--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Jay Kamat <jgkamat@fb.com>
+Date: Fri, 7 Sep 2018 14:34:05 -0700
+Subject: Add tests for memory.oom.group
+
+From: Jay Kamat <jgkamat@fb.com>
+
+[ Upstream commit a987785dcd6c8ae2915460582aebd6481c81eb67 ]
+
+Add tests for memory.oom.group for the following cases:
+- Killing all processes in a leaf cgroup, but leaving the
+ parent untouched
+- Killing all processes in a parent and leaf cgroup
+- Keeping processes marked by OOM_SCORE_ADJ_MIN alive when considered
+ for being killed by the group oom killer.
+
+Signed-off-by: Jay Kamat <jgkamat@fb.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/cgroup/cgroup_util.c | 21 ++
+ tools/testing/selftests/cgroup/cgroup_util.h | 1
+ tools/testing/selftests/cgroup/test_memcontrol.c | 205 +++++++++++++++++++++++
+ 3 files changed, 227 insertions(+)
+
+--- a/tools/testing/selftests/cgroup/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/cgroup_util.c
+@@ -340,3 +340,24 @@ int is_swap_enabled(void)
+
+ return cnt > 1;
+ }
++
++int set_oom_adj_score(int pid, int score)
++{
++ char path[PATH_MAX];
++ int fd, len;
++
++ sprintf(path, "/proc/%d/oom_score_adj", pid);
++
++ fd = open(path, O_WRONLY | O_APPEND);
++ if (fd < 0)
++ return fd;
++
++ len = dprintf(fd, "%d", score);
++ if (len < 0) {
++ close(fd);
++ return len;
++ }
++
++ close(fd);
++ return 0;
++}
+--- a/tools/testing/selftests/cgroup/cgroup_util.h
++++ b/tools/testing/selftests/cgroup/cgroup_util.h
+@@ -39,3 +39,4 @@ extern int get_temp_fd(void);
+ extern int alloc_pagecache(int fd, size_t size);
+ extern int alloc_anon(const char *cgroup, void *arg);
+ extern int is_swap_enabled(void);
++extern int set_oom_adj_score(int pid, int score);
+--- a/tools/testing/selftests/cgroup/test_memcontrol.c
++++ b/tools/testing/selftests/cgroup/test_memcontrol.c
+@@ -2,6 +2,7 @@
+ #define _GNU_SOURCE
+
+ #include <linux/limits.h>
++#include <linux/oom.h>
+ #include <fcntl.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -202,6 +203,36 @@ static int alloc_pagecache_50M_noexit(co
+ return 0;
+ }
+
++static int alloc_anon_noexit(const char *cgroup, void *arg)
++{
++ int ppid = getppid();
++
++ if (alloc_anon(cgroup, arg))
++ return -1;
++
++ while (getppid() == ppid)
++ sleep(1);
++
++ return 0;
++}
++
++/*
++ * Wait until processes are killed asynchronously by the OOM killer
++ * If we exceed a timeout, fail.
++ */
++static int cg_test_proc_killed(const char *cgroup)
++{
++ int limit;
++
++ for (limit = 10; limit > 0; limit--) {
++ if (cg_read_strcmp(cgroup, "cgroup.procs", "") == 0)
++ return 0;
++
++ usleep(100000);
++ }
++ return -1;
++}
++
+ /*
+ * First, this test creates the following hierarchy:
+ * A memory.min = 50M, memory.max = 200M
+@@ -964,6 +995,177 @@ cleanup:
+ return ret;
+ }
+
++/*
++ * This test disables swapping and tries to allocate anonymous memory
++ * up to OOM with memory.group.oom set. Then it checks that all
++ * processes in the leaf (but not the parent) were killed.
++ */
++static int test_memcg_oom_group_leaf_events(const char *root)
++{
++ int ret = KSFT_FAIL;
++ char *parent, *child;
++
++ parent = cg_name(root, "memcg_test_0");
++ child = cg_name(root, "memcg_test_0/memcg_test_1");
++
++ if (!parent || !child)
++ goto cleanup;
++
++ if (cg_create(parent))
++ goto cleanup;
++
++ if (cg_create(child))
++ goto cleanup;
++
++ if (cg_write(parent, "cgroup.subtree_control", "+memory"))
++ goto cleanup;
++
++ if (cg_write(child, "memory.max", "50M"))
++ goto cleanup;
++
++ if (cg_write(child, "memory.swap.max", "0"))
++ goto cleanup;
++
++ if (cg_write(child, "memory.oom.group", "1"))
++ goto cleanup;
++
++ cg_run_nowait(parent, alloc_anon_noexit, (void *) MB(60));
++ cg_run_nowait(child, alloc_anon_noexit, (void *) MB(1));
++ cg_run_nowait(child, alloc_anon_noexit, (void *) MB(1));
++ if (!cg_run(child, alloc_anon, (void *)MB(100)))
++ goto cleanup;
++
++ if (cg_test_proc_killed(child))
++ goto cleanup;
++
++ if (cg_read_key_long(child, "memory.events", "oom_kill ") <= 0)
++ goto cleanup;
++
++ if (cg_read_key_long(parent, "memory.events", "oom_kill ") != 0)
++ goto cleanup;
++
++ ret = KSFT_PASS;
++
++cleanup:
++ if (child)
++ cg_destroy(child);
++ if (parent)
++ cg_destroy(parent);
++ free(child);
++ free(parent);
++
++ return ret;
++}
++
++/*
++ * This test disables swapping and tries to allocate anonymous memory
++ * up to OOM with memory.group.oom set. Then it checks that all
++ * processes in the parent and leaf were killed.
++ */
++static int test_memcg_oom_group_parent_events(const char *root)
++{
++ int ret = KSFT_FAIL;
++ char *parent, *child;
++
++ parent = cg_name(root, "memcg_test_0");
++ child = cg_name(root, "memcg_test_0/memcg_test_1");
++
++ if (!parent || !child)
++ goto cleanup;
++
++ if (cg_create(parent))
++ goto cleanup;
++
++ if (cg_create(child))
++ goto cleanup;
++
++ if (cg_write(parent, "memory.max", "80M"))
++ goto cleanup;
++
++ if (cg_write(parent, "memory.swap.max", "0"))
++ goto cleanup;
++
++ if (cg_write(parent, "memory.oom.group", "1"))
++ goto cleanup;
++
++ cg_run_nowait(parent, alloc_anon_noexit, (void *) MB(60));
++ cg_run_nowait(child, alloc_anon_noexit, (void *) MB(1));
++ cg_run_nowait(child, alloc_anon_noexit, (void *) MB(1));
++
++ if (!cg_run(child, alloc_anon, (void *)MB(100)))
++ goto cleanup;
++
++ if (cg_test_proc_killed(child))
++ goto cleanup;
++ if (cg_test_proc_killed(parent))
++ goto cleanup;
++
++ ret = KSFT_PASS;
++
++cleanup:
++ if (child)
++ cg_destroy(child);
++ if (parent)
++ cg_destroy(parent);
++ free(child);
++ free(parent);
++
++ return ret;
++}
++
++/*
++ * This test disables swapping and tries to allocate anonymous memory
++ * up to OOM with memory.group.oom set. Then it checks that all
++ * processes were killed except those set with OOM_SCORE_ADJ_MIN
++ */
++static int test_memcg_oom_group_score_events(const char *root)
++{
++ int ret = KSFT_FAIL;
++ char *memcg;
++ int safe_pid;
++
++ memcg = cg_name(root, "memcg_test_0");
++
++ if (!memcg)
++ goto cleanup;
++
++ if (cg_create(memcg))
++ goto cleanup;
++
++ if (cg_write(memcg, "memory.max", "50M"))
++ goto cleanup;
++
++ if (cg_write(memcg, "memory.swap.max", "0"))
++ goto cleanup;
++
++ if (cg_write(memcg, "memory.oom.group", "1"))
++ goto cleanup;
++
++ safe_pid = cg_run_nowait(memcg, alloc_anon_noexit, (void *) MB(1));
++ if (set_oom_adj_score(safe_pid, OOM_SCORE_ADJ_MIN))
++ goto cleanup;
++
++ cg_run_nowait(memcg, alloc_anon_noexit, (void *) MB(1));
++ if (!cg_run(memcg, alloc_anon, (void *)MB(100)))
++ goto cleanup;
++
++ if (cg_read_key_long(memcg, "memory.events", "oom_kill ") != 3)
++ goto cleanup;
++
++ if (kill(safe_pid, SIGKILL))
++ goto cleanup;
++
++ ret = KSFT_PASS;
++
++cleanup:
++ if (memcg)
++ cg_destroy(memcg);
++ free(memcg);
++
++ return ret;
++}
++
++
+ #define T(x) { x, #x }
+ struct memcg_test {
+ int (*fn)(const char *root);
+@@ -978,6 +1180,9 @@ struct memcg_test {
+ T(test_memcg_oom_events),
+ T(test_memcg_swap_max),
+ T(test_memcg_sock),
++ T(test_memcg_oom_group_leaf_events),
++ T(test_memcg_oom_group_parent_events),
++ T(test_memcg_oom_group_score_events),
+ };
+ #undef T
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+Date: Fri, 14 Sep 2018 17:48:11 +0200
+Subject: ARM: dts: at91: add new compatibility string for macb on sama5d3
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 321cc359d899a8e988f3725d87c18a628e1cc624 ]
+
+We need this new compatibility string as we experienced different behavior
+for this 10/100Mbits/s macb interface on this particular SoC.
+Backward compatibility is preserved as we keep the alternative strings.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/net/macb.txt | 1 +
+ arch/arm/boot/dts/sama5d3_emac.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/net/macb.txt
++++ b/Documentation/devicetree/bindings/net/macb.txt
+@@ -10,6 +10,7 @@ Required properties:
+ Use "cdns,pc302-gem" for Picochip picoXcell pc302 and later devices based on
+ the Cadence GEM, or the generic form: "cdns,gem".
+ Use "atmel,sama5d2-gem" for the GEM IP (10/100) available on Atmel sama5d2 SoCs.
++ Use "atmel,sama5d3-macb" for the 10/100Mbit IP available on Atmel sama5d3 SoCs.
+ Use "atmel,sama5d3-gem" for the Gigabit IP available on Atmel sama5d3 SoCs.
+ Use "atmel,sama5d4-gem" for the GEM IP (10/100) available on Atmel sama5d4 SoCs.
+ Use "cdns,zynq-gem" Xilinx Zynq-7xxx SoC.
+--- a/arch/arm/boot/dts/sama5d3_emac.dtsi
++++ b/arch/arm/boot/dts/sama5d3_emac.dtsi
+@@ -41,7 +41,7 @@
+ };
+
+ macb1: ethernet@f802c000 {
+- compatible = "cdns,at91sam9260-macb", "cdns,macb";
++ compatible = "atmel,sama5d3-macb", "cdns,at91sam9260-macb", "cdns,macb";
+ reg = <0xf802c000 0x100>;
+ interrupts = <35 IRQ_TYPE_LEVEL_HIGH 3>;
+ pinctrl-names = "default";
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+Date: Mon, 10 Sep 2018 13:36:30 +0530
+Subject: ASoC: AMD: Ensure reset bit is cleared before configuring
+
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+
+[ Upstream commit 2a665dba016d5493c7d826fec82b0cb643b30d42 ]
+
+HW register descriptions says:
+"DMA Channel Reset...Software must confirm that this bit is
+cleared before reprogramming any of the channel configuration registers."
+There could be cases where dma stop errored out leaving dma channel
+in reset state. We need to ensure that before the start of another dma,
+channel is out of the reset state.
