--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Chunyan Zhang <zhang.lyra@gmail.com>
+Date: Fri, 1 Dec 2017 03:51:04 +0100
+Subject: ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
+
+From: Chunyan Zhang <zhang.lyra@gmail.com>
+
+
+[ Upstream commit 36b0cb84ee858f02c256d26f0cb4229c78e3399e ]
+
+An additional 'ip' will be pushed to the stack, for restoring the
+DACR later, if CONFIG_CPU_SW_DOMAIN_PAN defined.
+
+However, the fixup still get the err_ptr by add #8*4 to sp, which
+results in the fact that the code area pointed by the LR will be
+overwritten, or the kernel will crash if CONFIG_DEBUG_RODATA is enabled.
+
+This patch fixes the stack mismatch.
+
+Fixes: a5e090acbf54 ("ARM: software-based priviledged-no-access support")
+Signed-off-by: Lvqiang Huang <Lvqiang.Huang@spreadtrum.com>
+Signed-off-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/lib/csumpartialcopyuser.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/lib/csumpartialcopyuser.S
++++ b/arch/arm/lib/csumpartialcopyuser.S
+@@ -85,7 +85,11 @@
+ .pushsection .text.fixup,"ax"
+ .align 4
+ 9001: mov r4, #-EFAULT
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ ldr r5, [sp, #9*4] @ *err_ptr
++#else
+ ldr r5, [sp, #8*4] @ *err_ptr
++#endif
+ str r4, [r5]
+ ldmia sp, {r1, r2} @ retrieve dst, len
+ add r2, r2, r1
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 21 Dec 2017 22:35:19 +0100
+Subject: ARM: dts: ls1021a: fix incorrect clock references
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 506e8a912661c97b41adc8a286b875d01323ec45 ]
+
+dtc warns about two 'clocks' properties that have an extraneous '1'
+at the end:
+
+arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a
+arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a:clocks[1])
+Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2190000/sgtl5000@a
+arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2190000/sgtl5000@a:clocks[1])
+
+The clocks that get referenced here are fixed-rate, so they do not
+take any argument, and dtc interprets the next cell as a phandle, which
+is invalid.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/ls1021a-qds.dts | 2 +-
+ arch/arm/boot/dts/ls1021a-twr.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/ls1021a-qds.dts
++++ b/arch/arm/boot/dts/ls1021a-qds.dts
+@@ -215,7 +215,7 @@
+ reg = <0x2a>;
+ VDDA-supply = <®_3p3v>;
+ VDDIO-supply = <®_3p3v>;
+- clocks = <&sys_mclk 1>;
++ clocks = <&sys_mclk>;
+ };
+ };
+ };
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -167,7 +167,7 @@
+ reg = <0x0a>;
+ VDDA-supply = <®_3p3v>;
+ VDDIO-supply = <®_3p3v>;
+- clocks = <&sys_mclk 1>;
++ clocks = <&sys_mclk>;
+ };
+ };
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+Date: Fri, 22 Dec 2017 13:01:39 -0200
+Subject: bnx2x: Improve reliability in case of nested PCI errors
+
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+
+
+[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ]
+
+While in recovery process of PCI error (called EEH on PowerPC arch),
+another PCI transaction could be corrupted causing a situation of
+nested PCI errors. Also, this scenario could be reproduced with
+error injection mechanisms (for debug purposes).
+
+We observe that in case of nested PCI errors, bnx2x might attempt to
+initialize its shmem and cause a kernel crash due to bad addresses
+read from MCP. Multiple different stack traces were observed depending
+on the point the second PCI error happens.
+
+This patch avoids the crashes by:
+
+ * failing PCI recovery in case of nested errors (since multiple
+ PCI errors in a row are not expected to lead to a functional
+ adapter anyway), and by,
+
+ * preventing access to adapter FW when MCP is failed (we mark it as
+ failed when shmem cannot get initialized properly).
+
+Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Acked-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 4 ++--
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 +++++++++++++-
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3052,7 +3052,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
+
+ del_timer_sync(&bp->timer);
+
+- if (IS_PF(bp)) {
++ if (IS_PF(bp) && !BP_NOMCP(bp)) {
+ /* Set ALWAYS_ALIVE bit in shmem */
+ bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
+ bnx2x_drv_pulse(bp);
+@@ -3134,7 +3134,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
+ bp->cnic_loaded = false;
+
+ /* Clear driver version indication in shmem */
+- if (IS_PF(bp))
++ if (IS_PF(bp) && !BP_NOMCP(bp))
+ bnx2x_update_mng_version(bp);
+
+ /* Check if there are pending parity attentions. If there are - set
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9570,6 +9570,15 @@ static int bnx2x_init_shmem(struct bnx2x
+
+ do {
+ bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
++
++ /* If we read all 0xFFs, means we are in PCI error state and
++ * should bail out to avoid crashes on adapter's FW reads.
++ */
++ if (bp->common.shmem_base == 0xFFFFFFFF) {
++ bp->flags |= NO_MCP_FLAG;
++ return -ENODEV;
++ }
++
+ if (bp->common.shmem_base) {
+ val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
+ if (val & SHR_MEM_VALIDITY_MB)
+@@ -14214,7 +14223,10 @@ static pci_ers_result_t bnx2x_io_slot_re
+ BNX2X_ERR("IO slot reset --> driver unload\n");
+
+ /* MCP should have been reset; Need to wait for validity */
+- bnx2x_init_shmem(bp);
++ if (bnx2x_init_shmem(bp)) {
++ rtnl_unlock();
++ return PCI_ERS_RESULT_DISCONNECT;
++ }
+
+ if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
+ u32 v;
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+Date: Thu, 4 Jan 2018 18:46:55 -0500
+Subject: bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
+
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+
+
+[ Upstream commit 78f300049335ae81a5cc6b4b232481dc5e1f9d41 ]
+
+In bnxt_vf_ndo_prep (which is called by bnxt_get_vf_config ndo), there is a
+check for "Invalid VF id". Currently, the check is done against max_vfs.
