase in overhead
+due to the use of `kmalloc_array()`
+
+[1] https://lkml.org/lkml/2018/3/7/621
+
+Signed-off-by: Tobin C. Harding <me@tobin.cc>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/pwrseq_simple.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/pwrseq_simple.c
++++ b/drivers/mmc/core/pwrseq_simple.c
+@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_
+ struct gpio_descs *reset_gpios = pwrseq->reset_gpios;
+
+ if (!IS_ERR(reset_gpios)) {
+- int i;
+- int values[reset_gpios->ndescs];
++ int i, *values;
++ int nvalues = reset_gpios->ndescs;
+
+- for (i = 0; i < reset_gpios->ndescs; i++)
++ values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL);
++ if (!values)
++ return;
++
++ for (i = 0; i < nvalues; i++)
+ values[i] = value;
+
+- gpiod_set_array_value_cansleep(
+- reset_gpios->ndescs, reset_gpios->desc, values);
++ gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values);
++ kfree(values);
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Fri, 27 Apr 2018 17:17:10 +0530
+Subject: mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 0ec4ee3c9b9755b28fd2e89b2ceaae6f15403368 ]
+
+sdhci_omap_config_iodelay_pinctrl_state() requires caps and caps2 to be
+initialized (speed mode capabilities like UHS/HS200) before it is
+invoked. While mmc_of_parse() initializes caps/caps2 if capabilities is
+populated in device tree, it will remain uninitialized for capabilities
+obtained from SDHCI_CAPABILITIES register.
+Fix sdhci_omap_config_iodelay_pinctrl_state() to be used even while
+getting the capabilities from SDHCI_CAPABILITIES register by invoking
+sdhci_setup_host() before sdhci_omap_config_iodelay_pinctrl_state().
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-omap.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -916,10 +916,6 @@ static int sdhci_omap_probe(struct platf
+ goto err_put_sync;
+ }
+
+- ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host);
+- if (ret)
+- goto err_put_sync;
+-
+ host->mmc_host_ops.get_ro = mmc_gpio_get_ro;
+ host->mmc_host_ops.start_signal_voltage_switch =
+ sdhci_omap_start_signal_voltage_switch;
+@@ -930,12 +926,23 @@ static int sdhci_omap_probe(struct platf
+ sdhci_read_caps(host);
+ host->caps |= SDHCI_CAN_DO_ADMA2;
+
+- ret = sdhci_add_host(host);
++ ret = sdhci_setup_host(host);
+ if (ret)
+ goto err_put_sync;
+
++ ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host);
++ if (ret)
++ goto err_cleanup_host;
++
++ ret = __sdhci_add_host(host);
++ if (ret)
++ goto err_cleanup_host;
++
+ return 0;
+
++err_cleanup_host:
++ sdhci_cleanup_host(host);
++
+ err_put_sync:
+ pm_runtime_put_sync(dev);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 25 Apr 2018 11:11:23 +0200
+Subject: mt76: add rcu locking around tx scheduling
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 1d868b70e06a2319fdda46cc46ec7c6762557543 ]
+
+Fixes a reported lockdep error in mac80211:
+
+[ 179.867321] =============================
+[ 179.871510] WARNING: suspicious RCU usage
+[ 179.875528] 4.14.32 #0 Not tainted
+[ 179.878924] -----------------------------
+[ 179.882981] backports-2017-11-01/net/mac80211/tx.c:594 suspicious rcu_dereference_check() usage!
+[ 179.891785]
+[ 179.891785] other info that might help us debug this:
+[ 179.891785]
+[ 179.899824]
+[ 179.899824] rcu_scheduler_active = 2, debug_locks = 1
+[ 179.906343] 2 locks held by ksoftirqd/0/7:
+[ 179.910479] #0: (&(&q->lock)->rlock){+.-.}, at: [<86b207a4>] mt76_dma_tx_cleanup+0x64/0x354 [mt76]
+[ 179.919734] #1: (&(&fq->lock)->rlock){+.-.}, at: [<87238410>] ieee80211_tx_dequeue+0x54/0xc3c [mac80211]
+[ 179.929890]
+[ 179.929890] stack backtrace:
+[ 179.934257] CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 4.14.32 #0
+[ 179.940421] Stack : 00000000 00000000 00000000 00000000 80e0fce2 00000036 00000000 00000000
+[ 179.948864] 87c3d24c 80696377 8061039c 00000000 00000007 00000001 87c5db78 6534689d
+[ 179.957306] 00000000 00000000 80e10000 87c5da74 00000001 0000015a 00000007 00000000
+[ 179.965748] 00000000 806a0000 000e4171 00000000 00000000 00000000 ffffffff 00000001
+[ 179.974189] 806c0000 8692b240 86b000d0 87316fe4 00000001 802c9a68 00000000 80700000
+[ 179.982632] ...
+[ 179.985104] Call Trace:
+[ 179.987582] [<80010a48>] show_stack+0x58/0x100
+[ 179.992040] [<804c2c58>] dump_stack+0xe8/0x170
+[ 179.996868] [<87234a04>] ieee80211_tx_h_select_key+0xa8/0x5b8 [mac80211]
+[ 180.004299] [<87238d44>] ieee80211_tx_dequeue+0x988/0xc3c [mac80211]
+[ 180.011048] [<86b230dc>] mt76_txq_schedule+0x110/0x3a4 [mt76]
+[ 180.016821] [<86b209d0>] mt76_dma_tx_cleanup+0x290/0x354 [mt76]
+[ 180.022777] [<86be2e60>] mt7603_tx_tasklet+0x40/0x6c [mt7603e]
+[ 180.028637] [<80037058>] tasklet_action+0x110/0x1ec
+[ 180.033532] [<804e1dac>] __do_softirq+0x164/0x35c
+[ 180.038235] [<80037174>] run_ksoftirqd+0x40/0x84
+[ 180.042870] [<800580c8>] smpboot_thread_fn+0x1a8/0x1d8
+[ 180.048023] [<800542e8>] kthread+0x130/0x144
+[ 180.052297] [<8000b1f8>] ret_from_kernel_thread+0x14/0x1c
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/tx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -422,12 +422,14 @@ void mt76_txq_schedule(struct mt76_dev *
+ {
+ int len;
+
++ rcu_read_lock();
+ do {
+ if (hwq->swq_queued >= 4 || list_empty(&hwq->swq))
+ break;
+
+ len = mt76_txq_schedule_list(dev, hwq);
+ } while (len > 0);
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL_GPL(mt76_txq_schedule);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Tue, 15 May 2018 12:08:14 +0200
+Subject: mt76x2: apply coverage class on slot time too
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit 0d45d3fe42efc76b6c4f5a62f8d110c7a2e6f83f ]
+
+According to 802.11-2007 17.3.8.6 (slot time), the slot time should
+be increased by 3 us * coverage class. Taking into account coverage
+class in slot time configuration allows to increase by an order of
+magnitude the throughput on a 4Km link in a noisy environment
+
+Tested-by: Luca Bisti <luca.bisti@gmail.com>
+Tested-by: Gaetano Catalli <gaetano.catalli@gmail.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Acked-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x2_init.c | 3 +++
+ drivers/net/wireless/mediatek/mt76/mt76x2_main.c | 3 +--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
+@@ -482,7 +482,10 @@ void mt76x2_set_tx_ackto(struct mt76x2_d
+ {
+ u8 ackto, sifs, slottime = dev->slottime;
+
++ /* As defined by IEEE 802.11-2007 17.3.8.6 */
+ slottime += 3 * dev->coverage_class;
++ mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
++ MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
+
+ sifs = mt76_get_field(dev, MT_XIFS_TIME_CFG,
+ MT_XIFS_TIME_CFG_OFDM_SIFS);
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_main.c
+@@ -247,8 +247,7 @@ mt76x2_bss_info_changed(struct ieee80211
+ int slottime = info->use_short_slot ? 9 : 20;
+
+ dev->slottime = slottime;
+- mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG,
+- MT_BKOFF_SLOT_CFG_SLOTTIME, slottime);
++ mt76x2_set_tx_ackto(dev);
+ }
+
+ mutex_unlock(&dev->mutex);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Wed, 2 May 2018 11:46:36 +0200
+Subject: mt76x2: fix avg_rssi estimation
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit c990affd5abce1f338ac52539e092dad04647fb6 ]
+
+Add leftover filter coefficients in IIR rssi estimation
+
+Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Acked-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x2_phy.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c
+@@ -492,8 +492,10 @@ mt76x2_phy_update_channel_gain(struct mt
+ u8 gain_delta;
+ int low_gain;
+
+- dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 + (rssi0 << 8);
+- dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 + (rssi1 << 8);
++ dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 +
++ (rssi0 << 8) / 16;
++ dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 +
++ (rssi1 << 8) / 16;
+ dev->cal.avg_rssi_all = (dev->cal.avg_rssi[0] +
+ dev->cal.avg_rssi[1]) / 512;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jane Wan <Jane.Wan@nokia.com>
+Date: Tue, 8 May 2018 14:19:53 -0700
+Subject: mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages
+
+From: Jane Wan <Jane.Wan@nokia.com>
+
+[ Upstream commit a75bbe71a27875fdc61cde1af6d799037cef6bed ]
+
+Per ONFI specification (Rev. 4.0), if the CRC of the first parameter page
+read is not valid, the host should read redundant parameter page copies.
+Fix FSL NAND driver to read the two redundant copies which are mandatory
+in the specification.
+
+Signed-off-by: Jane Wan <Jane.Wan@nokia.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/fsl_ifc_nand.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -342,9 +342,16 @@ static void fsl_ifc_cmdfunc(struct mtd_i
+
+ case NAND_CMD_READID:
+ case NAND_CMD_PARAM: {
++ /*
++ * For READID, read 8 bytes that are currently used.
++ * For PARAM, read all 3 copies of 256-bytes pages.
++ */
++ int len = 8;
+ int timing = IFC_FIR_OP_RB;
+- if (command == NAND_CMD_PARAM)
++ if (command == NAND_CMD_PARAM) {
+ timing = IFC_FIR_OP_RBCD;
++ len = 256 * 3;
++ }
+
+ ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
+ (IFC_FIR_OP_UA << IFC_NAND_FIR0_OP1_SHIFT) |
+@@ -354,12 +361,8 @@ static void fsl_ifc_cmdfunc(struct mtd_i
+ &ifc->ifc_nand.nand_fcr0);
+ ifc_out32(column, &ifc->ifc_nand.row3);
+
+- /*
+- * although currently it's 8 bytes for READID, we always read
+- * the maximum 256 bytes(for PARAM)
+- */
+- ifc_out32(256, &ifc->ifc_nand.nand_fbcr);
+- ifc_nand_ctrl->read_bytes = 256;
++ ifc_out32(len, &ifc->ifc_nand.nand_fbcr);
++ ifc_nand_ctrl->read_bytes = len;
+
+ set_addr(mtd, 0, 0, 0);
+ fsl_ifc_run_command(mtd);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Xinming Hu <huxm@marvell.com>
+Date: Fri, 18 May 2018 15:38:54 +0800
+Subject: mwifiex: correct histogram data with appropriate index
+
+From: Xinming Hu <huxm@marvell.com>
+
+[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ]
+
+Correct snr/nr/rssi data index to avoid possible buffer underflow.
+
+Signed-off-by: Xinming Hu <huxm@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/util.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifie
+ s8 nflr)
+ {
+ struct mwifiex_histogram_data *phist_data = priv->hist_data;
++ s8 nf = -nflr;
++ s8 rssi = snr - nflr;
+
+ atomic_inc(&phist_data->num_samples);
+ atomic_inc(&phist_data->rx_rate[rx_rate]);
+- atomic_inc(&phist_data->snr[snr]);
+- atomic_inc(&phist_data->noise_flr[128 + nflr]);
+- atomic_inc(&phist_data->sig_str[nflr - snr]);
++ atomic_inc(&phist_data->snr[snr + 128]);
++ atomic_inc(&phist_data->noise_flr[nf + 128]);
++ atomic_inc(&phist_data->sig_str[rssi + 128]);
+ }
+
+ /* function to reset histogram data during init/reset */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Ganapathi Bhat <gbhat@marvell.com>
+Date: Thu, 24 May 2018 19:18:27 +0530
+Subject: mwifiex: handle race during mwifiex_usb_disconnect
+
+From: Ganapathi Bhat <gbhat@marvell.com>
+
+[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ]
+
+Race condition is observed during rmmod of mwifiex_usb:
+
+1. The rmmod thread will call mwifiex_usb_disconnect(), download
+ SHUTDOWN command and do wait_event_interruptible_timeout(),
+ waiting for response.
+
+2. The main thread will handle the response and will do a
+ wake_up_interruptible(), unblocking rmmod thread.
+
+3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in
+ mwifiex_usb_free().
+
+4. The main thread will try to resubmit rx_cmd.urb in
+ mwifiex_usb_submit_rx_urb(), which is NULL.
+
+To fix, wait for main thread to complete before calling
+mwifiex_usb_free().
+
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc
+ MWIFIEX_FUNC_SHUTDOWN);
+ }
+
++ if (adapter->workqueue)
++ flush_workqueue(adapter->workqueue);
++
+ mwifiex_usb_free(card);
+
+ mwifiex_dbg(adapter, FATAL,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Michal Vokáč" <vokac.m@gmail.com>
+Date: Wed, 23 May 2018 08:20:19 +0200
+Subject: net: dsa: qca8k: Add support for QCA8334 switch
+
+From: "Michal Vokáč" <vokac.m@gmail.com>
+
+[ Upstream commit 64cf81675a1f64c1b311e4611dd3b6a961607612 ]
+
+Add support for the four-port variant of the Qualcomm QCA833x switch.
+
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/qca8k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -933,6 +933,7 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+ qca8k_suspend, qca8k_resume);
+
+ static const struct of_device_id qca8k_of_match[] = {
++ { .compatible = "qca,qca8334" },
+ { .compatible = "qca,qca8337" },
+ { /* sentinel */ },
+ };
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Tue, 15 May 2018 18:37:25 -0500
+Subject: net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit c6213eb1aee308e67377fd1890d84f7284caf531 ]
+
+This fixes klockworks warnings: Pointer 'dev' returned from call to
+function 'bus_find_device' at line 179 may be NULL and will be dereferenced
+at line 181.
+
+ cpsw-phy-sel.c:179: 'dev' is assigned the return value from function 'bus_find_device'.
+ bus.c:342: 'bus_find_device' explicitly returns a NULL value.
+ cpsw-phy-sel.c:181: 'dev' is dereferenced by passing argument 1 to function 'dev_get_drvdata'.
+ device.h:1024: 'dev' is passed to function 'dev_get_drvdata'.
+ device.h:1026: 'dev' is explicitly dereferenced.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+[nsekhar@ti.com: add an error message, fix return path]
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw-phy-sel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
+@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, ph
+ }
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
+- of_node_put(node);
++ if (!dev) {
++ dev_err(dev, "unable to find platform device for %pOF\n", node);
++ goto out;
++ }
++
+ priv = dev_get_drvdata(dev);
+
+ priv->cpsw_phy_sel(priv, phy_mode, slave);
+
+ put_device(dev);
++out:
++ of_node_put(node);
+ }
+ EXPORT_SYMBOL_GPL(cpsw_phy_sel);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Sat, 19 May 2018 16:53:23 +0100
+Subject: net: hns3: Fix for CMDQ and Misc. interrupt init order problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit eddf04626d1d6d0bcd01ac6a287e49f5ddb90a26 ]
+
+When vf module is loading, the cmd queue initialization should
+happen before misc interrupt initialization, otherwise the misc
+interrupt handle will cause using uninitialized cmd queue problem.
+There is also the same issue when vf module is unloading.
+
+This patch fixes it by adjusting the location of some function.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 16 +++++++-------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1631,6 +1631,10 @@ static int hclgevf_init_hdev(struct hclg
+
+ hclgevf_state_init(hdev);
+
++ ret = hclgevf_cmd_init(hdev);
++ if (ret)
++ goto err_cmd_init;
++
+ ret = hclgevf_misc_irq_init(hdev);
+ if (ret) {
+ dev_err(&pdev->dev, "failed(%d) to init Misc IRQ(vector0)\n",
+@@ -1638,10 +1642,6 @@ static int hclgevf_init_hdev(struct hclg
+ goto err_misc_irq_init;
+ }
+
+- ret = hclgevf_cmd_init(hdev);
+- if (ret)
+- goto err_cmd_init;
+-
+ ret = hclgevf_configure(hdev);
+ if (ret) {
+ dev_err(&pdev->dev, "failed(%d) to fetch configuration\n", ret);
+@@ -1689,10 +1689,10 @@ static int hclgevf_init_hdev(struct hclg
+ return 0;
+
+ err_config:
+- hclgevf_cmd_uninit(hdev);
+-err_cmd_init:
+ hclgevf_misc_irq_uninit(hdev);
+ err_misc_irq_init:
++ hclgevf_cmd_uninit(hdev);
++err_cmd_init:
+ hclgevf_state_uninit(hdev);
+ hclgevf_uninit_msi(hdev);
+ err_irq_init:
+@@ -1702,9 +1702,9 @@ err_irq_init:
+
+ static void hclgevf_uninit_hdev(struct hclgevf_dev *hdev)
+ {
+- hclgevf_cmd_uninit(hdev);
+- hclgevf_misc_irq_uninit(hdev);
+ hclgevf_state_uninit(hdev);
++ hclgevf_misc_irq_uninit(hdev);
++ hclgevf_cmd_uninit(hdev);
+ hclgevf_uninit_msi(hdev);
+ hclgevf_pci_uninit(hdev);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Tue, 15 May 2018 19:20:12 +0100
+Subject: net: hns3: Fix for fiber link up problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit be8d8cdb8ebf3afd841c109dd035fd789a0c7d53 ]
+
+When hclge_ae_start is called, hdev->hw.mac.link may be set
+to one after up/down multi-times, which does not correspond to
+the link state of netdev when the netdev is up.
+
+This fixes it by setting hdev->hw.mac.link to zero when
+hclge_ae_start is called.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3783,6 +3783,7 @@ static int hclge_ae_start(struct hnae3_h
+ hclge_cfg_mac_mode(hdev, true);
+ clear_bit(HCLGE_STATE_DOWN, &hdev->state);
+ mod_timer(&hdev->service_timer, jiffies + HZ);
++ hdev->hw.mac.link = 0;
+
+ /* reset tqp stats */
+ hclge_reset_tqp_stats(handle);
+@@ -3819,7 +3820,6 @@ static void hclge_ae_stop(struct hnae3_h
+
+ /* reset tqp stats */
+ hclge_reset_tqp_stats(handle);
+- hclge_update_link_status(hdev);
+ }
+
+ static int hclge_get_mac_vlan_cmd_status(struct hclge_vport *vport,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Xi Wang <wangxi11@huawei.com>
+Date: Sat, 19 May 2018 16:53:19 +0100
+Subject: net: hns3: Fix for hns3 module is loaded multiple times problem
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 3c7624d8fc0b893b644b945ab904c629ebc9611e ]
+
+If the hns3 driver has been built into kernel and then loaded with
+the same driver which built as KLM, it may trigger an error like
+below:
+
+[ 20.009555] hns3: Hisilicon Ethernet Network Driver for Hip08 Family - version
+[ 20.016789] hns3: Copyright (c) 2017 Huawei Corporation.
+[ 20.022100] Error: Driver 'hns3' is already registered, aborting...
+[ 23.517397] Unable to handle kernel NULL pointer dereference at virtual address 00000000
+...
+[ 23.691583] Process insmod (pid: 1982, stack limit = 0x00000000cd5f21cb)
+[ 23.698270] Call trace:
+[ 23.700705] __list_del_entry_valid+0x2c/0xd8
+[ 23.705049] hnae3_unregister_client+0x68/0xa8
+[ 23.709487] hns3_init_module+0x98/0x1000 [hns3]
+[ 23.714093] do_one_initcall+0x5c/0x170
+[ 23.717918] do_init_module+0x64/0x1f4
+[ 23.721654] load_module+0x1d14/0x24b0
+[ 23.725390] SyS_init_module+0x158/0x208
+[ 23.729300] el0_svc_naked+0x30/0x34
+
+This patch fixes it by adding module version info.
+
+Fixes: 38caee9d3ee8 ("net: hns3: Add support of the HNAE3 framework")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +-
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +-
+ 6 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -283,3 +283,4 @@ EXPORT_SYMBOL(hnae3_unregister_ae_dev);
+ MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("HNAE3(Hisilicon Network Acceleration Engine) Framework");
++MODULE_VERSION(HNAE3_MOD_VERSION);
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -36,6 +36,8 @@
+ #include <linux/pci.h>
+ #include <linux/types.h>
+
++#define HNAE3_MOD_VERSION "1.0"
++
+ /* Device IDs */
+ #define HNAE3_DEV_ID_GE 0xA220
+ #define HNAE3_DEV_ID_25GE 0xA221
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3631,3 +3631,4 @@ MODULE_DESCRIPTION("HNS3: Hisilicon Ethe
+ MODULE_AUTHOR("Huawei Tech. Co., Ltd.");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("pci:hns-nic");
++MODULE_VERSION(HNS3_MOD_VERSION);
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+@@ -14,6 +14,8 @@
+
+ #include "hnae3.h"
+
++#define HNS3_MOD_VERSION "1.0"
++
+ extern const char hns3_driver_version[];
+
+ enum hns3_nic_state {
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -15,7 +15,7 @@
+ #include "hclge_cmd.h"
+ #include "hnae3.h"
+
+-#define HCLGE_MOD_VERSION "v1.0"
++#define HCLGE_MOD_VERSION "1.0"
+ #define HCLGE_DRIVER_NAME "hclge"
+
+ #define HCLGE_INVALID_VPORT 0xffff
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
+@@ -9,7 +9,7 @@
+ #include "hclgevf_cmd.h"
+ #include "hnae3.h"
+
+-#define HCLGEVF_MOD_VERSION "v1.0"
++#define HCLGEVF_MOD_VERSION "1.0"
+ #define HCLGEVF_DRIVER_NAME "hclgevf"
+
+ #define HCLGEVF_ROCEE_VECTOR_NUM 0
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Fri, 1 Jun 2018 17:52:07 +0100
+Subject: net: hns3: Fix for phy not link up problem after resetting
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 9617f66867b09b326cc932416be2431c5b91c8d8 ]
+
+When resetting, phy_state_machine may be accessing the phy through
+firmware if the phy is not stopped or disconnected, which will
+cause firemware timeout problem because the firmware is busy
+processing the reset request.
+
+This patch fixes it by disabling the phy when resetting.
+
+Fixes: b940aeae0ed6 ("net: hns3: never send command queue message to IMP when reset")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3787,9 +3787,6 @@ static int hclge_ae_start(struct hnae3_h
+ /* reset tqp stats */
+ hclge_reset_tqp_stats(handle);
+
+- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
+- return 0;
+-
+ ret = hclge_mac_start_phy(hdev);
+ if (ret)
+ return ret;
+@@ -3806,8 +3803,10 @@ static void hclge_ae_stop(struct hnae3_h
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
+
+- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
++ if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
++ hclge_mac_stop_phy(hdev);
+ return;
++ }
+
+ for (i = 0; i < vport->alloc_tqps; i++)
+ hclge_tqp_enable(hdev, i, 0, false);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Fri, 1 Jun 2018 17:52:05 +0100
+Subject: net: hns3: Fix for service_task not running problem after resetting
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit f5be79673fc4c925708c99ec37d77e0a2c3cd30b ]
+
+When hclge_ae_stop is called during resetting, it will cancel the
+service_task by calling cancel_work_sync, which may cause the
+service_task to exit without clearing HCLGE_STATE_SERVICE_SCHED
+bit. If this happens, the service_task will never run again.
+
+This patch fixes this problem by clearing it after calling
+cancel_work_sync in hclge_ae_stop.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3802,6 +3802,7 @@ static void hclge_ae_stop(struct hnae3_h
+
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
++ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
+
+ if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) {
+ hclge_mac_stop_phy(hdev);
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1323,6 +1323,7 @@ static void hclgevf_ae_stop(struct hnae3
+ hclgevf_reset_tqp_stats(handle);
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
++ clear_bit(HCLGEVF_STATE_SERVICE_SCHED, &hdev->state);
+ hclgevf_update_link_status(hdev, 0);
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Xi Wang <wangxi11@huawei.com>
+Date: Wed, 6 Jun 2018 14:07:51 +0100
+Subject: net: hns3: Fix for VF mailbox cannot receiving PF response
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 1819e40908ee76c7219287224c22c772556c927e ]
+
+When the VF frequently switches the CMDQ interrupt, if the CMDQ_SRC is not
+cleared, the VF will not receive the new PF response after the interrupt
+is re-enabled, the corresponding log is as follows:
+
+[ 317.482222] hns3 0000:00:03.0: VF could not get mbx resp(=0) from PF
+in 500 tries
+[ 317.483137] hns3 0000:00:03.0: VF request to get tqp info from PF
+failed -5
+
+This patch fixes this problem by clearing CMDQ_SRC before enabling
+interrupt and syncing pending IRQ handlers after disabling interrupt.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1441,6 +1441,8 @@ static int hclgevf_misc_irq_init(struct
+ return ret;
+ }
+
++ hclgevf_clear_event_cause(hdev, 0);
++
+ /* enable misc. vector(vector 0) */
+ hclgevf_enable_vector(&hdev->misc_vector, true);
+
+@@ -1451,6 +1453,7 @@ static void hclgevf_misc_irq_uninit(stru
+ {
+ /* disable misc vector(vector 0) */
+ hclgevf_enable_vector(&hdev->misc_vector, false);
++ synchronize_irq(hdev->misc_vector.vector_irq);
+ free_irq(hdev->misc_vector.vector_irq, hdev);
+ hclgevf_free_vector(hdev, 0);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Xi Wang <wangxi11@huawei.com>
+Date: Sat, 19 May 2018 16:53:18 +0100
+Subject: net: hns3: Fix the missing client list node initialization
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 13562d1f5e2fbe2cf33b23a00abca3f71264c4ac ]
+
+This patch fixes the missing initialization of the client list node
+in the hnae3_register_client() function.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3602,6 +3602,8 @@ static int __init hns3_init_module(void)
+
+ client.ops = &client_ops;
+
++ INIT_LIST_HEAD(&client.node);
++
+ ret = hnae3_register_client(&client);
+ if (ret)
+ return ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Lijun Ou <oulijun@huawei.com>
+Date: Fri, 25 May 2018 19:43:07 +0100
+Subject: net: hns3: Fixes initalization of RoCE handle and makes it conditional
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 544a7bcd5cc74734003cf7f12502b26cebfed19f ]
+
+When register a RoCE client with hnae3vf device, it needs to judge
+the device whether support RoCE vf function. Otherwise, it will
+lead to calltrace when RoCE is not support vf function and remove
+roce device.
+
+The calltrace as follows:
+[ 93.156614] Unable to handle kernel NULL pointer dereference at virtual address 00000015
+ <SNIP>
+[ 93.278784] Call trace:
+[ 93.278788] hnae3_match_n_instantiate+0x24/0xd8 [hnae3]
+[ 93.278790] hnae3_register_client+0xcc/0x150 [hnae3]
+[ 93.278801] hns_roce_hw_v2_init+0x18/0x1000 [hns_roce_hw_v2]
+[ 93.278805] do_one_initcall+0x58/0x160
+[ 93.278807] do_init_module+0x64/0x1d8
+[ 93.278809] load_module+0x135c/0x15c8
+[ 93.278811] SyS_finit_module+0x100/0x118
+[ 93.278816] __sys_trace_return+0x0/0x4
+[ 93.278827] Code: aa0003f5 12001c56 aa1e03e0 d503201f (b9402660)
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Reported-by: Xinwei Kong <kong.kongxinwei@hisilicon.com>
+Reported-by: Zhou Wang <wangzhou1@hisilicon.com>
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Zhou Wang <wangzhou1@hisilicon.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1493,10 +1493,12 @@ static int hclgevf_init_instance(struct
+ return ret;
+ break;
+ case HNAE3_CLIENT_ROCE:
+- hdev->roce_client = client;
+- hdev->roce.client = client;
++ if (hnae3_dev_roce_supported(hdev)) {
++ hdev->roce_client = client;
++ hdev->roce.client = client;
++ }
+
+- if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
++ if (hdev->roce_client && hdev->nic_client) {
+ ret = hclgevf_init_roce_base_info(hdev);
+ if (ret)
+ return ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Fuyun Liang <liangfuyun1@huawei.com>
+Date: Fri, 25 May 2018 19:43:02 +0100
+Subject: net: hns3: Fixes the init of the VALID BD info in the descriptor
+
+From: Fuyun Liang <liangfuyun1@huawei.com>
+
+[ Upstream commit 7d0b130cbbfa4651cc1ab9268a2956c1b9d82ff9 ]
+
+RX Buffer Descriptor contains a VALID bit which indicates if the BD
+is valid and has some data. This field is set by HNS3 hardware to
+intimate the driver of some valid data present in the BD. nd should
+be reset by the driver when BD is being used again. In the existing
+code this bit was not being (re-)initialized properly and hence was
+causing problems.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1836,6 +1836,7 @@ static void hns3_replace_buffer(struct h
+ hns3_unmap_buffer(ring, &ring->desc_cb[i]);
+ ring->desc_cb[i] = *res_cb;
+ ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
++ ring->desc[i].rx.bd_base_info = 0;
+ }
+
+ static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i)
+@@ -1843,6 +1844,7 @@ static void hns3_reuse_buffer(struct hns
+ ring->desc_cb[i].reuse_flag = 0;
+ ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma
+ + ring->desc_cb[i].page_offset);
++ ring->desc[i].rx.bd_base_info = 0;
+ }
+
+ static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Tue, 1 May 2018 19:55:59 +0100
+Subject: net: hns3: Fixes the out of bounds access in hclge_map_tqp
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 38e62046d4c95272e2fb001d2d72baf48fa090e9 ]
+
+This patch fixes the handling of the check when number of vports
+are detected to be more than available TPQs. Current handling causes
+an out of bounds access in hclge_map_tqp().
+
+Fixes: 7df7dad633e2 ("net: hns3: Refactor the mapping of tqp to vport")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1459,8 +1459,11 @@ static int hclge_alloc_vport(struct hclg
+ /* We need to alloc a vport for main NIC of PF */
+ num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1;
+
+- if (hdev->num_tqps < num_vport)
+- num_vport = hdev->num_tqps;
++ if (hdev->num_tqps < num_vport) {
++ dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)",
++ hdev->num_tqps, num_vport);
++ return -EINVAL;
++ }
+
+ /* Alloc the same number of TQPs for every vport */
+ tqp_per_vport = hdev->num_tqps / num_vport;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Fri, 18 May 2018 09:33:39 +0200
+Subject: net: mvpp2: Add missing VLAN tag detection
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit 62c8a069b510d905039abd4097434f190a316941 ]
+
+Marvell PPv2 Header Parser sets some bits in the 'result_info' field in
+each lookup iteration, to identify different packet attributes such as
+DSA / VLAN tag, protocol infos, etc. This is used in further
+classification stages in the controller.
+
+It's the DSA tag detection entry that is in charge of detecting when there
+is a single VLAN tag.
+
+This commits adds the missing update of the result_info in this case.
+
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -2109,6 +2109,9 @@ static void mvpp2_prs_dsa_tag_set(struct
+ mvpp2_prs_sram_ai_update(&pe, 0,
+ MVPP2_PRS_SRAM_AI_MASK);
+
++ /* Set result info bits to 'single vlan' */
++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_VLAN_SINGLE,
++ MVPP2_PRS_RI_VLAN_MASK);
+ /* If packet is tagged continue check vid filtering */
+ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_VID);
+ } else {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 10 May 2018 13:17:30 -0700
+Subject: net: phy: phylink: Release link GPIO
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit daab3349ad1a69663ccad278ed71d55974d104b4 ]
+
+We are not releasing the link GPIO descriptor with gpiod_put() which results in
+subsequent probing to get -EBUSY when calling fwnode_get_named_gpiod(). Fix this
+by doing the release in phylink_destroy().
+
+Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phylink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -612,6 +612,8 @@ void phylink_destroy(struct phylink *pl)
+ {
+ if (pl->sfp_bus)
+ sfp_unregister_upstream(pl->sfp_bus);
++ if (!IS_ERR(pl->link_gpio))
++ gpiod_put(pl->link_gpio);
+
+ cancel_work_sync(&pl->resolve);
+ kfree(pl);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Fri, 4 May 2018 17:21:03 +0200
+Subject: net: phy: sfp: handle cases where neither BR, min nor BR, max is given
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 2b999ba899059eed00a03d029894a62486e7e2bc ]
+
+When computing the bitrate using values read from an SFP module EEPROM,
+we use the nominal BR plus BR,min and BR,max to determine the
+boundaries. But in some cases BR,min and BR,max aren't provided, which
+led the SFP code to end up having the nominal value for both the minimum
+and maximum bitrate values. When using a passive cable, the nominal
+value should be used as the maximum one, and there is no minimum one
+so we should use 0.