+
+Signed-off-by: Akshu Agrawal <akshu.agrawal@amd.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/acp-pcm-dma.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -16,6 +16,7 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/sizes.h>
+ #include <linux/pm_runtime.h>
+
+@@ -184,6 +185,24 @@ static void config_dma_descriptor_in_sra
+ acp_reg_write(descr_info->xfer_val, acp_mmio, mmACP_SRBM_Targ_Idx_Data);
+ }
+
++static void pre_config_reset(void __iomem *acp_mmio, u16 ch_num)
++{
++ u32 dma_ctrl;
++ int ret;
++
++ /* clear the reset bit */
++ dma_ctrl = acp_reg_read(acp_mmio, mmACP_DMA_CNTL_0 + ch_num);
++ dma_ctrl &= ~ACP_DMA_CNTL_0__DMAChRst_MASK;
++ acp_reg_write(dma_ctrl, acp_mmio, mmACP_DMA_CNTL_0 + ch_num);
++ /* check the reset bit before programming configuration registers */
++ ret = readl_poll_timeout(acp_mmio + ((mmACP_DMA_CNTL_0 + ch_num) * 4),
++ dma_ctrl,
++ !(dma_ctrl & ACP_DMA_CNTL_0__DMAChRst_MASK),
++ 100, ACP_DMA_RESET_TIME);
++ if (ret < 0)
++ pr_err("Failed to clear reset of channel : %d\n", ch_num);
++}
++
+ /*
+ * Initialize the DMA descriptor information for transfer between
+ * system memory <-> ACP SRAM
+@@ -238,6 +257,7 @@ static void set_acp_sysmem_dma_descripto
+ config_dma_descriptor_in_sram(acp_mmio, dma_dscr_idx,
+ &dmadscr[i]);
+ }
++ pre_config_reset(acp_mmio, ch);
+ config_acp_dma_channel(acp_mmio, ch,
+ dma_dscr_idx - 1,
+ NUM_DSCRS_PER_CHANNEL,
+@@ -277,6 +297,7 @@ static void set_acp_to_i2s_dma_descripto
+ config_dma_descriptor_in_sram(acp_mmio, dma_dscr_idx,
+ &dmadscr[i]);
+ }
++ pre_config_reset(acp_mmio, ch);
+ /* Configure the DMA channel with the above descriptore */
+ config_acp_dma_channel(acp_mmio, ch, dma_dscr_idx - 1,
+ NUM_DSCRS_PER_CHANNEL,
--- /dev/null
+From foo@baz Tue Oct 16 11:10:20 CEST 2018
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Wed, 15 Aug 2018 13:11:35 +0100
+Subject: ASoC: dapm: Fix NULL pointer deference on CODEC to CODEC DAIs
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 249dc49576fc953a7378b916c6a6d47ea81e4da2 ]
+
+Commit a655de808cbde ("ASoC: core: Allow topology to override
+machine driver FE DAI link config.") caused soc_dai_hw_params to
+be come dependent on the substream private_data being set with
+a pointer to the snd_soc_pcm_runtime. Currently, CODEC to CODEC
+links don't set this, which causes a NULL pointer dereference:
+
+[<4069de54>] (soc_dai_hw_params) from
+[<40694b68>] (snd_soc_dai_link_event+0x1a0/0x380)
+
+Since the ASoC core in general assumes that the substream
+private_data will be set to a pointer to the snd_soc_pcm_runtime,
+update the CODEC to CODEC links to respect this.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/soc-dapm.h | 1 +
+ sound/soc/soc-core.c | 4 ++--
+ sound/soc/soc-dapm.c | 4 ++++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -410,6 +410,7 @@ int snd_soc_dapm_new_dai_widgets(struct
+ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card);
+ void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card);
+ int snd_soc_dapm_new_pcm(struct snd_soc_card *card,
++ struct snd_soc_pcm_runtime *rtd,
+ const struct snd_soc_pcm_stream *params,
+ unsigned int num_params,
+ struct snd_soc_dapm_widget *source,
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1430,7 +1430,7 @@ static int soc_link_dai_widgets(struct s
+ sink = codec_dai->playback_widget;
+ source = cpu_dai->capture_widget;
+ if (sink && source) {
+- ret = snd_soc_dapm_new_pcm(card, dai_link->params,
++ ret = snd_soc_dapm_new_pcm(card, rtd, dai_link->params,
+ dai_link->num_params,
+ source, sink);
+ if (ret != 0) {
+@@ -1443,7 +1443,7 @@ static int soc_link_dai_widgets(struct s
+ sink = cpu_dai->playback_widget;
+ source = codec_dai->capture_widget;
+ if (sink && source) {
+- ret = snd_soc_dapm_new_pcm(card, dai_link->params,
++ ret = snd_soc_dapm_new_pcm(card, rtd, dai_link->params,
+ dai_link->num_params,
+ source, sink);
+ if (ret != 0) {
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3658,6 +3658,7 @@ static int snd_soc_dai_link_event(struct
+ {
+ struct snd_soc_dapm_path *source_p, *sink_p;
+ struct snd_soc_dai *source, *sink;
++ struct snd_soc_pcm_runtime *rtd = w->priv;
+ const struct snd_soc_pcm_stream *config = w->params + w->params_select;
+ struct snd_pcm_substream substream;
+ struct snd_pcm_hw_params *params = NULL;
+@@ -3717,6 +3718,7 @@ static int snd_soc_dai_link_event(struct
+ goto out;
+ }
+ substream.runtime = runtime;
++ substream.private_data = rtd;
+
+ switch (event) {
+ case SND_SOC_DAPM_PRE_PMU:
+@@ -3901,6 +3903,7 @@ outfree_w_param:
+ }
+
+ int snd_soc_dapm_new_pcm(struct snd_soc_card *card,
++ struct snd_soc_pcm_runtime *rtd,
+ const struct snd_soc_pcm_stream *params,
+ unsigned int num_params,
+ struct snd_soc_dapm_widget *source,
+@@ -3969,6 +3972,7 @@ int snd_soc_dapm_new_pcm(struct snd_soc_
+
+ w->params = params;
+ w->num_params = num_params;
++ w->priv = rtd;
+
+ ret = snd_soc_dapm_add_path(&card->dapm, source, w, NULL, NULL);
+ if (ret)
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Ryan Lee <ryans.lee@maximintegrated.com>
+Date: Thu, 23 Aug 2018 18:37:08 -0700
+Subject: ASoC: max98373: Added 10ms sleep after amp software reset
+
+From: Ryan Lee <ryans.lee@maximintegrated.com>
+
+[ Upstream commit ca917f9fe1a0fab3dde41bba4bbd173c5a3c5805 ]
+
+Signed-off-by: Ryan Lee <ryans.lee@maximintegrated.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/max98373.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/codecs/max98373.c
++++ b/sound/soc/codecs/max98373.c
+@@ -729,6 +729,7 @@ static int max98373_probe(struct snd_soc
+ /* Software Reset */
+ regmap_write(max98373->regmap,
+ MAX98373_R2000_SW_RESET, MAX98373_SOFT_RESET);
++ usleep_range(10000, 11000);
+
+ /* IV default slot configuration */
+ regmap_write(max98373->regmap,
+@@ -817,6 +818,7 @@ static int max98373_resume(struct device
+
+ regmap_write(max98373->regmap,
+ MAX98373_R2000_SW_RESET, MAX98373_SOFT_RESET);
++ usleep_range(10000, 11000);
+ regcache_cache_only(max98373->regmap, false);
+ regcache_sync(max98373->regmap);
+ return 0;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:20 CEST 2018
+From: Ryan Lee <ryans.lee@maximintegrated.com>
+Date: Wed, 15 Aug 2018 18:53:38 -0700
+Subject: ASoC: max98373: Added speaker FS gain cotnrol register to volatile.
+
+From: Ryan Lee <ryans.lee@maximintegrated.com>
+
+[ Upstream commit 0d22825255f25adb6a609f130b42c752d3fd0f5d ]
+
+Signed-off-by: Ryan Lee <ryans.lee@maximintegrated.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/max98373.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/max98373.c
++++ b/sound/soc/codecs/max98373.c
+@@ -519,6 +519,7 @@ static bool max98373_volatile_reg(struct
+ {
+ switch (reg) {
+ case MAX98373_R2000_SW_RESET ... MAX98373_R2009_INT_FLAG3:
++ case MAX98373_R203E_AMP_PATH_GAIN:
+ case MAX98373_R2054_MEAS_ADC_PVDD_CH_READBACK:
+ case MAX98373_R2055_MEAS_ADC_THERM_CH_READBACK:
+ case MAX98373_R20B6_BDE_CUR_STATE_READBACK:
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Mon, 3 Sep 2018 12:07:47 +0100
+Subject: ASoC: q6routing: initialize data correctly
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 7aa09ff24301535491cd4de1b93107ee91449a12 ]
+
+Some of the router data fields are left as default zeros which are
+valid dai ids, so initialize these to invalid value of -1.
+
+Without intializing these correctly get_session_from_id() can return
+incorrect session resulting in not closing the opened copp and messing
+up with the copp ref count.
+
+Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6routing.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -933,8 +933,10 @@ static int msm_routing_probe(struct snd_
+ {
+ int i;
+
+- for (i = 0; i < MAX_SESSIONS; i++)
++ for (i = 0; i < MAX_SESSIONS; i++) {
+ routing_data->sessions[i].port_id = -1;
++ routing_data->sessions[i].fedai_id = -1;
++ }
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Thu, 6 Sep 2018 03:21:33 +0000
+Subject: ASoC: rsnd: adg: care clock-frequency size
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 69235ccf491d2e26aefd465c0d3ccd1e3b2a9a9c ]
+
+ADG has buffer over flow bug if DT has more than 3 clock-frequency.
+This patch fixup this issue, and uses first 2 values.
+
+ clock-frequency = <x y>; /* this is OK */
+ clock-frequency = <x y z>; /* this is NG */
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/adg.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -465,6 +465,11 @@ static void rsnd_adg_get_clkout(struct r
+ goto rsnd_adg_get_clkout_end;
+
+ req_size = prop->length / sizeof(u32);
++ if (req_size > REQ_SIZE) {
++ dev_err(dev,
++ "too many clock-frequency, use top %d\n", REQ_SIZE);
++ req_size = REQ_SIZE;
++ }
+
+ of_property_read_u32_array(np, "clock-frequency", req_rate, req_size);
+ req_48kHz_rate = 0;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Thu, 6 Sep 2018 03:21:47 +0000
+Subject: ASoC: rsnd: don't fallback to PIO mode when -EPROBE_DEFER
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 6c92d5a2744e27619a8fcc9d74b91ee9f1cdebd1 ]
+
+Current rsnd driver will fallback to PIO mode if it can't get DMA
+handler. But, DMA might return -EPROBE_DEFER when probe timing.
+This driver always fallback to PIO mode especially from
+commit ac6bbf0cdf4206c ("iommu: Remove IOMMU_OF_DECLARE") because
+of this reason.
+
+The DMA driver will be probed later, but sound driver might be
+probed as PIO mode in such case. This patch fixup this issue.
+Then, -EPROBE_DEFER is not error. Thus, let's don't indicate error
+message in such case.
+And it needs to call rsnd_adg_remove() individually if probe failed,
+because it registers clk which should be unregister.
+
+Maybe PIO fallback feature itself is not needed,
+but let's keep it so far.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/core.c | 10 +++++++++-
+ sound/soc/sh/rcar/dma.c | 4 ++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -482,7 +482,7 @@ static int rsnd_status_update(u32 *statu
+ (func_call && (mod)->ops->fn) ? #fn : ""); \
+ if (func_call && (mod)->ops->fn) \
+ tmp = (mod)->ops->fn(mod, io, param); \
+- if (tmp) \
++ if (tmp && (tmp != -EPROBE_DEFER)) \
+ dev_err(dev, "%s[%d] : %s error %d\n", \
+ rsnd_mod_name(mod), rsnd_mod_id(mod), \
+ #fn, tmp); \
+@@ -1550,6 +1550,14 @@ exit_snd_probe:
+ rsnd_dai_call(remove, &rdai->capture, priv);
+ }
+
++ /*
++ * adg is very special mod which can't use rsnd_dai_call(remove),
++ * and it registers ADG clock on probe.
++ * It should be unregister if probe failed.
++ * Mainly it is assuming -EPROBE_DEFER case
++ */
++ rsnd_adg_remove(priv);
++
+ return ret;
+ }
+
+--- a/sound/soc/sh/rcar/dma.c
++++ b/sound/soc/sh/rcar/dma.c
+@@ -244,6 +244,10 @@ static int rsnd_dmaen_attach(struct rsnd
+ /* try to get DMAEngine channel */
+ chan = rsnd_dmaen_request_channel(io, mod_from, mod_to);
+ if (IS_ERR_OR_NULL(chan)) {
++ /* Let's follow when -EPROBE_DEFER case */
++ if (PTR_ERR(chan) == -EPROBE_DEFER)
++ return PTR_ERR(chan);
++
+ /*
+ * DMA failed. try to PIO mode
+ * see
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Oder Chiou <oder_chiou@realtek.com>
+Date: Wed, 15 Aug 2018 14:47:49 +0800
+Subject: ASoC: rt5514: Fix the issue of the delay volume applied again
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+[ Upstream commit 6f0a256253f48095ba2e5bcdfbed41f21643c105 ]
+
+After our evaluation, we need to modify the default values to make sure
+the volume applied immediately.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/rt5514.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -64,8 +64,8 @@ static const struct reg_sequence rt5514_
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_ADCFED, 0x00000800},
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000342},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000342},
+ };
+
+ static const struct reg_default rt5514_reg[] = {
+@@ -92,10 +92,10 @@ static const struct reg_default rt5514_r
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+ {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000342},
+ {RT5514_DOWNFILTER1_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER1_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000342},
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_LDO18_16, 0x02000345},
+ {RT5514_ANA_CTRL_ADC12, 0x0000a2a8},
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Danny Smith <danny.smith@axis.com>
+Date: Thu, 23 Aug 2018 10:26:20 +0200
+Subject: ASoC: sigmadsp: safeload should not have lower byte limit
+
+From: Danny Smith <danny.smith@axis.com>
+
+[ Upstream commit 5ea752c6efdf5aa8a57aed816d453a8f479f1b0a ]
+
+Fixed range in safeload conditional to allow safeload to up to 20 bytes,
+without a lower limit.