+However, the user doesn't always create max_vfs. So, the check should be
+against the created number of VFs. The number of bnxt_vf_info structures
+that are allocated in bnxt_alloc_vf_resources routine is the "number of
+requested VFs". So, if an "invalid VF id" falls between the requested
+number of VFs and the max_vfs, the driver will be dereferencing an invalid
+pointer.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Venkat Devvuru <venkatkumar.duvvuru@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -29,7 +29,7 @@ static int bnxt_vf_ndo_prep(struct bnxt
+ netdev_err(bp->dev, "vf ndo called though sriov is disabled\n");
+ return -EINVAL;
+ }
+- if (vf_id >= bp->pf.max_vfs) {
++ if (vf_id >= bp->pf.active_vfs) {
+ netdev_err(bp->dev, "Invalid VF id %d\n", vf_id);
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Luu An Phu <phu.luuan@nxp.com>
+Date: Tue, 2 Jan 2018 10:44:18 +0700
+Subject: can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
+
+From: Luu An Phu <phu.luuan@nxp.com>
+
+
+[ Upstream commit 13454c14550065fcc1705d6bd4ee6d40e057099f ]
+
+The flexcan_start_xmit() function compares the frame length with data
+register length to write frame content into data[0] and data[1]
+register. Data register length is 4 bytes and frame maximum length is 8
+bytes.
+
+Fix the check that compares frame length with 3. Because the register
+length is 4.
+
+Signed-off-by: Luu An Phu <phu.luuan@nxp.com>
+Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -493,7 +493,7 @@ static int flexcan_start_xmit(struct sk_
+ data = be32_to_cpup((__be32 *)&cf->data[0]);
+ flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[0]);
+ }
+- if (cf->can_dlc > 3) {
++ if (cf->can_dlc > 4) {
+ data = be32_to_cpup((__be32 *)&cf->data[4]);
+ flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[1]);
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Karol Herbst <kherbst@redhat.com>
+Date: Fri, 24 Nov 2017 03:56:26 +0100
+Subject: drm/nouveau/pci: do a msi rearm on init
+
+From: Karol Herbst <kherbst@redhat.com>
+
+
+[ Upstream commit a121027d2747168df0aac0c3da35509eea39f61c ]
+
+On my GP107 when I load nouveau after unloading it, for some reason the
+GPU stopped sending or the CPU stopped receiving interrupts if MSI was
+enabled.
+
+Doing a rearm once before getting any interrupts fixes this.
+
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+@@ -127,6 +127,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev
+ return ret;
+
+ pci->irq = pdev->irq;
++
++ /* Ensure MSI interrupts are armed, for the case where there are
++ * already interrupts pending (for whatever reason) at load time.
++ */
++ if (pci->msi)
++ pci->func->msi_rearm(pci);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Xiongwei Song <sxwjean@gmail.com>
+Date: Tue, 2 Jan 2018 21:24:55 +0800
+Subject: drm/ttm: check the return value of kzalloc
+
+From: Xiongwei Song <sxwjean@gmail.com>
+
+
+[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ]
+
+In the function ttm_page_alloc_init, kzalloc call is made for variable
+_manager, we need to check its return value, it may return NULL.
+
+Signed-off-by: Xiongwei Song <sxwjean@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_g
+ pr_info("Initializing pool allocator\n");
+
+ _manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
++ if (!_manager)
++ return -ENOMEM;
+
+ ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Tushar Dave <tushar.n.dave@oracle.com>
+Date: Wed, 6 Dec 2017 02:26:29 +0530
+Subject: e1000: fix disabling already-disabled warning
+
+From: Tushar Dave <tushar.n.dave@oracle.com>
+
+
+[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ]
+
+This patch adds check so that driver does not disable already
+disabled device.
+
+[ 44.637743] advantechwdt: Unexpected close, not stopping watchdog!
+[ 44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6
+[ 45.013419] e1000 0000:00:03.0: disabling already-disabled device
+[ 45.013447] ------------[ cut here ]------------
+[ 45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105:
+ pci_disable_device at drivers/pci/pci.c:1640
+[ 45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1
+[ 45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000
+[ 45.017987] RIP: 0010:pci_disable_device+0xa1/0x105:
+ pci_disable_device at drivers/pci/pci.c:1640
+[ 45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286
+[ 45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000
+[ 45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203
+[ 45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000
+[ 45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001
+[ 45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f
+[ 45.023842] FS: 0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
+[ 45.024863] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0
+[ 45.026478] Call Trace:
+[ 45.026811] __e1000_shutdown+0x1d4/0x1e2:
+ __e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162
+[ 45.027344] ? rcu_perf_cleanup+0x2a1/0x2a1:
+ rcu_perf_shutdown at kernel/rcu/rcuperf.c:627
+[ 45.027883] e1000_shutdown+0x14/0x3a:
+ e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235
+[ 45.028351] device_shutdown+0x110/0x1aa:
+ device_shutdown at drivers/base/core.c:2807
+[ 45.028858] kernel_power_off+0x31/0x64:
+ kernel_power_off at kernel/reboot.c:260
+[ 45.029343] rcu_perf_shutdown+0x9b/0xa7:
+ rcu_perf_shutdown at kernel/rcu/rcuperf.c:637
+[ 45.029852] ? __wake_up_common_lock+0xa2/0xa2:
+ autoremove_wake_function at kernel/sched/wait.c:376
+[ 45.030414] kthread+0x126/0x12e:
+ kthread at kernel/kthread.c:233
+[ 45.030834] ? __kthread_bind_mask+0x8e/0x8e:
+ kthread at kernel/kthread.c:190
+[ 45.031399] ? ret_from_fork+0x1f/0x30:
+ ret_from_fork at arch/x86/entry/entry_64.S:443
+[ 45.031883] ? kernel_init+0xa/0xf5:
+ kernel_init at init/main.c:997
+[ 45.032325] ret_from_fork+0x1f/0x30:
+ ret_from_fork at arch/x86/entry/entry_64.S:443
+[ 45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82
+[ 45.035222] ---[ end trace c257137b1b1976ef ]---
+[ 45.037838] ACPI: Preparing to enter system sleep state S5
+
+Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com>
+Tested-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000.h | 3 +-
+ drivers/net/ethernet/intel/e1000/e1000_main.c | 27 +++++++++++++++++++++-----
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000.h
++++ b/drivers/net/ethernet/intel/e1000/e1000.h
+@@ -331,7 +331,8 @@ struct e1000_adapter {
+ enum e1000_state_t {
+ __E1000_TESTING,
+ __E1000_RESETTING,
+- __E1000_DOWN
++ __E1000_DOWN,
++ __E1000_DISABLED
+ };
+
+ #undef pr_fmt
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e
+ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct net_device *netdev;