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/sfp-bus.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -132,6 +132,13 @@ void sfp_parse_support(struct sfp_bus *b
+ br_max = br_nom + br_nom * id->ext.br_min / 100;
+ br_min = br_nom - br_nom * id->ext.br_min / 100;
+ }
++
++ /* When using passive cables, in case neither BR,min nor BR,max
++ * are specified, set br_min to 0 as the nominal value is then
++ * used as the maximum.
++ */
++ if (br_min == br_max && id->base.sfp_ct_passive)
++ br_min = 0;
+ }
+
+ /* Set ethtool support from the compliance fields. */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Masahisa KOJIMA <masahisa.kojima@linaro.org>
+Date: Mon, 16 Apr 2018 13:09:59 +0530
+Subject: net: socionext: reset hardware in ndo_stop
+
+From: Masahisa KOJIMA <masahisa.kojima@linaro.org>
+
+[ Upstream commit 9a00b697ce31e38c670a3042cf9f1e9cf28dabb5 ]
+
+When the interface is down, head/tail of the descriptor
+ring address is set to 0 in netsec_netdev_stop().
+But netsec hardware still keeps the previous descriptor
+ring address, so there is inconsistency between driver
+and hardware after interface is up at a later time.
+To address this inconsistency, add netsec_reset_hardware()
+when the interface is down.
+
+In addition, to minimize the reset process,
+add flag to decide whether driver loads the netsec microcode.
+Even if driver resets the netsec hardware, netsec microcode
+keeps resident on RAM, so it is ok we only load the microcode
+at initialization.
+
+This patch is critical for installation over network.
+
+Signed-off-by: Masahisa KOJIMA <masahisa.kojima@linaro.org>
+Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/socionext/netsec.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -1057,7 +1057,8 @@ static int netsec_netdev_load_microcode(
+ return 0;
+ }
+
+-static int netsec_reset_hardware(struct netsec_priv *priv)
++static int netsec_reset_hardware(struct netsec_priv *priv,
++ bool load_ucode)
+ {
+ u32 value;
+ int err;
+@@ -1102,11 +1103,14 @@ static int netsec_reset_hardware(struct
+ netsec_write(priv, NETSEC_REG_NRM_RX_CONFIG,
+ 1 << NETSEC_REG_DESC_ENDIAN);
+
+- err = netsec_netdev_load_microcode(priv);
+- if (err) {
+- netif_err(priv, probe, priv->ndev,
+- "%s: failed to load microcode (%d)\n", __func__, err);
+- return err;
++ if (load_ucode) {
++ err = netsec_netdev_load_microcode(priv);
++ if (err) {
++ netif_err(priv, probe, priv->ndev,
++ "%s: failed to load microcode (%d)\n",
++ __func__, err);
++ return err;
++ }
+ }
+
+ /* start DMA engines */
+@@ -1328,6 +1332,7 @@ err1:
+
+ static int netsec_netdev_stop(struct net_device *ndev)
+ {
++ int ret;
+ struct netsec_priv *priv = netdev_priv(ndev);
+
+ netif_stop_queue(priv->ndev);
+@@ -1343,12 +1348,14 @@ static int netsec_netdev_stop(struct net
+ netsec_uninit_pkt_dring(priv, NETSEC_RING_TX);
+ netsec_uninit_pkt_dring(priv, NETSEC_RING_RX);
+
++ ret = netsec_reset_hardware(priv, false);
++
+ phy_stop(ndev->phydev);
+ phy_disconnect(ndev->phydev);
+
+ pm_runtime_put_sync(priv->dev);
+
+- return 0;
++ return ret;
+ }
+
+ static int netsec_netdev_init(struct net_device *ndev)
+@@ -1364,7 +1371,7 @@ static int netsec_netdev_init(struct net
+ if (ret)
+ goto err1;
+
+- ret = netsec_reset_hardware(priv);
++ ret = netsec_reset_hardware(priv, true);
+ if (ret)
+ goto err2;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Florent Fourcot <florent.fourcot@wifirst.fr>
+Date: Mon, 4 Jun 2018 16:51:19 +0200
+Subject: netfilter: ipset: forbid family for hash:mac sets
+
+From: Florent Fourcot <florent.fourcot@wifirst.fr>
+
+[ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ]
+
+Userspace `ipset` command forbids family option for hash:mac type:
+
+ipset create test hash:mac family inet4
+ipset v6.30: Unknown argument: `family'
+
+However, this check is not done in kernel itself. When someone use
+external netlink applications (pyroute2 python library for example), one
+can create hash:mac with invalid family and inconsistant results from
+userspace (`ipset` command cannot read set content anymore).
+
+This patch enforce the logic in kernel, and forbids insertion of
+hash:mac with a family set.
+
+Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
+impact on other hash:* sets
+
+Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
+Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *
+ pr_debug("Create set %s with family %s\n",
+ set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");
+
+-#ifndef IP_SET_PROTO_UNDEF
++#ifdef IP_SET_PROTO_UNDEF
++ if (set->family != NFPROTO_UNSPEC)
++ return -IPSET_ERR_INVALID_FAMILY;
++#else
+ if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
+ return -IPSET_ERR_INVALID_FAMILY;
+ #endif
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Thu, 31 May 2018 18:45:21 +0200
+Subject: netfilter: ipset: List timing out entries with "timeout 1" instead of zero
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ]
+
+When listing sets with timeout support, there's a probability that
+just timing out entries with "0" timeout value is listed/saved.
+However when restoring the saved list, the zero timeout value means
+permanent elelements.
+
+The new behaviour is that timing out entries are listed with "timeout 1"
+instead of zero.
+
+Fixes netfilter bugzilla #1258.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/netfilter/ipset/ip_set_timeout.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netfilter/ipset/ip_set_timeout.h
++++ b/include/linux/netfilter/ipset/ip_set_timeout.h
+@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeou
+ static inline u32
+ ip_set_timeout_get(const unsigned long *timeout)
+ {
+- return *timeout == IPSET_ELEM_PERMANENT ? 0 :
+- jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
++ u32 t;
++
++ if (*timeout == IPSET_ELEM_PERMANENT)
++ return 0;
++
++ t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
++ /* Zero value in userspace means no timeout */
++ return t == 0 ? 1 : t;
+ }
+
+ #endif /* __KERNEL__ */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexey Kodanev <alexey.kodanev@oracle.com>
+Date: Thu, 31 May 2018 19:53:33 +0300
+Subject: netfilter: nf_tables: check msg_type before nft_trans_set(trans)
+
+From: Alexey Kodanev <alexey.kodanev@oracle.com>
+
+[ Upstream commit 9c7f96fd77b0dbe1fe7ed1f9c462c45dc48a1076 ]
+
+The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before
+using nft_trans_set(trans). Otherwise we can get out of bounds read.
+
+For example, KASAN reported the one when running 0001_cache_handling_0 nft
+test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE:
+
+[75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables]
+[75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356
+...
+[75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G E 4.17.0-rc7.1.x86_64 #1
+[75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2
+[75517.618129] Call Trace:
+[75517.648821] dump_stack+0xd1/0x13b
+[75517.691040] ? show_regs_print_info+0x5/0x5
+[75517.742519] ? kmsg_dump_rewind_nolock+0xf5/0xf5
+[75517.799300] ? lock_acquire+0x143/0x310
+[75517.846738] print_address_description+0x85/0x3a0
+[75517.904547] kasan_report+0x18d/0x4b0
+[75517.949892] ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
+[75518.019153] ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
+[75518.088420] ? nft_set_lookup_global+0x22f/0x270 [nf_tables]
+[75518.157689] nft_set_lookup_global+0x22f/0x270 [nf_tables]
+[75518.224869] nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables]
+[75518.291024] ? nft_add_set_elem+0x2280/0x2280 [nf_tables]
+[75518.357154] ? nla_parse+0x1a5/0x300
+[75518.401455] ? kasan_kmalloc+0xa6/0xd0
+[75518.447842] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
+[75518.507743] ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink]
+[75518.569745] ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink]
+[75518.631711] ? lock_acquire+0x143/0x310
+[75518.679133] ? netlink_deliver_tap+0x9b/0x1070
+[75518.733840] ? kasan_unpoison_shadow+0x31/0x40
+[75518.788542] netlink_unicast+0x45d/0x680
+[75518.837111] ? __isolate_free_page+0x890/0x890
+[75518.891913] ? netlink_attachskb+0x6b0/0x6b0
+[75518.944542] netlink_sendmsg+0x6fa/0xd30
+[75518.993107] ? netlink_unicast+0x680/0x680
+[75519.043758] ? netlink_unicast+0x680/0x680
+[75519.094402] sock_sendmsg+0xd9/0x160
+[75519.138810] ___sys_sendmsg+0x64d/0x980
+[75519.186234] ? copy_msghdr_from_user+0x350/0x350
+[75519.243118] ? lock_downgrade+0x650/0x650
+[75519.292738] ? do_raw_spin_unlock+0x5d/0x250
+[75519.345456] ? _raw_spin_unlock+0x24/0x30
+[75519.395065] ? __handle_mm_fault+0xbde/0x3410
+[75519.448830] ? sock_setsockopt+0x3d2/0x1940
+[75519.500516] ? __lock_acquire.isra.25+0xdc/0x19d0
+[75519.558448] ? lock_downgrade+0x650/0x650
+[75519.608057] ? __audit_syscall_entry+0x317/0x720
+[75519.664960] ? __fget_light+0x58/0x250
+[75519.711325] ? __sys_sendmsg+0xde/0x170
+[75519.758850] __sys_sendmsg+0xde/0x170
+[75519.804193] ? __ia32_sys_shutdown+0x90/0x90
+[75519.856725] ? syscall_trace_enter+0x897/0x10e0
+[75519.912354] ? trace_event_raw_event_sys_enter+0x920/0x920
+[75519.979432] ? __audit_syscall_entry+0x720/0x720
+[75520.036118] do_syscall_64+0xa3/0x3d0
+[75520.081248] ? prepare_exit_to_usermode+0x47/0x1d0
+[75520.139904] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[75520.201680] RIP: 0033:0x7fc153320ba0
+[75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0
+[75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003
+[75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090
+[75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660
+[75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001
+
+[75520.790946] Allocated by task 7356:
+[75520.833994] kasan_kmalloc+0xa6/0xd0
+[75520.878088] __kmalloc+0x189/0x450
+[75520.920107] nft_trans_alloc_gfp+0x20/0x190 [nf_tables]
+[75520.983961] nf_tables_newtable+0xcd0/0x1bd0 [nf_tables]
+[75521.048857] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink]
+[75521.108655] netlink_unicast+0x45d/0x680
+[75521.157013] netlink_sendmsg+0x6fa/0xd30
+[75521.205271] sock_sendmsg+0xd9/0x160
+[75521.249365] ___sys_sendmsg+0x64d/0x980
+[75521.296686] __sys_sendmsg+0xde/0x170
+[75521.341822] do_syscall_64+0xa3/0x3d0
+[75521.386957] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[75521.467867] Freed by task 23454:
+[75521.507804] __kasan_slab_free+0x132/0x180
+[75521.558137] kfree+0x14d/0x4d0
+[75521.596005] free_rt_sched_group+0x153/0x280
+[75521.648410] sched_autogroup_create_attach+0x19a/0x520
+[75521.711330] ksys_setsid+0x2ba/0x400
+[75521.755529] __ia32_sys_setsid+0xa/0x10
+[75521.802850] do_syscall_64+0xa3/0x3d0
+[75521.848090] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[75521.929000] The buggy address belongs to the object at ffff881bdb643f80
+ which belongs to the cache kmalloc-96 of size 96
+[75522.079797] The buggy address is located 72 bytes inside of
+ 96-byte region [ffff881bdb643f80, ffff881bdb643fe0)
+[75522.221234] The buggy address belongs to the page:
+[75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0
+[75522.377443] flags: 0x2fffff80000100(slab)
+[75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020
+[75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000
+[75522.615601] page dumped because: kasan: bad access detected
+
+Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets")
+Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2728,12 +2728,13 @@ static struct nft_set *nf_tables_set_loo
+ u32 id = ntohl(nla_get_be32(nla));
+
+ list_for_each_entry(trans, &net->nft.commit_list, list) {
+- struct nft_set *set = nft_trans_set(trans);
++ if (trans->msg_type == NFT_MSG_NEWSET) {
++ struct nft_set *set = nft_trans_set(trans);
+
+- if (trans->msg_type == NFT_MSG_NEWSET &&
+- id == nft_trans_set_id(trans) &&
+- nft_active_genmask(set, genmask))
+- return set;
++ if (id == nft_trans_set_id(trans) &&
++ nft_active_genmask(set, genmask))
++ return set;
++ }
+ }
+ return ERR_PTR(-ENOENT);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 29 May 2018 11:15:49 -0400
+Subject: NFS: Fix up nfs_post_op_update_inode() to force ctime updates
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d554168f87a55b35b7c59921a0dc45b6ba17d08d ]
+
+We do not want to ignore ctime updates that originate from functions
+such as link().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1629,7 +1629,8 @@ int nfs_post_op_update_inode(struct inod
+ nfs_fattr_set_barrier(fattr);
+ status = nfs_post_op_update_inode_locked(inode, fattr,
+ NFS_INO_INVALID_CHANGE
+- | NFS_INO_INVALID_CTIME);
++ | NFS_INO_INVALID_CTIME
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+
+ return status;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Andrew Elble <aweits@rit.edu>
+Date: Wed, 18 Apr 2018 17:04:37 -0400
+Subject: nfsd: fix error handling in nfs4_set_delegation()
+
+From: Andrew Elble <aweits@rit.edu>
+
+[ Upstream commit 692ad280bff3e81721ab138b9455948ab5289acf ]
+
+I noticed a memory corruption crash in nfsd in
+4.17-rc1. This patch corrects the issue.
+
+Fix to return error if the delegation couldn't be hashed or there was
+a recall in progress. Use the existing error path instead of
+destroy_delegation() for readability.
+
+Signed-off-by: Andrew Elble <aweits@rit.edu>
+Fixes: 353601e7d323c ("nfsd: create a separate lease for each delegation")
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfs4state.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4378,8 +4378,11 @@ nfs4_set_delegation(struct nfs4_client *
+ spin_unlock(&state_lock);
+
+ if (status)
+- destroy_unhashed_deleg(dp);
++ goto out_unlock;
++
+ return dp;
++out_unlock:
++ vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
+ out_clnt_odstate:
+ put_clnt_odstate(dp->dl_clnt_odstate);
+ out_stid:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Scott Mayhew <smayhew@redhat.com>
+Date: Fri, 8 Jun 2018 16:31:46 -0400
+Subject: nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ]
+
+When running a fuzz tester against a KASAN-enabled kernel, the following
+splat periodically occurs.
+
+The problem occurs when the test sends a GETDEVICEINFO request with a
+malformed xdr array (size but no data) for gdia_notify_types and the
+array size is > 0x3fffffff, which results in an overflow in the value of
+nbytes which is passed to read_buf().
+
+If the array size is 0x40000000, 0x80000000, or 0xc0000000, then after
+the overflow occurs, the value of nbytes 0, and when that happens the
+pointer returned by read_buf() points to the end of the xdr data (i.e.
+argp->end) when really it should be returning NULL.
+
+Fix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this
+value is arbitrary, but it's the same threshold used by
+nfsd4_decode_bitmap()... in could really be any value >= 1 since it's
+expected to get at most a single bitmap in gdia_notify_types).
+
+[ 119.256854] ==================================================================
+[ 119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
+[ 119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538
+
+[ 119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1
+[ 119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014
+[ 119.261202] Call Trace:
+[ 119.262265] dump_stack+0x71/0xab
+[ 119.263371] print_address_description+0x6a/0x270
+[ 119.264609] kasan_report+0x258/0x380
+[ 119.265854] ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
+[ 119.267291] nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]
+[ 119.268549] ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
+[ 119.269873] ? nfsd4_decode_sequence+0x490/0x490 [nfsd]
+[ 119.271095] nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]
+[ 119.272393] ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd]
+[ 119.273658] nfsd_dispatch+0x183/0x850 [nfsd]
+[ 119.274918] svc_process+0x161c/0x31a0 [sunrpc]
+[ 119.276172] ? svc_printk+0x190/0x190 [sunrpc]
+[ 119.277386] ? svc_xprt_release+0x451/0x680 [sunrpc]
+[ 119.278622] nfsd+0x2b9/0x430 [nfsd]
+[ 119.279771] ? nfsd_destroy+0x1c0/0x1c0 [nfsd]
+[ 119.281157] kthread+0x2db/0x390
+[ 119.282347] ? kthread_create_worker_on_cpu+0xc0/0xc0
+[ 119.283756] ret_from_fork+0x35/0x40
+
+[ 119.286041] Allocated by task 436:
+[ 119.287525] kasan_kmalloc+0xa0/0xd0
+[ 119.288685] kmem_cache_alloc+0xe9/0x1f0
+[ 119.289900] get_empty_filp+0x7b/0x410
+[ 119.291037] path_openat+0xca/0x4220
+[ 119.292242] do_filp_open+0x182/0x280
+[ 119.293411] do_sys_open+0x216/0x360
+[ 119.294555] do_syscall_64+0xa0/0x2f0
+[ 119.295721] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[ 119.298068] Freed by task 436:
+[ 119.299271] __kasan_slab_free+0x130/0x180
+[ 119.300557] kmem_cache_free+0x78/0x210
+[ 119.301823] rcu_process_callbacks+0x35b/0xbd0
+[ 119.303162] __do_softirq+0x192/0x5ea
+
+[ 119.305443] The buggy address belongs to the object at ffff880113ada000
+ which belongs to the cache filp of size 256
+[ 119.308556] The buggy address is located 0 bytes inside of
+ 256-byte region [ffff880113ada000, ffff880113ada100)
+[ 119.311376] The buggy address belongs to the page:
+[ 119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780
+[ 119.314428] flags: 0x17ffe000000100(slab)
+[ 119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001
+[ 119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000
+[ 119.319050] page dumped because: kasan: bad access detected
+
+[ 119.321652] Memory state around the buggy address:
+[ 119.322993] ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 119.324515] ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 119.327547] ^
+[ 119.328730] ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 119.330218] ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
+[ 119.331740] ==================================================================
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfs4xdr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1585,6 +1585,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_
+ gdev->gd_maxcount = be32_to_cpup(p++);
+ num = be32_to_cpup(p++);
+ if (num) {
++ if (num > 1000)
++ goto xdr_error;
+ READ_BUF(4 * num);
+ gdev->gd_notify_types = be32_to_cpup(p++);
+ for (i = 1; i < num; i++) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 9 Jun 2018 19:10:31 -0400
+Subject: NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit f9312a541050007ec59eb0106273a0a10718cd83 ]
+
+If the server returns NFS4ERR_SEQ_FALSE_RETRY or NFS4ERR_RETRY_UNCACHED_REP,
+then it thinks we're trying to replay an existing request. If so, then
+let's just bump the sequence ID and retry the operation.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -746,6 +746,13 @@ static int nfs41_sequence_process(struct
+ slot->slot_nr,
+ slot->seq_nr);
+ goto out_retry;
++ case -NFS4ERR_RETRY_UNCACHED_REP:
++ case -NFS4ERR_SEQ_FALSE_RETRY:
++ /*
++ * The server thinks we tried to replay a request.
++ * Retry the call after bumping the sequence ID.
++ */
++ goto retry_new_seq;
+ case -NFS4ERR_BADSLOT:
+ /*
+ * The slot id we used was probably retired. Try again
+@@ -770,10 +777,6 @@ static int nfs41_sequence_process(struct
+ goto retry_nowait;
+ }
+ goto session_recover;
+- case -NFS4ERR_SEQ_FALSE_RETRY:
+- if (interrupted)
+- goto retry_new_seq;
+- goto session_recover;
+ default:
+ /* Just update the slot sequence no. */
+ slot->seq_done = 1;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wei Xu <wxu@cnexlabs.com>
+Date: Thu, 26 Apr 2018 14:59:19 -0600
+Subject: nvme: lightnvm: add granby support
+
+From: Wei Xu <wxu@cnexlabs.com>
+
+[ Upstream commit ea48e877994f086af481427bac110aa63686c3ce ]
+
+Add a new lightnvm quirk to identify CNEX’s Granby controller.
+
+Signed-off-by: Wei Xu <wxu@cnexlabs.com>
+Reviewed-by: Javier González <javier@cnexlabs.com>
+Reviewed-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2731,6 +2731,8 @@ static const struct pci_device_id nvme_i
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
++ { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */
++ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Keith Busch <keith.busch@intel.com>
+Date: Thu, 24 May 2018 16:16:04 -0600
+Subject: nvme-pci: Fix AER reset handling
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit 72cd4cc28e234ed7189ee508ed65ab60c80a97c8 ]
+
+The nvme timeout handling doesn't do anything if the pci channel is
+offline, which is the case when recovering from PCI error event, so it
+was a bad idea to sync the controller reset in this state. This patch
+flushes the reset work in the error_resume callback instead when the
+channel is back to online. This keeps AER handling serialized and
+can recover from timeouts.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199757
+Fixes: cc1d5e749a2e ("nvme/pci: Sync controller reset for AER slot_reset")
+Reported-by: Alex Gagniuc <mr.nuke.me@gmail.com>
+Tested-by: Alex Gagniuc <mr.nuke.me@gmail.com>
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2679,19 +2679,15 @@ static pci_ers_result_t nvme_slot_reset(
+
+ dev_info(dev->ctrl.device, "restart after slot reset\n");
+ pci_restore_state(pdev);
+- nvme_reset_ctrl_sync(&dev->ctrl);
+-
+- switch (dev->ctrl.state) {
+- case NVME_CTRL_LIVE:
+- case NVME_CTRL_ADMIN_ONLY:
+- return PCI_ERS_RESULT_RECOVERED;
+- default:
+- return PCI_ERS_RESULT_DISCONNECT;
+- }
++ nvme_reset_ctrl(&dev->ctrl);
++ return PCI_ERS_RESULT_RECOVERED;
+ }
+
+ static void nvme_error_resume(struct pci_dev *pdev)
+ {
++ struct nvme_dev *dev = pci_get_drvdata(pdev);
++
++ flush_work(&dev->ctrl.reset_work);
+ pci_cleanup_aer_uncorrect_error_status(pdev);
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+Date: Thu, 24 May 2018 09:27:38 +0800
+Subject: nvme-rdma: stop admin queue before freeing it
+
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+
+[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ]
+
+For any failure after nvme_rdma_start_queue in
+nvme_rdma_configure_admin_queue, the admin queue will be freed with the
+NVME_RDMA_Q_LIVE flag still set. Once nvme_rdma_stop_queue is invoked,
+that will cause a use-after-free.
+BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm]
+
+To fix it, call nvme_rdma_stop_queue for all the failed cases after
+nvme_rdma_start_queue.
+
+Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
+Suggested-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -778,7 +778,7 @@ static int nvme_rdma_configure_admin_que
+ if (error) {
+ dev_err(ctrl->ctrl.device,
+ "prop_get NVME_REG_CAP failed\n");
+- goto out_cleanup_queue;
++ goto out_stop_queue;
+ }
+
+ ctrl->ctrl.sqsize =
+@@ -786,23 +786,25 @@ static int nvme_rdma_configure_admin_que
+
+ error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
+ if (error)
+- goto out_cleanup_queue;
++ goto out_stop_queue;
+
+ ctrl->ctrl.max_hw_sectors =
+ (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
+
+ error = nvme_init_identify(&ctrl->ctrl);
+ if (error)
+- goto out_cleanup_queue;
++ goto out_stop_queue;
+
+ error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev,
+ &ctrl->async_event_sqe, sizeof(struct nvme_command),
+ DMA_TO_DEVICE);
+ if (error)
+- goto out_cleanup_queue;
++ goto out_stop_queue;
+
+ return 0;
+
++out_stop_queue:
++ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ out_cleanup_queue:
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Fri, 11 May 2018 12:07:03 +0100
+Subject: nvmem: properly handle returned value nvmem_reg_read
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit 50808bfcc14b854775a9f1d0abe3dac2babcf5c3 ]
+
+Function nvmem_reg_read can return a non zero value indicating an error.
+This returned value must be read and error propagated to
+nvmem_cell_prepare_write_buffer. Silence the following gcc warning (W=1):
+
+drivers/nvmem/core.c:1093:9: warning: variable 'rc' set but
+ not used [-Wunused-but-set-variable]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -1107,6 +1107,8 @@ static void *nvmem_cell_prepare_write_bu
+
+ /* setup the first byte with lsb bits from nvmem */
+ rc = nvmem_reg_read(nvmem, cell->offset, &v, 1);
++ if (rc)
++ goto err;
+ *b++ |= GENMASK(bit_offset - 1, 0) & v;
+
+ /* setup rest of the byte if any */
+@@ -1125,11 +1127,16 @@ static void *nvmem_cell_prepare_write_bu
+ /* setup the last byte with msb bits from nvmem */
+ rc = nvmem_reg_read(nvmem,
+ cell->offset + cell->bytes - 1, &v, 1);
++ if (rc)
++ goto err;
+ *p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v;
+
+ }
+
+ return buf;
++err:
++ kfree(buf);
++ return ERR_PTR(rc);
+ }
+
+ /**
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Tue, 17 Apr 2018 11:25:51 -0500
+Subject: PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 9ab105deb60fa76d66cae5548819b4e8703d2056 ]
+
+When in the ASPM L1.0 state (but not the PCI-PM L1.0 state), the most
+recent LTR value and the LTR_L1.2_THRESHOLD determines whether the link
+enters the L1.2 substate.
+
+If we don't have LTR enabled, prevent the use of ASPM L1.2.
+
+PCI-PM L1.2 may still be used because it doesn't depend on
+LTR_L1.2_THRESHOLD (see PCIe r4.0, sec 5.5.1).
+
+Tested-by: Srinath Mannam <srinath.mannam@broadcom.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pcie/aspm.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -400,6 +400,15 @@ static void pcie_get_aspm_reg(struct pci
+ info->l1ss_cap = 0;
+ return;
+ }
++
++ /*
++ * If we don't have LTR for the entire path from the Root Complex
++ * to this device, we can't use ASPM L1.2 because it relies on the
++ * LTR_L1.2_THRESHOLD. See PCIe r4.0, secs 5.5.4, 6.18.
++ */
++ if (!pdev->ltr_path)
++ info->l1ss_cap &= ~PCI_L1SS_CAP_ASPM_L1_2;
++
+ pci_read_config_dword(pdev, info->l1ss_cap_ptr + PCI_L1SS_CTL1,
+ &info->l1ss_ctl1);
+ pci_read_config_dword(pdev, info->l1ss_cap_ptr + PCI_L1SS_CTL2,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Oza Pawandeep <poza@codeaurora.org>
+Date: Wed, 16 May 2018 15:59:35 -0500
+Subject: PCI/DPC: Clear interrupt status in interrupt handler top half
+
+From: Oza Pawandeep <poza@codeaurora.org>
+
+[ Upstream commit 56abbf8ad73c89d0a4c3c84b1449ceaaabd1b8c7 ]
+
+The generic IRQ handling code ensures that an interrupt handler runs with
+its interrupt masked or disabled. If the interrupt is level-triggered, the
+interrupt handler must tell its device to stop asserting the interrupt
+before returning. If it doesn't, we will immediately take the interrupt
+again when the handler returns and the generic code unmasks the interrupt.
+
+The driver doesn't know whether its interrupt is edge- or level-triggered,
+so it must clear its interrupt source directly in its interrupt handler.
+
+Previously we cleared the DPC interrupt status in the bottom half, i.e., in
+deferred work, which can cause an interrupt storm if the DPC interrupt
+happens to be level-triggered, e.g., if we're using INTx instead of MSI.
+
+Clear the DPC interrupt status bit in the interrupt handler, not in the
+deferred work.
+
+Signed-off-by: Oza Pawandeep <poza@codeaurora.org>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pcie/dpc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -113,7 +113,7 @@ static void dpc_work(struct work_struct
+ }
+
+ pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
+- PCI_EXP_DPC_STATUS_TRIGGER | PCI_EXP_DPC_STATUS_INTERRUPT);
++ PCI_EXP_DPC_STATUS_TRIGGER);
+
+ pci_read_config_word(pdev, cap + PCI_EXP_DPC_CTL, &ctl);
+ pci_write_config_word(pdev, cap + PCI_EXP_DPC_CTL,
+@@ -223,6 +223,9 @@ static irqreturn_t dpc_irq(int irq, void
+ if (dpc->rp_extensions && reason == 3 && ext_reason == 0)
+ dpc_process_rp_pio_error(dpc);
+
++ pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
++ PCI_EXP_DPC_STATUS_INTERRUPT);
++
+ schedule_work(&dpc->work);
+
+ return IRQ_HANDLED;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Tue, 15 May 2018 11:07:01 +0200
+Subject: PCI: Fix devm_pci_alloc_host_bridge() memory leak
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+[ Upstream commit 3bbce531788719749520f28052cabdef16af6b16 ]
+
+Fix a memory leak by freeing the PCI resource list in
+devm_pci_release_host_bridge_dev().
+
+Fixes: 5c3f18cce083 ("PCI: Add devm_pci_alloc_host_bridge() interface")
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/probe.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -526,12 +526,14 @@ static void devm_pci_release_host_bridge
+
+ if (bridge->release_fn)
+ bridge->release_fn(bridge);
++
++ pci_free_resource_list(&bridge->windows);
+ }
+
+ static void pci_release_host_bridge_dev(struct device *dev)
+ {
+ devm_pci_release_host_bridge_dev(dev);
+- pci_free_host_bridge(to_pci_host_bridge(dev));
++ kfree(to_pci_host_bridge(dev));
+ }
+
+ struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 23 May 2018 17:19:22 -0500
+Subject: PCI: pciehp: Request control of native hotplug only if supported
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ]
+
+Currently we request control of native PCIe hotplug unconditionally.
+Native PCIe hotplug events are handled by the pciehp driver, and if it is
+not enabled those events will be lost.
+
+Request control of native PCIe hotplug only if the pciehp driver is
+enabled, so we will actually handle native PCIe hotplug events.
+
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/pci_root.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -472,9 +472,11 @@ static void negotiate_os_control(struct
+ }
+
+ control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL
+- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
+ | OSC_PCI_EXPRESS_PME_CONTROL;
+
++ if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
++ control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL;
++
+ if (pci_aer_available()) {
+ if (aer_acpi_firmware_first())
+ dev_info(&device->dev,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Christoph Hellwig <hch@lst.de>
+Date: Fri, 18 May 2018 18:56:24 +0200
+Subject: PCI: Prevent sysfs disable of device while driver is attached
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ]
+
+Manipulating the enable_cnt behind the back of the driver will wreak
+complete havoc with the kernel state, so disallow it.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Acked-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci-sysfs.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -288,13 +288,16 @@ static ssize_t enable_store(struct devic
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- if (!val) {
+- if (pci_is_enabled(pdev))
+- pci_disable_device(pdev);
+- else
+- result = -EIO;
+- } else
++ device_lock(dev);
++ if (dev->driver)
++ result = -EBUSY;
++ else if (val)
+ result = pci_enable_device(pdev);
++ else if (pci_is_enabled(pdev))
++ pci_disable_device(pdev);
++ else
++ result = -EIO;
++ device_unlock(dev);
+
+ return result < 0 ? result : count;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 8 May 2018 07:53:39 +0200
+Subject: perf: fix invalid bit in diagnostic entry
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 3c0a83b14ea71fef5ccc93a3bd2de5f892be3194 ]
+
+The s390 CPU measurement facility sampling mode supports basic entries
+and diagnostic entries. Each entry has a valid bit to indicate the
+status of the entry as valid or invalid.
+
+This bit is bit 31 in the diagnostic entry, but the bit mask definition
+refers to bit 30.
+
+Fix this by making the reserved field one bit larger.
+
+Fixes: 7e75fc3ff4cf ("s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/include/asm/cpu_mf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/include/asm/cpu_mf.h
++++ b/arch/s390/include/asm/cpu_mf.h
+@@ -113,7 +113,7 @@ struct hws_basic_entry {
+
+ struct hws_diag_entry {
+ unsigned int def:16; /* 0-15 Data Entry Format */
+- unsigned int R:14; /* 16-19 and 20-30 reserved */
++ unsigned int R:15; /* 16-19 and 20-30 reserved */
+ unsigned int I:1; /* 31 entry valid or invalid */
+ u8 data[]; /* Machine-dependent sample data */
+ } __packed;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 5 Jun 2018 14:14:16 +0200
+Subject: perf tools: Fix pmu events parsing rule
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit ceac7b79df7bd67ef9aaf464b0179a2686aff4ee ]
+
+Currently all the event parsing fails end up
+in the event_pmu rule, and display misleading
+help like:
+
+ $ perf stat -e inst kill
+ event syntax error: 'inst'
+ \___ Cannot find PMU `inst'. Missing kernel support?