+
+Signed-off-by: Danny Smith <dannys@axis.com>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/sigmadsp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/sigmadsp.c
++++ b/sound/soc/codecs/sigmadsp.c
+@@ -117,8 +117,7 @@ static int sigmadsp_ctrl_write(struct si
+ struct sigmadsp_control *ctrl, void *data)
+ {
+ /* safeload loads up to 20 bytes in a atomic operation */
+- if (ctrl->num_bytes > 4 && ctrl->num_bytes <= 20 && sigmadsp->ops &&
+- sigmadsp->ops->safeload)
++ if (ctrl->num_bytes <= 20 && sigmadsp->ops && sigmadsp->ops->safeload)
+ return sigmadsp->ops->safeload(sigmadsp, ctrl->addr, data,
+ ctrl->num_bytes);
+ else
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Wed, 22 Aug 2018 22:49:36 -0500
+Subject: ASoC: wm8804: Add ACPI support
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 960cdd50ca9fdfeb82c2757107bcb7f93c8d7d41 ]
+
+HID made of either Wolfson/CirrusLogic PCI ID + 8804 identifier.
+
+This helps enumerate the HifiBerry Digi+ HAT boards on the Up2 platform.
+
+The scripts at https://github.com/thesofproject/acpi-scripts can be
+used to add the ACPI initrd overlays.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8804-i2c.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8804-i2c.c
++++ b/sound/soc/codecs/wm8804-i2c.c
+@@ -13,6 +13,7 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/i2c.h>
++#include <linux/acpi.h>
+
+ #include "wm8804.h"
+
+@@ -40,17 +41,29 @@ static const struct i2c_device_id wm8804
+ };
+ MODULE_DEVICE_TABLE(i2c, wm8804_i2c_id);
+
++#if defined(CONFIG_OF)
+ static const struct of_device_id wm8804_of_match[] = {
+ { .compatible = "wlf,wm8804", },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, wm8804_of_match);
++#endif
++
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id wm8804_acpi_match[] = {
++ { "1AEC8804", 0 }, /* Wolfson PCI ID + part ID */
++ { "10138804", 0 }, /* Cirrus Logic PCI ID + part ID */
++ { },
++};
++MODULE_DEVICE_TABLE(acpi, wm8804_acpi_match);
++#endif
+
+ static struct i2c_driver wm8804_i2c_driver = {
+ .driver = {
+ .name = "wm8804",
+ .pm = &wm8804_pm,
+- .of_match_table = wm8804_of_match,
++ .of_match_table = of_match_ptr(wm8804_of_match),
++ .acpi_match_table = ACPI_PTR(wm8804_acpi_match),
+ },
+ .probe = wm8804_i2c_probe,
+ .remove = wm8804_i2c_remove,
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Hermes Zhang <chenhuiz@axis.com>
+Date: Tue, 28 Aug 2018 09:48:30 +0800
+Subject: Bluetooth: hci_ldisc: Free rw_semaphore on close
+
+From: Hermes Zhang <chenhuiz@axis.com>
+
+[ Upstream commit e6a57d22f787e73635ce0d29eef0abb77928b3e9 ]
+
+The percpu_rw_semaphore is not currently freed, and this leads to
+a crash when the stale rcu callback is invoked. DEBUG_OBJECTS
+detects this.
+
+ ODEBUG: free active (active state 1) object type: rcu_head hint: (null)
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8
+ PC is at debug_print_object+0xac/0xc8
+ LR is at debug_print_object+0xac/0xc8
+ Call trace:
+ [<ffffff80082e2c2c>] debug_print_object+0xac/0xc8
+ [<ffffff80082e40b0>] debug_check_no_obj_freed+0x1e8/0x228
+ [<ffffff8008191254>] kfree+0x1cc/0x250
+ [<ffffff80083cc03c>] hci_uart_tty_close+0x54/0x108
+ [<ffffff800832e118>] tty_ldisc_close.isra.1+0x40/0x58
+ [<ffffff800832e14c>] tty_ldisc_kill+0x1c/0x40
+ [<ffffff800832e3dc>] tty_ldisc_release+0x94/0x170
+ [<ffffff8008325554>] tty_release_struct+0x1c/0x58
+ [<ffffff8008326400>] tty_release+0x3b0/0x490
+ [<ffffff80081a3fe8>] __fput+0x88/0x1d0
+ [<ffffff80081a418c>] ____fput+0xc/0x18
+ [<ffffff80080c0624>] task_work_run+0x9c/0xc0
+ [<ffffff80080a9e24>] do_exit+0x24c/0x8a0
+ [<ffffff80080aa4e0>] do_group_exit+0x38/0xa0
+ [<ffffff80080aa558>] __wake_up_parent+0x0/0x28
+ [<ffffff8008082c00>] el0_svc_naked+0x34/0x38
+ ---[ end trace bfe08cbd89098cdf ]---
+
+Signed-off-by: Hermes Zhang <chenhuiz@axis.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/hci_ldisc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -543,6 +543,8 @@ static void hci_uart_tty_close(struct tt
+ }
+ clear_bit(HCI_UART_PROTO_SET, &hu->flags);
+
++ percpu_free_rwsem(&hu->proto_lock);
++
+ kfree(hu);
+ }
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 11 Sep 2018 14:10:12 +0300
+Subject: Bluetooth: SMP: Fix trying to use non-existent local OOB data
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+[ Upstream commit 94f14e4728125f979629b2b020d31cd718191626 ]
+
+A remote device may claim that it has received our OOB data, even
+though we never geneated it. Add a new flag to track whether we
+actually have OOB data, and ignore the remote peer's flag if haven't
+generated OOB data.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/smp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -83,6 +83,7 @@ enum {
+
+ struct smp_dev {
+ /* Secure Connections OOB data */
++ bool local_oob;
+ u8 local_pk[64];
+ u8 local_rand[16];
+ bool debug_key;
+@@ -599,6 +600,8 @@ int smp_generate_oob(struct hci_dev *hde
+
+ memcpy(rand, smp->local_rand, 16);
+
++ smp->local_oob = true;
++
+ return 0;
+ }
+
+@@ -1785,7 +1788,7 @@ static u8 smp_cmd_pairing_req(struct l2c
+ * successfully received our local OOB data - therefore set the
+ * flag to indicate that local OOB is in use.
+ */
+- if (req->oob_flag == SMP_OOB_PRESENT)
++ if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
+ set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
+
+ /* SMP over BR/EDR requires special treatment */
+@@ -1967,7 +1970,7 @@ static u8 smp_cmd_pairing_rsp(struct l2c
+ * successfully received our local OOB data - therefore set the
+ * flag to indicate that local OOB is in use.
+ */
+- if (rsp->oob_flag == SMP_OOB_PRESENT)
++ if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
+ set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
+
+ smp->prsp[0] = SMP_CMD_PAIRING_RSP;
+@@ -3230,6 +3233,7 @@ static struct l2cap_chan *smp_add_cid(st
+ return ERR_CAST(tfm_ecdh);
+ }
+
++ smp->local_oob = false;
+ smp->tfm_aes = tfm_aes;
+ smp->tfm_cmac = tfm_cmac;
+ smp->tfm_ecdh = tfm_ecdh;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Matias Karhumaa <matias.karhumaa@gmail.com>
+Date: Tue, 11 Sep 2018 14:10:13 +0300
+Subject: Bluetooth: Use correct tfm to generate OOB data
+
+From: Matias Karhumaa <matias.karhumaa@gmail.com>
+
+[ Upstream commit 4ba5175f2c10affd412fa41855cecda02b66cd71 ]
+
+In case local OOB data was generated and other device initiated pairing
+claiming that it has got OOB data, following crash occurred:
+
+[ 222.847853] general protection fault: 0000 [#1] SMP PTI
+[ 222.848025] CPU: 1 PID: 42 Comm: kworker/u5:0 Tainted: G C 4.18.0-custom #4
+[ 222.848158] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 222.848307] Workqueue: hci0 hci_rx_work [bluetooth]
+[ 222.848416] RIP: 0010:compute_ecdh_secret+0x5a/0x270 [bluetooth]
+[ 222.848540] Code: 0c af f5 48 8b 3d 46 de f0 f6 ba 40 00 00 00 be c0 00 60 00 e8 b7 7b c5 f5 48 85 c0 0f 84 ea 01 00 00 48 89 c3 e8 16 0c af f5 <49> 8b 47 38 be c0 00 60 00 8b 78 f8 48 83 c7 48 e8 51 84 c5 f5 48
+[ 222.848914] RSP: 0018:ffffb1664087fbc0 EFLAGS: 00010293
+[ 222.849021] RAX: ffff8a5750d7dc00 RBX: ffff8a5671096780 RCX: ffffffffc08bc32a
+[ 222.849111] RDX: 0000000000000000 RSI: 00000000006000c0 RDI: ffff8a5752003800
+[ 222.849192] RBP: ffffb1664087fc60 R08: ffff8a57525280a0 R09: ffff8a5752003800
+[ 222.849269] R10: ffffb1664087fc70 R11: 0000000000000093 R12: ffff8a5674396e00
+[ 222.849350] R13: ffff8a574c2e79aa R14: ffff8a574c2e796a R15: 020e0e100d010101
+[ 222.849429] FS: 0000000000000000(0000) GS:ffff8a5752500000(0000) knlGS:0000000000000000
+[ 222.849518] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 222.849586] CR2: 000055856016a038 CR3: 0000000110d2c005 CR4: 00000000000606e0
+[ 222.849671] Call Trace:
+[ 222.849745] ? sc_send_public_key+0x110/0x2a0 [bluetooth]
+[ 222.849825] ? sc_send_public_key+0x115/0x2a0 [bluetooth]
+[ 222.849925] smp_recv_cb+0x959/0x2490 [bluetooth]
+[ 222.850023] ? _cond_resched+0x19/0x40
+[ 222.850105] ? mutex_lock+0x12/0x40
+[ 222.850202] l2cap_recv_frame+0x109d/0x3420 [bluetooth]
+[ 222.850315] ? l2cap_recv_frame+0x109d/0x3420 [bluetooth]
+[ 222.850426] ? __switch_to_asm+0x34/0x70
+[ 222.850515] ? __switch_to_asm+0x40/0x70
+[ 222.850625] ? __switch_to_asm+0x34/0x70
+[ 222.850724] ? __switch_to_asm+0x40/0x70
+[ 222.850786] ? __switch_to_asm+0x34/0x70
+[ 222.850846] ? __switch_to_asm+0x40/0x70
+[ 222.852581] ? __switch_to_asm+0x34/0x70
+[ 222.854976] ? __switch_to_asm+0x40/0x70
+[ 222.857475] ? __switch_to_asm+0x40/0x70
+[ 222.859775] ? __switch_to_asm+0x34/0x70
+[ 222.861218] ? __switch_to_asm+0x40/0x70
+[ 222.862327] ? __switch_to_asm+0x34/0x70
+[ 222.863758] l2cap_recv_acldata+0x266/0x3c0 [bluetooth]
+[ 222.865122] hci_rx_work+0x1c9/0x430 [bluetooth]
+[ 222.867144] process_one_work+0x210/0x4c0
+[ 222.868248] worker_thread+0x41/0x4d0
+[ 222.869420] kthread+0x141/0x160
+[ 222.870694] ? process_one_work+0x4c0/0x4c0
+[ 222.871668] ? kthread_create_worker_on_cpu+0x90/0x90
+[ 222.872896] ret_from_fork+0x35/0x40
+[ 222.874132] Modules linked in: algif_hash algif_skcipher af_alg rfcomm bnep btusb btrtl btbcm btintel snd_intel8x0 cmac intel_rapl_perf vboxvideo(C) snd_ac97_codec bluetooth ac97_bus joydev ttm snd_pcm ecdh_generic drm_kms_helper snd_timer snd input_leds drm serio_raw fb_sys_fops soundcore syscopyarea sysfillrect sysimgblt mac_hid sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper ahci psmouse libahci i2c_piix4 video e1000 pata_acpi
+[ 222.883153] fbcon_switch: detected unhandled fb_set_par error, error code -16
+[ 222.886774] fbcon_switch: detected unhandled fb_set_par error, error code -16
+[ 222.890503] ---[ end trace 6504aa7a777b5316 ]---
+[ 222.890541] RIP: 0010:compute_ecdh_secret+0x5a/0x270 [bluetooth]
+[ 222.890551] Code: 0c af f5 48 8b 3d 46 de f0 f6 ba 40 00 00 00 be c0 00 60 00 e8 b7 7b c5 f5 48 85 c0 0f 84 ea 01 00 00 48 89 c3 e8 16 0c af f5 <49> 8b 47 38 be c0 00 60 00 8b 78 f8 48 83 c7 48 e8 51 84 c5 f5 48
+[ 222.890555] RSP: 0018:ffffb1664087fbc0 EFLAGS: 00010293
+[ 222.890561] RAX: ffff8a5750d7dc00 RBX: ffff8a5671096780 RCX: ffffffffc08bc32a
+[ 222.890565] RDX: 0000000000000000 RSI: 00000000006000c0 RDI: ffff8a5752003800
+[ 222.890571] RBP: ffffb1664087fc60 R08: ffff8a57525280a0 R09: ffff8a5752003800
+[ 222.890576] R10: ffffb1664087fc70 R11: 0000000000000093 R12: ffff8a5674396e00
+[ 222.890581] R13: ffff8a574c2e79aa R14: ffff8a574c2e796a R15: 020e0e100d010101
+[ 222.890586] FS: 0000000000000000(0000) GS:ffff8a5752500000(0000) knlGS:0000000000000000
+[ 222.890591] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 222.890594] CR2: 000055856016a038 CR3: 0000000110d2c005 CR4: 00000000000606e0
+
+This commit fixes a bug where invalid pointer to crypto tfm was used for
+SMP SC ECDH calculation when OOB was in use. Solution is to use same
+crypto tfm than when generating OOB material on generate_oob() function.