+- struct e1000_adapter *adapter;
++ struct e1000_adapter *adapter = NULL;
+ struct e1000_hw *hw;
+
+ static int cards_found = 0;
+@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *p
+ u16 tmp = 0;
+ u16 eeprom_apme_mask = E1000_EEPROM_APME;
+ int bars, need_ioport;
++ bool disable_dev = false;
+
+ /* do not allocate ioport bars when not needed */
+ need_ioport = e1000_is_need_ioport(pdev);
+@@ -1250,11 +1251,13 @@ err_mdio_ioremap:
+ iounmap(hw->ce4100_gbe_mdio_base_virt);
+ iounmap(hw->hw_addr);
+ err_ioremap:
++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ free_netdev(netdev);
+ err_alloc_etherdev:
+ pci_release_selected_regions(pdev, bars);
+ err_pci_reg:
+- pci_disable_device(pdev);
++ if (!adapter || disable_dev)
++ pci_disable_device(pdev);
+ return err;
+ }
+
+@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct e1000_hw *hw = &adapter->hw;
++ bool disable_dev;
+
+ e1000_down_and_stop(adapter);
+ e1000_release_manageability(adapter);
+@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev
+ iounmap(hw->flash_address);
+ pci_release_selected_regions(pdev, adapter->bars);
+
++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ free_netdev(netdev);
+
+- pci_disable_device(pdev);
++ if (disable_dev)
++ pci_disable_device(pdev);
+ }
+
+ /**
+@@ -5135,7 +5141,8 @@ static int __e1000_shutdown(struct pci_d
+ if (netif_running(netdev))
+ e1000_free_irq(adapter);
+
+- pci_disable_device(pdev);
++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++ pci_disable_device(pdev);
+
+ return 0;
+ }
+@@ -5179,6 +5186,10 @@ static int e1000_resume(struct pci_dev *
+ pr_err("Cannot enable PCI device from suspend\n");
+ return err;
+ }
++
++ /* flush memory to make sure state is correct */
++ smp_mb__before_atomic();
++ clear_bit(__E1000_DISABLED, &adapter->flags);
+ pci_set_master(pdev);
+
+ pci_enable_wake(pdev, PCI_D3hot, 0);
+@@ -5253,7 +5264,9 @@ static pci_ers_result_t e1000_io_error_d
+
+ if (netif_running(netdev))
+ e1000_down(adapter);
+- pci_disable_device(pdev);
++
++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++ pci_disable_device(pdev);
+
+ /* Request a slot slot reset. */
+ return PCI_ERS_RESULT_NEED_RESET;
+@@ -5281,6 +5294,10 @@ static pci_ers_result_t e1000_io_slot_re
+ pr_err("Cannot re-enable PCI device after reset.\n");
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
++
++ /* flush memory to make sure state is correct */
++ smp_mb__before_atomic();
++ clear_bit(__E1000_DISABLED, &adapter->flags);
+ pci_set_master(pdev);
+
+ pci_enable_wake(pdev, PCI_D3hot, 0);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Sun, 31 Dec 2017 15:33:15 +0200
+Subject: IB/ipoib: Fix race condition in neigh creation
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+
+[ Upstream commit 16ba3defb8bd01a9464ba4820a487f5b196b455b ]
+
+When using enhanced mode for IPoIB, two threads may execute xmit in
+parallel to two different TX queues while the target is the same.
+In this case, both of them will add the same neighbor to the path's
+neigh link list and we might see the following message:
+
+ list_add double add: new=ffff88024767a348, prev=ffff88024767a348...
+ WARNING: lib/list_debug.c:31__list_add_valid+0x4e/0x70
+ ipoib_start_xmit+0x477/0x680 [ib_ipoib]
+ dev_hard_start_xmit+0xb9/0x3e0
+ sch_direct_xmit+0xf9/0x250
+ __qdisc_run+0x176/0x5d0
+ __dev_queue_xmit+0x1f5/0xb10
+ __dev_queue_xmit+0x55/0xb10
+
+Analysis:
+Two SKB are scheduled to be transmitted from two cores.
+In ipoib_start_xmit, both gets NULL when calling ipoib_neigh_get.
+Two calls to neigh_add_path are made. One thread takes the spin-lock
+and calls ipoib_neigh_alloc which creates the neigh structure,
+then (after the __path_find) the neigh is added to the path's neigh
+link list. When the second thread enters the critical section it also
+calls ipoib_neigh_alloc but in this case it gets the already allocated
+ipoib_neigh structure, which is already linked to the path's neigh
+link list and adds it again to the list. Which beside of triggering
+the list, it creates a loop in the linked list. This loop leads to
+endless loop inside path_rec_completion.
+
+Solution:
+Check list_empty(&neigh->list) before adding to the list.
+Add a similar fix in "ipoib_multicast.c::ipoib_mcast_send"
+
+Fixes: b63b70d87741 ('IPoIB: Use a private hash table for path lookup in xmit path')
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Reviewed-by: Alex Vesker <valex@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 25 ++++++++++++++++++-------
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 5 ++++-
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -844,8 +844,8 @@ static int path_rec_start(struct net_dev
+ return 0;
+ }
+
+-static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+- struct net_device *dev)
++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr,
++ struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = netdev_priv(dev);
+ struct ipoib_path *path;
+@@ -858,7 +858,15 @@ static void neigh_add_path(struct sk_buf
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ++dev->stats.tx_dropped;
+ dev_kfree_skb_any(skb);
+- return;
++ return NULL;
++ }
++
++ /* To avoid race condition, make sure that the
++ * neigh will be added only once.
++ */
++ if (unlikely(!list_empty(&neigh->list))) {
++ spin_unlock_irqrestore(&priv->lock, flags);
++ return neigh;
+ }
+
+ path = __path_find(dev, daddr + 4);
+@@ -896,7 +904,7 @@ static void neigh_add_path(struct sk_buf
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ipoib_send(dev, skb, path->ah, IPOIB_QPN(daddr));
+ ipoib_neigh_put(neigh);
+- return;
++ return NULL;
+ }
+ } else {
+ neigh->ah = NULL;
+@@ -913,7 +921,7 @@ static void neigh_add_path(struct sk_buf
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ipoib_neigh_put(neigh);
+- return;
++ return NULL;
+
+ err_path:
+ ipoib_neigh_free(neigh);
+@@ -923,6 +931,8 @@ err_drop:
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ipoib_neigh_put(neigh);
++
++ return NULL;
+ }
+
+ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+@@ -1028,8 +1038,9 @@ static int ipoib_start_xmit(struct sk_bu
+ case htons(ETH_P_TIPC):
+ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
+ if (unlikely(!neigh)) {
+- neigh_add_path(skb, phdr->hwaddr, dev);
+- return NETDEV_TX_OK;
++ neigh = neigh_add_path(skb, phdr->hwaddr, dev);
++ if (likely(!neigh))
++ return NETDEV_TX_OK;
+ }
+ break;
+ case htons(ETH_P_ARP):
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -775,7 +775,10 @@ void ipoib_mcast_send(struct net_device
+ spin_lock_irqsave(&priv->lock, flags);
+ if (!neigh) {
+ neigh = ipoib_neigh_alloc(daddr, dev);
+- if (neigh) {
++ /* Make sure that the neigh will be added only
++ * once to mcast list.