+ ...
+
+The reason is that the event_pmu is too strong
+and match also single string. Changing it to
+force the '/' separators to be part of the rule,
+and getting the proper error now:
+
+ $ perf stat -e inst kill
+ event syntax error: 'inst'
+ \___ parser error
+ Run 'perf list' for a list of valid events
+ ...
+
+Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20180605121416.31645-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/parse-events.y | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/parse-events.y
++++ b/tools/perf/util/parse-events.y
+@@ -73,6 +73,7 @@ static void inc_group_count(struct list_
+ %type <num> value_sym
+ %type <head> event_config
+ %type <head> opt_event_config
++%type <head> opt_pmu_config
+ %type <term> event_term
+ %type <head> event_pmu
+ %type <head> event_legacy_symbol
+@@ -224,7 +225,7 @@ event_def: event_pmu |
+ event_bpf_file
+
+ event_pmu:
+-PE_NAME opt_event_config
++PE_NAME opt_pmu_config
+ {
+ struct list_head *list, *orig_terms, *terms;
+
+@@ -495,6 +496,17 @@ opt_event_config:
+ {
+ $$ = NULL;
+ }
++
++opt_pmu_config:
++'/' event_config '/'
++{
++ $$ = $2;
++}
++|
++'/' '/'
++{
++ $$ = NULL;
++}
+
+ start_terms: event_config
+ {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kan Liang <kan.liang@intel.com>
+Date: Thu, 3 May 2018 11:25:07 -0700
+Subject: perf/x86/intel/uncore: Correct fixed counter index check for NHM
+
+From: Kan Liang <kan.liang@intel.com>
+
+[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ]
+
+For Nehalem and Westmere, there is only one fixed counter for W-Box.
+There is no index which is bigger than UNCORE_PMC_IDX_FIXED.
+It is not correct to use >= to check fixed counter.
+The code quality issue will bring problem when new counter index is
+introduced.
+
+Signed-off-by: Kan Liang <kan.liang@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: acme@kernel.org
+Cc: eranian@google.com
+Link: http://lkml.kernel.org/r/1525371913-10597-2-git-send-email-kan.liang@intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/uncore_nhmex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/uncore_nhmex.c
++++ b/arch/x86/events/intel/uncore_nhmex.c
+@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_even
+ {
+ struct hw_perf_event *hwc = &event->hw;
+
+- if (hwc->idx >= UNCORE_PMC_IDX_FIXED)
++ if (hwc->idx == UNCORE_PMC_IDX_FIXED)
+ wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0);
+ else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0)
+ wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Kan Liang <kan.liang@intel.com>
+Date: Thu, 3 May 2018 11:25:08 -0700
+Subject: perf/x86/intel/uncore: Correct fixed counter index check in generic code
+
+From: Kan Liang <kan.liang@intel.com>
+
+[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ]
+
+There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only
+exception is client IMC uncore, which has been specially handled.
+For generic code, it is not correct to use >= to check fixed counter.
+The code quality issue will bring problem when a new counter index is
+introduced.
+
+Signed-off-by: Kan Liang <kan.liang@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: acme@kernel.org
+Cc: eranian@google.com
+Link: http://lkml.kernel.org/r/1525371913-10597-3-git-send-email-kan.liang@intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/uncore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct int
+ u64 prev_count, new_count, delta;
+ int shift;
+
+- if (event->hw.idx >= UNCORE_PMC_IDX_FIXED)
++ if (event->hw.idx == UNCORE_PMC_IDX_FIXED)
+ shift = 64 - uncore_fixed_ctr_bits(box);
+ else
+ shift = 64 - uncore_perf_ctr_bits(box);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Wed, 23 May 2018 21:07:12 +0200
+Subject: pinctrl: at91-pio4: add missing of_node_put
+
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+
+[ Upstream commit 21816364715f508c10da1e087e352bc1e326614f ]
+
+The device node iterators perform an of_node_get on each iteration, so a
+jump out of the loop requires an of_node_put.
+
+The semantic patch that fixes this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+expression root,e;
+local idexpression child;
+iterator name for_each_child_of_node;
+@@
+
+ for_each_child_of_node(root, child) {
+ ... when != of_node_put(child)
+ when != e = child
++ of_node_put(child);
+? break;
+ ...
+}
+... when != child
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(str
+ for_each_child_of_node(np_config, np) {
+ ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map,
+ &reserved_maps, num_maps);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(np);
+ break;
++ }
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Mon, 21 May 2018 22:57:37 +0200
+Subject: pinctrl: msm: fix gpio-hog related boot issues
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 ]
+
+Sven Eckelmann reported an issue with the current IPQ4019 pinctrl.
+Setting up any gpio-hog in the device-tree for his device would
+"kill the bootup completely":
+
+| [ 0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
+| [ 0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe
+| [ 1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517
+| [ 1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register
+| [ 1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip
+| [ 1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
+| [ 1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri
+
+This was also verified on a RT-AC58U (IPQ4018) which would
+no longer boot, if a gpio-hog was specified. (Tried forcing
+the USB LED PIN (GPIO0) to high.).
+
+The problem is that Pinctrl+GPIO registration is currently
+peformed in the following order in pinctrl-msm.c:
+ 1. pinctrl_register()
+ 2. gpiochip_add()
+ 3. gpiochip_add_pin_range()
+
+The actual error code -517 == -EPROBE_DEFER is coming from
+pinctrl_get_device_gpio_range(), which is called through:
+ gpiochip_add
+ of_gpiochip_add
+ of_gpiochip_scan_gpios
+ gpiod_hog
+ gpiochip_request_own_desc
+ __gpiod_request
+ chip->request
+ gpiochip_generic_request
+ pinctrl_gpio_request
+ pinctrl_get_device_gpio_range
+
+pinctrl_get_device_gpio_range() is unable to find any valid
+pin ranges, since nothing has been added to the pinctrldev_list yet.
+so the range can't be found, and the operation fails with -EPROBE_DEFER.
+
+This patch fixes the issue by adding the "gpio-ranges" property to
+the pinctrl device node of all upstream Qcom SoC. The pin ranges are
+then added by the gpio core.
+
+In order to remain compatible with older, existing DTs (and ACPI)
+a check for the "gpio-ranges" property has been added to
+msm_gpio_init(). This prevents the driver of adding the same entry
+to the pinctrldev_list twice.
+
+Reported-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Tested-by: Sven Eckelmann <sven.eckelmann@openmesh.com> [ipq4019]
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -890,11 +890,24 @@ static int msm_gpio_init(struct msm_pinc
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio);
+- if (ret) {
+- dev_err(pctrl->dev, "Failed to add pin range\n");
+- gpiochip_remove(&pctrl->chip);
+- return ret;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&pctrl->chip,
++ dev_name(pctrl->dev), 0, 0, chip->ngpio);
++ if (ret) {
++ dev_err(pctrl->dev, "Failed to add pin range\n");
++ gpiochip_remove(&pctrl->chip);
++ return ret;
++ }
+ }
+
+ ret = gpiochip_irqchip_add(chip,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Tue, 17 Apr 2018 14:45:56 -0500
+Subject: platform/x86: dell-smbios: Match on www.dell.com in OEM strings too
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit b004b21cc664ca00782508514dade43e29eebf94 ]
+
+Sergey reported that some much older Dell systems don't support
+the OEM string "Dell System" but instead supported www.dell.com
+in OEM strings.
+
+Match both of these to indicate that this driver is running on
+a Dell system.
+
+Reported-by: Sergey Kubushyn <ksi@koi8.net>
+Tested-by: Sergey Kubushyn <ksi@koi8.net>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+[dvhart: Simplify DMI logic and eliminate unnecessary variables]
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell-smbios-base.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/dell-smbios-base.c
++++ b/drivers/platform/x86/dell-smbios-base.c
+@@ -555,11 +555,10 @@ static void free_group(struct platform_d
+
+ static int __init dell_smbios_init(void)
+ {
+- const struct dmi_device *valid;
+ int ret, wmi, smm;
+
+- valid = dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL);
+- if (!valid) {
++ if (!dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL) &&
++ !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "www.dell.com", NULL)) {
+ pr_err("Unable to run on non-Dell system\n");
+ return -ENODEV;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Fri, 25 May 2018 11:46:48 +0200
+Subject: PM / wakeup: Make s2idle_lock a RAW_SPINLOCK
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 62fc00a6611a0014c85763f9def1fc07c15d1302 ]
+
+The `s2idle_lock' is acquired during suspend while interrupts are
+disabled even on RT. The lock is acquired for short sections only.
+Make it a RAW lock which avoids "sleeping while atomic" warnings on RT.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/power/suspend.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/kernel/power/suspend.c
++++ b/kernel/power/suspend.c
+@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops
+ static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head);
+
+ enum s2idle_states __read_mostly s2idle_state;
+-static DEFINE_SPINLOCK(s2idle_lock);
++static DEFINE_RAW_SPINLOCK(s2idle_lock);
+
+ void s2idle_set_ops(const struct platform_s2idle_ops *ops)
+ {
+@@ -78,12 +78,12 @@ static void s2idle_enter(void)
+ {
+ trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true);
+
+- spin_lock_irq(&s2idle_lock);
++ raw_spin_lock_irq(&s2idle_lock);
+ if (pm_wakeup_pending())
+ goto out;
+
+ s2idle_state = S2IDLE_STATE_ENTER;
+- spin_unlock_irq(&s2idle_lock);
++ raw_spin_unlock_irq(&s2idle_lock);
+
+ get_online_cpus();
+ cpuidle_resume();
+@@ -97,11 +97,11 @@ static void s2idle_enter(void)
+ cpuidle_pause();
+ put_online_cpus();
+
+- spin_lock_irq(&s2idle_lock);
++ raw_spin_lock_irq(&s2idle_lock);
+
+ out:
+ s2idle_state = S2IDLE_STATE_NONE;
+- spin_unlock_irq(&s2idle_lock);
++ raw_spin_unlock_irq(&s2idle_lock);
+
+ trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false);
+ }
+@@ -156,12 +156,12 @@ void s2idle_wake(void)
+ {
+ unsigned long flags;
+
+- spin_lock_irqsave(&s2idle_lock, flags);
++ raw_spin_lock_irqsave(&s2idle_lock, flags);
+ if (s2idle_state > S2IDLE_STATE_NONE) {
+ s2idle_state = S2IDLE_STATE_WAKE;
+ wake_up(&s2idle_wait_head);
+ }
+- spin_unlock_irqrestore(&s2idle_lock, flags);
++ raw_spin_unlock_irqrestore(&s2idle_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(s2idle_wake);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 22 May 2018 11:17:16 -0400
+Subject: pnfs: Don't release the sequence slot until we've processed layoutget on open
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit ae55e59da0e401893b3c52b575fc18a00623d0a1 ]
+
+If the server recalls the layout that was just handed out, we risk hitting
+a race as described in RFC5661 Section 2.10.6.3 unless we ensure that we
+release the sequence slot after processing the LAYOUTGET operation that
+was sent as part of the OPEN compound.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2807,7 +2807,7 @@ static int _nfs4_open_and_get_state(stru
+ if (ret != 0)
+ goto out;
+
+- state = nfs4_opendata_to_nfs4_state(opendata);
++ state = _nfs4_opendata_to_nfs4_state(opendata);
+ ret = PTR_ERR(state);
+ if (IS_ERR(state))
+ goto out;
+@@ -2843,6 +2843,7 @@ static int _nfs4_open_and_get_state(stru
+ nfs4_schedule_stateid_recovery(server, state);
+ }
+ out:
++ nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 22 Mar 2018 21:20:03 +0100
+Subject: powerpc/32: Add a missing include header
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit c89ca593220931c150cffda24b4d4ccf82f13fc8 ]
+
+The header file <linux/syscalls.h> was missing from the includes. Fix the
+following warning, treated as error with W=1:
+
+ arch/powerpc/kernel/pci_32.c:286:6: error: no previous prototype for ‘sys_pciconfig_iobase’ [-Werror=missing-prototypes]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/pci_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/kernel/pci_32.c
++++ b/arch/powerpc/kernel/pci_32.c
+@@ -11,6 +11,7 @@
+ #include <linux/sched.h>
+ #include <linux/errno.h>
+ #include <linux/bootmem.h>
++#include <linux/syscalls.h>
+ #include <linux/irq.h>
+ #include <linux/list.h>
+ #include <linux/of.h>
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Michal Suchanek <msuchanek@suse.de>
+Date: Tue, 24 Apr 2018 14:15:54 +1000
+Subject: powerpc/64s: Add barrier_nospec
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit a6b3964ad71a61bb7c61d80a60bea7d42187b2eb ]
+
+A no-op form of ori (or immediate of 0 into r31 and the result stored
+in r31) has been re-tasked as a speculation barrier. The instruction
+only acts as a barrier on newer machines with appropriate firmware
+support. On older CPUs it remains a harmless no-op.
+
+Implement barrier_nospec using this instruction.
+
+mpe: The semantics of the instruction are believed to be that it
+prevents execution of subsequent instructions until preceding branches
+have been fully resolved and are no longer executing speculatively.
+There is no further documentation available at this time.
+
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/barrier.h | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/arch/powerpc/include/asm/barrier.h
++++ b/arch/powerpc/include/asm/barrier.h
+@@ -76,6 +76,21 @@ do { \
+ ___p1; \
+ })
+
++#ifdef CONFIG_PPC_BOOK3S_64
++/*
++ * Prevent execution of subsequent instructions until preceding branches have
++ * been fully resolved and are no longer executing speculatively.
++ */
++#define barrier_nospec_asm ori 31,31,0
++
++// This also acts as a compiler barrier due to the memory clobber.
++#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory")
++
++#else /* !CONFIG_PPC_BOOK3S_64 */
++#define barrier_nospec_asm
++#define barrier_nospec()
++#endif
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* _ASM_POWERPC_BARRIER_H */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Wed, 30 May 2018 20:31:22 +1000
+Subject: powerpc/64s: Fix compiler store ordering to SLB shadow area
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ]
+
+The stores to update the SLB shadow area must be made as they appear
+in the C code, so that the hypervisor does not see an entry with
+mismatched vsid and esid. Use WRITE_ONCE for this.
+
+GCC has been observed to elide the first store to esid in the update,
+which means that if the hypervisor interrupts the guest after storing
+to vsid, it could see an entry with old esid and new vsid, which may
+possibly result in memory corruption.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/slb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -63,14 +63,14 @@ static inline void slb_shadow_update(uns
+ * updating it. No write barriers are needed here, provided
+ * we only update the current CPU's SLB shadow buffer.
+ */
+- p->save_area[index].esid = 0;
+- p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags));
+- p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index));
++ WRITE_ONCE(p->save_area[index].esid, 0);
++ WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags)));
++ WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index)));
+ }
+
+ static inline void slb_shadow_clear(enum slb_index index)
+ {
+- get_slb_shadow()->save_area[index].esid = 0;
++ WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0);
+ }
+
+ static inline void create_shadowed_slbe(unsigned long ea, int ssize,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Thu, 24 May 2018 11:02:06 +0000
+Subject: powerpc/8xx: fix invalid register expression in head_8xx.S
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ]
+
+New binutils generate the following warning
+
+ AS arch/powerpc/kernel/head_8xx.o
+arch/powerpc/kernel/head_8xx.S: Assembler messages:
+arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression
+
+This patch fixes it.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -913,7 +913,7 @@ start_here:
+ tovirt(r6,r6)
+ lis r5, abatron_pteptrs@h
+ ori r5, r5, abatron_pteptrs@l
+- stw r5, 0xf0(r0) /* Must match your Abatron config file */
++ stw r5, 0xf0(0) /* Must match your Abatron config file */
+ tophys(r5,r5)
+ stw r6, 0(r5)
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Fri, 6 Apr 2018 22:12:19 +0200
+Subject: powerpc: Add __printf verification to prom_printf
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit eae5f709a4d738c52b6ab636981755d76349ea9e ]
+
+__printf is useful to verify format and arguments. Fix arg mismatch
+reported by gcc, remove the following warnings (with W=1):
+
+ arch/powerpc/kernel/prom_init.c:1467:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1471:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1504:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1505:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1506:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1507:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1508:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1509:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:1975:39: error: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘unsigned int’
+ arch/powerpc/kernel/prom_init.c:1986:27: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:2567:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:2567:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:2569:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
+ arch/powerpc/kernel/prom_init.c:2569:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’
+
+The patch also include arg mismatch fix for case with #define DEBUG_PROM
+(warning not listed here).
+
+This patch fix also the following warnings revealed by checkpatch:
+
+ WARNING: Prefer using '"%s...", __func__' to using 'alloc_up', this function's name, in a string
+ #101: FILE: arch/powerpc/kernel/prom_init.c:1235:
+ + prom_debug("alloc_up(%lx, %lx)\n", size, align);
+
+and
+
+ WARNING: Prefer using '"%s...", __func__' to using 'alloc_down', this function's name, in a string
+ #138: FILE: arch/powerpc/kernel/prom_init.c:1278:
+ + prom_debug("alloc_down(%lx, %lx, %s)\n", size, align,
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/prom_init.c | 114 ++++++++++++++++++++--------------------
+ 1 file changed, 58 insertions(+), 56 deletions(-)
+
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -334,6 +334,7 @@ static void __init prom_print_dec(unsign
+ call_prom("write", 3, 1, prom.stdout, buf+i, size);
+ }
+
++__printf(1, 2)
+ static void __init prom_printf(const char *format, ...)
+ {
+ const char *p, *q, *s;
+@@ -1160,7 +1161,7 @@ static void __init prom_send_capabilitie
+ */
+
+ cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads());
+- prom_printf("Max number of cores passed to firmware: %lu (NR_CPUS = %lu)\n",
++ prom_printf("Max number of cores passed to firmware: %u (NR_CPUS = %d)\n",
+ cores, NR_CPUS);
+
+ ibm_architecture_vec.vec5.max_cpus = cpu_to_be32(cores);
+@@ -1242,7 +1243,7 @@ static unsigned long __init alloc_up(uns
+
+ if (align)
+ base = _ALIGN_UP(base, align);
+- prom_debug("alloc_up(%x, %x)\n", size, align);
++ prom_debug("%s(%lx, %lx)\n", __func__, size, align);
+ if (ram_top == 0)
+ prom_panic("alloc_up() called with mem not initialized\n");
+
+@@ -1253,7 +1254,7 @@ static unsigned long __init alloc_up(uns
+
+ for(; (base + size) <= alloc_top;
+ base = _ALIGN_UP(base + 0x100000, align)) {
+- prom_debug(" trying: 0x%x\n\r", base);
++ prom_debug(" trying: 0x%lx\n\r", base);
+ addr = (unsigned long)prom_claim(base, size, 0);
+ if (addr != PROM_ERROR && addr != 0)
+ break;
+@@ -1265,12 +1266,12 @@ static unsigned long __init alloc_up(uns
+ return 0;
+ alloc_bottom = addr + size;
+
+- prom_debug(" -> %x\n", addr);
+- prom_debug(" alloc_bottom : %x\n", alloc_bottom);
+- prom_debug(" alloc_top : %x\n", alloc_top);
+- prom_debug(" alloc_top_hi : %x\n", alloc_top_high);
+- prom_debug(" rmo_top : %x\n", rmo_top);
+- prom_debug(" ram_top : %x\n", ram_top);
++ prom_debug(" -> %lx\n", addr);
++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom);
++ prom_debug(" alloc_top : %lx\n", alloc_top);
++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high);
++ prom_debug(" rmo_top : %lx\n", rmo_top);
++ prom_debug(" ram_top : %lx\n", ram_top);
+
+ return addr;
+ }
+@@ -1285,7 +1286,7 @@ static unsigned long __init alloc_down(u
+ {
+ unsigned long base, addr = 0;
+
+- prom_debug("alloc_down(%x, %x, %s)\n", size, align,
++ prom_debug("%s(%lx, %lx, %s)\n", __func__, size, align,
+ highmem ? "(high)" : "(low)");
+ if (ram_top == 0)
+ prom_panic("alloc_down() called with mem not initialized\n");
+@@ -1313,7 +1314,7 @@ static unsigned long __init alloc_down(u
+ base = _ALIGN_DOWN(alloc_top - size, align);
+ for (; base > alloc_bottom;
+ base = _ALIGN_DOWN(base - 0x100000, align)) {
+- prom_debug(" trying: 0x%x\n\r", base);
++ prom_debug(" trying: 0x%lx\n\r", base);
+ addr = (unsigned long)prom_claim(base, size, 0);
+ if (addr != PROM_ERROR && addr != 0)
+ break;
+@@ -1324,12 +1325,12 @@ static unsigned long __init alloc_down(u
+ alloc_top = addr;
+
+ bail:
+- prom_debug(" -> %x\n", addr);
+- prom_debug(" alloc_bottom : %x\n", alloc_bottom);
+- prom_debug(" alloc_top : %x\n", alloc_top);
+- prom_debug(" alloc_top_hi : %x\n", alloc_top_high);
+- prom_debug(" rmo_top : %x\n", rmo_top);
+- prom_debug(" ram_top : %x\n", ram_top);
++ prom_debug(" -> %lx\n", addr);
++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom);
++ prom_debug(" alloc_top : %lx\n", alloc_top);
++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high);
++ prom_debug(" rmo_top : %lx\n", rmo_top);
++ prom_debug(" ram_top : %lx\n", ram_top);
+
+ return addr;
+ }
+@@ -1455,7 +1456,7 @@ static void __init prom_init_mem(void)
+
+ if (size == 0)
+ continue;
+- prom_debug(" %x %x\n", base, size);
++ prom_debug(" %lx %lx\n", base, size);
+ if (base == 0 && (of_platform & PLATFORM_LPAR))
+ rmo_top = size;
+ if ((base + size) > ram_top)
+@@ -1475,12 +1476,12 @@ static void __init prom_init_mem(void)
+
+ if (prom_memory_limit) {
+ if (prom_memory_limit <= alloc_bottom) {
+- prom_printf("Ignoring mem=%x <= alloc_bottom.\n",
+- prom_memory_limit);
++ prom_printf("Ignoring mem=%lx <= alloc_bottom.\n",
++ prom_memory_limit);
+ prom_memory_limit = 0;
+ } else if (prom_memory_limit >= ram_top) {
+- prom_printf("Ignoring mem=%x >= ram_top.\n",
+- prom_memory_limit);
++ prom_printf("Ignoring mem=%lx >= ram_top.\n",
++ prom_memory_limit);
+ prom_memory_limit = 0;
+ } else {
+ ram_top = prom_memory_limit;
+@@ -1512,12 +1513,13 @@ static void __init prom_init_mem(void)
+ alloc_bottom = PAGE_ALIGN(prom_initrd_end);
+
+ prom_printf("memory layout at init:\n");
+- prom_printf(" memory_limit : %x (16 MB aligned)\n", prom_memory_limit);
+- prom_printf(" alloc_bottom : %x\n", alloc_bottom);
+- prom_printf(" alloc_top : %x\n", alloc_top);
+- prom_printf(" alloc_top_hi : %x\n", alloc_top_high);
+- prom_printf(" rmo_top : %x\n", rmo_top);
+- prom_printf(" ram_top : %x\n", ram_top);
++ prom_printf(" memory_limit : %lx (16 MB aligned)\n",
++ prom_memory_limit);
++ prom_printf(" alloc_bottom : %lx\n", alloc_bottom);
++ prom_printf(" alloc_top : %lx\n", alloc_top);
++ prom_printf(" alloc_top_hi : %lx\n", alloc_top_high);
++ prom_printf(" rmo_top : %lx\n", rmo_top);
++ prom_printf(" ram_top : %lx\n", ram_top);
+ }
+
+ static void __init prom_close_stdin(void)
+@@ -1578,7 +1580,7 @@ static void __init prom_instantiate_opal
+ return;
+ }
+
+- prom_printf("instantiating opal at 0x%x...", base);
++ prom_printf("instantiating opal at 0x%llx...", base);
+
+ if (call_prom_ret("call-method", 4, 3, rets,
+ ADDR("load-opal-runtime"),
+@@ -1594,10 +1596,10 @@ static void __init prom_instantiate_opal
+
+ reserve_mem(base, size);
+
+- prom_debug("opal base = 0x%x\n", base);
+- prom_debug("opal align = 0x%x\n", align);
+- prom_debug("opal entry = 0x%x\n", entry);
+- prom_debug("opal size = 0x%x\n", (long)size);
++ prom_debug("opal base = 0x%llx\n", base);
++ prom_debug("opal align = 0x%llx\n", align);
++ prom_debug("opal entry = 0x%llx\n", entry);
++ prom_debug("opal size = 0x%llx\n", size);
+
+ prom_setprop(opal_node, "/ibm,opal", "opal-base-address",
+ &base, sizeof(base));
+@@ -1674,7 +1676,7 @@ static void __init prom_instantiate_rtas
+
+ prom_debug("rtas base = 0x%x\n", base);
+ prom_debug("rtas entry = 0x%x\n", entry);
+- prom_debug("rtas size = 0x%x\n", (long)size);
++ prom_debug("rtas size = 0x%x\n", size);
+
+ prom_debug("prom_instantiate_rtas: end...\n");
+ }
+@@ -1732,7 +1734,7 @@ static void __init prom_instantiate_sml(
+ if (base == 0)
+ prom_panic("Could not allocate memory for sml\n");
+
+- prom_printf("instantiating sml at 0x%x...", base);
++ prom_printf("instantiating sml at 0x%llx...", base);
+
+ memset((void *)base, 0, size);
+
+@@ -1751,8 +1753,8 @@ static void __init prom_instantiate_sml(
+ prom_setprop(ibmvtpm_node, "/vdevice/vtpm", "linux,sml-size",
+ &size, sizeof(size));
+
+- prom_debug("sml base = 0x%x\n", base);
+- prom_debug("sml size = 0x%x\n", (long)size);
++ prom_debug("sml base = 0x%llx\n", base);
++ prom_debug("sml size = 0x%x\n", size);
+
+ prom_debug("prom_instantiate_sml: end...\n");
+ }
+@@ -1845,7 +1847,7 @@ static void __init prom_initialize_tce_t
+
+ prom_debug("TCE table: %s\n", path);
+ prom_debug("\tnode = 0x%x\n", node);
+- prom_debug("\tbase = 0x%x\n", base);
++ prom_debug("\tbase = 0x%llx\n", base);
+ prom_debug("\tsize = 0x%x\n", minsize);
+
+ /* Initialize the table to have a one-to-one mapping
+@@ -1932,12 +1934,12 @@ static void __init prom_hold_cpus(void)
+ }
+
+ prom_debug("prom_hold_cpus: start...\n");
+- prom_debug(" 1) spinloop = 0x%x\n", (unsigned long)spinloop);
+- prom_debug(" 1) *spinloop = 0x%x\n", *spinloop);
+- prom_debug(" 1) acknowledge = 0x%x\n",
++ prom_debug(" 1) spinloop = 0x%lx\n", (unsigned long)spinloop);
++ prom_debug(" 1) *spinloop = 0x%lx\n", *spinloop);
++ prom_debug(" 1) acknowledge = 0x%lx\n",
+ (unsigned long)acknowledge);
+- prom_debug(" 1) *acknowledge = 0x%x\n", *acknowledge);
+- prom_debug(" 1) secondary_hold = 0x%x\n", secondary_hold);
++ prom_debug(" 1) *acknowledge = 0x%lx\n", *acknowledge);
++ prom_debug(" 1) secondary_hold = 0x%lx\n", secondary_hold);
+
+ /* Set the common spinloop variable, so all of the secondary cpus
+ * will block when they are awakened from their OF spinloop.
+@@ -1965,7 +1967,7 @@ static void __init prom_hold_cpus(void)
+ prom_getprop(node, "reg", ®, sizeof(reg));
+ cpu_no = be32_to_cpu(reg);
+
+- prom_debug("cpu hw idx = %lu\n", cpu_no);
++ prom_debug("cpu hw idx = %u\n", cpu_no);
+
+ /* Init the acknowledge var which will be reset by
+ * the secondary cpu when it awakens from its OF
+@@ -1975,7 +1977,7 @@ static void __init prom_hold_cpus(void)
+
+ if (cpu_no != prom.cpu) {
+ /* Primary Thread of non-boot cpu or any thread */
+- prom_printf("starting cpu hw idx %lu... ", cpu_no);
++ prom_printf("starting cpu hw idx %u... ", cpu_no);
+ call_prom("start-cpu", 3, 0, node,
+ secondary_hold, cpu_no);
+
+@@ -1986,11 +1988,11 @@ static void __init prom_hold_cpus(void)
+ if (*acknowledge == cpu_no)
+ prom_printf("done\n");
+ else
+- prom_printf("failed: %x\n", *acknowledge);
++ prom_printf("failed: %lx\n", *acknowledge);
+ }
+ #ifdef CONFIG_SMP
+ else
+- prom_printf("boot cpu hw idx %lu\n", cpu_no);
++ prom_printf("boot cpu hw idx %u\n", cpu_no);
+ #endif /* CONFIG_SMP */
+ }
+
+@@ -2268,7 +2270,7 @@ static void __init *make_room(unsigned l
+ while ((*mem_start + needed) > *mem_end) {
+ unsigned long room, chunk;
+
+- prom_debug("Chunk exhausted, claiming more at %x...\n",
++ prom_debug("Chunk exhausted, claiming more at %lx...\n",
+ alloc_bottom);
+ room = alloc_top - alloc_bottom;
+ if (room > DEVTREE_CHUNK_SIZE)
+@@ -2494,7 +2496,7 @@ static void __init flatten_device_tree(v
+ room = alloc_top - alloc_bottom - 0x4000;
+ if (room > DEVTREE_CHUNK_SIZE)
+ room = DEVTREE_CHUNK_SIZE;
+- prom_debug("starting device tree allocs at %x\n", alloc_bottom);
++ prom_debug("starting device tree allocs at %lx\n", alloc_bottom);
+
+ /* Now try to claim that */
+ mem_start = (unsigned long)alloc_up(room, PAGE_SIZE);
+@@ -2557,7 +2559,7 @@ static void __init flatten_device_tree(v
+ int i;
+ prom_printf("reserved memory map:\n");
+ for (i = 0; i < mem_reserve_cnt; i++)
+- prom_printf(" %x - %x\n",
++ prom_printf(" %llx - %llx\n",
+ be64_to_cpu(mem_reserve_map[i].base),
+ be64_to_cpu(mem_reserve_map[i].size));
+ }
+@@ -2567,9 +2569,9 @@ static void __init flatten_device_tree(v
+ */
+ mem_reserve_cnt = MEM_RESERVE_MAP_SIZE;
+
+- prom_printf("Device tree strings 0x%x -> 0x%x\n",
++ prom_printf("Device tree strings 0x%lx -> 0x%lx\n",
+ dt_string_start, dt_string_end);
+- prom_printf("Device tree struct 0x%x -> 0x%x\n",
++ prom_printf("Device tree struct 0x%lx -> 0x%lx\n",
+ dt_struct_start, dt_struct_end);
+ }
+
+@@ -3001,7 +3003,7 @@ static void __init prom_find_boot_cpu(vo
+ prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
+ prom.cpu = be32_to_cpu(rval);
+
+- prom_debug("Booting CPU hw index = %lu\n", prom.cpu);
++ prom_debug("Booting CPU hw index = %d\n", prom.cpu);
+ }
+
+ static void __init prom_check_initrd(unsigned long r3, unsigned long r4)
+@@ -3023,8 +3025,8 @@ static void __init prom_check_initrd(uns
+ reserve_mem(prom_initrd_start,
+ prom_initrd_end - prom_initrd_start);
+
+- prom_debug("initrd_start=0x%x\n", prom_initrd_start);
+- prom_debug("initrd_end=0x%x\n", prom_initrd_end);
++ prom_debug("initrd_start=0x%lx\n", prom_initrd_start);
++ prom_debug("initrd_end=0x%lx\n", prom_initrd_end);
+ }
+ #endif /* CONFIG_BLK_DEV_INITRD */
+ }
+@@ -3277,7 +3279,7 @@ unsigned long __init prom_init(unsigned
+ /* Don't print anything after quiesce under OPAL, it crashes OFW */
+ if (of_platform != PLATFORM_OPAL) {
+ prom_printf("Booting Linux via __start() @ 0x%lx ...\n", kbase);
+- prom_debug("->dt_header_start=0x%x\n", hdr);
++ prom_debug("->dt_header_start=0x%lx\n", hdr);
+ }
+
+ #ifdef CONFIG_PPC32
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 22 Mar 2018 21:19:56 +0100
+Subject: powerpc/chrp/time: Make some functions static, add missing header include
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit b87a358b4a1421abd544c0b554b1b7159b2b36c0 ]
+
+Add a missing include <platforms/chrp/chrp.h>.