+
+This bug was introduced in commit c0153b0b901a ("Bluetooth: let the crypto
+subsystem generate the ecc privkey"). Bug was found by fuzzing kernel SMP
+implementation using Synopsys Defensics.
+
+Signed-off-by: Matias Karhumaa <matias.karhumaa@gmail.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/smp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2700,7 +2700,13 @@ static int smp_cmd_public_key(struct l2c
+ * key was set/generated.
+ */
+ if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
+- struct smp_dev *smp_dev = chan->data;
++ struct l2cap_chan *hchan = hdev->smp_data;
++ struct smp_dev *smp_dev;
++
++ if (!hchan || !hchan->data)
++ return SMP_UNSPECIFIED;
++
++ smp_dev = hchan->data;
+
+ tfm_ecdh = smp_dev->tfm_ecdh;
+ } else {
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 12 Sep 2018 10:29:11 -0700
+Subject: bpf: btf: Fix end boundary calculation for type section
+
+From: Martin KaFai Lau <kafai@fb.com>
+
+[ Upstream commit 4b1c5d917d34f705096bb7dd8a2bd19b0881970e ]
+
+The end boundary math for type section is incorrect in
+btf_check_all_metas(). It just happens that hdr->type_off
+is always 0 for now because there are only two sections
+(type and string) and string section must be at the end (ensured
+in btf_parse_str_sec).
+
+However, type_off may not be 0 if a new section would be added later.
+This patch fixes it.
+
+Fixes: f80442a4cd18 ("bpf: btf: Change how section is supported in btf_header")
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/btf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -1844,7 +1844,7 @@ static int btf_check_all_metas(struct bt
+
+ hdr = &btf->hdr;
+ cur = btf->nohdr_data + hdr->type_off;
+- end = btf->nohdr_data + hdr->type_len;
++ end = cur + hdr->type_len;
+
+ env->log_type_id = 1;
+ while (cur < end) {
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Tushar Dave <tushar.n.dave@oracle.com>
+Date: Wed, 12 Sep 2018 22:15:29 +0200
+Subject: bpf: use __GFP_COMP while allocating page
+
+From: Tushar Dave <tushar.n.dave@oracle.com>
+
+[ Upstream commit 4c3d795cb012a378855543a775408fba1ccff6f2 ]
+
+Helper bpg_msg_pull_data() can allocate multiple pages while
+linearizing multiple scatterlist elements into one shared page.
+However, if the shared page has size > PAGE_SIZE, using
+copy_page_to_iter() causes below warning.
+
+e.g.
+[ 6367.019832] WARNING: CPU: 2 PID: 7410 at lib/iov_iter.c:825
+page_copy_sane.part.8+0x0/0x8
+
+To avoid above warning, use __GFP_COMP while allocating multiple
+contiguous pages.
+
+Fixes: 015632bb30da ("bpf: sk_msg program helper bpf_sk_msg_pull_data")
+Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2334,7 +2334,8 @@ BPF_CALL_4(bpf_msg_pull_data,
+ if (unlikely(bytes_sg_total > copy))
+ return -EINVAL;
+
+- page = alloc_pages(__GFP_NOWARN | GFP_ATOMIC, get_order(copy));
++ page = alloc_pages(__GFP_NOWARN | GFP_ATOMIC | __GFP_COMP,
++ get_order(copy));
+ if (unlikely(!page))
+ return -ENOMEM;
+ p = page_address(page);
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2018 11:34:54 +0200
+Subject: clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b1e3454d39f992e5409cd19f97782185950df6e7 ]
+
+Commit d31fd43c0f9a ("clk: x86: Do not gate clocks enabled by the
+firmware") causes all unclaimed PMC clocks on Cherry Trail devices to be on
+all the time, resulting on the device not being able to reach S0i2 or S0i3
+when suspended.
+
+The reason for this commit is that on some Bay Trail / Cherry Trail devices
+the ethernet controller uses pmc_plt_clk_4. This commit adds an "ether_clk"
+alias, so that the relevant ethernet drivers can try to (optionally) use
+this, without needing X86 specific code / hacks, thus fixing ethernet on
+these devices without breaking S0i3 support.
+
+This commit uses clkdev_hw_create() to create the alias, mirroring the code
+for the already existing "mclk" alias for pmc_plt_clk_3.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=193891#c102
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=196861
+Cc: Johannes Stezenbach <js@sig21.net>
+Cc: Carlo Caione <carlo@endlessm.com>
+Reported-by: Johannes Stezenbach <js@sig21.net>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/x86/clk-pmc-atom.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/clk/x86/clk-pmc-atom.c
++++ b/drivers/clk/x86/clk-pmc-atom.c
+@@ -55,6 +55,7 @@ struct clk_plt_data {
+ u8 nparents;
+ struct clk_plt *clks[PMC_CLK_NUM];
+ struct clk_lookup *mclk_lookup;
++ struct clk_lookup *ether_clk_lookup;
+ };
+
+ /* Return an index in parent table */
+@@ -351,11 +352,20 @@ static int plt_clk_probe(struct platform
+ goto err_unreg_clk_plt;
+ }
+
++ data->ether_clk_lookup = clkdev_hw_create(&data->clks[4]->hw,
++ "ether_clk", NULL);
++ if (!data->ether_clk_lookup) {
++ err = -ENOMEM;
++ goto err_drop_mclk;
++ }
++
+ plt_clk_free_parent_names_loop(parent_names, data->nparents);
+
+ platform_set_drvdata(pdev, data);
+ return 0;
+
++err_drop_mclk:
++ clkdev_drop(data->mclk_lookup);
+ err_unreg_clk_plt:
+ plt_clk_unregister_loop(data, i);
+ plt_clk_unregister_parents(data);
+@@ -369,6 +379,7 @@ static int plt_clk_remove(struct platfor
+
+ data = platform_get_drvdata(pdev);
+
++ clkdev_drop(data->ether_clk_lookup);
+ clkdev_drop(data->mclk_lookup);
+ plt_clk_unregister_loop(data, PMC_CLK_NUM);
+ plt_clk_unregister_parents(data);
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Sep 2018 11:34:56 +0200
+Subject: clk: x86: Stop marking clocks as CLK_IS_CRITICAL
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 648e921888ad96ea3dc922739e96716ad3225d7f ]
+
+Commit d31fd43c0f9a ("clk: x86: Do not gate clocks enabled by the
+firmware"), which added the code to mark clocks as CLK_IS_CRITICAL, causes
+all unclaimed PMC clocks on Cherry Trail devices to be on all the time,
+resulting on the device not being able to reach S0i3 when suspended.
+
+The reason for this commit is that on some Bay Trail / Cherry Trail devices
+the r8169 ethernet controller uses pmc_plt_clk_4. Now that the clk-pmc-atom
+driver exports an "ether_clk" alias for pmc_plt_clk_4 and the r8169 driver
+has been modified to get and enable this clock (if present) the marking of
+the clocks as CLK_IS_CRITICAL is no longer necessary.
+
+This commit removes the CLK_IS_CRITICAL marking, fixing Cherry Trail
+devices not being able to reach S0i3 greatly decreasing their battery
+drain when suspended.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=193891#c102
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=196861
+Cc: Johannes Stezenbach <js@sig21.net>
+Cc: Carlo Caione <carlo@endlessm.com>
+Reported-by: Johannes Stezenbach <js@sig21.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/x86/clk-pmc-atom.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/clk/x86/clk-pmc-atom.c
++++ b/drivers/clk/x86/clk-pmc-atom.c
+@@ -187,13 +187,6 @@ static struct clk_plt *plt_clk_register(
+ pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
+ spin_lock_init(&pclk->lock);
+
+- /*
+- * If the clock was already enabled by the firmware mark it as critical
+- * to avoid it being gated by the clock framework if no driver owns it.
+- */
+- if (plt_clk_is_enabled(&pclk->hw))
+- init.flags |= CLK_IS_CRITICAL;
+-
+ ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
+ if (ret) {
+ pclk = ERR_PTR(ret);
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Amber Lin <Amber.Lin@amd.com>
+Date: Wed, 12 Sep 2018 21:42:18 -0400
+Subject: drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit caaa4c8a6be2a275bd14f2369ee364978ff74704 ]
+
+A wrong register bit was examinated for checking SDMA status so it reports
+false failures. This typo only appears on gfx_v7. gfx_v8 checks the correct
+bit.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+@@ -677,7 +677,7 @@ static int kgd_hqd_sdma_destroy(struct k
+
+ while (true) {
+ temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS);
+- if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT)
++ if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK)
+ break;
+ if (time_after(jiffies, end_jiffies))
+ return -ETIME;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Yong Zhao <yong.zhao@amd.com>
+Date: Wed, 12 Sep 2018 21:42:19 -0400
+Subject: drm/amdkfd: Change the control stack MTYPE from UC to NC on GFX9
+
+From: Yong Zhao <yong.zhao@amd.com>
+
+[ Upstream commit 15426dbb65c5b37680d27e84d58a1ed3b8532518 ]
+
+CWSR fails on Raven if the control stack is MTYPE_UC, which is used
+for regular GART mappings. As a workaround we map it using MTYPE_NC.
+
+The MEC firmware expects the control stack at one page offset from the
+start of the MQD so it is part of the MQD allocation on GFXv9. AMDGPU
+added a memory allocation flag just for this purpose.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Yong Zhao <yong.zhao@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 6 +++++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +-
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 3 ++-
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 2 +-
+ drivers/gpu/drm/amd/include/kgd_kfd_interface.h | 2 +-
+ 5 files changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -245,7 +245,7 @@ int amdgpu_amdkfd_resume(struct amdgpu_d
+
+ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
+ void **mem_obj, uint64_t *gpu_addr,
+- void **cpu_ptr)
++ void **cpu_ptr, bool mqd_gfx9)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
+ struct amdgpu_bo *bo = NULL;
+@@ -261,6 +261,10 @@ int alloc_gtt_mem(struct kgd_dev *kgd, s
+ bp.flags = AMDGPU_GEM_CREATE_CPU_GTT_USWC;
+ bp.type = ttm_bo_type_kernel;
+ bp.resv = NULL;
++
++ if (mqd_gfx9)
++ bp.flags |= AMDGPU_GEM_CREATE_MQD_GFX9;
++
+ r = amdgpu_bo_create(adev, &bp, &bo);
+ if (r) {
+ dev_err(adev->dev,
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+@@ -129,7 +129,7 @@ bool amdgpu_amdkfd_is_kfd_vmid(struct am
+ /* Shared API */
+ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
+ void **mem_obj, uint64_t *gpu_addr,
+- void **cpu_ptr);
++ void **cpu_ptr, bool mqd_gfx9);
+ void free_gtt_mem(struct kgd_dev *kgd, void *mem_obj);
+ void get_local_mem_info(struct kgd_dev *kgd,
+ struct kfd_local_mem_info *mem_info);
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -423,7 +423,8 @@ bool kgd2kfd_device_init(struct kfd_dev
+
+ if (kfd->kfd2kgd->init_gtt_mem_allocation(
+ kfd->kgd, size, &kfd->gtt_mem,
+- &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr)){
++ &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr,
++ false)) {
+ dev_err(kfd_device, "Could not allocate %d bytes\n", size);
+ goto out;
+ }
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -63,7 +63,7 @@ static int init_mqd(struct mqd_manager *
+ ALIGN(sizeof(struct v9_mqd), PAGE_SIZE),
+ &((*mqd_mem_obj)->gtt_mem),
+ &((*mqd_mem_obj)->gpu_addr),
+- (void *)&((*mqd_mem_obj)->cpu_ptr));
++ (void *)&((*mqd_mem_obj)->cpu_ptr), true);
+ } else
+ retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
+ mqd_mem_obj);
+--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
++++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+@@ -266,7 +266,7 @@ struct tile_config {
+ struct kfd2kgd_calls {
+ int (*init_gtt_mem_allocation)(struct kgd_dev *kgd, size_t size,
+ void **mem_obj, uint64_t *gpu_addr,
+- void **cpu_ptr);
++ void **cpu_ptr, bool mqd_gfx9);
+
+ void (*free_gtt_mem)(struct kgd_dev *kgd, void *mem_obj);
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Yong Zhao <Yong.Zhao@amd.com>
+Date: Wed, 12 Sep 2018 21:42:20 -0400
+Subject: drm/amdkfd: Fix ATS capablity was not reported correctly on some APUs
+
+From: Yong Zhao <Yong.Zhao@amd.com>
+
+[ Upstream commit 44d8cc6f1a905e4bb1d4221a898abb0d7e9d100a ]
+
+Because CRAT_CU_FLAGS_IOMMU_PRESENT was not set in some BIOS crat, we
+need to workaround this.