++ */
++ if (neigh && list_empty(&neigh->list)) {
+ kref_get(&mcast->ah->ref);
+ neigh->ah = mcast->ah;
+ list_add_tail(&neigh->list, &mcast->neigh_list);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Sun, 31 Dec 2017 15:33:14 +0200
+Subject: IB/mlx4: Fix mlx4_ib_alloc_mr error flow
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+
+[ Upstream commit 5a371cf87e145b86efd32007e46146e78c1eff6d ]
+
+ibmr.device is being set only after ib_alloc_mr() is successfully complete.
+Therefore, in case imlx4_mr_enable() returns with error, the error flow
+unwinder calls to mlx4_free_priv_pages(), which uses ibmr.device.
+
+Such usage causes to NULL dereference oops and to fix it, the IB device
+should be set in the mr struct earlier stage (e.g. prior to calling
+mlx4_free_priv_pages()).
+
+Fixes: 1b2cd0fc673c ("IB/mlx4: Support the new memory registration API")
+Signed-off-by: Nitzan Carmi <nitzanc@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/mr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -424,7 +424,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
+ goto err_free_mr;
+
+ mr->max_pages = max_num_sg;
+-
+ err = mlx4_mr_enable(dev->dev, &mr->mmr);
+ if (err)
+ goto err_free_pl;
+@@ -435,6 +434,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
+ return &mr->ibmr;
+
+ err_free_pl:
++ mr->ibmr.device = pd->device;
+ mlx4_free_priv_pages(mr);
+ err_free_mr:
+ (void) mlx4_mr_free(dev->dev, &mr->mmr);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Brendan McGrath <redmcg@redmandi.dyndns.org>
+Date: Wed, 13 Dec 2017 22:14:57 +1100
+Subject: ipv6: icmp6: Allow icmp messages to be looped back
+
+From: Brendan McGrath <redmcg@redmandi.dyndns.org>
+
+
+[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ]
+
+One example of when an ICMPv6 packet is required to be looped back is
+when a host acts as both a Multicast Listener and a Multicast Router.
+
+A Multicast Router will listen on address ff02::16 for MLDv2 messages.
+
+Currently, MLDv2 messages originating from a Multicast Listener running
+on the same host as the Multicast Router are not being delivered to the
+Multicast Router. This is due to dst.input being assigned the default
+value of dst_discard.
+
+This results in the packet being looped back but discarded before being
+delivered to the Multicast Router.
+
+This patch sets dst.input to ip6_input to ensure a looped back packet
+is delivered to the Multicast Router.
+
+Signed-off-by: Brendan McGrath <redmcg@redmandi.dyndns.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/route.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1614,6 +1614,7 @@ struct dst_entry *icmp6_dst_alloc(struct
+ }
+
+ rt->dst.flags |= DST_HOST;
++ rt->dst.input = ip6_input;
+ rt->dst.output = ip6_output;
+ atomic_set(&rt->dst.__refcnt, 1);
+ rt->rt6i_gateway = fl6->daddr;
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+Date: Tue, 12 Dec 2017 11:10:44 +0100
+Subject: led: core: Fix brightness setting when setting delay_off=0
+
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+
+
+[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ]
+
+With the current code, the following sequence won't work :
+echo timer > trigger
+
+echo 0 > delay_off
+* at this point we call
+** led_delay_off_store
+** led_blink_set
+---
+ drivers/leds/led-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -149,7 +149,7 @@ void led_blink_set(struct led_classdev *
+ unsigned long *delay_on,
+ unsigned long *delay_off)
+ {
+- del_timer_sync(&led_cdev->blink_timer);
++ led_stop_software_blink(led_cdev);
+
+ led_cdev->flags &= ~LED_BLINK_ONESHOT;
+ led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: James Hogan <jhogan@kernel.org>
+Date: Tue, 5 Dec 2017 23:31:35 +0000
+Subject: lib/mpi: Fix umul_ppmm() for MIPS64r6
+
+From: James Hogan <jhogan@kernel.org>
+
+
+[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ]
+
+Current MIPS64r6 toolchains aren't able to generate efficient
+DMULU/DMUHU based code for the C implementation of umul_ppmm(), which
+performs an unsigned 64 x 64 bit multiply and returns the upper and
+lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit
+inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128
+x 128 multiply. This is both inefficient, and it results in a link error
+since we don't include __multi3 in MIPS linux.
+
+For example commit 90a53e4432b1 ("cfg80211: implement regdb signature
+checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and
+64r6el_defconfig builds by indirectly selecting MPILIB. The same build
+errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA:
+
+lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1':
+lib/mpi/generic_mpih-mul1.c:50: undefined reference to `__multi3'
+lib/mpi/generic_mpih-mul2.o: In function `mpihelp_addmul_1':
+lib/mpi/generic_mpih-mul2.c:49: undefined reference to `__multi3'
+lib/mpi/generic_mpih-mul3.o: In function `mpihelp_submul_1':
+lib/mpi/generic_mpih-mul3.c:49: undefined reference to `__multi3'
+lib/mpi/mpih-div.o In function `mpihelp_divrem':
+lib/mpi/mpih-div.c:205: undefined reference to `__multi3'
+lib/mpi/mpih-div.c:142: undefined reference to `__multi3'
+
+Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using
+inline assembly and the DMULU/DMUHU instructions, to prevent __multi3
+calls being emitted.
+
+Fixes: 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA")
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-mips@linux-mips.org
+Cc: linux-crypto@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/mpi/longlong.h | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -671,7 +671,23 @@ do { \
+ ************** MIPS/64 **************
+ ***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
++/*
++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
++ * code below, so we special case MIPS64r6 until the compiler can do better.
++ */
++#define umul_ppmm(w1, w0, u, v) \
++do { \
++ __asm__ ("dmulu %0,%1,%2" \
++ : "=d" ((UDItype)(w0)) \
++ : "d" ((UDItype)(u)), \
++ "d" ((UDItype)(v))); \
++ __asm__ ("dmuhu %0,%1,%2" \
++ : "=d" ((UDItype)(w1)) \
++ : "d" ((UDItype)(u)), \
++ "d" ((UDItype)(v))); \
++} while (0)
++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do { \
+ typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 4 Jan 2018 15:51:53 +0100
+Subject: mac80211: mesh: drop frames appearing to be from us
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit 736a80bbfda709fb3631f5f62056f250a38e5804 ]
+
+If there are multiple mesh stations with the same MAC address,
+they will both get confused and start throwing warnings.