+
+These functions can all be static, make it so. Fix warnings treated as
+errors with W=1:
+
+ arch/powerpc/platforms/chrp/time.c:41:13: error: no previous prototype for ‘chrp_time_init’ [-Werror=missing-prototypes]
+ arch/powerpc/platforms/chrp/time.c:66:5: error: no previous prototype for ‘chrp_cmos_clock_read’ [-Werror=missing-prototypes]
+ arch/powerpc/platforms/chrp/time.c:74:6: error: no previous prototype for ‘chrp_cmos_clock_write’ [-Werror=missing-prototypes]
+ arch/powerpc/platforms/chrp/time.c:86:5: error: no previous prototype for ‘chrp_set_rtc_time’ [-Werror=missing-prototypes]
+ arch/powerpc/platforms/chrp/time.c:130:6: error: no previous prototype for ‘chrp_get_rtc_time’ [-Werror=missing-prototypes]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/chrp/time.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/chrp/time.c
++++ b/arch/powerpc/platforms/chrp/time.c
+@@ -28,6 +28,8 @@
+ #include <asm/sections.h>
+ #include <asm/time.h>
+
++#include <platforms/chrp/chrp.h>
++
+ extern spinlock_t rtc_lock;
+
+ #define NVRAM_AS0 0x74
+@@ -63,7 +65,7 @@ long __init chrp_time_init(void)
+ return 0;
+ }
+
+-int chrp_cmos_clock_read(int addr)
++static int chrp_cmos_clock_read(int addr)
+ {
+ if (nvram_as1 != 0)
+ outb(addr>>8, nvram_as1);
+@@ -71,7 +73,7 @@ int chrp_cmos_clock_read(int addr)
+ return (inb(nvram_data));
+ }
+
+-void chrp_cmos_clock_write(unsigned long val, int addr)
++static void chrp_cmos_clock_write(unsigned long val, int addr)
+ {
+ if (nvram_as1 != 0)
+ outb(addr>>8, nvram_as1);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+Date: Fri, 25 May 2018 13:11:30 +1000
+Subject: powerpc/eeh: Fix use-after-release of EEH driver
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 46d4be41b987a6b2d25a2ebdd94cafb44e21d6c5 ]
+
+Correct two cases where eeh_pcid_get() is used to reference the driver's
+module but the reference is dropped before the driver pointer is used.
+
+In eeh_rmv_device() also refactor a little so that only two calls to
+eeh_pcid_put() are needed, rather than three and the reference isn't
+taken at all if it wasn't needed.
+
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -458,9 +458,11 @@ static void *eeh_add_virt_device(void *d
+
+ driver = eeh_pcid_get(dev);
+ if (driver) {
+- eeh_pcid_put(dev);
+- if (driver->err_handler)
++ if (driver->err_handler) {
++ eeh_pcid_put(dev);
+ return NULL;
++ }
++ eeh_pcid_put(dev);
+ }
+
+ #ifdef CONFIG_PCI_IOV
+@@ -497,17 +499,19 @@ static void *eeh_rmv_device(void *data,
+ if (eeh_dev_removed(edev))
+ return NULL;
+
+- driver = eeh_pcid_get(dev);
+- if (driver) {
+- eeh_pcid_put(dev);
+- if (removed &&
+- eeh_pe_passed(edev->pe))
+- return NULL;
+- if (removed &&
+- driver->err_handler &&
+- driver->err_handler->error_detected &&
+- driver->err_handler->slot_reset)
++ if (removed) {
++ if (eeh_pe_passed(edev->pe))
+ return NULL;
++ driver = eeh_pcid_get(dev);
++ if (driver) {
++ if (driver->err_handler &&
++ driver->err_handler->error_detected &&
++ driver->err_handler->slot_reset) {
++ eeh_pcid_put(dev);
++ return NULL;
++ }
++ eeh_pcid_put(dev);
++ }
+ }
+
+ /* Remove it from PCI subsystem */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Jonathan Neuschäfer" <j.neuschaefer@gmx.net>
+Date: Thu, 10 May 2018 23:59:19 +0200
+Subject: powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by Starlet
+
+From: "Jonathan Neuschäfer" <j.neuschaefer@gmx.net>
+
+[ Upstream commit 9dcb3df4281876731e4e8bff7940514d72375154 ]
+
+The interrupt controller inside the Wii's Hollywood chip is connected to
+two masters, the "Broadway" PowerPC and the "Starlet" ARM926, each with
+their own interrupt status and mask registers.
+
+When booting the Wii with mini[1], interrupts from the SD card
+controller (IRQ 7) are handled by the ARM, because mini provides SD
+access over IPC. Linux however can't currently use or disable this IPC
+service, so both sides try to handle IRQ 7 without coordination.
+
+Let's instead make sure that all interrupts that are unmasked on the PPC
+side are masked on the ARM side; this will also make sure that Linux can
+properly talk to the SD card controller (and potentially other devices).
+
+If access to a device through IPC is desired in the future, interrupts
+from that device should not be handled by Linux directly.
+
+[1]: https://github.com/lewurm/mini
+
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -35,6 +35,8 @@
+ */
+ #define HW_BROADWAY_ICR 0x00
+ #define HW_BROADWAY_IMR 0x04
++#define HW_STARLET_ICR 0x08
++#define HW_STARLET_IMR 0x0c
+
+
+ /*
+@@ -74,6 +76,9 @@ static void hlwd_pic_unmask(struct irq_d
+ void __iomem *io_base = irq_data_get_irq_chip_data(d);
+
+ setbits32(io_base + HW_BROADWAY_IMR, 1 << irq);
++
++ /* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */
++ clrbits32(io_base + HW_STARLET_IMR, 1 << irq);
+ }
+
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 18 May 2018 15:01:16 +0200
+Subject: powerpc/lib: Adjust .balign inside string functions for PPC32
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 1128bb7813a896bd608fb622eee3c26aaf33b473 ]
+
+commit 87a156fb18fe1 ("Align hot loops of some string functions")
+degraded the performance of string functions by adding useless
+nops
+
+A simple benchmark on an 8xx calling 100000x a memchr() that
+matches the first byte runs in 41668 TB ticks before this patch
+and in 35986 TB ticks after this patch. So this gives an
+improvement of approx 10%
+
+Another benchmark doing the same with a memchr() matching the 128th
+byte runs in 1011365 TB ticks before this patch and 1005682 TB ticks
+after this patch, so regardless on the number of loops, removing
+those useless nops improves the test by 5683 TB ticks.
+
+Fixes: 87a156fb18fe1 ("Align hot loops of some string functions")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/cache.h | 3 +++
+ arch/powerpc/lib/string.S | 7 ++++---
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/include/asm/cache.h
++++ b/arch/powerpc/include/asm/cache.h
+@@ -9,11 +9,14 @@
+ #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX)
+ #define L1_CACHE_SHIFT 4
+ #define MAX_COPY_PREFETCH 1
++#define IFETCH_ALIGN_SHIFT 2
+ #elif defined(CONFIG_PPC_E500MC)
+ #define L1_CACHE_SHIFT 6
+ #define MAX_COPY_PREFETCH 4
++#define IFETCH_ALIGN_SHIFT 3
+ #elif defined(CONFIG_PPC32)
+ #define MAX_COPY_PREFETCH 4
++#define IFETCH_ALIGN_SHIFT 3 /* 603 fetches 2 insn at a time */
+ #if defined(CONFIG_PPC_47x)
+ #define L1_CACHE_SHIFT 7
+ #else
+--- a/arch/powerpc/lib/string.S
++++ b/arch/powerpc/lib/string.S
+@@ -12,6 +12,7 @@
+ #include <asm/errno.h>
+ #include <asm/ppc_asm.h>
+ #include <asm/export.h>
++#include <asm/cache.h>
+
+ .text
+
+@@ -23,7 +24,7 @@ _GLOBAL(strncpy)
+ mtctr r5
+ addi r6,r3,-1
+ addi r4,r4,-1
+- .balign 16
++ .balign IFETCH_ALIGN_BYTES
+ 1: lbzu r0,1(r4)
+ cmpwi 0,r0,0
+ stbu r0,1(r6)
+@@ -43,7 +44,7 @@ _GLOBAL(strncmp)
+ mtctr r5
+ addi r5,r3,-1
+ addi r4,r4,-1
+- .balign 16
++ .balign IFETCH_ALIGN_BYTES
+ 1: lbzu r3,1(r5)
+ cmpwi 1,r3,0
+ lbzu r0,1(r4)
+@@ -77,7 +78,7 @@ _GLOBAL(memchr)
+ beq- 2f
+ mtctr r5
+ addi r3,r3,-1
+- .balign 16
++ .balign IFETCH_ALIGN_BYTES
+ 1: lbzu r0,1(r3)
+ cmpw 0,r0,r4
+ bdnzf 2,1b
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Wed, 4 Apr 2018 22:13:05 +0200
+Subject: powerpc/powermac: Add missing prototype for note_bootable_part()
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit f72cf3f1d49f2c35d6cb682af2e8c93550f264e4 ]
+
+Add a missing prototype for function `note_bootable_part` to silence a
+warning treated as error with W=1:
+
+ arch/powerpc/platforms/powermac/setup.c:361:12: error: no previous prototype for ‘note_bootable_part’ [-Werror=missing-prototypes]
+
+Suggested-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/powermac/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/platforms/powermac/setup.c
++++ b/arch/powerpc/platforms/powermac/setup.c
+@@ -352,6 +352,7 @@ static int pmac_late_init(void)
+ }
+ machine_late_initcall(powermac, pmac_late_init);
+
++void note_bootable_part(dev_t dev, int part, int goodness);
+ /*
+ * This is __ref because we check for "initializing" before
+ * touching any of the __init sensitive things and "initializing"
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Wed, 4 Apr 2018 22:07:46 +0200
+Subject: powerpc/powermac: Mark variable x as unused
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit 5a4b475cf8511da721f20ba432c244061db7139f ]
+
+Since the value of x is never intended to be read, declare it with gcc
+attribute as unused. Fix warning treated as error with W=1:
+
+ arch/powerpc/platforms/powermac/bootx_init.c:471:21: error: variable ‘x’ set but not used [-Werror=unused-but-set-variable]
+
+Suggested-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/powermac/bootx_init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powermac/bootx_init.c
++++ b/arch/powerpc/platforms/powermac/bootx_init.c
+@@ -468,7 +468,7 @@ void __init bootx_init(unsigned long r3,
+ boot_infos_t *bi = (boot_infos_t *) r4;
+ unsigned long hdr;
+ unsigned long space;
+- unsigned long ptr, x;
++ unsigned long ptr;
+ char *model;
+ unsigned long offset = reloc_offset();
+
+@@ -562,6 +562,8 @@ void __init bootx_init(unsigned long r3,
+ * MMU switched OFF, so this should not be useful anymore.
+ */
+ if (bi->version < 4) {
++ unsigned long x __maybe_unused;
++
+ bootx_printf("Touching pages...\n");
+
+ /*
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Date: Wed, 30 May 2018 16:03:50 +0900
+Subject: printk: drop in_nmi check from printk_safe_flush_on_panic()
+
+From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+
+[ Upstream commit 554755be08fba31c74f66b82a485e5513205af84 ]
+
+Drop the in_nmi() check from printk_safe_flush_on_panic()
+and attempt to re-init (IOW unlock) locked logbuf spinlock
+from panic CPU regardless of its context.
+
+Otherwise, theoretically, we can deadlock on logbuf trying to flush
+per-CPU buffers:
+
+ a) Panic CPU is running in non-NMI context
+ b) Panic CPU sends out shutdown IPI via reboot vector
+ c) Panic CPU fails to stop all remote CPUs
+ d) Panic CPU sends out shutdown IPI via NMI vector
+ One of the CPUs that we bring down via NMI vector can hold
+ logbuf spin lock (theoretically).
+
+Link: http://lkml.kernel.org/r/20180530070350.10131-1-sergey.senozhatsky@gmail.com
+To: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/printk/printk_safe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/printk/printk_safe.c
++++ b/kernel/printk/printk_safe.c
+@@ -281,7 +281,7 @@ void printk_safe_flush_on_panic(void)
+ * Make sure that we could access the main ring buffer.
+ * Do not risk a double release when more CPUs are up.
+ */
+- if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) {
++ if (raw_spin_is_locked(&logbuf_lock)) {
+ if (num_online_cpus() > 1)
+ return;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Date: Tue, 29 May 2018 15:00:05 +0300
+Subject: qtnfmac: fix invalid STA state on EAPOL failure
+
+From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+
+[ Upstream commit 480daa9cb62c14bbd1b87a01cd9bc10cc56dbf32 ]
+
+Driver switches vif sta_state into QTNF_STA_CONNECTING when cfg80211
+core initiates connect procedure. Further this state is changed either
+to QTNF_STA_CONNECTED or to QTNF_STA_DISCONNECTED by BSS_JOIN and
+BSS_LEAVE events from firmware. However it is possible that no such
+events will be sent by firmware, e.g. if EAPOL timed out.
+
+In this case vif sta_mode will remain in QTNF_STA_CONNECTING state and
+all subsequent connection attempts will fail with -EBUSY error code.
+Fix this by perfroming STA state transition from QTNF_STA_CONNECTING
+to QTNF_STA_DISCONNECTED in cfg80211 disconnect callback.
+No need to rely upon firmware events in this case.
+
+Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/cfg80211.c | 21 ++++++++++++++-------
+ drivers/net/wireless/quantenna/qtnfmac/event.c | 8 +++-----
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+@@ -651,28 +651,35 @@ qtnf_disconnect(struct wiphy *wiphy, str
+ {
+ struct qtnf_wmac *mac = wiphy_priv(wiphy);
+ struct qtnf_vif *vif;
+- int ret;
++ int ret = 0;
+
+ vif = qtnf_mac_get_base_vif(mac);
+ if (!vif) {
+ pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
+- return -EFAULT;
++ ret = -EFAULT;
++ goto out;
+ }
+
+- if (vif->wdev.iftype != NL80211_IFTYPE_STATION)
+- return -EOPNOTSUPP;
++ if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
+
+ if (vif->sta_state == QTNF_STA_DISCONNECTED)
+- return 0;
++ goto out;
+
+ ret = qtnf_cmd_send_disconnect(vif, reason_code);
+ if (ret) {
+ pr_err("VIF%u.%u: failed to disconnect\n", mac->macid,
+ vif->vifid);
+- return ret;
++ goto out;
+ }
+
+- return 0;
++out:
++ if (vif->sta_state == QTNF_STA_CONNECTING)
++ vif->sta_state = QTNF_STA_DISCONNECTED;
++
++ return ret;
+ }
+
+ static int
+--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
+@@ -198,11 +198,9 @@ qtnf_event_handle_bss_leave(struct qtnf_
+ return -EPROTO;
+ }
+
+- if (vif->sta_state != QTNF_STA_CONNECTED) {
+- pr_err("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
+- vif->mac->macid, vif->vifid);
+- return -EPROTO;
+- }
++ if (vif->sta_state != QTNF_STA_CONNECTED)
++ pr_warn("VIF%u.%u: BSS_LEAVE event when STA is not connected\n",
++ vif->mac->macid, vif->vifid);
+
+ pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Thu, 5 Apr 2018 10:49:49 -0500
+Subject: qtnfmac: pearl: pcie: fix memory leak in qtnf_fw_work_handler
+
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+
+[ Upstream commit 3763770044640caeb1101cdea40697cc0814403c ]
+
+In case memory resources for fw were succesfully allocated, release
+them before jumping to fw_load_fail.
+
+Addresses-Coverity-ID: 1466092 ("Resource leak")
+Fixes: c3b2f7ca4186 ("qtnfmac: implement asynchronous firmware loading")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
+@@ -1185,6 +1185,10 @@ static void qtnf_fw_work_handler(struct
+ if (qtnf_poll_state(&priv->bda->bda_ep_state, QTN_EP_FW_LOADRDY,
+ QTN_FW_DL_TIMEOUT_MS)) {
+ pr_err("card is not ready\n");
++
++ if (!flashboot)
++ release_firmware(fw);
++
+ goto fw_load_fail;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Tue, 29 May 2018 14:56:19 +0300
+Subject: RDMA/mad: Convert BUG_ONs to error flows
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ]
+
+Let's perform checks in-place instead of BUG_ONs.
+
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/mad.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -1557,7 +1557,8 @@ static int add_oui_reg_req(struct ib_mad
+ mad_reg_req->oui, 3)) {
+ method = &(*vendor_table)->vendor_class[
+ vclass]->method_table[i];
+- BUG_ON(!*method);
++ if (!*method)
++ goto error3;
+ goto check_in_use;
+ }
+ }
+@@ -1567,10 +1568,12 @@ static int add_oui_reg_req(struct ib_mad
+ vclass]->oui[i])) {
+ method = &(*vendor_table)->vendor_class[
+ vclass]->method_table[i];
+- BUG_ON(*method);
+ /* Allocate method table for this OUI */
+- if ((ret = allocate_method_table(method)))
+- goto error3;
++ if (!*method) {
++ ret = allocate_method_table(method);
++ if (ret)
++ goto error3;
++ }
+ memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
+ mad_reg_req->oui, 3);
+ goto check_in_use;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Changbin Du <changbin.du@intel.com>
+Date: Wed, 2 May 2018 21:44:57 +0800
+Subject: regulator: add dummy function of_find_regulator_by_node
+
+From: Changbin Du <changbin.du@intel.com>
+
+[ Upstream commit 08813e0ec1cb48e53c86a24d88d26b26878e7b6e ]
+
+If device tree is not enabled, of_find_regulator_by_node() should have
+a dummy function since the function call is still there.
+
+This is to fix build error after CONFIG_NO_AUTO_INLINE is introduced.
+If this option is enabled, GCC will not auto-inline functions that are
+not explicitly marked as inline.
+
+In this case (no CONFIG_OF), the copmiler will report error in function
+regulator_dev_lookup().
+
+W/O NO_AUTO_INLINE, function of_get_regulator() is auto-inlined and then
+the call to of_find_regulator_by_node() is optimized out since
+of_get_regulator() always return NULL.
+
+W/ NO_AUTO_INLINE, the return value of of_get_regulator() is a variable
+so the call to of_find_regulator_by_node() cannot be optimized out. So
+we need a stub of_find_regulator_by_node().
+
+static struct regulator_dev *regulator_dev_lookup(struct device *dev,
+ const char *supply)
+{
+ struct regulator_dev *r = NULL;
+ struct device_node *node;
+ struct regulator_map *map;
+ const char *devname = NULL;
+
+ regulator_supply_alias(&dev, &supply);
+
+ /* first do a dt based lookup */
+ if (dev && dev->of_node) {
+ node = of_get_regulator(dev, supply);
+ if (node) {
+ r = of_find_regulator_by_node(node);
+ if (r)
+ return r;
+ ...
+
+Signed-off-by: Changbin Du <changbin.du@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/internal.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/internal.h
++++ b/drivers/regulator/internal.h
+@@ -56,14 +56,19 @@ static inline struct regulator_dev *dev_
+ return container_of(dev, struct regulator_dev, dev);
+ }
+
+-struct regulator_dev *of_find_regulator_by_node(struct device_node *np);
+-
+ #ifdef CONFIG_OF
++struct regulator_dev *of_find_regulator_by_node(struct device_node *np);
+ struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
+ const struct regulator_desc *desc,
+ struct regulator_config *config,
+ struct device_node **node);
+ #else
++static inline struct regulator_dev *
++of_find_regulator_by_node(struct device_node *np)
++{
++ return NULL;
++}
++
+ static inline struct regulator_init_data *
+ regulator_of_get_init_data(struct device *dev,
+ const struct regulator_desc *desc,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Wed, 18 Apr 2018 08:54:18 -0700
+Subject: regulator: Don't return or expect -errno from of_map_mode()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 02f3703934a42417021405ef336fe45add13c3d1 ]
+
+In of_get_regulation_constraints() we were taking the result of
+of_map_mode() (an unsigned int) and assigning it to an int. We were
+then checking whether this value was -EINVAL. Some implementers of
+of_map_mode() were returning -EINVAL (even though the return type of
+their function needed to be unsigned int) because they needed to
+signal an error back to of_get_regulation_constraints().
+
+In general in the regulator framework the mode is always referred to
+as an unsigned int. While we could fix this to be a signed int (the
+highest value we store in there right now is 0x8), it's actually
+pretty clean to just define the regulator mode 0x0 (the lack of any
+bits set) as an invalid mode. Let's do that.
+
+Fixes: 5e5e3a42c653 ("regulator: of: Add support for parsing initial and suspend modes")
+Suggested-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/cpcap-regulator.c | 2 +-
+ drivers/regulator/of_regulator.c | 13 +++++++------
+ drivers/regulator/twl-regulator.c | 2 +-
+ include/linux/regulator/consumer.h | 1 +
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/regulator/cpcap-regulator.c
++++ b/drivers/regulator/cpcap-regulator.c
+@@ -222,7 +222,7 @@ static unsigned int cpcap_map_mode(unsig
+ case CPCAP_BIT_AUDIO_LOW_PWR:
+ return REGULATOR_MODE_STANDBY;
+ default:
+- return -EINVAL;
++ return REGULATOR_MODE_INVALID;
+ }
+ }
+
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -31,6 +31,7 @@ static void of_get_regulation_constraint
+ struct regulation_constraints *constraints = &(*init_data)->constraints;
+ struct regulator_state *suspend_state;
+ struct device_node *suspend_np;
++ unsigned int mode;
+ int ret, i;
+ u32 pval;
+
+@@ -124,11 +125,11 @@ static void of_get_regulation_constraint
+
+ if (!of_property_read_u32(np, "regulator-initial-mode", &pval)) {
+ if (desc && desc->of_map_mode) {
+- ret = desc->of_map_mode(pval);
+- if (ret == -EINVAL)
++ mode = desc->of_map_mode(pval);
++ if (mode == REGULATOR_MODE_INVALID)
+ pr_err("%s: invalid mode %u\n", np->name, pval);
+ else
+- constraints->initial_mode = ret;
++ constraints->initial_mode = mode;
+ } else {
+ pr_warn("%s: mapping for mode %d not defined\n",
+ np->name, pval);
+@@ -163,12 +164,12 @@ static void of_get_regulation_constraint
+ if (!of_property_read_u32(suspend_np, "regulator-mode",
+ &pval)) {
+ if (desc && desc->of_map_mode) {
+- ret = desc->of_map_mode(pval);
+- if (ret == -EINVAL)
++ mode = desc->of_map_mode(pval);
++ if (mode == REGULATOR_MODE_INVALID)
+ pr_err("%s: invalid mode %u\n",
+ np->name, pval);
+ else
+- suspend_state->mode = ret;
++ suspend_state->mode = mode;
+ } else {
+ pr_warn("%s: mapping for mode %d not defined\n",
+ np->name, pval);
+--- a/drivers/regulator/twl-regulator.c
++++ b/drivers/regulator/twl-regulator.c
+@@ -274,7 +274,7 @@ static inline unsigned int twl4030reg_ma
+ case RES_STATE_SLEEP:
+ return REGULATOR_MODE_STANDBY;
+ default:
+- return -EINVAL;
++ return REGULATOR_MODE_INVALID;
+ }
+ }
+
+--- a/include/linux/regulator/consumer.h
++++ b/include/linux/regulator/consumer.h
+@@ -80,6 +80,7 @@ struct regmap;
+ * These modes can be OR'ed together to make up a mask of valid register modes.
+ */
+
++#define REGULATOR_MODE_INVALID 0x0
+ #define REGULATOR_MODE_FAST 0x1
+ #define REGULATOR_MODE_NORMAL 0x2
+ #define REGULATOR_MODE_IDLE 0x4
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Thu, 17 May 2018 15:27:22 +0800
+Subject: regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ]
+
+If is_enabled() is not defined, regulator core will assume
+this regulator is already enabled, then it can NOT be really
+enabled after disabled.
+
+Based on Li Jun's patch from the NXP kernel tree.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/pfuze100-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze1
+ static const struct regulator_ops pfuze100_swb_regulator_ops = {
+ .enable = regulator_enable_regmap,
+ .disable = regulator_disable_regmap,
++ .is_enabled = regulator_is_enabled_regmap,
+ .list_voltage = regulator_list_voltage_table,
+ .map_voltage = regulator_map_voltage_ascend,
+ .set_voltage_sel = regulator_set_voltage_sel_regmap,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
+Date: Fri, 11 May 2018 20:27:51 +0530
+Subject: rsi: Add null check for virtual interfaces in wowlan config
+
+From: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
+
+[ Upstream commit 54b5172087aeae61150835c91e68f084a9644f1c ]
+
+When the "poweroff" command is executed after wowlan enabled, we have
+observed a system crash. In the system "poweroff" sequence, network-manager
+is sent to inactive state by cleaning up the network interfaces, using
+rsi_mac80211_remove_interface() and when driver tries to access those
+network interfaces in rsi_wowlan_config() which was invoked by SDIO
+shutdown, results in a crash. Added a NULL check before accessing the
+network interfaces in rsi_wowlan_config().
+
+Signed-off-by: Sanjay Kumar Konduri <sanjay.konduri@redpinesignals.com>
+Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_mac80211.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -1788,10 +1788,15 @@ int rsi_config_wowlan(struct rsi_hw *ada
+ struct rsi_common *common = adapter->priv;
+ u16 triggers = 0;
+ u16 rx_filter_word = 0;
+- struct ieee80211_bss_conf *bss = &adapter->vifs[0]->bss_conf;
++ struct ieee80211_bss_conf *bss = NULL;
+
+ rsi_dbg(INFO_ZONE, "Config WoWLAN to device\n");
+
++ if (!adapter->vifs[0])
++ return -EINVAL;
++
++ bss = &adapter->vifs[0]->bss_conf;
++
+ if (WARN_ON(!wowlan)) {
+ rsi_dbg(ERR_ZONE, "WoW triggers not enabled\n");
+ return -EINVAL;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Date: Wed, 11 Apr 2018 12:13:32 +0530
+Subject: rsi: Fix 'invalid vdd' warning in mmc
+
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+
+[ Upstream commit 78e450719c702784e42af6da912d3692fd3da0cb ]
+
+While performing cleanup, driver is messing with card->ocr
+value by not masking rocr against ocr_avail. Below panic
+is observed with some of the SDIO host controllers due to
+this. Issue is resolved by reverting incorrect modifications
+to vdd.
+
+[ 927.423821] mmc1: Invalid vdd 0x1f
+[ 927.423925] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x
+ mac80211 cfg80211 btrsi rfcomm bluetooth ecdh_generic
+[ 927.424073] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000-caracalla #1
+[ 927.424075] Hardware name: Dell Inc. Edge Gateway 3003/ , BIOS 01.00.06 01/22/2018
+[ 927.424082] RIP: 0010:sdhci_set_power_noreg+0xdd/0x190[sdhci]
+[ 927.424085] RSP: 0018:ffffac3fc064b930 EFLAGS: 00010282
+[ 927.424107] Call Trace:
+[ 927.424118] sdhci_set_power+0x5a/0x60 [sdhci]
+[ 927.424125] sdhci_set_ios+0x360/0x3b0 [sdhci]
+[ 927.424133] mmc_set_initial_state+0x92/0x120
+[ 927.424137] mmc_power_up.part.34+0x33/0x1d0
+[ 927.424141] mmc_power_up+0x17/0x20
+[ 927.424147] mmc_sdio_runtime_resume+0x2d/0x50
+[ 927.424151] mmc_runtime_resume+0x17/0x20
+[ 927.424156] __rpm_callback+0xc4/0x200
+[ 927.424161] ? idr_alloc_cyclic+0x57/0xd0
+[ 927.424165] ? mmc_runtime_suspend+0x20/0x20
+[ 927.424169] rpm_callback+0x24/0x80
+[ 927.424172] ? mmc_runtime_suspend+0x20/0x20
+[ 927.424176] rpm_resume+0x4b3/0x6c0
+[ 927.424181] __pm_runtime_resume+0x4e/0x80
+[ 927.424188] driver_probe_device+0x41/0x490
+[ 927.424192] __driver_attach+0xdf/0xf0
+[ 927.424196] ? driver_probe_device+0x490/0x490
+[ 927.424201] bus_for_each_dev+0x6c/0xc0
+[ 927.424205] driver_attach+0x1e/0x20
+[ 927.424209] bus_add_driver+0x1f4/0x270
+[ 927.424217] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
+[ 927.424221] driver_register+0x60/0xe0
+[ 927.424227] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
+[ 927.424231] sdio_register_driver+0x20/0x30
+[ 927.424237] rsi_module_init+0x16/0x40 [rsi_sdio]
+
+Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -170,7 +170,6 @@ static void rsi_reset_card(struct sdio_f
+ int err;
+ struct mmc_card *card = pfunction->card;
+ struct mmc_host *host = card->host;
+- s32 bit = (fls(host->ocr_avail) - 1);
+ u8 cmd52_resp;
+ u32 clock, resp, i;
+ u16 rca;
+@@ -190,7 +189,6 @@ static void rsi_reset_card(struct sdio_f
+ msleep(20);
+
+ /* Initialize the SDIO card */
+- host->ios.vdd = bit;
+ host->ios.chip_select = MMC_CS_DONTCARE;
+ host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
+ host->ios.power_mode = MMC_POWER_UP;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Date: Wed, 11 Apr 2018 12:13:31 +0530
+Subject: rsi: fix nommu_map_sg overflow kernel panic
+
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+
+[ Upstream commit f700546682a62a87a9615121a37ee7452dab4b76 ]
+
+Following overflow kernel panic is observed on some platforms while
+loading the driver. It is fixed if dynamically allocated memory is
+passed to SDIO instead of static one
+
+[ 927.513963] nommu_map_sg: overflow 17d54064ba7c+20 of device mask ffffffff
+[ 927.517712] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x mac80211 cfg80211
+ btrsi rfcomm bluetooth ecdh_generic snd_soc_sst_bytcr_rt5660
+[ 927.517861] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000 #1
+[ 927.517870] RIP: 0010:sdhci_send_command+0x5f0/0xa90 [sdhci]
+[ 927.517873] RSP: 0000:ffffac3fc064b6d8 EFLAGS: 00010086
+[ 927.517895] Call Trace:
+[ 927.517908] ? __schedule+0x3cd/0x890
+[ 927.517915] ? mod_timer+0x17b/0x3c0
+[ 927.517922] sdhci_request+0x7c/0xf0 [sdhci]
+[ 927.517928] __mmc_start_request+0x5a/0x170
+[ 927.517932] mmc_start_request+0x74/0x90
+[ 927.517936] mmc_wait_for_req+0x87/0xe0
+[ 927.517940] mmc_io_rw_extended+0x2fd/0x330
+[ 927.517946] ? mmc_wait_data_done+0x30/0x30
+[ 927.517951] sdio_io_rw_ext_helper+0x160/0x210
+[ 927.517956] sdio_writesb+0x1d/0x20
+[ 927.517966] rsi_sdio_write_register_multiple+0x68/0x110 [rsi_sdio]
+[ 927.517976] rsi_hal_device_init+0x357/0x910 [rsi_91x]
+[ 927.517983] ? rsi_hal_device_init+0x357/0x910 [rsi_91x]
+[ 927.517990] rsi_probe+0x2c6/0x450 [rsi_sdio]
+[ 927.517995] sdio_bus_probe+0xfc/0x110
+[ 927.518000] driver_probe_device+0x2b3/0x490
+[ 927.518005] __driver_attach+0xdf/0xf0
+[ 927.518008] ? driver_probe_device+0x490/0x490
+[ 927.518014] bus_for_each_dev+0x6c/0xc0
+[ 927.518018] driver_attach+0x1e/0x20
+[ 927.518021] bus_add_driver+0x1f4/0x270
+[ 927.518028] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
+[ 927.518031] driver_register+0x60/0xe0
+[ 927.518038] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
+[ 927.518041] sdio_register_driver+0x20/0x30
+[ 927.518047] rsi_module_init+0x16/0x40 [rsi_sdio]
+
+Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_hal.c | 35 +++++++++++++++++++-------------
+ drivers/net/wireless/rsi/rsi_91x_sdio.c | 21 ++++++++++++-------
+ drivers/net/wireless/rsi/rsi_sdio.h | 2 -
+ 3 files changed, 36 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -616,28 +616,32 @@ static int bl_write_header(struct rsi_hw
+ u32 content_size)
+ {
+ struct rsi_host_intf_ops *hif_ops = adapter->host_intf_ops;
+- struct bl_header bl_hdr;
++ struct bl_header *bl_hdr;
+ u32 write_addr, write_len;
+ int status;
+
+- bl_hdr.flags = 0;
+- bl_hdr.image_no = cpu_to_le32(adapter->priv->coex_mode);
+- bl_hdr.check_sum = cpu_to_le32(
+- *(u32 *)&flash_content[CHECK_SUM_OFFSET]);
+- bl_hdr.flash_start_address = cpu_to_le32(
+- *(u32 *)&flash_content[ADDR_OFFSET]);
+- bl_hdr.flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]);
++ bl_hdr = kzalloc(sizeof(*bl_hdr), GFP_KERNEL);
++ if (!bl_hdr)
++ return -ENOMEM;
++
++ bl_hdr->flags = 0;
++ bl_hdr->image_no = cpu_to_le32(adapter->priv->coex_mode);
++ bl_hdr->check_sum =
++ cpu_to_le32(*(u32 *)&flash_content[CHECK_SUM_OFFSET]);
++ bl_hdr->flash_start_address =
++ cpu_to_le32(*(u32 *)&flash_content[ADDR_OFFSET]);
++ bl_hdr->flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]);
+ write_len = sizeof(struct bl_header);
+
+ if (adapter->rsi_host_intf == RSI_HOST_INTF_USB) {
+ write_addr = PING_BUFFER_ADDRESS;
+ status = hif_ops->write_reg_multiple(adapter, write_addr,
+- (u8 *)&bl_hdr, write_len);
++ (u8 *)bl_hdr, write_len);
+ if (status < 0) {
+ rsi_dbg(ERR_ZONE,
+ "%s: Failed to load Version/CRC structure\n",
+ __func__);
+- return status;
++ goto fail;
+ }
+ } else {
+ write_addr = PING_BUFFER_ADDRESS >> 16;
+@@ -646,20 +650,23 @@ static int bl_write_header(struct rsi_hw
+ rsi_dbg(ERR_ZONE,
+ "%s: Unable to set ms word to common reg\n",
+ __func__);
+- return status;
++ goto fail;
+ }
+ write_addr = RSI_SD_REQUEST_MASTER |
+ (PING_BUFFER_ADDRESS & 0xFFFF);
+ status = hif_ops->write_reg_multiple(adapter, write_addr,
+- (u8 *)&bl_hdr, write_len);
++ (u8 *)bl_hdr, write_len);
+ if (status < 0) {
+ rsi_dbg(ERR_ZONE,
+ "%s: Failed to load Version/CRC structure\n",
+ __func__);
+- return status;
++ goto fail;
+ }
+ }
+- return 0;
++ status = 0;
++fail:
++ kfree(bl_hdr);
++ return status;
+ }
+
+ static u32 read_flash_capacity(struct rsi_hw *adapter)
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1040,17 +1040,21 @@ static void ulp_read_write(struct rsi_hw
+ /*This function resets and re-initializes the chip.*/
+ static void rsi_reset_chip(struct rsi_hw *adapter)
+ {
+- __le32 data;
++ u8 *data;
+ u8 sdio_interrupt_status = 0;
+ u8 request = 1;
+ int ret;
+
++ data = kzalloc(sizeof(u32), GFP_KERNEL);
++ if (!data)
++ return;
++
+ rsi_dbg(INFO_ZONE, "Writing disable to wakeup register\n");
+ ret = rsi_sdio_write_register(adapter, 0, SDIO_WAKEUP_REG, &request);
+ if (ret < 0) {
+ rsi_dbg(ERR_ZONE,
+ "%s: Failed to write SDIO wakeup register\n", __func__);
+- return;
++ goto err;
+ }
+ msleep(20);
+ ret = rsi_sdio_read_register(adapter, RSI_FN1_INT_REGISTER,
+@@ -1058,7 +1062,7 @@ static void rsi_reset_chip(struct rsi_hw
+ if (ret < 0) {
+ rsi_dbg(ERR_ZONE, "%s: Failed to Read Intr Status Register\n",
+ __func__);
+- return;
++ goto err;
+ }
+ rsi_dbg(INFO_ZONE, "%s: Intr Status Register value = %d\n",
+ __func__, sdio_interrupt_status);
+@@ -1068,17 +1072,17 @@ static void rsi_reset_chip(struct rsi_hw
+ rsi_dbg(ERR_ZONE,
+ "%s: Unable to set ms word to common reg\n",
+ __func__);
+- return;
++ goto err;
+ }
+
+- data = TA_HOLD_THREAD_VALUE;
++ put_unaligned_le32(TA_HOLD_THREAD_VALUE, data);
+ if (rsi_sdio_write_register_multiple(adapter, TA_HOLD_THREAD_REG |
+ RSI_SD_REQUEST_MASTER,
+- (u8 *)&data, 4)) {
++ data, 4)) {
+ rsi_dbg(ERR_ZONE,
+ "%s: Unable to hold Thread-Arch processor threads\n",
+ __func__);
+- return;
++ goto err;
+ }
+
+ /* This msleep will ensure Thread-Arch processor to go to hold
+@@ -1099,6 +1103,9 @@ static void rsi_reset_chip(struct rsi_hw
+ * read write operations to complete for chip reset.