+
+For future compatibility, we also overwrite the bit in capability according
+to the value of needs_iommu_device.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Yong Zhao <Yong.Zhao@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 13 ++++++++++++-
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 +
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 21 ++++++++++++++++-----
+ 3 files changed, 29 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+@@ -62,9 +62,20 @@ int kfd_iommu_device_init(struct kfd_dev
+ struct amd_iommu_device_info iommu_info;
+ unsigned int pasid_limit;
+ int err;
++ struct kfd_topology_device *top_dev;
+
+- if (!kfd->device_info->needs_iommu_device)
++ top_dev = kfd_topology_device_by_id(kfd->id);
++
++ /*
++ * Overwrite ATS capability according to needs_iommu_device to fix
++ * potential missing corresponding bit in CRAT of BIOS.
++ */
++ if (!kfd->device_info->needs_iommu_device) {
++ top_dev->node_props.capability &= ~HSA_CAP_ATS_PRESENT;
+ return 0;
++ }
++
++ top_dev->node_props.capability |= HSA_CAP_ATS_PRESENT;
+
+ iommu_info.flags = 0;
+ err = amd_iommu_device_info(kfd->pdev, &iommu_info);
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -796,6 +796,7 @@ int kfd_topology_add_device(struct kfd_d
+ int kfd_topology_remove_device(struct kfd_dev *gpu);
+ struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
+ uint32_t proximity_domain);
++struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id);
+ struct kfd_dev *kfd_device_by_id(uint32_t gpu_id);
+ struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev);
+ int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev);
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -63,22 +63,33 @@ struct kfd_topology_device *kfd_topology
+ return device;
+ }
+
+-struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
++struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id)
+ {
+- struct kfd_topology_device *top_dev;
+- struct kfd_dev *device = NULL;
++ struct kfd_topology_device *top_dev = NULL;
++ struct kfd_topology_device *ret = NULL;
+
+ down_read(&topology_lock);
+
+ list_for_each_entry(top_dev, &topology_device_list, list)
+ if (top_dev->gpu_id == gpu_id) {
+- device = top_dev->gpu;
++ ret = top_dev;
+ break;
+ }
+
+ up_read(&topology_lock);
+
+- return device;
++ return ret;
++}
++
++struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
++{
++ struct kfd_topology_device *top_dev;
++
++ top_dev = kfd_topology_device_by_id(gpu_id);
++ if (!top_dev)
++ return NULL;
++
++ return top_dev->gpu;
+ }
+
+ struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev)
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: zhong jiang <zhongjiang@huawei.com>
+Date: Sat, 4 Aug 2018 18:49:27 +0800
+Subject: drm/pl111: Make sure of_device_id tables are NULL terminated
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 7eb33224572636248d5b6cfa1a6b2472207be5c4 ]
+
+We prefer to of_device_id tables are NULL terminated. So make
+vexpress_muxfpga_match is NULL terminated.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1533379767-15629-1-git-send-email-zhongjiang@huawei.com
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/pl111/pl111_vexpress.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/pl111/pl111_vexpress.c
++++ b/drivers/gpu/drm/pl111/pl111_vexpress.c
+@@ -111,7 +111,8 @@ static int vexpress_muxfpga_probe(struct
+ }
+
+ static const struct of_device_id vexpress_muxfpga_match[] = {
+- { .compatible = "arm,vexpress-muxfpga", }
++ { .compatible = "arm,vexpress-muxfpga", },
++ {}
+ };
+
+ static struct platform_driver vexpress_muxfpga_driver = {
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Jay Kamat <jgkamat@fb.com>
+Date: Fri, 7 Sep 2018 14:34:04 -0700
+Subject: Fix cg_read_strcmp()
+
+From: Jay Kamat <jgkamat@fb.com>
+
+[ Upstream commit 48c2bb0b9cf863e0ed78e269f188ce65b73e0fd1 ]
+
+Fix a couple issues with cg_read_strcmp(), to improve correctness of
+cgroup tests
+- Fix cg_read_strcmp() always returning 0 for empty "needle" strings.
+Previously, this function read to a size = 1 buffer when comparing
+against empty strings, which would lead to cg_read_strcmp() comparing
+two empty strings.
+- Fix a memory leak in cg_read_strcmp()
+
+Fixes: 84092dbcf901 ("selftests: cgroup: add memory controller self-tests")
+
+Signed-off-by: Jay Kamat <jgkamat@fb.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/cgroup/cgroup_util.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/tools/testing/selftests/cgroup/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/cgroup_util.c
+@@ -89,17 +89,28 @@ int cg_read(const char *cgroup, const ch
+ int cg_read_strcmp(const char *cgroup, const char *control,
+ const char *expected)
+ {
+- size_t size = strlen(expected) + 1;
++ size_t size;
+ char *buf;
++ int ret;
++
++ /* Handle the case of comparing against empty string */
++ if (!expected)
++ size = 32;
++ else
++ size = strlen(expected) + 1;
+
+ buf = malloc(size);
+ if (!buf)
+ return -1;
+
+- if (cg_read(cgroup, control, buf, size))
++ if (cg_read(cgroup, control, buf, size)) {
++ free(buf);
+ return -1;
++ }
+
+- return strcmp(expected, buf);
++ ret = strcmp(expected, buf);
++ free(buf);
++ return ret;
+ }
+
+ int cg_read_strstr(const char *cgroup, const char *control, const char *needle)
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Fri, 14 Sep 2018 12:54:57 -0700
+Subject: hv_netvsc: pair VF based on serial number
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 00d7ddba1143623b31bc2c15d18216e2da031b14 ]
+
+Matching network device based on MAC address is problematic
+since a non VF network device can be creted with a duplicate MAC
+address causing confusion and problems. The VMBus API does provide
+a serial number that is a better matching method.
+
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/netvsc.c | 3 ++
+ drivers/net/hyperv/netvsc_drv.c | 58 ++++++++++++++++++++++------------------
+ 2 files changed, 36 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1203,6 +1203,9 @@ static void netvsc_send_vf(struct net_de
+
+ net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+ net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
++ netdev_info(ndev, "VF slot %u %s\n",
++ net_device_ctx->vf_serial,
++ net_device_ctx->vf_alloc ? "added" : "removed");
+ }
+
+ static void netvsc_receive_inband(struct net_device *ndev,
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1794,20 +1794,6 @@ out_unlock:
+ rtnl_unlock();
+ }
+
+-static struct net_device *get_netvsc_bymac(const u8 *mac)
+-{
+- struct net_device_context *ndev_ctx;
+-
+- list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+- struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
+-
+- if (ether_addr_equal(mac, dev->perm_addr))
+- return dev;
+- }
+-
+- return NULL;
+-}
+-
+ static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
+ {
+ struct net_device_context *net_device_ctx;
+@@ -1936,26 +1922,48 @@ static void netvsc_vf_setup(struct work_
+ rtnl_unlock();
+ }
+
++/* Find netvsc by VMBus serial number.
++ * The PCI hyperv controller records the serial number as the slot.
++ */
++static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
++{
++ struct device *parent = vf_netdev->dev.parent;
++ struct net_device_context *ndev_ctx;
++ struct pci_dev *pdev;
++
++ if (!parent || !dev_is_pci(parent))
++ return NULL; /* not a PCI device */
++
++ pdev = to_pci_dev(parent);
++ if (!pdev->slot) {
++ netdev_notice(vf_netdev, "no PCI slot information\n");
++ return NULL;
++ }
++
++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
++ if (!ndev_ctx->vf_alloc)
++ continue;
++
++ if (ndev_ctx->vf_serial == pdev->slot->number)
++ return hv_get_drvdata(ndev_ctx->device_ctx);
++ }
++
++ netdev_notice(vf_netdev,
++ "no netdev found for slot %u\n", pdev->slot->number);
++ return NULL;
++}
++
+ static int netvsc_register_vf(struct net_device *vf_netdev)
+ {
+- struct net_device *ndev;
+ struct net_device_context *net_device_ctx;
+- struct device *pdev = vf_netdev->dev.parent;
+ struct netvsc_device *netvsc_dev;
++ struct net_device *ndev;
+ int ret;
+
+ if (vf_netdev->addr_len != ETH_ALEN)
+ return NOTIFY_DONE;
+
+- if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev))
+- return NOTIFY_DONE;
+-
+- /*
+- * We will use the MAC address to locate the synthetic interface to
+- * associate with the VF interface. If we don't find a matching
+- * synthetic interface, move on.
+- */
+- ndev = get_netvsc_bymac(vf_netdev->perm_addr);
++ ndev = get_netvsc_byslot(vf_netdev);
+ if (!ndev)
+ return NOTIFY_DONE;
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 6 Sep 2018 09:47:51 -0700
+Subject: hwmon: (nct6775) Fix access to fan pulse registers
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit c793279c77035053e67937f5743c6ebfc303e7c5 ]
+
+Not all fans have a fan pulse register. This can result in reading
+beyond the end of REG_FAN_PULSES and FAN_PULSE_SHIFT arrays,
+and was reported by smatch as possible error.
+
+1672 for (i = 0; i < ARRAY_SIZE(data->rpm); i++) {
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+ This is a 7 element array.
+...
+1685 data->fan_pulses[i] =
+1686 (nct6775_read_value(data, data->REG_FAN_PULSES[i])
+1687 >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+ FAN_PULSE_SHIFT is either 5 or 6
+ elements.
+
+To fix the problem, we have to ensure that all REG_FAN_PULSES and
+FAN_PULSE_SHIFT have the appropriate length, and that REG_FAN_PULSES
+is only read if the register actually exists.