+
+Obviously in this case nothing can actually work anyway, so just
+drop frames that look like they're from ourselves early on.
+
+Reported-by: Gui Iribarren <gui@altermundi.net>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/rx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3367,6 +3367,8 @@ static bool ieee80211_accept_frame(struc
+ }
+ return true;
+ case NL80211_IFTYPE_MESH_POINT:
++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++ return false;
+ if (multicast)
+ return true;
+ return ether_addr_equal(sdata->vif.addr, hdr->addr1);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 6 Jan 2018 09:00:09 +0100
+Subject: mdio-sun4i: Fix a memory leak
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ]
+
+If the probing of the regulator is deferred, the memory allocated by
+'mdiobus_alloc_size()' will be leaking.
+It should be freed before the next call to 'sun4i_mdio_probe()' which will
+reallocate it.
+
+Fixes: 4bdcb1dd9feb ("net: Add MDIO bus driver for the Allwinner EMAC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mdio-sun4i.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/mdio-sun4i.c
++++ b/drivers/net/phy/mdio-sun4i.c
+@@ -128,8 +128,10 @@ static int sun4i_mdio_probe(struct platf
+
+ data->regulator = devm_regulator_get(&pdev->dev, "phy");
+ if (IS_ERR(data->regulator)) {
+- if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err_out_free_mdiobus;
++ }
+
+ dev_info(&pdev->dev, "no regulator found\n");
+ } else {
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Tue, 5 Dec 2017 11:51:40 +0100
+Subject: mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+
+[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ]
+
+When erased subpages are read then the BCH decoder returns STATUS_ERASED
+if they are all empty, or STATUS_UNCORRECTABLE if there are bitflips.
+When there are bitflips, we have to set these bits again to show the
+upper layers a completely erased page. When a bitflip happens in the
+exact byte where the bad block marker is, then this byte is swapped
+with another byte in block_mark_swapping(). The correction code then
+detects a bitflip in another subpage and no longer corrects the bitflip
+where it really happens.
+
+Correct this behaviour by calling block_mark_swapping() after the
+bitflips have been corrected.
+
+In our case UBIFS failed with this bug because it expects erased
+pages to be really empty:
+
+UBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735
+UBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735
+UBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735
+UBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed
+UBIFS error (pid 187): do_commit: commit failed, error -117
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Richard Weinberger <richard@nod.at>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -1029,9 +1029,6 @@ static int gpmi_ecc_read_page(struct mtd
+ return ret;
+ }
+
+- /* handle the block mark swapping */
+- block_mark_swapping(this, payload_virt, auxiliary_virt);
+-
+ /* Loop over status bytes, accumulating ECC status. */
+ status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
+
+@@ -1047,6 +1044,9 @@ static int gpmi_ecc_read_page(struct mtd
+ max_bitflips = max_t(unsigned int, max_bitflips, *status);
+ }
+
++ /* handle the block mark swapping */
++ block_mark_swapping(this, buf, auxiliary_virt);
++
+ if (oob_required) {
+ /*
+ * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Fri, 15 Dec 2017 20:20:06 +0300
+Subject: net: arc_emac: fix arc_emac_rx() error paths
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+
+[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ]
+
+arc_emac_rx() has some issues found by code review.
+
+In case netdev_alloc_skb_ip_align() or dma_map_single() failure
+rx fifo entry will not be returned to EMAC.
+
+In case dma_map_single() failure previously allocated skb became
+lost to driver. At the same time address of newly allocated skb
+will not be provided to EMAC.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/arc/emac_main.c | 53 ++++++++++++++++++++---------------
+ 1 file changed, 31 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/ethernet/arc/emac_main.c
++++ b/drivers/net/ethernet/arc/emac_main.c
+@@ -250,39 +250,48 @@ static int arc_emac_rx(struct net_device
+ continue;
+ }
+
+- pktlen = info & LEN_MASK;
+- stats->rx_packets++;
+- stats->rx_bytes += pktlen;
+- skb = rx_buff->skb;
+- skb_put(skb, pktlen);
+- skb->dev = ndev;
+- skb->protocol = eth_type_trans(skb, ndev);
+-
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+-
+- /* Prepare the BD for next cycle */
+- rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
+- EMAC_BUFFER_SIZE);
+- if (unlikely(!rx_buff->skb)) {
++ /* Prepare the BD for next cycle. netif_receive_skb()
++ * only if new skb was allocated and mapped to avoid holes
++ * in the RX fifo.
++ */
++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
++ if (unlikely(!skb)) {
++ if (net_ratelimit())
++ netdev_err(ndev, "cannot allocate skb\n");
++ /* Return ownership to EMAC */
++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ stats->rx_errors++;
+- /* Because receive_skb is below, increment rx_dropped */
+ stats->rx_dropped++;
+ continue;
+ }
+
+- /* receive_skb only if new skb was allocated to avoid holes */
+- netif_receive_skb(skb);
+-
+- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
++ addr = dma_map_single(&ndev->dev, (void *)skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+ if (dma_mapping_error(&ndev->dev, addr)) {
+ if (net_ratelimit())
+- netdev_err(ndev, "cannot dma map\n");
+- dev_kfree_skb(rx_buff->skb);
++ netdev_err(ndev, "cannot map dma buffer\n");
++ dev_kfree_skb(skb);
++ /* Return ownership to EMAC */
++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ stats->rx_errors++;
++ stats->rx_dropped++;
+ continue;
+ }
++
++ /* unmap previosly mapped skb */
++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
++
++ pktlen = info & LEN_MASK;
++ stats->rx_packets++;
++ stats->rx_bytes += pktlen;
++ skb_put(rx_buff->skb, pktlen);
++ rx_buff->skb->dev = ndev;
++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
++
++ netif_receive_skb(rx_buff->skb);
++
++ rx_buff->skb = skb;
+ dma_unmap_addr_set(rx_buff, addr, addr);
+ dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Yangbo Lu <yangbo.lu@nxp.com>
+Date: Tue, 9 Jan 2018 11:02:33 +0800
+Subject: net: gianfar_ptp: move set_fipers() to spinlock protecting area
+
+From: Yangbo Lu <yangbo.lu@nxp.com>
+
+
+[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ]
+
+set_fipers() calling should be protected by spinlock in
+case that any interrupt breaks related registers setting
+and the function we expect. This patch is to move set_fipers()
+to spinlock protecting area in ptp_gianfar_adjtime().