+ */
+ msleep(500);
++err:
++ kfree(data);
++ return;
+ }
+
+ /**
+--- a/drivers/net/wireless/rsi/rsi_sdio.h
++++ b/drivers/net/wireless/rsi/rsi_sdio.h
+@@ -87,7 +87,7 @@ enum sdio_interrupt_type {
+ #define TA_SOFT_RST_CLR 0
+ #define TA_SOFT_RST_SET BIT(0)
+ #define TA_PC_ZERO 0
+-#define TA_HOLD_THREAD_VALUE cpu_to_le32(0xF)
++#define TA_HOLD_THREAD_VALUE 0xF
+ #define TA_RELEASE_THREAD_VALUE cpu_to_le32(0xF)
+ #define TA_BASE_ADDR 0x2200
+ #define MISC_CFG_BASE_ADDR 0x4105
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Tue, 5 Jun 2018 23:09:14 +0200
+Subject: rtc: ensure rtc_set_alarm fails when alarms are not supported
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]
+
+When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set,
+rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the
+subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that
+case.
+
+Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting
+programs think the alarms are working for a particular RTC when they are
+not.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/interface.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -441,6 +441,11 @@ int rtc_set_alarm(struct rtc_device *rtc
+ {
+ int err;
+
++ if (!rtc->ops)
++ return -ENODEV;
++ else if (!rtc->ops->set_alarm)
++ return -EINVAL;
++
+ err = rtc_valid_tm(&alarm->time);
+ if (err != 0)
+ return err;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 17 May 2018 22:48:17 +0200
+Subject: rtc: tps6586x: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 63d22063073b0ab46d1e06fe633fb5de8f5c58e1 ]
+
+The probe function is not allowed to fail after the RTC is registered
+because the following may happen:
+
+CPU0: CPU1:
+sys_load_module()
+ do_init_module()
+ do_one_initcall()
+ cmos_do_probe()
+ rtc_device_register()
+ __register_chrdev()
+ cdev->owner = struct module*
+ open("/dev/rtc0")
+ rtc_device_unregister()
+ module_put()
+ free_module()
+ module_free(mod->module_core)
+ /* struct module *module is now
+ freed */
+ chrdev_open()
+ spin_lock(cdev_lock)
+ cdev_get()
+ try_module_get()
+ module_is_live()
+ /* dereferences already
+ freed struct module* */
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-tps6586x.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/rtc/rtc-tps6586x.c
++++ b/drivers/rtc/rtc-tps6586x.c
+@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct pla
+ device_init_wakeup(&pdev->dev, 1);
+
+ platform_set_drvdata(pdev, rtc);
+- rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev),
+- &tps6586x_rtc_ops, THIS_MODULE);
++ rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
+ if (IS_ERR(rtc->rtc)) {
+ ret = PTR_ERR(rtc->rtc);
+- dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
++ dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret);
+ goto fail_rtc_register;
+ }
+
++ rtc->rtc->ops = &tps6586x_rtc_ops;
++
+ ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL,
+ tps6586x_rtc_irq,
+ IRQF_ONESHOT,
+@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct pla
+ goto fail_rtc_register;
+ }
+ disable_irq(rtc->irq);
++
++ ret = rtc_register_device(rtc->rtc);
++ if (ret) {
++ dev_err(&pdev->dev, "RTC device register: ret %d\n", ret);
++ goto fail_rtc_register;
++ }
++
+ return 0;
+
+ fail_rtc_register:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 17 May 2018 22:26:21 +0200
+Subject: rtc: tps65910: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit e6000a438e534ee0afd9e83b67f4e23a26dd1067 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-tps65910.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/rtc/rtc-tps65910.c
++++ b/drivers/rtc/rtc-tps65910.c
+@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct pla
+ if (!tps_rtc)
+ return -ENOMEM;
+
++ tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(tps_rtc->rtc))
++ return PTR_ERR(tps_rtc->rtc);
++
+ /* Clear pending interrupts */
+ ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg);
+ if (ret < 0)
+@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct pla
+ tps_rtc->irq = irq;
+ device_set_wakeup_capable(&pdev->dev, 1);
+
+- tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+- &tps65910_rtc_ops, THIS_MODULE);
+- if (IS_ERR(tps_rtc->rtc)) {
+- ret = PTR_ERR(tps_rtc->rtc);
++ tps_rtc->rtc->ops = &tps65910_rtc_ops;
++
++ ret = rtc_register_device(tps_rtc->rtc);
++ if (ret) {
+ dev_err(&pdev->dev, "RTC device register: err %d\n", ret);
+ return ret;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 17 May 2018 22:47:05 +0200
+Subject: rtc: vr41xx: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 9a99247c9c1d1c95c6e8153d013979aac6111c6e ]
+
+The probe function is not allowed to fail after the RTC is registered
+because the following may happen:
+
+CPU0: CPU1:
+sys_load_module()
+ do_init_module()
+ do_one_initcall()
+ cmos_do_probe()
+ rtc_device_register()
+ __register_chrdev()
+ cdev->owner = struct module*
+ open("/dev/rtc0")
+ rtc_device_unregister()
+ module_put()
+ free_module()
+ module_free(mod->module_core)
+ /* struct module *module is now
+ freed */
+ chrdev_open()
+ spin_lock(cdev_lock)
+ cdev_get()
+ try_module_get()
+ module_is_live()
+ /* dereferences already
+ freed struct module* */
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-vr41xx.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-vr41xx.c
++++ b/drivers/rtc/rtc-vr41xx.c
+@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_dev
+ goto err_rtc1_iounmap;
+ }
+
+- rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops,
+- THIS_MODULE);
++ rtc = devm_rtc_allocate_device(&pdev->dev);
+ if (IS_ERR(rtc)) {
+ retval = PTR_ERR(rtc);
+ goto err_iounmap_all;
+ }
+
++ rtc->ops = &vr41xx_rtc_ops;
++
+ rtc->max_user_freq = MAX_PERIODIC_RATE;
+
+ spin_lock_irq(&rtc_lock);
+@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_dev
+
+ dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n");
+
++ retval = rtc_register_device(rtc);
++ if (retval)
++ goto err_iounmap_all;
++
+ return 0;
+
+ err_iounmap_all:
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 6 Jun 2018 14:59:14 +0100
+Subject: rxrpc: Fix terminal retransmission connection ID to include the channel
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit fb1967a69f756073362b8f19347f863f227320ad ]
+
+When retransmitting the final ACK or ABORT packet for a call, the cid field
+in the packet header is set to the connection's cid, but this is incorrect
+as it also needs to include the channel number on that connection that the
+call was made on.
+
+Fix this by OR'ing in the channel number.
+
+Note that this fixes the bug that:
+
+ commit 1a025028d400b23477341aa7ec2ce55f8b39b554
+ rxrpc: Fix handling of call quietly cancelled out on server
+
+works around. I'm not intending to revert that as it will help protect
+against problems that might occur on the server.
+
+Fixes: 3136ef49a14c ("rxrpc: Delay terminal ACK transmission on a client call")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/conn_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -70,7 +70,7 @@ static void rxrpc_conn_retransmit_call(s
+ iov[2].iov_len = sizeof(ack_info);
+
+ pkt.whdr.epoch = htonl(conn->proto.epoch);
+- pkt.whdr.cid = htonl(conn->proto.cid);
++ pkt.whdr.cid = htonl(conn->proto.cid | channel);
+ pkt.whdr.callNumber = htonl(call_id);
+ pkt.whdr.seq = 0;
+ pkt.whdr.type = chan->last_type;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 8 May 2018 10:18:39 +0200
+Subject: s390/cpum_sf: Add data entry sizes to sampling trailer entry
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 77715b7ddb446bd39a06f3376e85f4bb95b29bb8 ]
+
+The CPU Measurement sampling facility creates a trailer entry for each
+Sample-Data-Block of stored samples. The trailer entry contains the sizes
+(in bytes) of the stored sampling types:
+ - basic-sampling data entry size
+ - diagnostic-sampling data entry size
+Both sizes are 2 bytes long.
+
+This patch changes the trailer entry definition to reflect this.
+
+Fixes: fcc77f507333 ("s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/include/asm/cpu_mf.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/s390/include/asm/cpu_mf.h
++++ b/arch/s390/include/asm/cpu_mf.h
+@@ -129,7 +129,9 @@ struct hws_trailer_entry {
+ unsigned int f:1; /* 0 - Block Full Indicator */
+ unsigned int a:1; /* 1 - Alert request control */
+ unsigned int t:1; /* 2 - Timestamp format */
+- unsigned long long:61; /* 3 - 63: Reserved */
++ unsigned int :29; /* 3 - 31: Reserved */
++ unsigned int bsdes:16; /* 32-47: size of basic SDE */
++ unsigned int dsdes:16; /* 48-63: size of diagnostic SDE */
+ };
+ unsigned long long flags; /* 0 - 63: All indicators */
+ };
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Patrick Bellasi <patrick.bellasi@arm.com>
+Date: Thu, 24 May 2018 15:10:22 +0100
+Subject: sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization
+
+From: Patrick Bellasi <patrick.bellasi@arm.com>
+
+[ Upstream commit 8ecf04e11283a28ca88b8b8049ac93c3a99fcd2c ]
+
+Since the refactoring introduced by:
+
+ commit 8f111bc357aa ("cpufreq/schedutil: Rewrite CPUFREQ_RT support")
+
+we aggregate FAIR utilization only if this class has runnable tasks.
+
+This was mainly due to avoid the risk to stay on an high frequency just
+because of the blocked utilization of a CPU not being properly decayed
+while the CPU was idle.
+
+However, since:
+
+ commit 31e77c93e432 ("sched/fair: Update blocked load when newly idle")
+
+the FAIR blocked utilization is properly decayed also for IDLE CPUs.
+
+This allows us to use the FAIR blocked utilization as a safe mechanism
+to gracefully reduce the frequency only if no FAIR tasks show up on a
+CPU for a reasonable period of time.
+
+Moreover, we also reduce the frequency drops of CPUs running periodic
+tasks which, depending on the task periodicity and the time required
+for a frequency switch, was increasing the chances to introduce some
+undesirable performance variations.
+
+Reported-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Patrick Bellasi <patrick.bellasi@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Joel Fernandes <joelaf@google.com>
+Cc: Juri Lelli <juri.lelli@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Morten Rasmussen <morten.rasmussen@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rafael J . Wysocki <rafael.j.wysocki@intel.com>
+Cc: Steve Muckle <smuckle@google.com>
+Link: http://lkml.kernel.org/r/20180524141023.13765-2-patrick.bellasi@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -183,22 +183,21 @@ static void sugov_get_util(struct sugov_
+ static unsigned long sugov_aggregate_util(struct sugov_cpu *sg_cpu)
+ {
+ struct rq *rq = cpu_rq(sg_cpu->cpu);
+- unsigned long util;
+
+- if (rq->rt.rt_nr_running) {
+- util = sg_cpu->max;
+- } else {
+- util = sg_cpu->util_dl;
+- if (rq->cfs.h_nr_running)
+- util += sg_cpu->util_cfs;
+- }
++ if (rq->rt.rt_nr_running)
++ return sg_cpu->max;
+
+ /*
++ * Utilization required by DEADLINE must always be granted while, for
++ * FAIR, we use blocked utilization of IDLE CPUs as a mechanism to
++ * gracefully reduce the frequency when no tasks show up for longer
++ * periods of time.
++ *
+ * Ideally we would like to set util_dl as min/guaranteed freq and
+ * util_cfs + util_dl as requested freq. However, cpufreq is not yet
+ * ready for such an interface. So, we only do the latter for now.
+ */
+- return min(util, sg_cpu->max);
++ return min(sg_cpu->max, (sg_cpu->util_dl + sg_cpu->util_cfs));
+ }
+
+ static void sugov_set_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, unsigned int flags)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Mon, 7 May 2018 19:46:43 -0500
+Subject: scsi: 3w-9xxx: fix a missing-check bug
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+[ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ]
+
+In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from
+the userspace pointer 'argp' and saved to the kernel object
+'driver_command'. Then a security check is performed on the data buffer
+size indicated by 'driver_command', which is
+'driver_command.buffer_length'. If the security check is passed, the
+entire ioctl command is copied again from the 'argp' pointer and saved
+to the kernel object 'tw_ioctl'. Then, various operations are performed
+on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer
+resides in userspace, a malicious userspace process can race to change
+the buffer size between the two copies. This way, the user can bypass
+the security check and inject invalid data buffer size. This can cause
+potential security issues in the following execution.
+
+This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o
+avoid the above issues.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Acked-by: Adam Radford <aradford@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/3w-9xxx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -882,6 +882,11 @@ static int twa_chrdev_open(struct inode
+ unsigned int minor_number;
+ int retval = TW_IOCTL_ERROR_OS_ENODEV;
+
++ if (!capable(CAP_SYS_ADMIN)) {
++ retval = -EACCES;
++ goto out;
++ }
++
+ minor_number = iminor(inode);
+ if (minor_number >= twa_device_extension_count)
+ goto out;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Mon, 7 May 2018 19:54:01 -0500
+Subject: scsi: 3w-xxxx: fix a missing-check bug
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+[ Upstream commit 9899e4d3523faaef17c67141aa80ff2088f17871 ]
+
+In tw_chrdev_ioctl(), the length of the data buffer is firstly copied
+from the userspace pointer 'argp' and saved to the kernel object
+'data_buffer_length'. Then a security check is performed on it to make
+sure that the length is not more than 'TW_MAX_IOCTL_SECTORS *
+512'. Otherwise, an error code -EINVAL is returned. If the security
+check is passed, the entire ioctl command is copied again from the
+'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various
+operations are performed on 'tw_ioctl' according to the 'cmd'. Given
+that the 'argp' pointer resides in userspace, a malicious userspace
+process can race to change the buffer length between the two
+copies. This way, the user can bypass the security check and inject
+invalid data buffer length. This can cause potential security issues in
+the following execution.
+
+This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to
+avoid the above issues.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Acked-by: Adam Radford <aradford@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/3w-xxxx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *
+
+ dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++
+ minor_number = iminor(inode);
+ if (minor_number >= tw_device_extension_count)
+ return -ENODEV;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: "Matthew R. Ochs" <mrochs@linux.vnet.ibm.com>
+Date: Mon, 26 Mar 2018 11:30:22 -0500
+Subject: scsi: cxlflash: Avoid clobbering context control register value
+
+From: "Matthew R. Ochs" <mrochs@linux.vnet.ibm.com>
+
+[ Upstream commit 465891fe9237b02f8d0fd26448f733fae7236f4a ]
+
+The SISLite specification originally defined the context control register with
+a single field of bits to represent the LISN and also stipulated that the
+register reset value be 0. The cxlflash driver took advantage of this when
+programming the LISN for the master contexts via an unconditional write - no
+other bits were preserved.
+
+When unmap support was added, SISLite was updated to define bit 0 of the
+context control register as a way for the AFU to notify the context owner that
+unmap operations were supported. Thus the assumptions under which the register
+is setup changed and the existing unconditional write is clobbering the unmap
+state for master contexts. This is presently not an issue due to the order in
+which the context control register is programmed in relation to the unmap bit
+being queried but should be addressed to avoid a future regression in the
+event this code is moved elsewhere.
+
+To remedy this issue, preserve the bits when programming the LISN field in the
+context control register. Since the LISN will now be programmed using a read
+value, assert that the initial state of the LISN field is as described in
+SISLite (0).
+
+Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
+Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/cxlflash/main.c | 5 ++++-
+ drivers/scsi/cxlflash/sislite.h | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -1303,7 +1303,10 @@ static void afu_err_intr_init(struct afu
+ for (i = 0; i < afu->num_hwqs; i++) {
+ hwq = get_hwq(afu, i);
+
+- writeq_be(SISL_MSI_SYNC_ERROR, &hwq->host_map->ctx_ctrl);
++ reg = readq_be(&hwq->host_map->ctx_ctrl);
++ WARN_ON((reg & SISL_CTX_CTRL_LISN_MASK) != 0);
++ reg |= SISL_MSI_SYNC_ERROR;
++ writeq_be(reg, &hwq->host_map->ctx_ctrl);
+ writeq_be(SISL_ISTATUS_MASK, &hwq->host_map->intr_mask);
+ }
+ }
+--- a/drivers/scsi/cxlflash/sislite.h
++++ b/drivers/scsi/cxlflash/sislite.h
+@@ -284,6 +284,7 @@ struct sisl_host_map {
+ __be64 cmd_room;
+ __be64 ctx_ctrl; /* least significant byte or b56:63 is LISN# */
+ #define SISL_CTX_CTRL_UNMAP_SECTOR 0x8000000000000000ULL /* b0 */
++#define SISL_CTX_CTRL_LISN_MASK (0xFFULL)
+ __be64 mbox_w; /* restricted use */
+ __be64 sq_start; /* Submission Queue (R/W): write sequence and */
+ __be64 sq_end; /* inclusion semantics are the same as RRQ */
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+Date: Mon, 26 Mar 2018 11:35:27 -0500
+Subject: scsi: cxlflash: Synchronize reset and remove ops
+
+From: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+
+[ Upstream commit a3feb6ef50def7c91244d7bd15a3625b7b49b81f ]
+
+The following Oops can be encountered if a device removal or system shutdown
+is initiated while an EEH recovery is in process:
+
+[c000000ff2f479c0] c008000015256f18 cxlflash_pci_slot_reset+0xa0/0x100
+ [cxlflash]
+[c000000ff2f47a30] c00800000dae22e0 cxl_pci_slot_reset+0x168/0x290 [cxl]
+[c000000ff2f47ae0] c00000000003ef1c eeh_report_reset+0xec/0x170
+[c000000ff2f47b20] c00000000003d0b8 eeh_pe_dev_traverse+0x98/0x170
+[c000000ff2f47bb0] c00000000003f80c eeh_handle_normal_event+0x56c/0x580
+[c000000ff2f47c60] c00000000003fba4 eeh_handle_event+0x2a4/0x338
+[c000000ff2f47d10] c0000000000400b8 eeh_event_handler+0x1f8/0x200
+[c000000ff2f47dc0] c00000000013da48 kthread+0x1a8/0x1b0
+[c000000ff2f47e30] c00000000000b528 ret_from_kernel_thread+0x5c/0xb4
+
+The remove handler frees AFU memory while the EEH recovery is in progress,
+leading to a race condition. This can result in a crash if the recovery thread
+tries to access this memory.
+
+To resolve this issue, the cxlflash remove handler will evaluate the device
+state and yield to any active reset or probing threads.
+
+Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/cxlflash/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -946,9 +946,9 @@ static void cxlflash_remove(struct pci_d
+ return;
+ }
+
+- /* If a Task Management Function is active, wait for it to complete
+- * before continuing with remove.
+- */
++ /* Yield to running recovery threads before continuing with remove */
++ wait_event(cfg->reset_waitq, cfg->state != STATE_RESET &&
++ cfg->state != STATE_PROBING);
+ spin_lock_irqsave(&cfg->tmf_slock, lock_flags);
+ if (cfg->tmf_active)
+ wait_event_interruptible_lock_irq(cfg->tmf_waitq,
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Xiang Chen <chenxiang66@hisilicon.com>
+Date: Wed, 2 May 2018 23:56:31 +0800
+Subject: scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 9413532788df7470297dd0475995c5dc5b07f362 ]
+
+As a unconstrained command, a command can be sent to SATA disk even if
+SATA disk status is BUSY, ERR or DRQ.
+
+If an ATA reset assert is successful but ATA reset de-assert fails, then
+it will retry the reset de-assert. If reset de- assert retry is
+successful, we think it is okay to probe the device but actually it
+still has Err status.
+
+Apparently we need to retry the ATA reset assertion and de- assertion
+instead for this mentioned scenario.
+
+As such, we config ATA reset assert as a constrained command, if ATA
+reset de-assert fails, then ATA reset de-assert retry will also
+fail. Then we will retry the proper process of ATA reset assert and
+de-assert again.
+
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -348,10 +348,11 @@ struct hisi_sas_err_record_v3 {
+ #define DIR_TO_DEVICE 2
+ #define DIR_RESERVED 3
+
+-#define CMD_IS_UNCONSTRAINT(cmd) \
+- ((cmd == ATA_CMD_READ_LOG_EXT) || \
+- (cmd == ATA_CMD_READ_LOG_DMA_EXT) || \
+- (cmd == ATA_CMD_DEV_RESET))
++#define FIS_CMD_IS_UNCONSTRAINED(fis) \
++ ((fis.command == ATA_CMD_READ_LOG_EXT) || \
++ (fis.command == ATA_CMD_READ_LOG_DMA_EXT) || \
++ ((fis.command == ATA_CMD_DEV_RESET) && \
++ ((fis.control & ATA_SRST) != 0)))
+
+ static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off)
+ {
+@@ -1046,7 +1047,7 @@ static int prep_ata_v3_hw(struct hisi_hb
+ << CMD_HDR_FRAME_TYPE_OFF;
+ dw1 |= sas_dev->device_id << CMD_HDR_DEV_ID_OFF;
+
+- if (CMD_IS_UNCONSTRAINT(task->ata_task.fis.command))
++ if (FIS_CMD_IS_UNCONSTRAINED(task->ata_task.fis))
+ dw1 |= 1 << CMD_HDR_UNCON_CMD_OFF;
+
+ hdr->dw1 = cpu_to_le32(dw1);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 3 May 2018 13:54:32 +0300
+Subject: scsi: megaraid: silence a static checker bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 27e833dabab74ee665e487e291c9afc6d71effba ]
+
+If we had more than 32 megaraid cards then it would cause memory
+corruption. That's not likely, of course, but it's handy to enforce it
+and make the static checker happy.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/megaraid.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4199,6 +4199,9 @@ megaraid_probe_one(struct pci_dev *pdev,
+ int irq, i, j;
+ int error = -ENODEV;
+
++ if (hba_count >= MAX_CONTROLLERS)
++ goto out;
++
+ if (pci_enable_device(pdev))
+ goto out;
+ pci_set_master(pdev);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Date: Fri, 6 Apr 2018 02:02:11 -0700
+Subject: scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs
+
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+
+[ Upstream commit 3239b8cd28fd849a2023483257d35d68c5876c74 ]
+
+Hardware could time out Fastpath IOs one second earlier than the timeout
+provided by the host.
+
+For non-RAID devices, driver provides timeout value based on OS provided
+timeout value. Under certain scenarios, if the OS provides a timeout
+value of 1 second, due to above behavior hardware will timeout
+immediately.
+
+Increase timeout value for non-RAID fastpath IOs by 1 second.
+
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2981,6 +2981,9 @@ megasas_build_syspd_fusion(struct megasa
+ pRAID_Context->timeout_value = cpu_to_le16(os_timeout_value);
+ pRAID_Context->virtual_disk_tgt_id = cpu_to_le16(device_id);
+ } else {
++ if (os_timeout_value)
++ os_timeout_value++;
++
+ /* system pd Fast Path */
+ io_request->Function = MPI2_FUNCTION_SCSI_IO_REQUEST;
+ timeout_limit = (scmd->device->type == TYPE_DISK) ?
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Chad Dupuis <chad.dupuis@cavium.com>
+Date: Wed, 25 Apr 2018 06:09:02 -0700
+Subject: scsi: qedf: Set the UNLOADING flag when removing a vport
+
+From: Chad Dupuis <chad.dupuis@cavium.com>
+
+[ Upstream commit 4f4616ceebaf045c59e8a6aa01f08826d18d5c63 ]
+
+Similar to what we do when we remove a PCI function, set the
+QEDF_UNLOADING flag to prevent any requests from being queued while a
+vport is being deleted. This prevents any requests from getting stuck
+in limbo when the vport is unloaded or deleted.
+
+Fixes the crash:
+
+PID: 106676 TASK: ffff9a436aa90000 CPU: 12 COMMAND: "multipathd"
+ #0 [ffff9a43567d3550] machine_kexec+522 at ffffffffaca60b2a
+ #1 [ffff9a43567d35b0] __crash_kexec+114 at ffffffffacb13512
+ #2 [ffff9a43567d3680] crash_kexec+48 at ffffffffacb13600
+ #3 [ffff9a43567d3698] oops_end+168 at ffffffffad117768
+ #4 [ffff9a43567d36c0] no_context+645 at ffffffffad106f52
+ #5 [ffff9a43567d3710] __bad_area_nosemaphore+116 at ffffffffad106fe9
+ #6 [ffff9a43567d3760] bad_area+70 at ffffffffad107379
+ #7 [ffff9a43567d3788] __do_page_fault+1247 at ffffffffad11a8cf
+ #8 [ffff9a43567d37f0] do_page_fault+53 at ffffffffad11a915
+ #9 [ffff9a43567d3820] page_fault+40 at ffffffffad116768
+ [exception RIP: qedf_init_task+61]
+ RIP: ffffffffc0e13c2d RSP: ffff9a43567d38d0 RFLAGS: 00010046
+ RAX: 0000000000000000 RBX: ffffbe920472c738 RCX: ffff9a434fa0e3e8
+ RDX: ffff9a434f695280 RSI: ffffbe920472c738 RDI: ffff9a43aa359c80
+ RBP: ffff9a43567d3950 R8: 0000000000000c15 R9: ffff9a3fb09b9880
+ R10: ffff9a434fa0e3e8 R11: ffff9a43567d35ce R12: 0000000000000000
+ R13: ffff9a434f695280 R14: ffff9a43aa359c80 R15: ffff9a3fb9e005c0
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+
+Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -1647,6 +1647,15 @@ static int qedf_vport_destroy(struct fc_
+ struct Scsi_Host *shost = vport_to_shost(vport);
+ struct fc_lport *n_port = shost_priv(shost);
+ struct fc_lport *vn_port = vport->dd_data;
++ struct qedf_ctx *qedf = lport_priv(vn_port);
++
++ if (!qedf) {
++ QEDF_ERR(NULL, "qedf is NULL.\n");
++ goto out;
++ }
++
++ /* Set unloading bit on vport qedf_ctx to prevent more I/O */
++ set_bit(QEDF_UNLOADING, &qedf->flags);
+
+ mutex_lock(&n_port->lp_mutex);
+ list_del(&vn_port->list);
+@@ -1673,6 +1682,7 @@ static int qedf_vport_destroy(struct fc_
+ if (vn_port->host)
+ scsi_host_put(vn_port->host);
+
++out:
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Date: Sat, 7 Apr 2018 00:47:23 +0200
+Subject: scsi: scsi_dh: replace too broad "TP9" string with the exact models
+
+From: Xose Vazquez Perez <xose.vazquez@gmail.com>
+
+[ Upstream commit 37b37d2609cb0ac267280ef27350b962d16d272e ]
+
+SGI/TP9100 is not an RDAC array:
+ ^^^
+https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=blob;f=libmultipath/hwtable.c;h=88b4700beb1d8940008020fbe4c3cd97d62f4a56;hb=HEAD#l235
+
+This partially reverts commit 35204772ea03 ("[SCSI] scsi_dh_rdac :
+Consolidate rdac strings together")
+
+[mkp: fixed up the new entries to align with rest of struct]
+
+Cc: NetApp RDAC team <ng-eseries-upstream-maintainers@netapp.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: SCSI ML <linux-scsi@vger.kernel.org>
+Cc: DM ML <dm-devel@redhat.com>
+Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_dh.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -58,7 +58,10 @@ static const struct scsi_dh_blist scsi_d
+ {"IBM", "3526", "rdac", },
+ {"IBM", "3542", "rdac", },
+ {"IBM", "3552", "rdac", },
+- {"SGI", "TP9", "rdac", },
++ {"SGI", "TP9300", "rdac", },
++ {"SGI", "TP9400", "rdac", },
++ {"SGI", "TP9500", "rdac", },
++ {"SGI", "TP9700", "rdac", },
+ {"SGI", "IS", "rdac", },
+ {"STK", "OPENstorage", "rdac", },
+ {"STK", "FLEXLINE 380", "rdac", },
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Maya Erez <merez@codeaurora.org>
+Date: Thu, 3 May 2018 16:37:16 +0530
+Subject: scsi: ufs: fix exception event handling
+
+From: Maya Erez <merez@codeaurora.org>
+
+[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ]
+
+The device can set the exception event bit in one of the response UPIU,
+for example to notify the need for urgent BKOPs operation. In such a
+case, the host driver calls ufshcd_exception_event_handler to handle
+this notification. When trying to check the exception event status (for
+finding the cause for the exception event), the device may be busy with
+additional SCSI commands handling and may not respond within the 100ms
+timeout.