+
+Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/nct6775.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -299,8 +299,9 @@ static const u16 NCT6775_REG_PWM_READ[]
+
+ static const u16 NCT6775_REG_FAN[] = { 0x630, 0x632, 0x634, 0x636, 0x638 };
+ static const u16 NCT6775_REG_FAN_MIN[] = { 0x3b, 0x3c, 0x3d };
+-static const u16 NCT6775_REG_FAN_PULSES[] = { 0x641, 0x642, 0x643, 0x644, 0 };
+-static const u16 NCT6775_FAN_PULSE_SHIFT[] = { 0, 0, 0, 0, 0, 0 };
++static const u16 NCT6775_REG_FAN_PULSES[NUM_FAN] = {
++ 0x641, 0x642, 0x643, 0x644 };
++static const u16 NCT6775_FAN_PULSE_SHIFT[NUM_FAN] = { };
+
+ static const u16 NCT6775_REG_TEMP[] = {
+ 0x27, 0x150, 0x250, 0x62b, 0x62c, 0x62d };
+@@ -425,8 +426,8 @@ static const u8 NCT6776_PWM_MODE_MASK[]
+
+ static const u16 NCT6776_REG_FAN_MIN[] = {
+ 0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c };
+-static const u16 NCT6776_REG_FAN_PULSES[] = {
+- 0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
++static const u16 NCT6776_REG_FAN_PULSES[NUM_FAN] = {
++ 0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
+
+ static const u16 NCT6776_REG_WEIGHT_DUTY_BASE[] = {
+ 0x13e, 0x23e, 0x33e, 0x83e, 0x93e, 0xa3e };
+@@ -502,8 +503,8 @@ static const s8 NCT6779_BEEP_BITS[] = {
+
+ static const u16 NCT6779_REG_FAN[] = {
+ 0x4b0, 0x4b2, 0x4b4, 0x4b6, 0x4b8, 0x4ba, 0x660 };
+-static const u16 NCT6779_REG_FAN_PULSES[] = {
+- 0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
++static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
++ 0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
+
+ static const u16 NCT6779_REG_CRITICAL_PWM_ENABLE[] = {
+ 0x136, 0x236, 0x336, 0x836, 0x936, 0xa36, 0xb36 };
+@@ -779,8 +780,8 @@ static const u16 NCT6106_REG_TEMP_CONFIG
+
+ static const u16 NCT6106_REG_FAN[] = { 0x20, 0x22, 0x24 };
+ static const u16 NCT6106_REG_FAN_MIN[] = { 0xe0, 0xe2, 0xe4 };
+-static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6, 0, 0 };
+-static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4, 0, 0 };
++static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6 };
++static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4 };
+
+ static const u8 NCT6106_REG_PWM_MODE[] = { 0xf3, 0xf3, 0xf3 };
+ static const u8 NCT6106_PWM_MODE_MASK[] = { 0x01, 0x02, 0x04 };
+@@ -1682,9 +1683,13 @@ static struct nct6775_data *nct6775_upda
+ if (data->has_fan_min & BIT(i))
+ data->fan_min[i] = nct6775_read_value(data,
+ data->REG_FAN_MIN[i]);
+- data->fan_pulses[i] =
+- (nct6775_read_value(data, data->REG_FAN_PULSES[i])
+- >> data->FAN_PULSE_SHIFT[i]) & 0x03;
++
++ if (data->REG_FAN_PULSES[i]) {
++ data->fan_pulses[i] =
++ (nct6775_read_value(data,
++ data->REG_FAN_PULSES[i])
++ >> data->FAN_PULSE_SHIFT[i]) & 0x03;
++ }
+
+ nct6775_select_fan_div(dev, data, i, reg);
+ }
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 13 Sep 2018 20:01:12 -0700
+Subject: hwmon: (nct6775) Fix RPM output for fan7 on NCT6796D
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f6de298806d9cbc63a4907bca34a06162b9d7dce ]
+
+fan7 on NCT6796D does not have a fan count register; it only has an RPM
+register. Switch to using RPM registers to read the fan speed for all
+chips supporting it to solve the problem for good.
+
+Reported-by: Robert Kern <ulteq@web.de>
+Cc: Robert Kern <ulteq@web.de>
+Fixes: 81820059a428 ("hwmon: (nct6775) Add support for NCT6796D")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/nct6775.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -502,7 +502,7 @@ static const s8 NCT6779_BEEP_BITS[] = {
+ 30, 31 }; /* intrusion0, intrusion1 */
+
+ static const u16 NCT6779_REG_FAN[] = {
+- 0x4b0, 0x4b2, 0x4b4, 0x4b6, 0x4b8, 0x4ba, 0x660 };
++ 0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x660 };
+ static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
+ 0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
+
+@@ -924,6 +924,11 @@ static unsigned int fan_from_reg16(u16 r
+ return 1350000U / (reg << divreg);
+ }
+
++static unsigned int fan_from_reg_rpm(u16 reg, unsigned int divreg)
++{
++ return reg;
++}
++
+ static u16 fan_to_reg(u32 fan, unsigned int divreg)
+ {
+ if (!fan)
+@@ -1284,7 +1289,7 @@ static bool is_word_sized(struct nct6775
+ case nct6795:
+ case nct6796:
+ return reg == 0x150 || reg == 0x153 || reg == 0x155 ||
+- ((reg & 0xfff0) == 0x4b0 && (reg & 0x000f) < 0x0b) ||
++ (reg & 0xfff0) == 0x4c0 ||
+ reg == 0x402 ||
+ reg == 0x63a || reg == 0x63c || reg == 0x63e ||
+ reg == 0x640 || reg == 0x642 || reg == 0x64a ||
+@@ -3868,7 +3873,7 @@ static int nct6775_probe(struct platform
+ data->ALARM_BITS = NCT6779_ALARM_BITS;
+ data->BEEP_BITS = NCT6779_BEEP_BITS;
+
+- data->fan_from_reg = fan_from_reg13;
++ data->fan_from_reg = fan_from_reg_rpm;
+ data->fan_from_reg_min = fan_from_reg13;
+ data->target_temp_mask = 0xff;
+ data->tolerance_mask = 0x07;
+@@ -3949,7 +3954,7 @@ static int nct6775_probe(struct platform
+ data->ALARM_BITS = NCT6791_ALARM_BITS;
+ data->BEEP_BITS = NCT6779_BEEP_BITS;
+
+- data->fan_from_reg = fan_from_reg13;
++ data->fan_from_reg = fan_from_reg_rpm;
+ data->fan_from_reg_min = fan_from_reg13;
+ data->target_temp_mask = 0xff;
+ data->tolerance_mask = 0x07;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 13 Sep 2018 19:43:58 -0700
+Subject: hwmon: (nct6775) Fix virtual temperature sources for NCT6796D
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 37196ba4ae95a2077d78715eb12e879e57613d43 ]
+
+The following kernel log message is reported for the nct6775 driver
+on ASUS WS X299 SAGE.
+
+nct6775: Found NCT6796D or compatible chip at 0x2e:0x290
+nct6775 nct6775.656: Invalid temperature source 11 at index 0,
+ source register 0x100, temp register 0x73
+nct6775 nct6775.656: Invalid temperature source 11 at index 2,
+ source register 0x300, temp register 0x77
+nct6775 nct6775.656: Invalid temperature source 11 at index 3,
+ source register 0x800, temp register 0x79
+nct6775 nct6775.656: Invalid temperature source 11 at index 4,
+ source register 0x900, temp register 0x7b
+
+A recent version of the datasheet lists temperature source 11 as reserved.
+However, an older version of the datasheet lists temperature sources 10
+and 11 as supported virtual temperature sources. Apparently the older
+version of the datasheet is correct, so list those temperature sources
+as supported.
+
+Virtual temperature sources are different than other temperature sources:
+Values are not read from a temperature sensor, but written either from
+BIOS or an embedded controller. As such, each virtual temperature has to
+be reported. Since there is now more than one temperature source, we have
+to keep virtual temperature sources in a chip-specific mask and can no
+longer rely on the assumption that there is only one virtual temperature
+source with a fixed index. This accounts for most of the complexity of this
+patch.
+
+Reported-by: Robert Kern <ulteq@web.de>
+Cc: Robert Kern <ulteq@web.de>
+Fixes: 81820059a428 ("hwmon: (nct6775) Add support for NCT6796D")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/nct6775.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -207,8 +207,6 @@ superio_exit(int ioreg)
+
+ #define NUM_FAN 7
+
+-#define TEMP_SOURCE_VIRTUAL 0x1f
+-
+ /* Common and NCT6775 specific data */
+
+ /* Voltage min/max registers for nr=7..14 are in bank 5 */
+@@ -374,6 +372,7 @@ static const char *const nct6775_temp_la
+ };
+
+ #define NCT6775_TEMP_MASK 0x001ffffe
++#define NCT6775_VIRT_TEMP_MASK 0x00000000
+
+ static const u16 NCT6775_REG_TEMP_ALTERNATE[32] = {
+ [13] = 0x661,
+@@ -462,6 +461,7 @@ static const char *const nct6776_temp_la
+ };
+
+ #define NCT6776_TEMP_MASK 0x007ffffe
++#define NCT6776_VIRT_TEMP_MASK 0x00000000
+
+ static const u16 NCT6776_REG_TEMP_ALTERNATE[32] = {
+ [14] = 0x401,
+@@ -560,7 +560,9 @@ static const char *const nct6779_temp_la
+ };
+
+ #define NCT6779_TEMP_MASK 0x07ffff7e
++#define NCT6779_VIRT_TEMP_MASK 0x00000000
+ #define NCT6791_TEMP_MASK 0x87ffff7e
++#define NCT6791_VIRT_TEMP_MASK 0x80000000
+
+ static const u16 NCT6779_REG_TEMP_ALTERNATE[32]
+ = { 0x490, 0x491, 0x492, 0x493, 0x494, 0x495, 0, 0,
+@@ -639,6 +641,7 @@ static const char *const nct6792_temp_la
+ };
+
+ #define NCT6792_TEMP_MASK 0x9fffff7e
++#define NCT6792_VIRT_TEMP_MASK 0x80000000
+
+ static const char *const nct6793_temp_label[] = {
+ "",
+@@ -676,6 +679,7 @@ static const char *const nct6793_temp_la
+ };
+
+ #define NCT6793_TEMP_MASK 0xbfff037e
++#define NCT6793_VIRT_TEMP_MASK 0x80000000
+
+ static const char *const nct6795_temp_label[] = {
+ "",
+@@ -713,6 +717,7 @@ static const char *const nct6795_temp_la
+ };
+
+ #define NCT6795_TEMP_MASK 0xbfffff7e
++#define NCT6795_VIRT_TEMP_MASK 0x80000000
+
+ static const char *const nct6796_temp_label[] = {
+ "",
+@@ -725,8 +730,8 @@ static const char *const nct6796_temp_la
+ "AUXTIN4",
+ "SMBUSMASTER 0",
+ "SMBUSMASTER 1",
+- "",
+- "",
++ "Virtual_TEMP",
++ "Virtual_TEMP",
+ "",
+ "",
+ "",
+@@ -749,7 +754,8 @@ static const char *const nct6796_temp_la
+ "Virtual_TEMP"
+ };
+
+-#define NCT6796_TEMP_MASK 0xbfff03fe
++#define NCT6796_TEMP_MASK 0xbfff0ffe
++#define NCT6796_VIRT_TEMP_MASK 0x80000c00
+
+ /* NCT6102D/NCT6106D specific data */
+
+@@ -970,6 +976,7 @@ struct nct6775_data {
+ u16 reg_temp_config[NUM_TEMP];
+ const char * const *temp_label;
+ u32 temp_mask;
++ u32 virt_temp_mask;
+
+ u16 REG_CONFIG;
+ u16 REG_VBAT;
+@@ -3644,6 +3651,7 @@ static int nct6775_probe(struct platform
+
+ data->temp_label = nct6776_temp_label;
+ data->temp_mask = NCT6776_TEMP_MASK;
++ data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
+
+ data->REG_VBAT = NCT6106_REG_VBAT;
+ data->REG_DIODE = NCT6106_REG_DIODE;
+@@ -3722,6 +3730,7 @@ static int nct6775_probe(struct platform
+
+ data->temp_label = nct6775_temp_label;
+ data->temp_mask = NCT6775_TEMP_MASK;
++ data->virt_temp_mask = NCT6775_VIRT_TEMP_MASK;
+
+ data->REG_CONFIG = NCT6775_REG_CONFIG;
+ data->REG_VBAT = NCT6775_REG_VBAT;
+@@ -3794,6 +3803,7 @@ static int nct6775_probe(struct platform
+
+ data->temp_label = nct6776_temp_label;
+ data->temp_mask = NCT6776_TEMP_MASK;
++ data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
+
+ data->REG_CONFIG = NCT6775_REG_CONFIG;
+ data->REG_VBAT = NCT6775_REG_VBAT;
+@@ -3866,6 +3876,7 @@ static int nct6775_probe(struct platform
+
+ data->temp_label = nct6779_temp_label;
+ data->temp_mask = NCT6779_TEMP_MASK;
++ data->virt_temp_mask = NCT6779_VIRT_TEMP_MASK;
+
+ data->REG_CONFIG = NCT6775_REG_CONFIG;
+ data->REG_VBAT = NCT6775_REG_VBAT;
+@@ -3949,22 +3960,27 @@ static int nct6775_probe(struct platform
+ case nct6791:
+ data->temp_label = nct6779_temp_label;
+ data->temp_mask = NCT6791_TEMP_MASK;
++ data->virt_temp_mask = NCT6791_VIRT_TEMP_MASK;
+ break;
+ case nct6792:
+ data->temp_label = nct6792_temp_label;
+ data->temp_mask = NCT6792_TEMP_MASK;
++ data->virt_temp_mask = NCT6792_VIRT_TEMP_MASK;
+ break;
+ case nct6793:
+ data->temp_label = nct6793_temp_label;
+ data->temp_mask = NCT6793_TEMP_MASK;
++ data->virt_temp_mask = NCT6793_VIRT_TEMP_MASK;
+ break;
+ case nct6795:
+ data->temp_label = nct6795_temp_label;
+ data->temp_mask = NCT6795_TEMP_MASK;
++ data->virt_temp_mask = NCT6795_VIRT_TEMP_MASK;
+ break;
+ case nct6796:
+ data->temp_label = nct6796_temp_label;
+ data->temp_mask = NCT6796_TEMP_MASK;
++ data->virt_temp_mask = NCT6796_VIRT_TEMP_MASK;
+ break;
+ }
+
+@@ -4148,7 +4164,7 @@ static int nct6775_probe(struct platform
+ * for each fan reflects a different temperature, and there
+ * are no duplicates.