+
+Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
+@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct pt
+ now = tmr_cnt_read(etsects);
+ now += delta;
+ tmr_cnt_write(etsects, now);
++ set_fipers(etsects);
+
+ spin_unlock_irqrestore(&etsects->lock, flags);
+
+- set_fipers(etsects);
+-
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Wed, 6 Dec 2017 10:30:39 +0100
+Subject: s390/dasd: fix wrongly assigned configuration data
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ]
+
+We store per path and per device configuration data to identify the
+path or device correctly. The per path configuration data might get
+mixed up if the original request gets into error recovery and is
+started with a random path mask.
+
+This would lead to a wrong identification of a path in case of a CUIR
+event for example.
+
+Fix by copying the path mask from the original request to the error
+recovery request in case it is a path verification request.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_3990_erp.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/s390/block/dasd_3990_erp.c
++++ b/drivers/s390/block/dasd_3990_erp.c
+@@ -2743,6 +2743,16 @@ dasd_3990_erp_action(struct dasd_ccw_req
+ erp = dasd_3990_erp_handle_match_erp(cqr, erp);
+ }
+
++
++ /*
++ * For path verification work we need to stick with the path that was
++ * originally chosen so that the per path configuration data is
++ * assigned correctly.
++ */
++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
++ erp->lpm = cqr->lpm;
++ }
++
+ if (device->features & DASD_FEATURE_ERPLOG) {
+ /* print current erp_chain */
+ dev_err(&device->cdev->dev,
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Cathy Avery <cavery@redhat.com>
+Date: Tue, 19 Dec 2017 13:32:48 -0500
+Subject: scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
+
+From: Cathy Avery <cavery@redhat.com>
+
+
+[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ]
+
+When an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN
+which has zero good_bytes it must be assigned an error. Otherwise the
+I/O will be continuously requeued and will cause a deadlock in the case
+where disks are being hot added and removed. sd_probe_async will wait
+forever for its I/O to complete while holding scsi_sd_probe_domain.
+
+Also returning the default error of DID_TARGET_FAILURE causes multipath
+to not retry the I/O resulting in applications receiving I/O errors
+before a failover can occur.
+
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/storvsc_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -890,10 +890,11 @@ static void storvsc_handle_error(struct
+ case TEST_UNIT_READY:
+ break;
+ default:
+- set_host_byte(scmnd, DID_TARGET_FAILURE);
++ set_host_byte(scmnd, DID_ERROR);
+ }
+ break;
+ case SRB_STATUS_INVALID_LUN:
++ set_host_byte(scmnd, DID_NO_CONNECT);
+ do_work = true;
+ process_err_fn = storvsc_remove_lun;
+ break;
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Mon, 8 Jan 2018 19:02:29 -0200
+Subject: sctp: make use of pre-calculated len
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+
+[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ]
+
+Some sockopt handling functions were calculating the length of the
+buffer to be written to userspace and then calculating it again when
+actually writing the buffer, which could lead to some write not using
+an up-to-date length.
+
+This patch updates such places to just make use of the len variable.
+
+Also, replace some sizeof(type) to sizeof(var).
+
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4445,7 +4445,7 @@ static int sctp_getsockopt_autoclose(str
+ len = sizeof(int);
+ if (put_user(len, optlen))
+ return -EFAULT;
+- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
+ return -EFAULT;
+ return 0;
+ }
+@@ -5022,6 +5022,9 @@ copy_getaddrs:
+ err = -EFAULT;
+ goto out;
+ }
++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
++ * but we can't change it anymore.
++ */
+ if (put_user(bytes_copied, optlen))
+ err = -EFAULT;
+ out:
+@@ -5458,7 +5461,7 @@ static int sctp_getsockopt_maxseg(struct
+ params.assoc_id = 0;
+ } else if (len >= sizeof(struct sctp_assoc_value)) {
+ len = sizeof(struct sctp_assoc_value);
+- if (copy_from_user(¶ms, optval, sizeof(params)))
++ if (copy_from_user(¶ms, optval, len))
+ return -EFAULT;
+ } else
+ return -EINVAL;
+@@ -5627,7 +5630,9 @@ static int sctp_getsockopt_active_key(st
+
+ if (len < sizeof(struct sctp_authkeyid))
+ return -EINVAL;
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
++
++ len = sizeof(struct sctp_authkeyid);
++ if (copy_from_user(&val, optval, len))
+ return -EFAULT;
+
+ asoc = sctp_id2assoc(sk, val.scact_assoc_id);
+@@ -5639,7 +5644,6 @@ static int sctp_getsockopt_active_key(st
+ else
+ val.scact_keynumber = ep->active_key_id;
+
+- len = sizeof(struct sctp_authkeyid);
+ if (put_user(len, optlen))
+ return -EFAULT;
+ if (copy_to_user(optval, &val, len))
+@@ -5665,7 +5669,7 @@ static int sctp_getsockopt_peer_auth_chu
+ if (len < sizeof(struct sctp_authchunks))
+ return -EINVAL;
+
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+ to = p->gauth_chunks;
+@@ -5710,7 +5714,7 @@ static int sctp_getsockopt_local_auth_ch
+ if (len < sizeof(struct sctp_authchunks))
+ return -EINVAL;
+
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+ to = p->gauth_chunks;
hrtimer-ensure-posix-compliance-relative-clock_realtime-hrtimers.patch
f2fs-fix-a-bug-caused-by-null-extent-tree.patch
+mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch
+ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch
+arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch
+sget-handle-failures-of-register_shrinker.patch
+drm-nouveau-pci-do-a-msi-rearm-on-init.patch
+spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch
+net-arc_emac-fix-arc_emac_rx-error-paths.patch
+scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch
+arm-dts-ls1021a-fix-incorrect-clock-references.patch
+lib-mpi-fix-umul_ppmm-for-mips64r6.patch
+tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch
+tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch
+bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch
+led-core-fix-brightness-setting-when-setting-delay_off-0.patch
+s390-dasd-fix-wrongly-assigned-configuration-data.patch
+ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch
+ib-ipoib-fix-race-condition-in-neigh-creation.patch
+xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch
+xfs-quota-check-result-of-register_shrinker.patch
+e1000-fix-disabling-already-disabled-warning.patch
+drm-ttm-check-the-return-value-of-kzalloc.patch
+mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
+can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch
+bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch
+xen-netfront-enable-device-after-manual-module-load.patch
+mdio-sun4i-fix-a-memory-leak.patch
+solutionengine771x-fix-ether-platform-data.patch
+xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch
+xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch
+sctp-make-use-of-pre-calculated-len.patch
+net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 18 Dec 2017 15:05:07 -0500
+Subject: sget(): handle failures of register_shrinker()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+
+[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -497,7 +497,11 @@ retry:
+ hlist_add_head(&s->s_instances, &type->fs_supers);
+ spin_unlock(&sb_lock);
+ get_filesystem(type);
+- register_shrinker(&s->s_shrink);
++ err = register_shrinker(&s->s_shrink);
++ if (err) {
++ deactivate_locked_super(s);
++ s = ERR_PTR(err);
++ }
+ return s;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Sat, 6 Jan 2018 21:53:26 +0300
+Subject: SolutionEngine771x: fix Ether platform data
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+
+[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ]
+
+The 'sh_eth' driver's probe() method would fail on the SolutionEngine7710
+board and crash on SolutionEngine7712 board as the platform code is
+hopelessly behind the driver's platform data -- it passes the PHY address
+instead of 'struct sh_eth_plat_data *'; pass the latter to the driver in
+order to fix the bug...