+
+To prevent that, we need to block SCSI commands during handling of
+exception events and allow retransmissions of the query requests, in
+case of timeout.
+
+Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
+Reviewed-by: Subhash Jadavani <subhashj@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4969,6 +4969,7 @@ static void ufshcd_exception_event_handl
+ hba = container_of(work, struct ufs_hba, eeh_work);
+
+ pm_runtime_get_sync(hba->dev);
++ scsi_block_requests(hba->host);
+ err = ufshcd_get_ee_status(hba, &status);
+ if (err) {
+ dev_err(hba->dev, "%s: failed to get exception status %d\n",
+@@ -4982,6 +4983,7 @@ static void ufshcd_exception_event_handl
+ ufshcd_bkops_exception_event_handler(hba);
+
+ out:
++ scsi_unblock_requests(hba->host);
+ pm_runtime_put_sync(hba->dev);
+ return;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Subhash Jadavani <subhashj@codeaurora.org>
+Date: Thu, 3 May 2018 16:37:17 +0530
+Subject: scsi: ufs: ufshcd: fix possible unclocked register access
+
+From: Subhash Jadavani <subhashj@codeaurora.org>
+
+[ Upstream commit b334456ec2021b1addc19806990115e69ec4ac32 ]
+
+Vendor specific setup_clocks ops may depend on clocks managed by ufshcd
+driver so if the vendor specific setup_clocks callback is called when
+the required clocks are turned off, it results into unclocked register
+access.
+
+This change make sure that required clocks are enabled before vendor
+specific setup_clocks callback is called.
+
+Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
+Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6799,9 +6799,16 @@ static int __ufshcd_setup_clocks(struct
+ if (list_empty(head))
+ goto out;
+
+- ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
+- if (ret)
+- return ret;
++ /*
++ * vendor specific setup_clocks ops may depend on clocks managed by
++ * this standard driver hence call the vendor specific setup_clocks
++ * before disabling the clocks managed here.
++ */
++ if (!on) {
++ ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE);
++ if (ret)
++ return ret;
++ }
+
+ list_for_each_entry(clki, head, list) {
+ if (!IS_ERR_OR_NULL(clki->clk)) {
+@@ -6825,9 +6832,16 @@ static int __ufshcd_setup_clocks(struct
+ }
+ }
+
+- ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
+- if (ret)
+- return ret;
++ /*
++ * vendor specific setup_clocks ops may depend on clocks managed by
++ * this standard driver hence call the vendor specific setup_clocks
++ * after enabling the clocks managed here.
++ */
++ if (on) {
++ ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE);
++ if (ret)
++ return ret;
++ }
+
+ out:
+ if (ret) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Jens Remus <jremus@linux.ibm.com>
+Date: Thu, 17 May 2018 19:15:05 +0200
+Subject: scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger
+
+From: Jens Remus <jremus@linux.ibm.com>
+
+[ Upstream commit 9e156c54ace310ce7fb1cd960e62416947f3d47c ]
+
+Otherwise iterating with list_for_each() over the adapter->erp_ready_head
+and adapter->erp_running_head lists can lead to an infinite loop. See commit
+"zfcp: fix infinite iteration on erp_ready_head list".
+
+The run-time check is only performed for debug kernels which have the kernel
+lock validator enabled. Following is an example of the warning that is
+reported, if the ERP lock is not held when calling zfcp_dbf_rec_trig():
+
+WARNING: CPU: 0 PID: 604 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x172/0x188
+Modules linked in: ...
+CPU: 0 PID: 604 Comm: kworker/u128:3 Not tainted 4.16.0-... #1
+Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
+Workqueue: zfcp_q_0.0.1906 zfcp_scsi_rport_work
+Krnl PSW : 00000000330fdbf9 00000000367e9728 (zfcp_dbf_rec_trig+0x172/0x188)
+ R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
+Krnl GPRS: 00000000c57a5d99 3288200000000000 0000000000000000 000000006cc82740
+ 00000000009d09d6 0000000000000000 00000000000000ff 0000000000000000
+ 0000000000000000 0000000000e1b5fe 000000006de01d38 0000000076130958
+ 000000006cc82548 000000006de01a98 00000000009d09d6 000000006a6d3c80
+Krnl Code: 00000000009d0ad2: eb7ff0b80004 lmg %r7,%r15,184(%r15)
+ 00000000009d0ad8: c0f4000d7dd0 brcl 15,b80678
+ #00000000009d0ade: a7f40001 brc 15,9d0ae0
+ >00000000009d0ae2: a7f4ff7d brc 15,9d09dc
+ 00000000009d0ae6: e340f0f00004 lg %r4,240(%r15)
+ 00000000009d0aec: eb7ff0b80004 lmg %r7,%r15,184(%r15)
+ 00000000009d0af2: 07f4 bcr 15,%r4
+ 00000000009d0af4: 0707 bcr 0,%r7
+Call Trace:
+([<00000000009d09d6>] zfcp_dbf_rec_trig+0x66/0x188)
+ [<00000000009dd740>] zfcp_scsi_rport_work+0x98/0x190
+ [<0000000000169b34>] process_one_work+0x3d4/0x6f8
+ [<000000000016a08a>] worker_thread+0x232/0x418
+ [<000000000017219e>] kthread+0x166/0x178
+ [<0000000000b815ea>] kernel_thread_starter+0x6/0xc
+ [<0000000000b815e4>] kernel_thread_starter+0x0/0xc
+2 locks held by kworker/u128:3/604:
+ #0: ((wq_completion)name){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
+ #1: ((work_completion)(&port->rport_work)){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8
+Last Breaking-Event-Address:
+ [<00000000009d0ade>] zfcp_dbf_rec_trig+0x16e/0x188
+---[ end trace b2f4020572e2c124 ]---
+
+Suggested-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Jens Remus <jremus@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Reviewed-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/scsi/zfcp_dbf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct
+ struct list_head *entry;
+ unsigned long flags;
+
++ lockdep_assert_held(&adapter->erp_lock);
++
+ if (unlikely(!debug_level_enabled(dbf->rec, level)))
+ return;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Wed, 18 Apr 2018 09:52:55 +0200
+Subject: selftests/filesystems: devpts_pts included wrong header
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit dd4b16b4f9b1b7d9f4a185cb8222e42f3a5daf00 ]
+
+We were picking up the wrong header should use asm/ioctls.h form the kernel
+and not the header from the system (sys/ioctl.h). In the current code we
+added the correct include and we added the kernel headers path to the CFLAGS.
+
+Fixes: ce290a19609d ("selftests: add devpts selftests")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/filesystems/Makefile | 1 +
+ tools/testing/selftests/filesystems/devpts_pts.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/filesystems/Makefile
++++ b/tools/testing/selftests/filesystems/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+
++CFLAGS += -I../../../../usr/include/
+ TEST_GEN_PROGS := devpts_pts
+ TEST_GEN_PROGS_EXTENDED := dnotify_test
+
+--- a/tools/testing/selftests/filesystems/devpts_pts.c
++++ b/tools/testing/selftests/filesystems/devpts_pts.c
+@@ -8,7 +8,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <unistd.h>
+-#include <sys/ioctl.h>
++#include <asm/ioctls.h>
+ #include <sys/mount.h>
+ #include <sys/wait.h>
+ #include "../kselftest.h"
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Thu, 3 May 2018 16:21:20 -0600
+Subject: selftests: filesystems: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 7357dcf2ef2811156fdf223a9a27f73528934e1f ]
+
+When devpts_pts test is skipped because of unmet dependencies and/or
+unsupported configuration, it exits with error which is treated as
+a fail by the Kselftest framework. This leads to false negative
+result even when the test could not be run.
+
+In another case, it returns pass for a skipped test reporting a false
+postive.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run.
+
+Change it to use ksft_exit_skip() when test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/filesystems/devpts_pts.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/tools/testing/selftests/filesystems/devpts_pts.c
++++ b/tools/testing/selftests/filesystems/devpts_pts.c
+@@ -11,6 +11,7 @@
+ #include <sys/ioctl.h>
+ #include <sys/mount.h>
+ #include <sys/wait.h>
++#include "../kselftest.h"
+
+ static bool terminal_dup2(int duplicate, int original)
+ {
+@@ -125,10 +126,12 @@ static int do_tiocgptpeer(char *ptmx, ch
+ if (errno == EINVAL) {
+ fprintf(stderr, "TIOCGPTPEER is not supported. "
+ "Skipping test.\n");
+- fret = EXIT_SUCCESS;
++ fret = KSFT_SKIP;
++ } else {
++ fprintf(stderr,
++ "Failed to perform TIOCGPTPEER ioctl\n");
++ fret = EXIT_FAILURE;
+ }
+-
+- fprintf(stderr, "Failed to perform TIOCGPTPEER ioctl\n");
+ goto do_cleanup;
+ }
+
+@@ -281,7 +284,7 @@ int main(int argc, char *argv[])
+ if (!isatty(STDIN_FILENO)) {
+ fprintf(stderr, "Standard input file desciptor is not attached "
+ "to a terminal. Skipping test\n");
+- exit(EXIT_FAILURE);
++ exit(KSFT_SKIP);
+ }
+
+ ret = unshare(CLONE_NEWNS);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Daniel Díaz" <daniel.diaz@linaro.org>
+Date: Tue, 10 Apr 2018 17:11:15 -0500
+Subject: selftests/intel_pstate: Improve test, minor fixes
+
+From: "Daniel Díaz" <daniel.diaz@linaro.org>
+
+[ Upstream commit e9d33f149f52981fd856a0b16aa8ebda89b02e34 ]
+
+A few changes improve the overall usability of the test:
+* fix a hard-coded maximum frequency (3300),
+* don't adjust the CPU frequency if only evaluating results,
+* fix a comparison for multiple frequencies.
+
+A symptom of that last issue looked like this:
+ ./run.sh: line 107: [: too many arguments
+ ./run.sh: line 110: 3099
+ 3099
+ 3100-3100: syntax error in expression (error token is \"3099
+ 3100-3100\")
+
+Because a check will count how many differente frequencies
+there are among the CPUs of the system, and after they are
+tallied another read is performed, which might produce
+different results.
+
+Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/intel_pstate/run.sh | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+--- a/tools/testing/selftests/intel_pstate/run.sh
++++ b/tools/testing/selftests/intel_pstate/run.sh
+@@ -48,11 +48,12 @@ function run_test () {
+
+ echo "sleeping for 5 seconds"
+ sleep 5
+- num_freqs=$(cat /proc/cpuinfo | grep MHz | sort -u | wc -l)
+- if [ $num_freqs -le 2 ]; then
+- cat /proc/cpuinfo | grep MHz | sort -u | tail -1 > /tmp/result.$1
++ grep MHz /proc/cpuinfo | sort -u > /tmp/result.freqs
++ num_freqs=$(wc -l /tmp/result.freqs | awk ' { print $1 } ')
++ if [ $num_freqs -ge 2 ]; then
++ tail -n 1 /tmp/result.freqs > /tmp/result.$1
+ else
+- cat /proc/cpuinfo | grep MHz | sort -u > /tmp/result.$1
++ cp /tmp/result.freqs /tmp/result.$1
+ fi
+ ./msr 0 >> /tmp/result.$1
+
+@@ -82,21 +83,20 @@ _max_freq=$(cpupower frequency-info -l |
+ max_freq=$(($_max_freq / 1000))
+
+
+-for freq in `seq $max_freq -100 $min_freq`
++[ $EVALUATE_ONLY -eq 0 ] && for freq in `seq $max_freq -100 $min_freq`
+ do
+ echo "Setting maximum frequency to $freq"
+ cpupower frequency-set -g powersave --max=${freq}MHz >& /dev/null
+- [ $EVALUATE_ONLY -eq 0 ] && run_test $freq
++ run_test $freq
+ done
+
+-echo "=============================================================================="
++[ $EVALUATE_ONLY -eq 0 ] && cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null
+
++echo "=============================================================================="
+ echo "The marketing frequency of the cpu is $mkt_freq MHz"
+ echo "The maximum frequency of the cpu is $max_freq MHz"
+ echo "The minimum frequency of the cpu is $min_freq MHz"
+
+-cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null
+-
+ # make a pretty table
+ echo "Target Actual Difference MSR(0x199) max_perf_pct"
+ for freq in `seq $max_freq -100 $min_freq`
+@@ -104,10 +104,6 @@ do
+ result_freq=$(cat /tmp/result.${freq} | grep "cpu MHz" | awk ' { print $4 } ' | awk -F "." ' { print $1 } ')
+ msr=$(cat /tmp/result.${freq} | grep "msr" | awk ' { print $3 } ')
+ max_perf_pct=$(cat /tmp/result.${freq} | grep "max_perf_pct" | awk ' { print $2 } ' )
+- if [ $result_freq -eq $freq ]; then
+- echo " $freq $result_freq 0 $msr $(($max_perf_pct*3300))"
+- else
+- echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))"
+- fi
++ echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))"
+ done
+ exit 0
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Thu, 3 May 2018 17:09:40 -0600
+Subject: selftests: intel_pstate: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 5c30a038fb8ec8cdff011e6b5d5d51eb415381d4 ]
+
+When intel_pstate test is skipped because of unmet dependencies and/or
+unsupported configuration, it returns 0 which is treated as a pass
+by the Kselftest framework. This leads to false positive result even
+when the test could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to
+clearly report that the test could not be run.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/intel_pstate/run.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/intel_pstate/run.sh
++++ b/tools/testing/selftests/intel_pstate/run.sh
+@@ -30,9 +30,12 @@
+
+ EVALUATE_ONLY=0
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then
+ echo "$0 # Skipped: Test can only run on x86 architectures."
+- exit 0
++ exit $ksft_skip
+ fi
+
+ max_cpus=$(($(nproc)-1))
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Thu, 3 May 2018 19:53:03 -0600
+Subject: selftests: kvm: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit ab0e9c4b91ca902b1cae593b3dec9c4c7a724f9f ]
+
+When kvm test is skipped because of unmet dependencies and/or unsupported
+configuration, it exits with error which is treated as a fail by the
+Kselftest framework. This leads to false negative result even when the test
+could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to clearly
+report that the test could not be run.
+
+Change it to use ksft_exit_skip() when the test is skipped. In addition,
+refine test_assert() message to include strerror() string and add explicit
+check for EACCES to cleary identify when test doesn't run when access is
+denied to resources required e.g: open /dev/kvm failed, rc: -1 errno: 13
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/kvm/lib/assert.c | 9 +++++++--
+ tools/testing/selftests/kvm/vmx_tsc_adjust_test.c | 2 ++
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/kvm/lib/assert.c
++++ b/tools/testing/selftests/kvm/lib/assert.c
+@@ -13,6 +13,8 @@
+ #include <execinfo.h>
+ #include <sys/syscall.h>
+
++#include "../../kselftest.h"
++
+ /* Dumps the current stack trace to stderr. */
+ static void __attribute__((noinline)) test_dump_stack(void);
+ static void test_dump_stack(void)
+@@ -70,8 +72,9 @@ test_assert(bool exp, const char *exp_st
+
+ fprintf(stderr, "==== Test Assertion Failure ====\n"
+ " %s:%u: %s\n"
+- " pid=%d tid=%d\n",
+- file, line, exp_str, getpid(), gettid());
++ " pid=%d tid=%d - %s\n",
++ file, line, exp_str, getpid(), gettid(),
++ strerror(errno));
+ test_dump_stack();
+ if (fmt) {
+ fputs(" ", stderr);
+@@ -80,6 +83,8 @@ test_assert(bool exp, const char *exp_st
+ }
+ va_end(ap);
+
++ if (errno == EACCES)
++ ksft_exit_skip("Access denied - Exiting.\n");
+ exit(254);
+ }
+
+--- a/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
++++ b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
+@@ -28,6 +28,8 @@
+ #include <string.h>
+ #include <sys/ioctl.h>
+
++#include "../kselftest.h"
++
+ #ifndef MSR_IA32_TSC_ADJUST
+ #define MSR_IA32_TSC_ADJUST 0x3b
+ #endif
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Fri, 4 May 2018 13:33:37 -0600
+Subject: selftests: memfd: return Kselftest Skip code for skipped tests
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit b27f0259e8cea74c627327c063742a83613dd460 ]
+
+When memfd test is skipped because of unmet dependencies and/or unsupported
+configuration, it returns non-zero value which is treated as a fail by the
+Kselftest framework. This leads to false negative result even when the test
+could not be run.
+
+Change it to return kselftest skip code when a test gets skipped to clearly
+report that the test could not be run.
+
+Added an explicit check for root user at the start of memfd hugetlbfs test
+and return skip code if a non-root user attempts to run it.
+
+In addition, return skip code when not enough huge pages are available to
+run the test.
+
+Kselftest framework SKIP code is 4 and the framework prints appropriate
+messages to indicate that the test is skipped.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/memfd/run_tests.sh | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/tools/testing/selftests/memfd/run_tests.sh
++++ b/tools/testing/selftests/memfd/run_tests.sh
+@@ -1,6 +1,9 @@
+ #!/bin/bash
+ # please run as root
+
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ #
+ # Normal tests requiring no special resources
+ #
+@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $
+ nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
+ hpages_needed=`expr $hpages_test - $freepgs`
+
++ if [ $UID != 0 ]; then
++ echo "Please run memfd with hugetlbfs test as root"
++ exit $ksft_skip
++ fi
++
+ echo 3 > /proc/sys/vm/drop_caches
+ echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
+- if [ $? -ne 0 ]; then
+- echo "Please run this test as root"
+- exit 1
+- fi
+ while read name size unit; do
+ if [ "$name" = "HugePages_Free:" ]; then
+ freepgs=$size
+@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then
+ fi
+ printf "Not enough huge pages available (%d < %d)\n" \
+ $freepgs $needpgs
+- exit 1
++ exit $ksft_skip
+ fi
+
+ #
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Fri, 23 Mar 2018 10:58:31 -0700
+Subject: serial: core: Make sure compiler barfs for 16-byte earlycon names
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit c1c734cb1f54b062f7e67ffc9656d82f5b412b9c ]
+
+As part of bringup I ended up wanting to call an earlycon driver by a
+name that was exactly 16-bytes big, specifically "qcom_geni_serial".
+
+Unfortunately, when I tried this I found that things compiled just
+fine. They just didn't work.
+
+Specifically the compiler felt perfectly justified in initting the
+".name" field of "struct earlycon_id" with the full 16-bytes and just
+skipping the '\0'. Needless to say, that behavior didn't seem ideal,
+but I guess someone must have allowed it for a reason.
+
+One way to fix this is to shorten the name field to 15 bytes and then
+add an extra byte after that nobody touches. This should always be
+initted to 0 and we're golden.
+
+There are, of course, other ways to fix this too. We could audit all
+the users of the "name" field and make them stop at both null
+termination or at 16 bytes. We could also just make the name field
+much bigger so that we're not likely to run into this. ...but both
+seem like we'll just hit the bug again.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/serial_core.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -348,7 +348,8 @@ struct earlycon_device {
+ };
+
+ struct earlycon_id {
+- char name[16];
++ char name[15];
++ char name_term; /* In case compiler didn't '\0' term name */
+ char compatible[128];
+ int (*setup)(struct earlycon_device *, const char *options);
+ };
tracing-quiet-gcc-warning-about-maybe-unused-link-variable.patch
arm64-fix-vmemmap-build_bug_on-triggering-on-vmemmap-setups.patch
drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch
+mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch
+lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch
+kcov-ensure-irq-code-sees-a-valid-area.patch
+mm-check-for-sigkill-inside-dup_mmap-loop.patch
+drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch
+xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch
+hv_netvsc-fix-network-namespace-issues-with-vf-support.patch
+skip-layoutreturn-if-layout-is-invalid.patch
+ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch
+alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch
+alsa-fm801-add-error-handling-for-snd_ctl_add.patch
+nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch
+nfsd-fix-error-handling-in-nfs4_set_delegation.patch
+nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch
+vfio-platform-fix-reset-module-leak-in-error-path.patch
+vfio-mdev-check-globally-for-duplicate-devices.patch
+vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch
+kernel-hung_task.c-show-all-hung-tasks-before-panic.patch
+mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch
+mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch
+mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch
+mm-slub.c-add-__printf-verification-to-slab_err.patch
+rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch
+rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch
+net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch
+perf-tools-fix-pmu-events-parsing-rule.patch
+netfilter-ipset-forbid-family-for-hash-mac-sets.patch
+netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch
+irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch
+watchdog-da9063-fix-updating-timeout-value.patch
+media-arch-sh-migor-fix-tw9910-pdn-gpio.patch
+printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch
+bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch
+ceph-fix-alignment-of-rasize.patch
+ceph-fix-use-after-free-in-ceph_statfs.patch
+e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch
+infiniband-fix-a-possible-use-after-free-bug.patch
+powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch
+powerpc-64s-add-barrier_nospec.patch
+powerpc-eeh-fix-use-after-release-of-eeh-driver.patch
+hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch
+powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch
+clk-si544-properly-round-requested-frequency-to-nearest-match.patch
+clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch
+net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch
+net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch
+rdma-mad-convert-bug_ons-to-error-flows.patch
+lightnvm-fix-partial-read-error-path.patch
+lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch
+lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch
+netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch
+pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch
+nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch
+disable-loading-f2fs-module-on-page_size-4kb.patch
+f2fs-fix-error-path-of-move_data_page.patch
+f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch
+f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch
+f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch
+f2fs-fix-deadlock-in-shutdown-ioctl.patch
+f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch
+f2fs-fix-to-detect-failure-of-dquot_initialize.patch
+f2fs-fix-race-in-between-gc-and-atomic-open.patch
+block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch
+usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch
+usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch
+perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch
+perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch
+selftests-intel_pstate-improve-test-minor-fixes.patch
+selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch
+selftests-filesystems-devpts_pts-included-wrong-header.patch
+qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch
+pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch
+btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch
+iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch
+iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch
+bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch
+drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch
+drivers-bus-arm-cci-fix-build-warnings.patch
+bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch
+asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch
+mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch
+mwifiex-handle-race-during-mwifiex_usb_disconnect.patch
+wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch
+net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch
+net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch
+media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch
+media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch
+media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch
+btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch
+btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch
+btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch
+btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch
+x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch
+pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch
+pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch
+soc-qcom-qmi-fix-a-buffer-sizing-bug.patch
+soc-qcom-smem-fix-qcom_smem_set_global_partition.patch
+soc-qcom-smem-byte-swap-values-properly.patch
+nvme-rdma-stop-admin-queue-before-freeing-it.patch
+nvme-pci-fix-aer-reset-handling.patch
+ath-add-regulatory-mapping-for-fcc3_etsic.patch
+ath-add-regulatory-mapping-for-etsi8_world.patch
+ath-add-regulatory-mapping-for-apl13_world.patch
+ath-add-regulatory-mapping-for-apl2_fcca.patch
+ath-add-regulatory-mapping-for-uganda.patch
+ath-add-regulatory-mapping-for-tanzania.patch
+ath-add-regulatory-mapping-for-serbia.patch
+ath-add-regulatory-mapping-for-bermuda.patch
+ath-add-regulatory-mapping-for-bahamas.patch
+sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch
+powerpc-32-add-a-missing-include-header.patch
+powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch
+powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch
+powerpc-powermac-mark-variable-x-as-unused.patch
+powerpc-add-__printf-verification-to-prom_printf.patch
+kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch
+spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch
+powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch
+pinctrl-at91-pio4-add-missing-of_node_put.patch
+pinctrl-msm-fix-gpio-hog-related-boot-issues.patch
+bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch
+bpf-powerpc64-pad-function-address-loads-with-nops.patch
+pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch
+net-dsa-qca8k-add-support-for-qca8334-switch.patch
+mwifiex-correct-histogram-data-with-appropriate-index.patch
+mt76x2-apply-coverage-class-on-slot-time-too.patch
+ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch
+watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch
+drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch
+spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch
+net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch
+net-hns3-fix-the-missing-client-list-node-initialization.patch
+net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch
+fscrypt-use-unbound-workqueue-for-decryption.patch
+net-mvpp2-add-missing-vlan-tag-detection.patch
+scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch
+scsi-ufs-fix-exception-event-handling.patch
+scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch
+drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch
+drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch
+drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch
+bluetooth-btusb-add-id-for-liteon-04ca-301a.patch
+rtc-tps6586x-fix-possible-race-condition.patch
+rtc-vr41xx-fix-possible-race-condition.patch
+rtc-tps65910-fix-possible-race-condition.patch
+alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch
+regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch
+md-raid1-add-error-handling-of-read-error-from-failfast-device.patch
+md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch
+ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch
+gpu-host1x-acquire-a-reference-to-the-iova-cache.patch
+media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch
+pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch
+clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch
+net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch
+alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch
+net-hns3-fix-for-fiber-link-up-problem.patch
+media-atomisp-ov2680-don-t-declare-unused-vars.patch
+media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch
+arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch
+hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch
+arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch
+clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch
+drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch
+drm-radeon-fix-mode_valid-s-return-type.patch
+drm-amdgpu-remove-vram-from-shared-bo-domains.patch
+drm-amd-display-fix-dim-display-on-dce11.patch
+ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch
+powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch
+hid-i2c-hid-check-if-device-is-there-before-really-probing.patch
+edac-altera-fix-arm64-build-warning.patch
+rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch
+arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch
+arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch
+arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch
+arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch
+nvmem-properly-handle-returned-value-nvmem_reg_read.patch
+arm-dts-imx53-fix-ldb-of-graph-warning.patch
+i40e-free-the-skb-after-clearing-the-bitlock.patch
+tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch
+dma-iommu-fix-compilation-when-config_iommu_dma.patch
+tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch
+net-phy-phylink-release-link-gpio.patch
+media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch
+libata-fix-command-retry-decision.patch
+acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch
+media-media-device-fix-ioctl-function-types.patch
+media-saa7164-fix-driver-name-in-debug-output.patch
+media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch
+media-em28xx-fix-dualhd-broken-second-tuner.patch
+drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch
+mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch
+brcmfmac-add-support-for-bcm43364-wireless-chipset.patch
+s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch
+perf-fix-invalid-bit-in-diagnostic-entry.patch
+net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch
+bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch
+bnxt_en-always-forward-vf-mac-address-to-the-pf.patch
+mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch
+staging-most-cdev-fix-chrdev_region-leak.patch
+scsi-3w-9xxx-fix-a-missing-check-bug.patch
+scsi-3w-xxxx-fix-a-missing-check-bug.patch
+scsi-megaraid-silence-a-static-checker-bug.patch
+scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch
+soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch
+scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch
+dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch
+staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch
+staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch
+thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch
+regulator-add-dummy-function-of_find_regulator_by_node.patch
+bpf-fix-references-to-free_bpf_prog_info-in-comments.patch
+f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch
+media-em28xx-fix-a-regression-with-hvr-950.patch
+media-siano-get-rid-of-__le32-__le16-cast-warnings.patch
+mt76x2-fix-avg_rssi-estimation.patch
+drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch
+mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch
+f2fs-check-cap_resource-only-for-data-blocks.patch
+mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch
+alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch
+mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch
+mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch
+dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch
+spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch
+net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch
+dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch
+fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch
+i40e-add-advertising-10g-lr-mode.patch
+i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch
+mt76-add-rcu-locking-around-tx-scheduling.patch
+backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch
+stop_machine-use-raw-spinlocks.patch
+delayacct-use-raw_spinlocks.patch
+ath10k-fix-kernel-panic-while-reading-tpc_stats.patch
+memory-tegra-do-not-handle-spurious-interrupts.patch
+memory-tegra-apply-interrupts-mask-per-soc.patch
+nvme-lightnvm-add-granby-support.patch
+asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch
+arm64-defconfig-enable-rockchip-io-domain-driver.patch
+asoc-compress-only-call-free-for-components-which-have-been-opened.patch
+igb-fix-queue-selection-on-mac-filters-on-i210.patch
+qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch
+drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch
+ipconfig-correctly-initialise-ic_nameservers.patch
+rsi-fix-invalid-vdd-warning-in-mmc.patch
+rsi-fix-nommu_map_sg-overflow-kernel-panic.patch
+audit-allow-not-equal-op-for-audit-by-executable.patch
+drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch
+platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch
+staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch
+staging-lustre-llite-correct-removexattr-detection.patch
+staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch
+staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch
+serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch
+soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch
+microblaze-fix-simpleimage-format-generation.patch
+usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch
+crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch
+crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch
+y2038-ipc-use-ktime_get_real_seconds-consistently.patch
+media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch
+media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch
+regulator-don-t-return-or-expect-errno-from-of_map_mode.patch
+ath10k-search-all-ies-for-variant-before-falling-back.patch
+drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch
+scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch
+scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch
+scsi-cxlflash-synchronize-reset-and-remove-ops.patch
+scsi-cxlflash-avoid-clobbering-context-control-register-value.patch
+pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch
+media-atomisp-compat32-fix-__user-annotations.patch
+media-cec-fix-smatch-error.patch
+media-si470x-fix-__be16-annotations.patch
+net-socionext-reset-hardware-in-ndo_stop.patch
+asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch
+asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch
+arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch
+drm-add-dp-psr2-sink-enable-bit.patch
+drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch
+drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch
+drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+Date: Mon, 11 Jun 2018 15:32:06 -0400
+Subject: skip LAYOUTRETURN if layout is invalid
+
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+
+[ Upstream commit 93b7f7ad2018d2037559b1d0892417864c78b371 ]
+
+Currently, when IO to DS fails, client returns the layout and
+retries against the MDS. However, then on umounting (inode eviction)
+it returns the layout again.
+
+This is because pnfs_return_layout() was changed in
+commit d78471d32bb6 ("pnfs/blocklayout: set PNFS_LAYOUTRETURN_ON_ERROR")
+to always set NFS_LAYOUT_RETURN_REQUESTED so even if we returned
+the layout, it will be returned again. Instead, let's also check
+if we have already marked the layout invalid.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/pnfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1144,7 +1144,7 @@ _pnfs_return_layout(struct inode *ino)
+ LIST_HEAD(tmp_list);
+ nfs4_stateid stateid;
+ int status = 0;
+- bool send;
++ bool send, valid_layout;
+
+ dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino);
+
+@@ -1165,6 +1165,7 @@ _pnfs_return_layout(struct inode *ino)
+ goto out_put_layout_hdr;
+ spin_lock(&ino->i_lock);
+ }
++ valid_layout = pnfs_layout_is_valid(lo);
+ pnfs_clear_layoutcommit(ino, &tmp_list);
+ pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0);
+
+@@ -1178,7 +1179,8 @@ _pnfs_return_layout(struct inode *ino)
+ }
+
+ /* Don't send a LAYOUTRETURN if list was initially empty */
+- if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
++ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
++ !valid_layout) {
+ spin_unlock(&ino->i_lock);
+ dprintk("NFS: %s no layout segments to return\n", __func__);
+ goto out_put_layout_hdr;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+Date: Tue, 10 Apr 2018 11:32:09 -0700
+Subject: soc: imx: gpcv2: Do not pass static memory as platform data
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 050f810e238f268670f14a8f8b793ba2dbf2e92f ]
+
+Platform device core assumes the ownership of dev.platform_data as
+well as that it is dynamically allocated and it will try to kfree it
+as a part of platform_device_release(). Change the code to use
+platform_device_add_data() n instead of a pointer to a static memory
+to avoid causing a BUG() when calling platform_device_put().
+
+The problem can be reproduced by artificially enabling the error path
+of platform_device_add() call (around line 357).
+
+Note that this change also allows us to constify imx7_pgc_domains,
+since we no longer need to be able to modify it.