+ */
+- if (src != TEMP_SOURCE_VIRTUAL) {
++ if (!(data->virt_temp_mask & BIT(src))) {
+ if (mask & BIT(src))
+ continue;
+ mask |= BIT(src);
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Mon, 17 Sep 2018 05:23:58 -0700
+Subject: hwmon: (nct6775) Use different register to get fan RPM for fan7
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 55066354285b36ee09dc50e2527f43a97c567177 ]
+
+The documented register to retrieve the fan RPM for fan7 is found
+to be unreliable at least with NCT6796D revision 3. Let's use
+register 0x4ce instead. This is undocumented for NCT6796D, but
+documented for NCT6797D and NCT6798D and known to be working.
+
+Reported-by: Robert Kern <ulteq@web.de>
+Cc: Robert Kern <ulteq@web.de>
+Fixes: 81820059a428 ("hwmon: (nct6775) Add support for NCT6796D")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/nct6775.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -502,7 +502,7 @@ static const s8 NCT6779_BEEP_BITS[] = {
+ 30, 31 }; /* intrusion0, intrusion1 */
+
+ static const u16 NCT6779_REG_FAN[] = {
+- 0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x660 };
++ 0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x4ce };
+ static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
+ 0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
+
+@@ -1293,7 +1293,7 @@ static bool is_word_sized(struct nct6775
+ reg == 0x402 ||
+ reg == 0x63a || reg == 0x63c || reg == 0x63e ||
+ reg == 0x640 || reg == 0x642 || reg == 0x64a ||
+- reg == 0x64c || reg == 0x660 ||
++ reg == 0x64c ||
+ reg == 0x73 || reg == 0x75 || reg == 0x77 || reg == 0x79 ||
+ reg == 0x7b || reg == 0x7d;
+ }
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 11 Sep 2018 20:48:34 +1000
+Subject: KVM: PPC: Book3S HV: Don't use compound_order to determine host mapping size
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 71d29f43b6332badc5598c656616a62575e83342 ]
+
+THP paths can defer splitting compound pages until after the actual
+remap and TLB flushes to split a huge PMD/PUD. This causes radix
+partition scope page table mappings to get out of synch with the host
+qemu page table mappings.
+
+This results in random memory corruption in the guest when running
+with THP. The easiest way to reproduce is use KVM balloon to free up
+a lot of memory in the guest and then shrink the balloon to give the
+memory back, while some work is being done in the guest.
+
+Cc: David Gibson <david@gibson.dropbear.id.au>
+Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
+Cc: kvm-ppc@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kvm/book3s_64_mmu_radix.c | 91 +++++++++++++--------------------
+ 1 file changed, 37 insertions(+), 54 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+@@ -538,8 +538,8 @@ int kvmppc_book3s_radix_page_fault(struc
+ unsigned long ea, unsigned long dsisr)
+ {
+ struct kvm *kvm = vcpu->kvm;
+- unsigned long mmu_seq, pte_size;
+- unsigned long gpa, gfn, hva, pfn;
++ unsigned long mmu_seq;
++ unsigned long gpa, gfn, hva;
+ struct kvm_memory_slot *memslot;
+ struct page *page = NULL;
+ long ret;
+@@ -636,9 +636,10 @@ int kvmppc_book3s_radix_page_fault(struc
+ */
+ hva = gfn_to_hva_memslot(memslot, gfn);
+ if (upgrade_p && __get_user_pages_fast(hva, 1, 1, &page) == 1) {
+- pfn = page_to_pfn(page);
+ upgrade_write = true;
+ } else {
++ unsigned long pfn;
++
+ /* Call KVM generic code to do the slow-path check */
+ pfn = __gfn_to_pfn_memslot(memslot, gfn, false, NULL,
+ writing, upgrade_p);
+@@ -652,63 +653,45 @@ int kvmppc_book3s_radix_page_fault(struc
+ }
+ }
+
+- /* See if we can insert a 1GB or 2MB large PTE here */
+- level = 0;
+- if (page && PageCompound(page)) {
+- pte_size = PAGE_SIZE << compound_order(compound_head(page));
+- if (pte_size >= PUD_SIZE &&
+- (gpa & (PUD_SIZE - PAGE_SIZE)) ==
+- (hva & (PUD_SIZE - PAGE_SIZE))) {
+- level = 2;
+- pfn &= ~((PUD_SIZE >> PAGE_SHIFT) - 1);
+- } else if (pte_size >= PMD_SIZE &&
+- (gpa & (PMD_SIZE - PAGE_SIZE)) ==
+- (hva & (PMD_SIZE - PAGE_SIZE))) {
+- level = 1;
+- pfn &= ~((PMD_SIZE >> PAGE_SHIFT) - 1);
+- }
+- }
+-
+ /*
+- * Compute the PTE value that we need to insert.
++ * Read the PTE from the process' radix tree and use that
++ * so we get the shift and attribute bits.
+ */
+- if (page) {
+- pgflags = _PAGE_READ | _PAGE_EXEC | _PAGE_PRESENT | _PAGE_PTE |
+- _PAGE_ACCESSED;
+- if (writing || upgrade_write)
+- pgflags |= _PAGE_WRITE | _PAGE_DIRTY;
+- pte = pfn_pte(pfn, __pgprot(pgflags));
++ local_irq_disable();
++ ptep = __find_linux_pte(vcpu->arch.pgdir, hva, NULL, &shift);
++ pte = *ptep;
++ local_irq_enable();
++
++ /* Get pte level from shift/size */
++ if (shift == PUD_SHIFT &&
++ (gpa & (PUD_SIZE - PAGE_SIZE)) ==
++ (hva & (PUD_SIZE - PAGE_SIZE))) {
++ level = 2;
++ } else if (shift == PMD_SHIFT &&
++ (gpa & (PMD_SIZE - PAGE_SIZE)) ==
++ (hva & (PMD_SIZE - PAGE_SIZE))) {
++ level = 1;
+ } else {
+- /*
+- * Read the PTE from the process' radix tree and use that
+- * so we get the attribute bits.
+- */
+- local_irq_disable();
+- ptep = __find_linux_pte(vcpu->arch.pgdir, hva, NULL, &shift);
+- pte = *ptep;
+- local_irq_enable();
+- if (shift == PUD_SHIFT &&
+- (gpa & (PUD_SIZE - PAGE_SIZE)) ==
+- (hva & (PUD_SIZE - PAGE_SIZE))) {
+- level = 2;
+- } else if (shift == PMD_SHIFT &&
+- (gpa & (PMD_SIZE - PAGE_SIZE)) ==
+- (hva & (PMD_SIZE - PAGE_SIZE))) {
+- level = 1;
+- } else if (shift && shift != PAGE_SHIFT) {
+- /* Adjust PFN */
+- unsigned long mask = (1ul << shift) - PAGE_SIZE;
+- pte = __pte(pte_val(pte) | (hva & mask));
+- }
+- pte = __pte(pte_val(pte) | _PAGE_EXEC | _PAGE_ACCESSED);
+- if (writing || upgrade_write) {
+- if (pte_val(pte) & _PAGE_WRITE)
+- pte = __pte(pte_val(pte) | _PAGE_DIRTY);
+- } else {
+- pte = __pte(pte_val(pte) & ~(_PAGE_WRITE | _PAGE_DIRTY));
++ level = 0;
++ if (shift > PAGE_SHIFT) {
++ /*
++ * If the pte maps more than one page, bring over
++ * bits from the virtual address to get the real
++ * address of the specific single page we want.
++ */
++ unsigned long rpnmask = (1ul << shift) - PAGE_SIZE;
++ pte = __pte(pte_val(pte) | (hva & rpnmask));
+ }
+ }
+
++ pte = __pte(pte_val(pte) | _PAGE_EXEC | _PAGE_ACCESSED);
++ if (writing || upgrade_write) {
++ if (pte_val(pte) & _PAGE_WRITE)
++ pte = __pte(pte_val(pte) | _PAGE_DIRTY);
++ } else {
++ pte = __pte(pte_val(pte) & ~(_PAGE_WRITE | _PAGE_DIRTY));
++ }
++
+ /* Allocate space in the tree and write the PTE */
+ ret = kvmppc_create_pte(kvm, pte, gpa, level, mmu_seq);
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 25 Apr 2018 07:29:22 -0700
+Subject: mfd: omap-usb-host: Fix dts probe of children
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 10492ee8ed9188d6d420e1f79b2b9bdbc0624e65 ]
+
+It currently only works if the parent bus uses "simple-bus". We
+currently try to probe children with non-existing compatible values.
+And we're missing .probe.
+
+I noticed this while testing devices configured to probe using ti-sysc
+interconnect target module driver. For that we also may want to rebind
+the driver, so let's remove __init and __exit.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/omap-usb-host.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/mfd/omap-usb-host.c
++++ b/drivers/mfd/omap-usb-host.c
+@@ -528,8 +528,8 @@ static int usbhs_omap_get_dt_pdata(struc
+ }
+
+ static const struct of_device_id usbhs_child_match_table[] = {
+- { .compatible = "ti,omap-ehci", },
+- { .compatible = "ti,omap-ohci", },
++ { .compatible = "ti,ehci-omap", },
++ { .compatible = "ti,ohci-omap3", },
+ { }
+ };
+
+@@ -855,6 +855,7 @@ static struct platform_driver usbhs_omap
+ .pm = &usbhsomap_dev_pm_ops,
+ .of_match_table = usbhs_omap_dt_ids,
+ },
++ .probe = usbhs_omap_probe,
+ .remove = usbhs_omap_remove,
+ };
+
+@@ -864,9 +865,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NA
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI");
+
+-static int __init omap_usbhs_drvinit(void)
++static int omap_usbhs_drvinit(void)
+ {
+- return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe);
++ return platform_driver_register(&usbhs_omap_driver);
+ }
+
+ /*
+@@ -878,7 +879,7 @@ static int __init omap_usbhs_drvinit(voi
+ */
+ fs_initcall_sync(omap_usbhs_drvinit);
+
+-static void __exit omap_usbhs_drvexit(void)
++static void omap_usbhs_drvexit(void)
+ {
+ platform_driver_unregister(&usbhs_omap_driver);
+ }
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Roman Gushchin <guro@fb.com>
+Date: Thu, 20 Sep 2018 12:22:46 -0700
+Subject: mm: slowly shrink slabs with a relatively small number of objects
+
+From: Roman Gushchin <guro@fb.com>
+
+[ Upstream commit 172b06c32b949759fe6313abec514bc4f15014f4 ]
+
+9092c71bb724 ("mm: use sc->priority for slab shrink targets") changed the
+way that the target slab pressure is calculated and made it
+priority-based:
+
+ delta = freeable >> priority;
+ delta *= 4;
+ do_div(delta, shrinker->seeks);
+
+The problem is that on a default priority (which is 12) no pressure is
+applied at all, if the number of potentially reclaimable objects is less
+than 4096 (1<<12).
+
+This causes the last objects on slab caches of no longer used cgroups to
+(almost) never get reclaimed. It's obviously a waste of memory.
+
+It can be especially painful, if these stale objects are holding a
+reference to a dying cgroup. Slab LRU lists are reparented on memcg
+offlining, but corresponding objects are still holding a reference to the
+dying cgroup. If we don't scan these objects, the dying cgroup can't go
+away. Most likely, the parent cgroup hasn't any directly charged objects,
+only remaining objects from dying children cgroups. So it can easily hold
+a reference to hundreds of dying cgroups.
+
+If there are no big spikes in memory pressure, and new memory cgroups are
+created and destroyed periodically, this causes the number of dying
+cgroups grow steadily, causing a slow-ish and hard-to-detect memory
+"leak". It's not a real leak, as the memory can be eventually reclaimed,
+but it could not happen in a real life at all. I've seen hosts with a
+steadily climbing number of dying cgroups, which doesn't show any signs of
+a decline in months, despite the host is loaded with a production
+workload.
+
+It is an obvious waste of memory, and to prevent it, let's apply a minimal
+pressure even on small shrinker lists. E.g. if there are freeable
+objects, let's scan at least min(freeable, scan_batch) objects.
+
+This fix significantly improves a chance of a dying cgroup to be
+reclaimed, and together with some previous patches stops the steady growth
+of the dying cgroups number on some of our hosts.