+
+Fixes: 71557a37adb5 ("[netdrvr] sh_eth: Add SH7619 support")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sh/boards/mach-se/770x/setup.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/boards/mach-se/770x/setup.c
++++ b/arch/sh/boards/mach-se/770x/setup.c
+@@ -8,6 +8,7 @@
+ */
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
++#include <linux/sh_eth.h>
+ #include <mach-se/mach/se.h>
+ #include <mach-se/mach/mrshpc.h>
+ #include <asm/machvec.h>
+@@ -114,6 +115,11 @@ static struct platform_device heartbeat_
+ #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
+ defined(CONFIG_CPU_SUBTYPE_SH7712)
+ /* SH771X Ethernet driver */
++static struct sh_eth_plat_data sh_eth_plat = {
++ .phy = PHY_ID,
++ .phy_interface = PHY_INTERFACE_MODE_MII,
++};
++
+ static struct resource sh_eth0_resources[] = {
+ [0] = {
+ .start = SH_ETH0_BASE,
+@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_de
+ .name = "sh771x-ether",
+ .id = 0,
+ .dev = {
+- .platform_data = PHY_ID,
++ .platform_data = &sh_eth_plat,
+ },
+ .num_resources = ARRAY_SIZE(sh_eth0_resources),
+ .resource = sh_eth0_resources,
+@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_de
+ .name = "sh771x-ether",
+ .id = 1,
+ .dev = {
+- .platform_data = PHY_ID,
++ .platform_data = &sh_eth_plat,
+ },
+ .num_resources = ARRAY_SIZE(sh_eth1_resources),
+ .resource = sh_eth1_resources,
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Radu Pirea <radu.pirea@microchip.com>
+Date: Fri, 15 Dec 2017 17:40:17 +0200
+Subject: spi: atmel: fixed spin_lock usage inside atmel_spi_remove
+
+From: Radu Pirea <radu.pirea@microchip.com>
+
+
+[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ]
+
+The only part of atmel_spi_remove which needs to be atomic is hardware
+reset.
+
+atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts
+enabled.
+atmel_spi_release_dma calls dma_release_channel and dma_release_channel
+locks a mutex inside of spin_lock.
+
+So the call of these functions can't be inside a spin_lock.
+
+Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Radu Pirea <radu.pirea@microchip.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-atmel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1669,12 +1669,12 @@ static int atmel_spi_remove(struct platf
+ pm_runtime_get_sync(&pdev->dev);
+
+ /* reset the hardware and block queue progress */
+- spin_lock_irq(&as->lock);
+ if (as->use_dma) {
+ atmel_spi_stop_dma(as);
+ atmel_spi_release_dma(as);
+ }
+
++ spin_lock_irq(&as->lock);
+ spi_writel(as, CR, SPI_BIT(SWRST));
+ spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
+ spi_readl(as, SR);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Date: Fri, 22 Dec 2017 16:05:28 +0530
+Subject: tg3: Add workaround to restrict 5762 MRRS to 2048
+
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+
+
+[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ]
+
+One of AMD based server with 5762 hangs with jumbo frame traffic.
+This AMD platform has southbridge limitation which is restricting MRRS
+to 4000. As a work around, driver to restricts the MRRS to 2048 for
+this particular 5762 NX1 card.
+
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 10 ++++++++++
+ drivers/net/ethernet/broadcom/tg3.h | 4 ++++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10051,6 +10051,16 @@ static int tg3_reset_hw(struct tg3 *tp,
+
+ tw32(GRC_MODE, tp->grc_mode | val);
+
++ /* On one of the AMD platform, MRRS is restricted to 4000 because of
++ * south bridge limitation. As a workaround, Driver is setting MRRS
++ * to 2048 instead of default 4096.
++ */
++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
++ }
++
+ /* Setup the timer prescalar register. Clock is always 66Mhz. */
+ val = tr32(GRC_MISC_CFG);
+ val &= ~0xff;
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -95,6 +95,7 @@
+ #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106
+ #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109
+ #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a
++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0
+ #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a
+@@ -280,6 +281,9 @@
+ #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */
+ #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */
+ /* 0xa8 --> 0xb8 unused */
++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4
++#define MAX_READ_REQ_SIZE_2048 0x00004000
++#define MAX_READ_REQ_MASK 0x00007000
+ #define TG3PCI_DUAL_MAC_CTRL 0x000000b8
+ #define DUAL_MAC_CTRL_CH_MASK 0x00000003
+ #define DUAL_MAC_CTRL_ID 0x00000004
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Date: Fri, 22 Dec 2017 16:05:29 +0530
+Subject: tg3: Enable PHY reset in MTU change path for 5720
+
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+
+
+[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ]
+
+A customer noticed RX path hang when MTU is changed on the fly while
+running heavy traffic with NCSI enabled for 5717 and 5719. Since 5720
+belongs to same ASIC family, we observed same issue and same fix
+could solve this problem for 5720.