+
+Cc: Stefan Agner <stefan@agner.ch>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/imx/gpcv2.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/soc/imx/gpcv2.c
++++ b/drivers/soc/imx/gpcv2.c
+@@ -155,7 +155,7 @@ static int imx7_gpc_pu_pgc_sw_pdn_req(st
+ return imx7_gpc_pu_pgc_sw_pxx_req(genpd, false);
+ }
+
+-static struct imx7_pgc_domain imx7_pgc_domains[] = {
++static const struct imx7_pgc_domain imx7_pgc_domains[] = {
+ [IMX7_POWER_DOMAIN_MIPI_PHY] = {
+ .genpd = {
+ .name = "mipi-phy",
+@@ -321,11 +321,6 @@ static int imx_gpcv2_probe(struct platfo
+ continue;
+ }
+
+- domain = &imx7_pgc_domains[domain_index];
+- domain->regmap = regmap;
+- domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req;
+- domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req;
+-
+ pd_pdev = platform_device_alloc("imx7-pgc-domain",
+ domain_index);
+ if (!pd_pdev) {
+@@ -334,7 +329,20 @@ static int imx_gpcv2_probe(struct platfo
+ return -ENOMEM;
+ }
+
+- pd_pdev->dev.platform_data = domain;
++ ret = platform_device_add_data(pd_pdev,
++ &imx7_pgc_domains[domain_index],
++ sizeof(imx7_pgc_domains[domain_index]));
++ if (ret) {
++ platform_device_put(pd_pdev);
++ of_node_put(np);
++ return ret;
++ }
++
++ domain = pd_pdev->dev.platform_data;
++ domain->regmap = regmap;
++ domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req;
++ domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req;
++
+ pd_pdev->dev.parent = dev;
+ pd_pdev->dev.of_node = np;
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alex Elder <elder@linaro.org>
+Date: Fri, 27 Apr 2018 09:08:17 -0500
+Subject: soc: qcom: qmi: fix a buffer sizing bug
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 7df5ff258bd27900d516fea88da10d05602bf8c7 ]
+
+In qmi_handle_init(), a buffer is allocated for to hold messages
+received through the handle's socket. Any "normal" messages
+(expected by the caller) will have a header prepended, so the
+buffer size is adjusted to accomodate that.
+
+The buffer must also be of sufficient size to receive control
+messages, so the size is increased if necessary to ensure these
+will fit.
+
+Unfortunately the calculation is done wrong, making it possible
+for the calculated buffer size to be too small to hold a "normal"
+message. Specifically, if:
+
+ recv_buf_size > sizeof(struct qrtr_ctrl_pkt) - sizeof(struct qmi_header)
+ AND
+ recv_buf_size < sizeof(struct qrtr_ctrl_pkt)
+
+the current logic will use sizeof(struct qrtr_ctrl_pkt) as the
+receive buffer size, which is not enough to hold the maximum
+"normal" message plus its header. Currently this problem occurs
+for (13 < recv_buf_size < 20).
+
+This patch corrects this.
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/qmi_interface.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/qcom/qmi_interface.c
++++ b/drivers/soc/qcom/qmi_interface.c
+@@ -639,10 +639,11 @@ int qmi_handle_init(struct qmi_handle *q
+ if (ops)
+ qmi->ops = *ops;
+
++ /* Make room for the header */
++ recv_buf_size += sizeof(struct qmi_header);
++ /* Must also be sufficient to hold a control packet */
+ if (recv_buf_size < sizeof(struct qrtr_ctrl_pkt))
+ recv_buf_size = sizeof(struct qrtr_ctrl_pkt);
+- else
+- recv_buf_size += sizeof(struct qmi_header);
+
+ qmi->recv_buf_size = recv_buf_size;
+ qmi->recv_buf = kzalloc(recv_buf_size, GFP_KERNEL);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alex Elder <elder@linaro.org>
+Date: Tue, 10 Apr 2018 17:25:39 -0500
+Subject: soc: qcom: smem: byte swap values properly
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 04a512fea333369cc0b550f3b90df0d638e34d00 ]
+
+Two places report an error when a partition header is found to
+not contain the right canary value. The error messages do not
+properly byte swap the host ids. Fix this, and adjust the format
+specificier to match the 16-bit unsigned data type.
+
+Move the error handling for a bad canary value to the end of
+qcom_smem_alloc_private(). This avoids some long lines, and
+reduces the distraction of handling this unexpected problem.
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/smem.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -362,13 +362,8 @@ static int qcom_smem_alloc_private(struc
+ cached = phdr_to_last_cached_entry(phdr);
+
+ while (hdr < end) {
+- if (hdr->canary != SMEM_PRIVATE_CANARY) {
+- dev_err(smem->dev,
+- "Found invalid canary in hosts %d:%d partition\n",
+- phdr->host0, phdr->host1);
+- return -EINVAL;
+- }
+-
++ if (hdr->canary != SMEM_PRIVATE_CANARY)
++ goto bad_canary;
+ if (le16_to_cpu(hdr->item) == item)
+ return -EEXIST;
+
+@@ -397,6 +392,11 @@ static int qcom_smem_alloc_private(struc
+ le32_add_cpu(&phdr->offset_free_uncached, alloc_size);
+
+ return 0;
++bad_canary:
++ dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
++ le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
++
++ return -EINVAL;
+ }
+
+ static int qcom_smem_alloc_global(struct qcom_smem *smem,
+@@ -560,8 +560,8 @@ static void *qcom_smem_get_private(struc
+ return ERR_PTR(-ENOENT);
+
+ invalid_canary:
+- dev_err(smem->dev, "Found invalid canary in hosts %d:%d partition\n",
+- phdr->host0, phdr->host1);
++ dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
++ le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
+
+ return ERR_PTR(-EINVAL);
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alex Elder <elder@linaro.org>
+Date: Tue, 10 Apr 2018 17:25:41 -0500
+Subject: soc: qcom: smem: fix qcom_smem_set_global_partition()
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 8fa1a21409da6abfe890f66532f9fcd8d2c25a3d ]
+
+If there is at least one entry in the partition table, but no global
+entry, the qcom_smem_set_global_partition() should return an error
+just like it does if there are no partition table entries.
+
+It turns out the function still returns an error in this case, but
+it waits to do so until it has mistakenly treated the last entry in
+the table as if it were the global entry found.
+
+Fix the function to return immediately if no global entry is found
+in the table.
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/smem.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -695,9 +695,10 @@ static u32 qcom_smem_get_item_count(stru
+ static int qcom_smem_set_global_partition(struct qcom_smem *smem)
+ {
+ struct smem_partition_header *header;
+- struct smem_ptable_entry *entry = NULL;
++ struct smem_ptable_entry *entry;
+ struct smem_ptable *ptable;
+ u32 host0, host1, size;
++ bool found = false;
+ int i;
+
+ ptable = qcom_smem_get_ptable(smem);
+@@ -709,11 +710,13 @@ static int qcom_smem_set_global_partitio
+ host0 = le16_to_cpu(entry->host0);
+ host1 = le16_to_cpu(entry->host1);
+
+- if (host0 == SMEM_GLOBAL_HOST && host0 == host1)
++ if (host0 == SMEM_GLOBAL_HOST && host0 == host1) {
++ found = true;
+ break;
++ }
+ }
+
+- if (!entry) {
++ if (!found) {
+ dev_err(smem->dev, "Missing entry for global partition\n");
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 3 May 2018 13:56:17 +0530
+Subject: soc/tegra: pmc: Don't allocate struct tegra_powergate on stack
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 495ac33a3b82f85ed4fbdd9b826c1d2fbc8e9b68 ]
+
+With a later commit an instance of the struct device will be added to
+struct genpd and with that the size of the struct tegra_powergate will
+be over 1024 bytes. That generates following warning:
+
+drivers/soc/tegra/pmc.c:579:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+
+Avoid such warnings by allocating the structure dynamically.
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/tegra/pmc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -559,22 +559,28 @@ EXPORT_SYMBOL(tegra_powergate_remove_cla
+ int tegra_powergate_sequence_power_up(unsigned int id, struct clk *clk,
+ struct reset_control *rst)
+ {
+- struct tegra_powergate pg;
++ struct tegra_powergate *pg;
+ int err;
+
+ if (!tegra_powergate_is_available(id))
+ return -EINVAL;
+
+- pg.id = id;
+- pg.clks = &clk;
+- pg.num_clks = 1;
+- pg.reset = rst;
+- pg.pmc = pmc;
++ pg = kzalloc(sizeof(*pg), GFP_KERNEL);
++ if (!pg)
++ return -ENOMEM;
+
+- err = tegra_powergate_power_up(&pg, false);
++ pg->id = id;
++ pg->clks = &clk;
++ pg->num_clks = 1;
++ pg->reset = rst;
++ pg->pmc = pmc;
++
++ err = tegra_powergate_power_up(pg, false);
+ if (err)
+ pr_err("failed to turn on partition %d: %d\n", id, err);
+
++ kfree(pg);
++
+ return err;
+ }
+ EXPORT_SYMBOL(tegra_powergate_sequence_power_up);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Fri, 18 May 2018 10:30:07 -0700
+Subject: spi: Add missing pm_runtime_put_noidle() after failed get
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7e48e23a1f4a50f93ac1073f1326e0a73829b631 ]
+
+If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle().
+This is probably not a critical fix as we should only hit this when
+things are broken elsewhere.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct s
+ if (!was_busy && ctlr->auto_runtime_pm) {
+ ret = pm_runtime_get_sync(ctlr->dev.parent);
+ if (ret < 0) {
++ pm_runtime_put_noidle(ctlr->dev.parent);
+ dev_err(&ctlr->dev, "Failed to power device: %d\n",
+ ret);
+ mutex_unlock(&ctlr->io_mutex);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sun, 29 Apr 2018 01:46:23 +0300
+Subject: spi: meson-spicc: Fix error handling in meson_spicc_probe()
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+[ Upstream commit ded5fa4e8bac25612caab8f0822691308a28a552 ]
+
+If devm_spi_register_master() fails in meson_spicc_probe(),
+spicc->core is left undisabled. The patch fixes that.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-meson-spicc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -574,10 +574,15 @@ static int meson_spicc_probe(struct plat
+ master->max_speed_hz = rate >> 2;
+
+ ret = devm_spi_register_master(&pdev->dev, master);
+- if (!ret)
+- return 0;
++ if (ret) {
++ dev_err(&pdev->dev, "spi master registration failed\n");
++ goto out_clk;
++ }
+
+- dev_err(&pdev->dev, "spi master registration failed\n");
++ return 0;
++
++out_clk:
++ clk_disable_unprepare(spicc->core);
+
+ out_master:
+ spi_master_put(master);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 23 May 2018 11:02:04 +0200
+Subject: spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ]
+
+According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in
+the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit
+must match the value of the SITMDR1.SYNCAC bit. However,
+sh_msiof_spi_setup() changes only the latter.
+
+Fix this by updating the SIRMDR1 register like the SITMDR1 register,
+taking into account register bits that exist in SITMDR1 only.
+
+Reported-by: Renesas BSP team via Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Fixes: 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-sh-msiof.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -564,14 +564,16 @@ static int sh_msiof_spi_setup(struct spi
+
+ /* Configure native chip select mode/polarity early */
+ clr = MDR1_SYNCMD_MASK;
+- set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI;
++ set = MDR1_SYNCMD_SPI;
+ if (spi->mode & SPI_CS_HIGH)
+ clr |= BIT(MDR1_SYNCAC_SHIFT);
+ else
+ set |= BIT(MDR1_SYNCAC_SHIFT);
+ pm_runtime_get_sync(&p->pdev->dev);
+ tmp = sh_msiof_read(p, TMDR1) & ~clr;
+- sh_msiof_write(p, TMDR1, tmp | set);
++ sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON);
++ tmp = sh_msiof_read(p, RMDR1) & ~clr;
++ sh_msiof_write(p, RMDR1, tmp | set);
+ pm_runtime_put(&p->pdev->dev);
+ p->native_cs_high = spi->mode & SPI_CS_HIGH;
+ p->native_cs_inited = true;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 3 Apr 2018 17:13:00 +0200
+Subject: staging: ks7010: fix error handling in ks7010_upload_firmware
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit 6e043704fb99e3e1d7a1bb02030e49c093cdd943 ]
+
+This commit checks missing error code check when checking
+if the firmware is running reading General Communication
+Register A (GCR_A).
+
+It also set ret to EBUSY if firmware is running before
+copying it.
+
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/ks7010/ks7010_sdio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/ks7010/ks7010_sdio.c
++++ b/drivers/staging/ks7010/ks7010_sdio.c
+@@ -657,8 +657,11 @@ static int ks7010_upload_firmware(struct
+
+ /* Firmware running ? */
+ ret = ks7010_sdio_readb(priv, GCR_A, &byte);
++ if (ret)
++ goto release_host_and_free;
+ if (byte == GCR_A_RUN) {
+ netdev_dbg(priv->net_dev, "MAC firmware running ...\n");
++ ret = -EBUSY;
+ goto release_host_and_free;
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: NeilBrown <neilb@suse.com>
+Date: Thu, 29 Mar 2018 15:26:48 +1100
+Subject: staging: lustre: ldlm: free resource when ldlm_lock_create() fails.
+
+From: NeilBrown <neilb@suse.com>
+
+[ Upstream commit d8caf662b4aeeb2ac83ac0b22e40db88e9360c77 ]
+
+ldlm_lock_create() gets a resource, but don't put it on
+all failure paths. It should.
+
+Signed-off-by: NeilBrown <neilb@suse.com>
+Reviewed-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/ldlm/ldlm_lock.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
+@@ -1565,8 +1565,10 @@ struct ldlm_lock *ldlm_lock_create(struc
+ return ERR_CAST(res);
+
+ lock = ldlm_lock_new(res);
+- if (!lock)
++ if (!lock) {
++ ldlm_resource_putref(res);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ lock->l_req_mode = mode;
+ lock->l_ast_data = data;
+@@ -1609,6 +1611,8 @@ out:
+ return ERR_PTR(rc);
+ }
+
++
++
+ /**
+ * Enqueue (request) a lock.
+ * On the client this is called from ldlm_cli_enqueue_fini
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: James Simmons <jsimmons@infradead.org>
+Date: Mon, 16 Apr 2018 00:15:10 -0400
+Subject: staging: lustre: llite: correct removexattr detection
+
+From: James Simmons <jsimmons@infradead.org>
+
+[ Upstream commit 1b60f6dfa38403ff7c4d0b4b7ecdb810f9789a2a ]
+
+In ll_xattr_set_common() detect the removexattr() case correctly by
+testing for a NULL value as well as XATTR_REPLACE.
+
+Signed-off-by: John L. Hammond <john.hammond@intel.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10787
+Reviewed-on: https://review.whamcloud.com/
+Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
+Reviewed-by: James Simmons <uja.ornl@yahoo.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/llite/xattr.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lustre/llite/xattr.c
++++ b/drivers/staging/lustre/lustre/llite/xattr.c
+@@ -94,7 +94,11 @@ ll_xattr_set_common(const struct xattr_h
+ __u64 valid;
+ int rc;
+
+- if (flags == XATTR_REPLACE) {
++ /* When setxattr() is called with a size of 0 the value is
++ * unconditionally replaced by "". When removexattr() is
++ * called we get a NULL value and XATTR_REPLACE for flags.
++ */
++ if (!value && flags == XATTR_REPLACE) {
+ ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_REMOVEXATTR, 1);
+ valid = OBD_MD_FLXATTRRM;
+ } else {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Doug Oucharek <dougso@me.com>
+Date: Tue, 1 May 2018 23:49:18 -0400
+Subject: staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5
+
+From: Doug Oucharek <dougso@me.com>
+
+[ Upstream commit 24d4b7c8de007cff9c7d83c06ae76099fdcce008 ]
+
+The FastReg support in ko2iblnd was not unmapping pool items
+causing the items to leak. In addition, the mapping code
+is not growing the pool like we do with FMR.
+
+This patch makes sure we are unmapping FastReg pool elements
+when we are done with them. It also makes sure the pool
+will grow when we depleat the pool.
+
+Signed-off-by: Doug Oucharek <doug.s.oucharek@intel.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9472
+Reviewed-on: https://review.whamcloud.com/27015
+Reviewed-by: Andrew Perepechko <andrew.perepechko@seagate.com>
+Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
+Reviewed-by: James Simmons <uja.ornl@yahoo.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: Doug Oucharek <dougso@me.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c | 2 +-
+ drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 12 ++++--------
+ 2 files changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c
++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c
+@@ -1702,7 +1702,7 @@ int kiblnd_fmr_pool_map(struct kib_fmr_p
+ return 0;
+ }
+ spin_unlock(&fps->fps_lock);
+- rc = -EBUSY;
++ rc = -EAGAIN;
+ }
+
+ spin_lock(&fps->fps_lock);
+--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+@@ -48,7 +48,7 @@ static int kiblnd_init_rdma(struct kib_c
+ __u64 dstcookie);
+ static void kiblnd_queue_tx_locked(struct kib_tx *tx, struct kib_conn *conn);
+ static void kiblnd_queue_tx(struct kib_tx *tx, struct kib_conn *conn);
+-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx);
++static void kiblnd_unmap_tx(struct kib_tx *tx);
+ static void kiblnd_check_sends_locked(struct kib_conn *conn);
+
+ static void
+@@ -66,7 +66,7 @@ kiblnd_tx_done(struct lnet_ni *ni, struc
+ LASSERT(!tx->tx_waiting); /* mustn't be awaiting peer response */
+ LASSERT(tx->tx_pool);
+
+- kiblnd_unmap_tx(ni, tx);
++ kiblnd_unmap_tx(tx);
+
+ /* tx may have up to 2 lnet msgs to finalise */
+ lntmsg[0] = tx->tx_lntmsg[0]; tx->tx_lntmsg[0] = NULL;
+@@ -591,13 +591,9 @@ kiblnd_fmr_map_tx(struct kib_net *net, s
+ return 0;
+ }
+
+-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx)
++static void kiblnd_unmap_tx(struct kib_tx *tx)
+ {
+- struct kib_net *net = ni->ni_data;
+-
+- LASSERT(net);
+-
+- if (net->ibn_fmr_ps)
++ if (tx->fmr.fmr_pfmr || tx->fmr.fmr_frd)
+ kiblnd_fmr_pool_unmap(&tx->fmr, tx->tx_status);
+
+ if (tx->tx_nfrags) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Doug Oucahrek <dougso@me.com>
+Date: Tue, 1 May 2018 22:22:19 -0700
+Subject: staging: lustre: o2iblnd: fix race at kiblnd_connect_peer
+
+From: Doug Oucahrek <dougso@me.com>
+
+[ Upstream commit cf04968efe341b9b1c30a527e5dd61b2af9c43d2 ]
+
+cmid will be destroyed at OFED if kiblnd_cm_callback return error.
+if error happen before the end of kiblnd_connect_peer, it will touch
+destroyed cmid and fail as
+(o2iblnd_cb.c:1315:kiblnd_connect_peer())
+ ASSERTION( cmid->device != ((void *)0) ) failed:
+
+Signed-off-by: Alexander Boyko <alexander.boyko@seagate.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10015
+Reviewed-by: Alexey Lyashkov <c17817@cray.com>
+Reviewed-by: Doug Oucharek <dougso@me.com>
+Reviewed-by: John L. Hammond <john.hammond@intel.com>
+Signed-off-by: Doug Oucharek <dougso@me.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 18 +++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+@@ -1290,11 +1290,6 @@ kiblnd_connect_peer(struct kib_peer *pee
+ goto failed2;
+ }
+
+- LASSERT(cmid->device);
+- CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n",
+- libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname,
+- &dev->ibd_ifip, cmid->device->name);
+-
+ return;
+
+ failed2:
+@@ -2996,8 +2991,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cm
+ } else {
+ rc = rdma_resolve_route(
+ cmid, *kiblnd_tunables.kib_timeout * 1000);
+- if (!rc)
++ if (!rc) {
++ struct kib_net *net = peer->ibp_ni->ni_data;
++ struct kib_dev *dev = net->ibn_dev;
++
++ CDEBUG(D_NET, "%s: connection bound to "\
++ "%s:%pI4h:%s\n",
++ libcfs_nid2str(peer->ibp_nid),
++ dev->ibd_ifname,
++ &dev->ibd_ifip, cmid->device->name);
++
+ return 0;
++ }
++
+ /* Can't initiate route resolution */
+ CERROR("Can't resolve route for %s: %d\n",
+ libcfs_nid2str(peer->ibp_nid), rc);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Christian Gromm <christian.gromm@microchip.com>
+Date: Tue, 8 May 2018 11:45:06 +0200
+Subject: staging: most: cdev: fix chrdev_region leak
+
+From: Christian Gromm <christian.gromm@microchip.com>
+
+[ Upstream commit aba258b73101670c06b1dd700e500ed0a3fa0e8e ]
+
+The function unregister_chrdev_region is called with a different counter
+as the alloc_chrdev_region. To fix this, this patch introduces the
+constant CHRDEV_REGION_SIZE that is used in both functions.
+
+Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/most/cdev/cdev.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/most/cdev/cdev.c
++++ b/drivers/staging/most/cdev/cdev.c
+@@ -18,6 +18,8 @@
+ #include <linux/idr.h>
+ #include "most/core.h"
+
++#define CHRDEV_REGION_SIZE 50
++
+ static struct cdev_component {
+ dev_t devno;
+ struct ida minor_id;
+@@ -513,7 +515,7 @@ static int __init mod_init(void)
+ spin_lock_init(&ch_list_lock);
+ ida_init(&comp.minor_id);
+
+- err = alloc_chrdev_region(&comp.devno, 0, 50, "cdev");
++ err = alloc_chrdev_region(&comp.devno, 0, CHRDEV_REGION_SIZE, "cdev");
+ if (err < 0)
+ goto dest_ida;
+ comp.major = MAJOR(comp.devno);
+@@ -523,7 +525,7 @@ static int __init mod_init(void)
+ return 0;
+
+ free_cdev:
+- unregister_chrdev_region(comp.devno, 1);
++ unregister_chrdev_region(comp.devno, CHRDEV_REGION_SIZE);
+ dest_ida:
+ ida_destroy(&comp.minor_id);
+ class_destroy(comp.class);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 31 Mar 2018 22:09:37 +0200
+Subject: staging: vchiq_core: Fix missing semaphore release in error case
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 8113b89fc615cfb531df0334fb3a091cf6a45ce0 ]
+
+The bail out branch in case of a invalid tx_pos missed a semaphore
+release. Dan Carpenter found this with a static checker.
+
+Fixes: d1eab9dec610 ("staging: vchiq_core: Bail out in case of invalid tx_pos")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+@@ -601,6 +601,7 @@ reserve_space(VCHIQ_STATE_T *state, size
+ }
+
+ if (tx_pos == (state->slot_queue_available * VCHIQ_SLOT_SIZE)) {
++ up(&state->slot_available_event);
+ pr_warn("%s: invalid tx_pos: %d\n", __func__, tx_pos);
+ return NULL;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 23 Apr 2018 21:16:35 +0200
+Subject: stop_machine: Use raw spinlocks
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit de5b55c1d4e30740009864eb35ce4ed856aac01d ]
+
+Use raw-locks in stop_machine() to allow locking in irq-off and
+preempt-disabled regions on -RT. This also documents the possible locking
+context in general.
+
+[bigeasy: update patch description.]
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lkml.kernel.org/r/20180423191635.6014-1-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/stop_machine.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/kernel/stop_machine.c
++++ b/kernel/stop_machine.c
+@@ -37,7 +37,7 @@ struct cpu_stop_done {
+ struct cpu_stopper {
+ struct task_struct *thread;
+
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ bool enabled; /* is this stopper enabled? */
+ struct list_head works; /* list of pending works */
+
+@@ -81,13 +81,13 @@ static bool cpu_stop_queue_work(unsigned
+ unsigned long flags;
+ bool enabled;
+
+- spin_lock_irqsave(&stopper->lock, flags);
++ raw_spin_lock_irqsave(&stopper->lock, flags);
+ enabled = stopper->enabled;
+ if (enabled)
+ __cpu_stop_queue_work(stopper, work, &wakeq);
+ else if (work->done)
+ cpu_stop_signal_done(work->done);
+- spin_unlock_irqrestore(&stopper->lock, flags);
++ raw_spin_unlock_irqrestore(&stopper->lock, flags);
+
+ wake_up_q(&wakeq);
+
+@@ -237,8 +237,8 @@ static int cpu_stop_queue_two_works(int
+ DEFINE_WAKE_Q(wakeq);
+ int err;
+ retry:
+- spin_lock_irq(&stopper1->lock);
+- spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
++ raw_spin_lock_irq(&stopper1->lock);
++ raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
+
+ err = -ENOENT;
+ if (!stopper1->enabled || !stopper2->enabled)
+@@ -261,8 +261,8 @@ retry:
+ __cpu_stop_queue_work(stopper1, work1, &wakeq);
+ __cpu_stop_queue_work(stopper2, work2, &wakeq);
+ unlock:
+- spin_unlock(&stopper2->lock);
+- spin_unlock_irq(&stopper1->lock);
++ raw_spin_unlock(&stopper2->lock);
++ raw_spin_unlock_irq(&stopper1->lock);
+
+ if (unlikely(err == -EDEADLK)) {
+ while (stop_cpus_in_progress)
+@@ -461,9 +461,9 @@ static int cpu_stop_should_run(unsigned
+ unsigned long flags;
+ int run;
+
+- spin_lock_irqsave(&stopper->lock, flags);
++ raw_spin_lock_irqsave(&stopper->lock, flags);
+ run = !list_empty(&stopper->works);
+- spin_unlock_irqrestore(&stopper->lock, flags);
++ raw_spin_unlock_irqrestore(&stopper->lock, flags);
+ return run;
+ }
+
+@@ -474,13 +474,13 @@ static void cpu_stopper_thread(unsigned
+
+ repeat:
+ work = NULL;
+- spin_lock_irq(&stopper->lock);
++ raw_spin_lock_irq(&stopper->lock);
+ if (!list_empty(&stopper->works)) {
+ work = list_first_entry(&stopper->works,
+ struct cpu_stop_work, list);
+ list_del_init(&work->list);
+ }
+- spin_unlock_irq(&stopper->lock);
++ raw_spin_unlock_irq(&stopper->lock);
+
+ if (work) {
+ cpu_stop_fn_t fn = work->fn;
+@@ -554,7 +554,7 @@ static int __init cpu_stop_init(void)
+ for_each_possible_cpu(cpu) {
+ struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
+
+- spin_lock_init(&stopper->lock);
++ raw_spin_lock_init(&stopper->lock);
+ INIT_LIST_HEAD(&stopper->works);
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Date: Thu, 26 Apr 2018 13:51:16 +0200
+Subject: thermal: exynos: fix setting rising_threshold for Exynos5433
+
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+
+[ Upstream commit 8bfc218d0ebbabcba8ed2b8ec1831e0cf1f71629 ]
+
+Add missing clearing of the previous value when setting rising
+temperature threshold.
+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/samsung/exynos_tmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/thermal/samsung/exynos_tmu.c
++++ b/drivers/thermal/samsung/exynos_tmu.c
+@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(str
+ threshold_code = temp_to_code(data, temp);
+
+ rising_threshold = readl(data->base + rising_reg_offset);
++ rising_threshold &= ~(0xff << j * 8);
+ rising_threshold |= (threshold_code << j * 8);
+ writel(rising_threshold, data->base + rising_reg_offset);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Wed, 9 May 2018 17:02:08 +0100
+Subject: tick: Prefer a lower rating device only if it's CPU local device
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 1332a90558013ae4242e3dd7934bdcdeafb06c0d ]
+
+Checking the equality of cpumask for both new and old tick device doesn't
+ensure that it's CPU local device. This will cause issue if a low rating
+clockevent tick device is registered first followed by the registration
+of higher rating clockevent tick device.
+
+In such case, clockevents_released list will never get emptied as both
+the devices get selected as preferred one and we will loop forever in
+clockevents_notify_released.
+
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Link: https://lkml.kernel.org/r/1525881728-4858-1-git-send-email-sudeep.holla@arm.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/tick-common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -277,7 +277,8 @@ static bool tick_check_preferred(struct
+ */
+ return !curdev ||
+ newdev->rating > curdev->rating ||
+- !cpumask_equal(curdev->cpumask, newdev->cpumask);
++ (!cpumask_equal(curdev->cpumask, newdev->cpumask) &&
++ !tick_check_percpu(curdev, newdev, smp_processor_id()));
+ }
+
+ /*
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: DaeRyong Jeong <threeearcat@gmail.com>
+Date: Tue, 1 May 2018 00:27:04 +0900
+Subject: tty: Fix data race in tty_insert_flip_string_fixed_flag
+
+From: DaeRyong Jeong <threeearcat@gmail.com>
+
+[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ]
+
+Unlike normal serials, in pty layer, there is no guarantee that multiple
+threads don't insert input characters at the same time. If it is happened,
+tty_insert_flip_string_fixed_flag can be executed concurrently. This can
+lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag.
+
+Call sequences are as follows.
+CPU0 CPU1
+n_tty_ioctl_helper n_tty_ioctl_helper
+__start_tty tty_send_xchar
+tty_wakeup pty_write
+n_hdlc_tty_wakeup tty_insert_flip_string
+n_hdlc_send_frames tty_insert_flip_string_fixed_flag
+pty_write
+tty_insert_flip_string
+tty_insert_flip_string_fixed_flag
+
+To fix the race, acquire port->lock in pty_write() before it inserts input
+characters to tty buffer. It prevents multiple threads from inserting
+input characters concurrently.
+
+The crash log is as follows:
+BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/
+0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121
+Write of size 1792 by task syz-executor0/30017
+CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
+BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
+ 0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140
+ ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0
+ ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121
+Call Trace:
+ __dump_stack lib/dump_stack.c:15 [inline]
+ dump_stack+0xb3/0x110 lib/dump_stack.c:51
+ kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
+ print_address_description mm/kasan/report.c:194 [inline]
+ kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283
+ kasan_report+0x36/0x40 mm/kasan/report.c:303
+ check_memory_region_inline mm/kasan/kasan.c:292 [inline]
+ check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299
+ memcpy+0x37/0x50 mm/kasan/kasan.c:335
+ tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316
+ tty_insert_flip_string include/linux/tty_flip.h:35 [inline]
+ pty_write+0x7f/0xc0 drivers/tty/pty.c:115
+ n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419
+ n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496
+ tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601
+ __start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018
+ __start_tty+0x34/0x40 drivers/tty/tty_io.c:1013
+ n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138
+ n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794
+ tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992
+ vfs_ioctl fs/ioctl.c:43 [inline]
+ do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679
+ SYSC_ioctl fs/ioctl.c:694 [inline]
+ SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
+ entry_SYSCALL_64_fastpath+0x1f/0xbd
+
+Signed-off-by: DaeRyong Jeong <threeearcat@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/pty.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -110,16 +110,19 @@ static void pty_unthrottle(struct tty_st
+ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ {
+ struct tty_struct *to = tty->link;
++ unsigned long flags;
+
+ if (tty->stopped)
+ return 0;
+
+ if (c > 0) {
++ spin_lock_irqsave(&to->port->lock, flags);
+ /* Stuff the data into the input queue of the other end */
+ c = tty_insert_flip_string(to->port, buf, c);
+ /* And shovel */
+ if (c)
+ tty_flip_buffer_push(to->port);
++ spin_unlock_irqrestore(&to->port->lock, flags);
+ }
+ return c;
+ }
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Dominik Bozek <dominikx.bozek@intel.com>
+Date: Fri, 13 Apr 2018 10:42:31 -0700
+Subject: usb: hub: Don't wait for connect state at resume for powered-off ports
+
+From: Dominik Bozek <dominikx.bozek@intel.com>
+
+[ Upstream commit 5d111f5190848d6fb1c414dc57797efea3526a2f ]
+
+wait_for_connected() wait till a port change status to
+USB_PORT_STAT_CONNECTION, but this is not possible if
+the port is unpowered. The loop will only exit at timeout.
+
+Such case take place if an over-current incident happen
+while system is in S3. Then during resume wait_for_connected()
+will wait 2s, which may be noticeable by the user.