+
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -14240,7 +14240,8 @@ static int tg3_change_mtu(struct net_dev
+ */
+ if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+ tg3_asic_rev(tp) == ASIC_REV_5717 ||
+- tg3_asic_rev(tp) == ASIC_REV_5719)
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
+ reset_phy = true;
+
+ err = tg3_restart_hw(tp, reset_phy);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Tue, 9 Jan 2018 12:10:21 +0000
+Subject: xen/gntdev: Fix off-by-one error when unmapping with holes
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+
+[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ]
+
+If the requested range has a hole, the calculation of the number of
+pages to unmap is off by one. Fix it.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/gntdev.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -378,10 +378,8 @@ static int unmap_grant_pages(struct gran
+ }
+ range = 0;
+ while (range < pages) {
+- if (map->unmap_ops[offset+range].handle == -1) {
+- range--;
++ if (map->unmap_ops[offset+range].handle == -1)
+ break;
+- }
+ range++;
+ }
+ err = __unmap_grant_pages(map, offset, range);
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Tue, 9 Jan 2018 12:10:22 +0000
+Subject: xen/gntdev: Fix partial gntdev_mmap() cleanup
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+
+[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ]
+
+When cleaning up after a partially successful gntdev_mmap(), unmap the
+successfully mapped grant pages otherwise Xen will kill the domain if
+in debug mode (Attempt to implicitly unmap a granted PTE) or Linux will
+kill the process and emit "BUG: Bad page map in process" if Xen is in
+release mode.
+
+This is only needed when use_ptemod is true because gntdev_put_map()
+will unmap grant pages itself when use_ptemod is false.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/gntdev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -874,8 +874,10 @@ unlock_out:
+ out_unlock_put:
+ mutex_unlock(&priv->lock);
+ out_put_map:
+- if (use_ptemod)
++ if (use_ptemod) {
+ map->vma = NULL;
++ unmap_grant_pages(map, 0, map->count);
++ }
+ gntdev_put_map(priv, map);
+ return err;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Eduardo Otubo <otubo@redhat.com>
+Date: Fri, 5 Jan 2018 09:42:16 +0100
+Subject: xen-netfront: enable device after manual module load
+
+From: Eduardo Otubo <otubo@redhat.com>
+
+
+[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ]
+
+When loading the module after unloading it, the network interface would
+not be enabled and thus wouldn't have a backend counterpart and unable
+to be used by the guest.
+
+The guest would face errors like:
+
+ [root@guest ~]# ethtool -i eth0
+ Cannot get driver information: No such device
+
+ [root@guest ~]# ifconfig eth0
+ eth0: error fetching interface information: Device not found
+
+This patch initializes the state of the netfront device whenever it is
+loaded manually, this state would communicate the netback to create its
+device and establish the connection between them.
+
+Signed-off-by: Eduardo Otubo <otubo@redhat.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netfront.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1331,6 +1331,7 @@ static struct net_device *xennet_create_
+
+ netif_carrier_off(netdev);
+
++ xenbus_switch_state(dev, XenbusStateInitialising);
+ return netdev;
+
+ exit:
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Date: Thu, 21 Dec 2017 13:18:26 -0800
+Subject: xfs: quota: check result of register_shrinker()
+
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+
+
+[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ]
+
+xfs_qm_init_quotainfo() does not check result of register_shrinker()
+which was tagged as __must_check recently, reported by sparse.
+
+Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos]
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_qm.c | 45 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -47,7 +47,7 @@
+ STATIC int xfs_qm_init_quotainos(xfs_mount_t *);
+ STATIC int xfs_qm_init_quotainfo(xfs_mount_t *);
+
+-
++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
+ STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp);
+ /*
+ * We use the batch lookup interface to iterate over the dquots as it
+@@ -660,9 +660,17 @@ xfs_qm_init_quotainfo(
+ qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
+ qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
+ qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
+- register_shrinker(&qinf->qi_shrinker);
++
++ error = register_shrinker(&qinf->qi_shrinker);
++ if (error)
++ goto out_free_inos;
++
+ return 0;
+
++out_free_inos:
++ mutex_destroy(&qinf->qi_quotaofflock);
++ mutex_destroy(&qinf->qi_tree_lock);
++ xfs_qm_destroy_quotainos(qinf);
+ out_free_lru:
+ list_lru_destroy(&qinf->qi_lru);
+ out_free_qinf:
+@@ -671,7 +679,6 @@ out_free_qinf:
+ return error;
+ }
+
+-
+ /*
+ * Gets called when unmounting a filesystem or when all quotas get
+ * turned off.
+@@ -688,19 +695,7 @@ xfs_qm_destroy_quotainfo(
+
+ unregister_shrinker(&qi->qi_shrinker);
+ list_lru_destroy(&qi->qi_lru);
+-
+- if (qi->qi_uquotaip) {
+- IRELE(qi->qi_uquotaip);
+- qi->qi_uquotaip = NULL; /* paranoia */
+- }
+- if (qi->qi_gquotaip) {
+- IRELE(qi->qi_gquotaip);
+- qi->qi_gquotaip = NULL;
+- }
+- if (qi->qi_pquotaip) {
+- IRELE(qi->qi_pquotaip);
+- qi->qi_pquotaip = NULL;
+- }
++ xfs_qm_destroy_quotainos(qi);
+ mutex_destroy(&qi->qi_tree_lock);
+ mutex_destroy(&qi->qi_quotaofflock);
+ kmem_free(qi);
+@@ -1563,6 +1558,24 @@ error_rele:
+ }
+
+ STATIC void
++xfs_qm_destroy_quotainos(
++ xfs_quotainfo_t *qi)
++{
++ if (qi->qi_uquotaip) {
++ IRELE(qi->qi_uquotaip);
++ qi->qi_uquotaip = NULL; /* paranoia */
++ }
++ if (qi->qi_gquotaip) {
++ IRELE(qi->qi_gquotaip);
++ qi->qi_gquotaip = NULL;
++ }
++ if (qi->qi_pquotaip) {
++ IRELE(qi->qi_pquotaip);
++ qi->qi_pquotaip = NULL;
++ }
++}
++
++STATIC void
+ xfs_qm_dqfree_one(
+ struct xfs_dquot *dqp)
+ {
--- /dev/null
+From foo@baz Wed Feb 28 16:19:30 CET 2018
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Date: Thu, 21 Dec 2017 13:18:26 -0800
+Subject: xfs: quota: fix missed destroy of qi_tree_lock
+
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+
+
+[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ]
+
+xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock
+while destroys quotainfo->qi_quotaofflock.
+
+Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_qm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -701,6 +701,7 @@ xfs_qm_destroy_quotainfo(
+ IRELE(qi->qi_pquotaip);
+ qi->qi_pquotaip = NULL;
+ }
++ mutex_destroy(&qi->qi_tree_lock);
+ mutex_destroy(&qi->qi_quotaofflock);
+ kmem_free(qi);
+ mp->m_quotainfo = NULL;
projects / thirdparty / kernel / stable-queue.git / commitdiff