+
+Signed-off-by: Dominik Bozek <dominikx.bozek@intel.com>
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3380,6 +3380,10 @@ static int wait_for_connected(struct usb
+ while (delay_ms < 2000) {
+ if (status || *portstatus & USB_PORT_STAT_CONNECTION)
+ break;
++ if (!port_is_power_on(hub, *portstatus)) {
++ status = -ENODEV;
++ break;
++ }
+ msleep(20);
+ delay_ms += 20;
+ status = hub_port_status(hub, *port1, portstatus, portchange);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Fri, 25 May 2018 16:23:46 +0200
+Subject: usbip: dynamically allocate idev by nports found in sysfs
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit de19ca6fd72c7dd45ad82403e7b3fe9c74ef6767 ]
+
+As the amount of available ports varies by the kernels build
+configuration. To remove the limitation of the fixed 128 ports
+we allocate the amount of idevs by using the number we get
+from the kernel.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Acked-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/usb/usbip/libsrc/vhci_driver.c | 32 +++++++++++++++++++-------------
+ tools/usb/usbip/libsrc/vhci_driver.h | 3 +--
+ 2 files changed, 20 insertions(+), 15 deletions(-)
+
+--- a/tools/usb/usbip/libsrc/vhci_driver.c
++++ b/tools/usb/usbip/libsrc/vhci_driver.c
+@@ -135,11 +135,11 @@ static int refresh_imported_device_list(
+ return 0;
+ }
+
+-static int get_nports(void)
++static int get_nports(struct udev_device *hc_device)
+ {
+ const char *attr_nports;
+
+- attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports");
++ attr_nports = udev_device_get_sysattr_value(hc_device, "nports");
+ if (!attr_nports) {
+ err("udev_device_get_sysattr_value nports failed");
+ return -1;
+@@ -242,35 +242,41 @@ static int read_record(int rhport, char
+
+ int usbip_vhci_driver_open(void)
+ {
++ int nports;
++ struct udev_device *hc_device;
++
+ udev_context = udev_new();
+ if (!udev_context) {
+ err("udev_new failed");
+ return -1;
+ }
+
+- vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver));
+-
+ /* will be freed in usbip_driver_close() */
+- vhci_driver->hc_device =
++ hc_device =
+ udev_device_new_from_subsystem_sysname(udev_context,
+ USBIP_VHCI_BUS_TYPE,
+ USBIP_VHCI_DEVICE_NAME);
+- if (!vhci_driver->hc_device) {
++ if (!hc_device) {
+ err("udev_device_new_from_subsystem_sysname failed");
+ goto err;
+ }
+
+- vhci_driver->nports = get_nports();
+- dbg("available ports: %d", vhci_driver->nports);
+-
+- if (vhci_driver->nports <= 0) {
++ nports = get_nports(hc_device);
++ if (nports <= 0) {
+ err("no available ports");
+ goto err;
+- } else if (vhci_driver->nports > MAXNPORT) {
+- err("port number exceeds %d", MAXNPORT);
++ }
++ dbg("available ports: %d", nports);
++
++ vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) +
++ nports * sizeof(struct usbip_imported_device));
++ if (!vhci_driver) {
++ err("vhci_driver allocation failed");
+ goto err;
+ }
+
++ vhci_driver->nports = nports;
++ vhci_driver->hc_device = hc_device;
+ vhci_driver->ncontrollers = get_ncontrollers();
+ dbg("available controllers: %d", vhci_driver->ncontrollers);
+
+@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void)
+ return 0;
+
+ err:
+- udev_device_unref(vhci_driver->hc_device);
++ udev_device_unref(hc_device);
+
+ if (vhci_driver)
+ free(vhci_driver);
+--- a/tools/usb/usbip/libsrc/vhci_driver.h
++++ b/tools/usb/usbip/libsrc/vhci_driver.h
+@@ -13,7 +13,6 @@
+
+ #define USBIP_VHCI_BUS_TYPE "platform"
+ #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0"
+-#define MAXNPORT 128
+
+ enum hub_speed {
+ HUB_SPEED_HIGH = 0,
+@@ -41,7 +40,7 @@ struct usbip_vhci_driver {
+
+ int ncontrollers;
+ int nports;
+- struct usbip_imported_device idev[MAXNPORT];
++ struct usbip_imported_device idev[];
+ };
+
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Tue, 29 May 2018 16:13:03 -0600
+Subject: usbip: usbip_detach: Fix memory, udev context and udev leak
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ]
+
+detach_port() fails to call usbip_vhci_driver_close() from its error
+path after usbip_vhci_detach_device() returns failure, leaking memory
+allocated in usbip_vhci_driver_open() and holding udev_context and udev
+references. Fix it to call usbip_vhci_driver_close().
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/usb/usbip/src/usbip_detach.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/tools/usb/usbip/src/usbip_detach.c
++++ b/tools/usb/usbip/src/usbip_detach.c
+@@ -43,7 +43,7 @@ void usbip_detach_usage(void)
+
+ static int detach_port(char *port)
+ {
+- int ret;
++ int ret = 0;
+ uint8_t portnum;
+ char path[PATH_MAX+1];
+
+@@ -73,9 +73,12 @@ static int detach_port(char *port)
+ }
+
+ ret = usbip_vhci_detach_device(portnum);
+- if (ret < 0)
+- return -1;
++ if (ret < 0) {
++ ret = -1;
++ goto call_driver_close;
++ }
+
++call_driver_close:
+ usbip_vhci_driver_close();
+
+ return ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 15 May 2018 13:53:55 -0600
+Subject: vfio/mdev: Check globally for duplicate devices
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit 002fe996f67f4f46d8917b14cfb6e4313c20685a ]
+
+When we create an mdev device, we check for duplicates against the
+parent device and return -EEXIST if found, but the mdev device
+namespace is global since we'll link all devices from the bus. We do
+catch this later in sysfs_do_create_link_sd() to return -EEXIST, but
+with it comes a kernel warning and stack trace for trying to create
+duplicate sysfs links, which makes it an undesirable response.
+
+Therefore we should really be looking for duplicates across all mdev
+parent devices, or as implemented here, against our mdev device list.
+Using mdev_list to prevent duplicates means that we can remove
+mdev_parent.lock, but in order not to serialize mdev device creation
+and removal globally, we add mdev_device.active which allows UUIDs to
+be reserved such that we can drop the mdev_list_lock before the mdev
+device is fully in place.
+
+Two behavioral notes; first, mdev_parent.lock had the side-effect of
+serializing mdev create and remove ops per parent device. This was
+an implementation detail, not an intentional guarantee provided to
+the mdev vendor drivers. Vendor drivers can trivially provide this
+serialization internally if necessary. Second, review comments note
+the new -EAGAIN behavior when the device, and in particular the remove
+attribute, becomes visible in sysfs. If a remove is triggered prior
+to completion of mdev_device_create() the user will see a -EAGAIN
+error. While the errno is different, receiving an error during this
+period is not, the previous implementation returned -ENODEV for the
+same condition. Furthermore, the consistency to the user is improved
+in the case where mdev_device_remove_ops() returns error. Previously
+concurrent calls to mdev_device_remove() could see the device
+disappear with -ENODEV and return in the case of error. Now a user
+would see -EAGAIN while the device is in this transitory state.
+
+Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Acked-by: Halil Pasic <pasic@linux.ibm.com>
+Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/vfio-mediated-device.txt | 5 +
+ drivers/vfio/mdev/mdev_core.c | 102 +++++++++++----------------------
+ drivers/vfio/mdev/mdev_private.h | 2
+ 3 files changed, 42 insertions(+), 67 deletions(-)
+
+--- a/Documentation/vfio-mediated-device.txt
++++ b/Documentation/vfio-mediated-device.txt
+@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops str
+ * create: allocate basic resources in a driver for a mediated device
+ * remove: free resources in a driver when a mediated device is destroyed
+
++(Note that mdev-core provides no implicit serialization of create/remove
++callbacks per mdev parent device, per mdev type, or any other categorization.
++Vendor drivers are expected to be fully asynchronous in this respect or
++provide their own internal resource protection.)
++
+ The callbacks in the mdev_parent_ops structure are as follows:
+
+ * open: open callback of mediated device
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -66,34 +66,6 @@ uuid_le mdev_uuid(struct mdev_device *md
+ }
+ EXPORT_SYMBOL(mdev_uuid);
+
+-static int _find_mdev_device(struct device *dev, void *data)
+-{
+- struct mdev_device *mdev;
+-
+- if (!dev_is_mdev(dev))
+- return 0;
+-
+- mdev = to_mdev_device(dev);
+-
+- if (uuid_le_cmp(mdev->uuid, *(uuid_le *)data) == 0)
+- return 1;
+-
+- return 0;
+-}
+-
+-static bool mdev_device_exist(struct mdev_parent *parent, uuid_le uuid)
+-{
+- struct device *dev;
+-
+- dev = device_find_child(parent->dev, &uuid, _find_mdev_device);
+- if (dev) {
+- put_device(dev);
+- return true;
+- }
+-
+- return false;
+-}
+-
+ /* Should be called holding parent_list_lock */
+ static struct mdev_parent *__find_parent_device(struct device *dev)
+ {
+@@ -221,7 +193,6 @@ int mdev_register_device(struct device *
+ }
+
+ kref_init(&parent->ref);
+- mutex_init(&parent->lock);
+
+ parent->dev = dev;
+ parent->ops = ops;
+@@ -297,6 +268,10 @@ static void mdev_device_release(struct d
+ {
+ struct mdev_device *mdev = to_mdev_device(dev);
+
++ mutex_lock(&mdev_list_lock);
++ list_del(&mdev->next);
++ mutex_unlock(&mdev_list_lock);
++
+ dev_dbg(&mdev->dev, "MDEV: destroying\n");
+ kfree(mdev);
+ }
+@@ -304,7 +279,7 @@ static void mdev_device_release(struct d
+ int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid)
+ {
+ int ret;
+- struct mdev_device *mdev;
++ struct mdev_device *mdev, *tmp;
+ struct mdev_parent *parent;
+ struct mdev_type *type = to_mdev_type(kobj);
+
+@@ -312,21 +287,28 @@ int mdev_device_create(struct kobject *k
+ if (!parent)
+ return -EINVAL;
+
+- mutex_lock(&parent->lock);
++ mutex_lock(&mdev_list_lock);
+
+ /* Check for duplicate */
+- if (mdev_device_exist(parent, uuid)) {
+- ret = -EEXIST;
+- goto create_err;
++ list_for_each_entry(tmp, &mdev_list, next) {
++ if (!uuid_le_cmp(tmp->uuid, uuid)) {
++ mutex_unlock(&mdev_list_lock);
++ ret = -EEXIST;
++ goto mdev_fail;
++ }
+ }
+
+ mdev = kzalloc(sizeof(*mdev), GFP_KERNEL);
+ if (!mdev) {
++ mutex_unlock(&mdev_list_lock);
+ ret = -ENOMEM;
+- goto create_err;
++ goto mdev_fail;
+ }
+
+ memcpy(&mdev->uuid, &uuid, sizeof(uuid_le));
++ list_add(&mdev->next, &mdev_list);
++ mutex_unlock(&mdev_list_lock);
++
+ mdev->parent = parent;
+ kref_init(&mdev->ref);
+
+@@ -338,35 +320,28 @@ int mdev_device_create(struct kobject *k
+ ret = device_register(&mdev->dev);
+ if (ret) {
+ put_device(&mdev->dev);
+- goto create_err;
++ goto mdev_fail;
+ }
+
+ ret = mdev_device_create_ops(kobj, mdev);
+ if (ret)
+- goto create_failed;
++ goto create_fail;
+
+ ret = mdev_create_sysfs_files(&mdev->dev, type);
+ if (ret) {
+ mdev_device_remove_ops(mdev, true);
+- goto create_failed;
++ goto create_fail;
+ }
+
+ mdev->type_kobj = kobj;
++ mdev->active = true;
+ dev_dbg(&mdev->dev, "MDEV: created\n");
+
+- mutex_unlock(&parent->lock);
+-
+- mutex_lock(&mdev_list_lock);
+- list_add(&mdev->next, &mdev_list);
+- mutex_unlock(&mdev_list_lock);
+-
+- return ret;
++ return 0;
+
+-create_failed:
++create_fail:
+ device_unregister(&mdev->dev);
+-
+-create_err:
+- mutex_unlock(&parent->lock);
++mdev_fail:
+ mdev_put_parent(parent);
+ return ret;
+ }
+@@ -377,44 +352,39 @@ int mdev_device_remove(struct device *de
+ struct mdev_parent *parent;
+ struct mdev_type *type;
+ int ret;
+- bool found = false;
+
+ mdev = to_mdev_device(dev);
+
+ mutex_lock(&mdev_list_lock);
+ list_for_each_entry(tmp, &mdev_list, next) {
+- if (tmp == mdev) {
+- found = true;
++ if (tmp == mdev)
+ break;
+- }
+ }
+
+- if (found)
+- list_del(&mdev->next);
++ if (tmp != mdev) {
++ mutex_unlock(&mdev_list_lock);
++ return -ENODEV;
++ }
+
+- mutex_unlock(&mdev_list_lock);
++ if (!mdev->active) {
++ mutex_unlock(&mdev_list_lock);
++ return -EAGAIN;
++ }
+
+- if (!found)
+- return -ENODEV;
++ mdev->active = false;
++ mutex_unlock(&mdev_list_lock);
+
+ type = to_mdev_type(mdev->type_kobj);
+ parent = mdev->parent;
+- mutex_lock(&parent->lock);
+
+ ret = mdev_device_remove_ops(mdev, force_remove);
+ if (ret) {
+- mutex_unlock(&parent->lock);
+-
+- mutex_lock(&mdev_list_lock);
+- list_add(&mdev->next, &mdev_list);
+- mutex_unlock(&mdev_list_lock);
+-
++ mdev->active = true;
+ return ret;
+ }
+
+ mdev_remove_sysfs_files(dev, type);
+ device_unregister(dev);
+- mutex_unlock(&parent->lock);
+ mdev_put_parent(parent);
+
+ return 0;
+--- a/drivers/vfio/mdev/mdev_private.h
++++ b/drivers/vfio/mdev/mdev_private.h
+@@ -20,7 +20,6 @@ struct mdev_parent {
+ struct device *dev;
+ const struct mdev_parent_ops *ops;
+ struct kref ref;
+- struct mutex lock;
+ struct list_head next;
+ struct kset *mdev_types_kset;
+ struct list_head type_list;
+@@ -34,6 +33,7 @@ struct mdev_device {
+ struct kref ref;
+ struct list_head next;
+ struct kobject *type_kobj;
++ bool active;
+ };
+
+ #define to_mdev_device(dev) container_of(dev, struct mdev_device, dev)
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 11 Apr 2018 11:15:48 +0200
+Subject: vfio: platform: Fix reset module leak in error path
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 28a68387888997e8a7fa57940ea5d55f2e16b594 ]
+
+If the IOMMU group setup fails, the reset module is not released.
+
+Fixes: b5add544d677d363 ("vfio, platform: make reset driver a requirement by default")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Acked-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/platform/vfio_platform_common.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vf
+ group = vfio_iommu_group_get(dev);
+ if (!group) {
+ pr_err("VFIO: No IOMMU group for device %s\n", vdev->name);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_reset;
+ }
+
+ ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev);
+- if (ret) {
+- vfio_iommu_group_put(group, dev);
+- return ret;
+- }
++ if (ret)
++ goto put_iommu;
+
+ mutex_init(&vdev->igate);
+
+ return 0;
++
++put_iommu:
++ vfio_iommu_group_put(group, dev);
++put_reset:
++ vfio_platform_put_reset(vdev);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(vfio_platform_probe_common);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 11 May 2018 09:05:02 -0600
+Subject: vfio/type1: Fix task tracking for QEMU vCPU hotplug
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit 48d8476b41eed63567dd2f0ad125c895b9ac648a ]
+
+MAP_DMA ioctls might be called from various threads within a process,
+for example when using QEMU, the vCPU threads are often generating
+these calls and we therefore take a reference to that vCPU task.
+However, QEMU also supports vCPU hotplug on some machines and the task
+that called MAP_DMA may have exited by the time UNMAP_DMA is called,
+resulting in the mm_struct pointer being NULL and thus a failure to
+match against the existing mapping.
+
+To resolve this, we instead take a reference to the thread
+group_leader, which has the same mm_struct and resource limits, but
+is less likely exit, at least in the QEMU case. A difficulty here is
+guaranteeing that the capabilities of the group_leader match that of
+the calling thread, which we resolve by tracking CAP_IPC_LOCK at the
+time of calling rather than at an indeterminate time in the future.
+Potentially this also results in better efficiency as this is now
+recorded once per MAP_DMA ioctl.
+
+Reported-by: Xu Yandong <xuyandong2@huawei.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 73 +++++++++++++++++++++++++---------------
+ 1 file changed, 47 insertions(+), 26 deletions(-)
+
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -83,6 +83,7 @@ struct vfio_dma {
+ size_t size; /* Map size (bytes) */
+ int prot; /* IOMMU_READ/WRITE */
+ bool iommu_mapped;
++ bool lock_cap; /* capable(CAP_IPC_LOCK) */
+ struct task_struct *task;
+ struct rb_root pfn_list; /* Ex-user pinned pfn list */
+ };
+@@ -253,29 +254,25 @@ static int vfio_iova_put_vfio_pfn(struct
+ return ret;
+ }
+
+-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap)
++static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
+ {
+ struct mm_struct *mm;
+- bool is_current;
+ int ret;
+
+ if (!npage)
+ return 0;
+
+- is_current = (task->mm == current->mm);
+-
+- mm = is_current ? task->mm : get_task_mm(task);
++ mm = async ? get_task_mm(dma->task) : dma->task->mm;
+ if (!mm)
+ return -ESRCH; /* process exited */
+
+ ret = down_write_killable(&mm->mmap_sem);
+ if (!ret) {
+ if (npage > 0) {
+- if (lock_cap ? !*lock_cap :
+- !has_capability(task, CAP_IPC_LOCK)) {
++ if (!dma->lock_cap) {
+ unsigned long limit;
+
+- limit = task_rlimit(task,
++ limit = task_rlimit(dma->task,
+ RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+
+ if (mm->locked_vm + npage > limit)
+@@ -289,7 +286,7 @@ static int vfio_lock_acct(struct task_st
+ up_write(&mm->mmap_sem);
+ }
+
+- if (!is_current)
++ if (async)
+ mmput(mm);
+
+ return ret;
+@@ -398,7 +395,7 @@ static int vaddr_get_pfn(struct mm_struc
+ */
+ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
+ long npage, unsigned long *pfn_base,
+- bool lock_cap, unsigned long limit)
++ unsigned long limit)
+ {
+ unsigned long pfn = 0;
+ long ret, pinned = 0, lock_acct = 0;
+@@ -421,7 +418,7 @@ static long vfio_pin_pages_remote(struct
+ * pages are already counted against the user.
+ */
+ if (!rsvd && !vfio_find_vpfn(dma, iova)) {
+- if (!lock_cap && current->mm->locked_vm + 1 > limit) {
++ if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) {
+ put_pfn(*pfn_base, dma->prot);
+ pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__,
+ limit << PAGE_SHIFT);
+@@ -447,7 +444,7 @@ static long vfio_pin_pages_remote(struct
+ }
+
+ if (!rsvd && !vfio_find_vpfn(dma, iova)) {
+- if (!lock_cap &&
++ if (!dma->lock_cap &&
+ current->mm->locked_vm + lock_acct + 1 > limit) {
+ put_pfn(pfn, dma->prot);
+ pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n",
+@@ -460,7 +457,7 @@ static long vfio_pin_pages_remote(struct
+ }
+
+ out:
+- ret = vfio_lock_acct(current, lock_acct, &lock_cap);
++ ret = vfio_lock_acct(dma, lock_acct, false);
+
+ unpin_out:
+ if (ret) {
+@@ -491,7 +488,7 @@ static long vfio_unpin_pages_remote(stru
+ }
+
+ if (do_accounting)
+- vfio_lock_acct(dma->task, locked - unlocked, NULL);
++ vfio_lock_acct(dma, locked - unlocked, true);
+
+ return unlocked;
+ }
+@@ -508,7 +505,7 @@ static int vfio_pin_page_external(struct
+
+ ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base);
+ if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) {
+- ret = vfio_lock_acct(dma->task, 1, NULL);
++ ret = vfio_lock_acct(dma, 1, true);
+ if (ret) {
+ put_pfn(*pfn_base, dma->prot);
+ if (ret == -ENOMEM)
+@@ -535,7 +532,7 @@ static int vfio_unpin_page_external(stru
+ unlocked = vfio_iova_put_vfio_pfn(dma, vpfn);
+
+ if (do_accounting)
+- vfio_lock_acct(dma->task, -unlocked, NULL);
++ vfio_lock_acct(dma, -unlocked, true);
+
+ return unlocked;
+ }
+@@ -827,7 +824,7 @@ static long vfio_unmap_unpin(struct vfio
+ unlocked += vfio_sync_unpin(dma, domain, &unmapped_region_list);
+
+ if (do_accounting) {
+- vfio_lock_acct(dma->task, -unlocked, NULL);
++ vfio_lock_acct(dma, -unlocked, true);
+ return 0;
+ }
+ return unlocked;
+@@ -1042,14 +1039,12 @@ static int vfio_pin_map_dma(struct vfio_
+ size_t size = map_size;
+ long npage;
+ unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+- bool lock_cap = capable(CAP_IPC_LOCK);
+ int ret = 0;
+
+ while (size) {
+ /* Pin a contiguous chunk of memory */
+ npage = vfio_pin_pages_remote(dma, vaddr + dma->size,
+- size >> PAGE_SHIFT, &pfn,
+- lock_cap, limit);
++ size >> PAGE_SHIFT, &pfn, limit);
+ if (npage <= 0) {
+ WARN_ON(!npage);
+ ret = (int)npage;
+@@ -1124,8 +1119,36 @@ static int vfio_dma_do_map(struct vfio_i
+ dma->iova = iova;
+ dma->vaddr = vaddr;
+ dma->prot = prot;
+- get_task_struct(current);
+- dma->task = current;
++
++ /*
++ * We need to be able to both add to a task's locked memory and test
++ * against the locked memory limit and we need to be able to do both
++ * outside of this call path as pinning can be asynchronous via the
++ * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a
++ * task_struct and VM locked pages requires an mm_struct, however
++ * holding an indefinite mm reference is not recommended, therefore we
++ * only hold a reference to a task. We could hold a reference to
++ * current, however QEMU uses this call path through vCPU threads,
++ * which can be killed resulting in a NULL mm and failure in the unmap
++ * path when called via a different thread. Avoid this problem by
++ * using the group_leader as threads within the same group require
++ * both CLONE_THREAD and CLONE_VM and will therefore use the same
++ * mm_struct.
++ *
++ * Previously we also used the task for testing CAP_IPC_LOCK at the
++ * time of pinning and accounting, however has_capability() makes use
++ * of real_cred, a copy-on-write field, so we can't guarantee that it
++ * matches group_leader, or in fact that it might not change by the
++ * time it's evaluated. If a process were to call MAP_DMA with
++ * CAP_IPC_LOCK but later drop it, it doesn't make sense that they
++ * possibly see different results for an iommu_mapped vfio_dma vs
++ * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the
++ * time of calling MAP_DMA.
++ */
++ get_task_struct(current->group_leader);
++ dma->task = current->group_leader;
++ dma->lock_cap = capable(CAP_IPC_LOCK);
++
+ dma->pfn_list = RB_ROOT;
+
+ /* Insert zero-sized and grow as we map chunks of it */
+@@ -1160,7 +1183,6 @@ static int vfio_iommu_replay(struct vfio
+ struct vfio_domain *d;
+ struct rb_node *n;
+ unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+- bool lock_cap = capable(CAP_IPC_LOCK);
+ int ret;
+
+ /* Arbitrarily pick the first domain in the list for lookups */
+@@ -1207,8 +1229,7 @@ static int vfio_iommu_replay(struct vfio
+
+ npage = vfio_pin_pages_remote(dma, vaddr,
+ n >> PAGE_SHIFT,
+- &pfn, lock_cap,
+- limit);
++ &pfn, limit);
+ if (npage <= 0) {
+ WARN_ON(!npage);
+ ret = (int)npage;
+@@ -1485,7 +1506,7 @@ static void vfio_iommu_unmap_unpin_reacc
+ if (!is_invalid_reserved_pfn(vpfn->pfn))
+ locked++;
+ }
+- vfio_lock_acct(dma->task, locked - unlocked, NULL);
++ vfio_lock_acct(dma, locked - unlocked, true);
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Mon, 28 May 2018 08:45:45 +0200
+Subject: watchdog: da9063: Fix updating timeout value
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 44ee54aabfdb3b35866ed909bde3ab01e9679385 ]
+
+The DA9063 watchdog has only one register field to store the timeout value
+and to enable the watchdog. The watchdog gets enabled if the value is
+not zero. There is no issue if the watchdog is already running but it
+leads into problems if the watchdog is disabled.
+
+If the watchdog is disabled and only the timeout value should be prepared
+the watchdog gets enabled too. Add a check to get the current watchdog
+state and update the watchdog timeout value on hw-side only if the
+watchdog is already active.
+
+Fixes: 5e9c16e37608 ("watchdog: Add DA9063 PMIC watchdog driver.")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/watchdog/da9063_wdt.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/watchdog/da9063_wdt.c
++++ b/drivers/watchdog/da9063_wdt.c
+@@ -99,10 +99,23 @@ static int da9063_wdt_set_timeout(struct
+ {
+ struct da9063 *da9063 = watchdog_get_drvdata(wdd);
+ unsigned int selector;
+- int ret;
++ int ret = 0;
+
+ selector = da9063_wdt_timeout_to_sel(timeout);
+- ret = _da9063_wdt_set_timeout(da9063, selector);
++
++ /*
++ * There are two cases when a set_timeout() will be called:
++ * 1. The watchdog is off and someone wants to set the timeout for the
++ * further use.
++ * 2. The watchdog is already running and a new timeout value should be
++ * set.
++ *
++ * The watchdog can't store a timeout value not equal zero without
++ * enabling the watchdog, so the timeout must be buffered by the driver.
++ */
++ if (watchdog_active(wdd))
++ ret = _da9063_wdt_set_timeout(da9063, selector);
++
+ if (ret)
+ dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n",
+ ret);
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Mon, 7 May 2018 14:29:42 +0200
+Subject: watchdog: renesas-wdt: Add support for the R8A77965 WDT
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit b1eb8fedc01499132ced4b2a44b3ab3855c4e681 ]
+
+Document support for the Watchdog Timer (WDT) Controller in the Renesas
+R-Car M3-N (R8A77965) SoC. No driver update is needed.
+
+Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+[wsa: rebased to v4.17-rc3]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/watchdog/renesas-wdt.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
++++ b/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
+@@ -7,6 +7,7 @@ Required properties:
+ - "renesas,r7s72100-wdt" (RZ/A1)
+ - "renesas,r8a7795-wdt" (R-Car H3)
+ - "renesas,r8a7796-wdt" (R-Car M3-W)
++ - "renesas,r8a77965-wdt" (R-Car M3-N)
+ - "renesas,r8a77970-wdt" (R-Car V3M)
+ - "renesas,r8a77995-wdt" (R-Car D3)
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Eyal Reizer <eyalreizer@gmail.com>
+Date: Mon, 28 May 2018 11:36:42 +0300
+Subject: wlcore: sdio: check for valid platform device data before suspend
+
+From: Eyal Reizer <eyalreizer@gmail.com>
+
+[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ]
+
+the wl pointer can be null In case only wlcore_sdio is probed while
+no WiLink module is successfully probed, as in the case of mounting a
+wl12xx module while using a device tree file configured with wl18xx
+related settings.
+In this case the system was crashing in wl1271_suspend() as platform
+device data is not set.
+Make sure wl the pointer is valid before using it.
+
+Signed-off-by: Eyal Reizer <eyalr@ti.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ti/wlcore/sdio.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ti/wlcore/sdio.c
++++ b/drivers/net/wireless/ti/wlcore/sdio.c
+@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device
+ mmc_pm_flag_t sdio_flags;
+ int ret = 0;
+
++ if (!wl) {
++ dev_err(dev, "no wilink module was probed\n");
++ goto out;
++ }
++
+ dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n",
+ wl->wow_enabled);
+
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Scott Wood <swood@redhat.com>
+Date: Thu, 24 May 2018 10:44:20 -0500
+Subject: x86/microcode: Make the late update update_lock a raw lock for RT
+
+From: Scott Wood <swood@redhat.com>
+
+[ Upstream commit ff987fcf011d20c53b3a613edf6e2055ea48e26e ]
+
+__reload_late() is called from stop_machine context and thus cannot
+acquire a non-raw spinlock on PREEMPT_RT.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Clark Williams <williams@redhat.com>
+Cc: Pei Zhang <pezhang@redhat.com>
+Cc: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/20180524154420.24455-1-swood@redhat.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/microcode/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex);
+ /*
+ * Serialize late loading so that CPUs get updated one-by-one.
+ */
+-static DEFINE_SPINLOCK(update_lock);
++static DEFINE_RAW_SPINLOCK(update_lock);
+
+ struct ucode_cpu_info ucode_cpu_info[NR_CPUS];
+
+@@ -560,9 +560,9 @@ static int __reload_late(void *info)
+ if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC))
+ return -1;
+
+- spin_lock(&update_lock);
++ raw_spin_lock(&update_lock);
+ apply_microcode_local(&err);
+- spin_unlock(&update_lock);
++ raw_spin_unlock(&update_lock);
+
+ /* siblings return UCODE_OK because their engine got updated already */
+ if (err > UCODE_NFOUND) {
--- /dev/null
+From foo@baz Sat Jul 28 10:14:30 CEST 2018
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 12 Jun 2018 08:57:53 +0200
+Subject: xen/netfront: raise max number of slots in xennet_get_responses()
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ]
+
+The max number of slots used in xennet_get_responses() is set to
+MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD).
+
+In old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This
+difference is resulting in frequent messages "too many slots" and a
+reduced network throughput for some workloads (factor 10 below that of
+a kernel-xen based guest).
+
+Replacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of
+the max number of slots to use solves that problem (tests showed no
+more messages "too many slots" and throughput was as high as with the
+kernel-xen based guest system).
+
+Replace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in
+netfront_tx_slot_available() for making it clearer what is really being
+tested without actually modifying the tested value.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netfront.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -239,7 +239,7 @@ static void rx_refill_timeout(struct tim
+ static int netfront_tx_slot_available(struct netfront_queue *queue)
+ {
+ return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) <
+- (NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2);
++ (NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1);
+ }
+
+ static void xennet_maybe_wake_tx(struct netfront_queue *queue)
+@@ -790,7 +790,7 @@ static int xennet_get_responses(struct n
+ RING_IDX cons = queue->rx.rsp_cons;
+ struct sk_buff *skb = xennet_get_rx_skb(queue, cons);
+ grant_ref_t ref = xennet_get_rx_ref(queue, cons);
+- int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
++ int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
+ int slots = 1;
+ int err = 0;
+ unsigned long ret;
--- /dev/null
+From foo@baz Sat Jul 28 10:14:31 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 12 Apr 2018 15:19:44 +0200
+Subject: y2038: ipc: Use ktime_get_real_seconds consistently
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 2a70b7879b84d471fd0e440f027bba310e0c1fb7 ]
+
+In some places, we still used get_seconds() instead of
+ktime_get_real_seconds(), and I'm changing the remaining ones now to
+all use ktime_get_real_seconds() so we use the full available range for
+timestamps instead of overflowing the 'unsigned long' return value in
+year 2106 on 32-bit kernels.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ ipc/msg.c | 6 +++---
+ ipc/sem.c | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -758,7 +758,7 @@ static inline int pipelined_send(struct
+ WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG));
+ } else {
+ ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
+- msq->q_rtime = get_seconds();
++ msq->q_rtime = ktime_get_real_seconds();
+
+ wake_q_add(wake_q, msr->r_tsk);
+ WRITE_ONCE(msr->r_msg, msg);
+@@ -859,7 +859,7 @@ static long do_msgsnd(int msqid, long mt
+ }
+
+ ipc_update_pid(&msq->q_lspid, task_tgid(current));
+- msq->q_stime = get_seconds();
++ msq->q_stime = ktime_get_real_seconds();
+
+ if (!pipelined_send(msq, msg, &wake_q)) {
+ /* no one is waiting for this message, enqueue it */
+@@ -1087,7 +1087,7 @@ static long do_msgrcv(int msqid, void __
+
+ list_del(&msg->m_list);
+ msq->q_qnum--;
+- msq->q_rtime = get_seconds();
++ msq->q_rtime = ktime_get_real_seconds();
+ ipc_update_pid(&msq->q_lrpid, task_tgid(current));
+ msq->q_cbytes -= msg->m_ts;
+ atomic_sub(msg->m_ts, &ns->msg_bytes);
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -104,7 +104,7 @@ struct sem {
+ /* that alter the semaphore */
+ struct list_head pending_const; /* pending single-sop operations */
+ /* that do not alter the semaphore*/
+- time_t sem_otime; /* candidate for sem_otime */
++ time64_t sem_otime; /* candidate for sem_otime */
+ } ____cacheline_aligned_in_smp;
+
+ /* One sem_array data structure for each set of semaphores in the system. */
+@@ -984,10 +984,10 @@ again:
+ static void set_semotime(struct sem_array *sma, struct sembuf *sops)
+ {
+ if (sops == NULL) {
+- sma->sems[0].sem_otime = get_seconds();
++ sma->sems[0].sem_otime = ktime_get_real_seconds();
+ } else {
+ sma->sems[sops[0].sem_num].sem_otime =
+- get_seconds();
++ ktime_get_real_seconds();
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