+
+Link: http://lkml.kernel.org/r/20180905230759.12236-1-guro@fb.com
+Fixes: 9092c71bb724 ("mm: use sc->priority for slab shrink targets")
+Signed-off-by: Roman Gushchin <guro@fb.com>
+Acked-by: Rik van Riel <riel@surriel.com>
+Cc: Josef Bacik <jbacik@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Shakeel Butt <shakeelb@google.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/vmscan.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -386,6 +386,17 @@ static unsigned long do_shrink_slab(stru
+ delta = freeable >> priority;
+ delta *= 4;
+ do_div(delta, shrinker->seeks);
++
++ /*
++ * Make sure we apply some minimal pressure on default priority
++ * even on small cgroups. Stale objects are not only consuming memory
++ * by themselves, but can also hold a reference to a dying cgroup,
++ * preventing it from being reclaimed. A dying cgroup with all
++ * corresponding structures like per-cpu stats and kmem caches
++ * can be really big, so it may lead to a significant waste of memory.
++ */
++ delta = max_t(unsigned long long, delta, min(freeable, batch_size));
++
+ total_scan += delta;
+ if (total_scan < 0) {
+ pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Fri, 14 Sep 2018 11:20:07 +0000
+Subject: net: ethernet: ti: add missing GENERIC_ALLOCATOR dependency
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit f025571e96caa95ffc3c1792f762a584893de582 ]
+
+This patch mades TI_DAVINCI_CPDMA select GENERIC_ALLOCATOR.
+without that, the following sparc64 build failure happen
+
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_check_free_tx_desc':
+(.text+0x278): undefined reference to `gen_pool_avail'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_chan_submit':
+(.text+0x340): undefined reference to `gen_pool_alloc'
+(.text+0x5c4): undefined reference to `gen_pool_free'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `__cpdma_chan_free':
+davinci_cpdma.c:(.text+0x64c): undefined reference to `gen_pool_free'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_desc_pool_destroy.isra.6':
+davinci_cpdma.c:(.text+0x17ac): undefined reference to `gen_pool_size'
+davinci_cpdma.c:(.text+0x17b8): undefined reference to `gen_pool_avail'
+davinci_cpdma.c:(.text+0x1824): undefined reference to `gen_pool_size'
+davinci_cpdma.c:(.text+0x1830): undefined reference to `gen_pool_avail'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_ctlr_create':
+(.text+0x19f8): undefined reference to `devm_gen_pool_create'
+(.text+0x1a90): undefined reference to `gen_pool_add_virt'
+Makefile:1011: recipe for target 'vmlinux' failed
+
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/ti/Kconfig
++++ b/drivers/net/ethernet/ti/Kconfig
+@@ -41,6 +41,7 @@ config TI_DAVINCI_MDIO
+ config TI_DAVINCI_CPDMA
+ tristate "TI DaVinci CPDMA Support"
+ depends on ARCH_DAVINCI || ARCH_OMAP2PLUS || COMPILE_TEST
++ select GENERIC_ALLOCATOR
+ ---help---
+ This driver supports TI's DaVinci CPDMA dma engine.
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+Date: Fri, 14 Sep 2018 17:48:10 +0200
+Subject: net: macb: disable scatter-gather for macb on sama5d3
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit eb4ed8e2d7fecb5f40db38e4498b9ee23cddf196 ]
+
+Create a new configuration for the sama5d3-macb new compatibility string.
+This configuration disables scatter-gather because we experienced lock down
+of the macb interface of this particular SoC under very high load.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -3765,6 +3765,13 @@ static const struct macb_config at91sam9
+ .init = macb_init,
+ };
+
++static const struct macb_config sama5d3macb_config = {
++ .caps = MACB_CAPS_SG_DISABLED
++ | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII,
++ .clk_init = macb_clk_init,
++ .init = macb_init,
++};
++
+ static const struct macb_config pc302gem_config = {
+ .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
+ .dma_burst_length = 16,
+@@ -3832,6 +3839,7 @@ static const struct of_device_id macb_dt
+ { .compatible = "cdns,gem", .data = &pc302gem_config },
+ { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config },
+ { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config },
++ { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config },
+ { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config },
+ { .compatible = "cdns,at91rm9200-emac", .data = &emac_config },
+ { .compatible = "cdns,emac", .data = &emac_config },
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Fri, 14 Sep 2018 12:54:56 -0700
+Subject: PCI: hv: support reporting serial number as slot information
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit a15f2c08c70811f120d99288d81f70d7f3d104f1 ]
+
+The Hyper-V host API for PCI provides a unique "serial number" which
+can be used as basis for sysfs PCI slot table. This can be useful
+for cases where userspace wants to find the PCI device based on
+serial number.
+
+When an SR-IOV NIC is added, the host sends an attach message
+with serial number. The kernel doesn't use the serial number, but
+it is useful when doing the same thing in a userspace driver such
+as the DPDK. By having /sys/bus/pci/slots/N it provides a direct
+way to find the matching PCI device.
+
+There maybe some cases where serial number is not unique such
+as when using GPU's. But the PCI slot infrastructure will handle
+that.
+
+This has a side effect which may also be useful. The common udev
+network device naming policy uses the slot information (rather
+than PCI address).
+
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pci-hyperv.c | 37 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -89,6 +89,9 @@ static enum pci_protocol_version_t pci_p
+
+ #define STATUS_REVISION_MISMATCH 0xC0000059
+
++/* space for 32bit serial number as string */
++#define SLOT_NAME_SIZE 11
++
+ /*
+ * Message Types
+ */
+@@ -494,6 +497,7 @@ struct hv_pci_dev {
+ struct list_head list_entry;
+ refcount_t refs;
+ enum hv_pcichild_state state;
++ struct pci_slot *pci_slot;
+ struct pci_function_description desc;
+ bool reported_missing;
+ struct hv_pcibus_device *hbus;
+@@ -1457,6 +1461,34 @@ static void prepopulate_bars(struct hv_p
+ spin_unlock_irqrestore(&hbus->device_list_lock, flags);
+ }
+
++/*
++ * Assign entries in sysfs pci slot directory.
++ *
++ * Note that this function does not need to lock the children list
++ * because it is called from pci_devices_present_work which
++ * is serialized with hv_eject_device_work because they are on the
++ * same ordered workqueue. Therefore hbus->children list will not change
++ * even when pci_create_slot sleeps.
++ */
++static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
++{
++ struct hv_pci_dev *hpdev;
++ char name[SLOT_NAME_SIZE];
++ int slot_nr;
++
++ list_for_each_entry(hpdev, &hbus->children, list_entry) {
++ if (hpdev->pci_slot)
++ continue;
++
++ slot_nr = PCI_SLOT(wslot_to_devfn(hpdev->desc.win_slot.slot));
++ snprintf(name, SLOT_NAME_SIZE, "%u", hpdev->desc.ser);
++ hpdev->pci_slot = pci_create_slot(hbus->pci_bus, slot_nr,
++ name, NULL);
++ if (!hpdev->pci_slot)
++ pr_warn("pci_create slot %s failed\n", name);
++ }
++}
++
+ /**
+ * create_root_hv_pci_bus() - Expose a new root PCI bus
+ * @hbus: Root PCI bus, as understood by this driver
+@@ -1480,6 +1512,7 @@ static int create_root_hv_pci_bus(struct
+ pci_lock_rescan_remove();
+ pci_scan_child_bus(hbus->pci_bus);
+ pci_bus_assign_resources(hbus->pci_bus);
++ hv_pci_assign_slots(hbus);
+ pci_bus_add_devices(hbus->pci_bus);
+ pci_unlock_rescan_remove();
+ hbus->state = hv_pcibus_installed;
+@@ -1742,6 +1775,7 @@ static void pci_devices_present_work(str
+ */
+ pci_lock_rescan_remove();
+ pci_scan_child_bus(hbus->pci_bus);
++ hv_pci_assign_slots(hbus);
+ pci_unlock_rescan_remove();
+ break;
+
+@@ -1858,6 +1892,9 @@ static void hv_eject_device_work(struct
+ list_del(&hpdev->list_entry);
+ spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
+
++ if (hpdev->pci_slot)
++ pci_destroy_slot(hpdev->pci_slot);
++
+ memset(&ctxt, 0, sizeof(ctxt));
+ ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
+ ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Simon Detheridge <s@sd.ai>
+Date: Sat, 15 Sep 2018 22:15:18 +0100
+Subject: pinctrl: cannonlake: Fix gpio base for GPP-E
+
+From: Simon Detheridge <s@sd.ai>
+
+[ Upstream commit 8e2aac333785f91ff74e219a1e78e6bdc1ef2c41 ]
+
+The gpio base for GPP-E was set incorrectly to 258 instead of 256,
+preventing the touchpad working on my Tong Fang GK5CN5Z laptop.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=200787
+Signed-off-by: Simon Detheridge <s@sd.ai>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-cannonlake.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cannonlake.c
++++ b/drivers/pinctrl/intel/pinctrl-cannonlake.c
+@@ -382,7 +382,7 @@ static const struct intel_padgroup cnlh_
+ static const struct intel_padgroup cnlh_community3_gpps[] = {
+ CNL_GPP(0, 155, 178, 192), /* GPP_K */
+ CNL_GPP(1, 179, 202, 224), /* GPP_H */
+- CNL_GPP(2, 203, 215, 258), /* GPP_E */
++ CNL_GPP(2, 203, 215, 256), /* GPP_E */
+ CNL_GPP(3, 216, 239, 288), /* GPP_F */
+ CNL_GPP(4, 240, 248, CNL_NO_GPIO), /* SPI */
+ };
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Laura Abbott <labbott@redhat.com>
+Date: Tue, 4 Sep 2018 11:47:40 -0700
+Subject: scsi: iscsi: target: Don't use stack buffer for scatterlist
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit 679fcae46c8b2352bba3485d521da070cfbe68e6 ]
+
+Fedora got a bug report of a crash with iSCSI:
+
+kernel BUG at include/linux/scatterlist.h:143!
+...
+RIP: 0010:iscsit_do_crypto_hash_buf+0x154/0x180 [iscsi_target_mod]
+...
+ Call Trace:
+ ? iscsi_target_tx_thread+0x200/0x200 [iscsi_target_mod]
+ iscsit_get_rx_pdu+0x4cd/0xa90 [iscsi_target_mod]
+ ? native_sched_clock+0x3e/0xa0
+ ? iscsi_target_tx_thread+0x200/0x200 [iscsi_target_mod]
+ iscsi_target_rx_thread+0x81/0xf0 [iscsi_target_mod]
+ kthread+0x120/0x140
+ ? kthread_create_worker_on_cpu+0x70/0x70
+ ret_from_fork+0x3a/0x50
+
+This is a BUG_ON for using a stack buffer with a scatterlist. There
+are two cases that trigger this bug. Switch to using a dynamically
+allocated buffer for one case and do not assign a NULL buffer in
+another case.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Reviewed-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1419,7 +1419,8 @@ static void iscsit_do_crypto_hash_buf(st
+
+ sg_init_table(sg, ARRAY_SIZE(sg));
+ sg_set_buf(sg, buf, payload_length);
+- sg_set_buf(sg + 1, pad_bytes, padding);
++ if (padding)
++ sg_set_buf(sg + 1, pad_bytes, padding);
+
+ ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding);
+
+@@ -3913,10 +3914,14 @@ static bool iscsi_target_check_conn_stat
+ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
+ {
+ int ret;
+- u8 buffer[ISCSI_HDR_LEN], opcode;
++ u8 *buffer, opcode;
+ u32 checksum = 0, digest = 0;
+ struct kvec iov;
+
++ buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL);
++ if (!buffer)
++ return;
++
+ while (!kthread_should_stop()) {
+ /*
+ * Ensure that both TX and RX per connection kthreads
+@@ -3924,7 +3929,6 @@ static void iscsit_get_rx_pdu(struct isc
+ */
+ iscsit_thread_check_cpumask(conn, current, 0);
+
+- memset(buffer, 0, ISCSI_HDR_LEN);
+ memset(&iov, 0, sizeof(struct kvec));
+
+ iov.iov_base = buffer;
+@@ -3933,7 +3937,7 @@ static void iscsit_get_rx_pdu(struct isc
+ ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
+ if (ret != ISCSI_HDR_LEN) {
+ iscsit_rx_thread_wait_for_tcp(conn);
+- return;
++ break;
+ }
+
+ if (conn->conn_ops->HeaderDigest) {
+@@ -3943,7 +3947,7 @@ static void iscsit_get_rx_pdu(struct isc
+ ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
+ if (ret != ISCSI_CRC_LEN) {
+ iscsit_rx_thread_wait_for_tcp(conn);
+- return;
++ break;
+ }
+
+ iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
+@@ -3967,7 +3971,7 @@ static void iscsit_get_rx_pdu(struct isc
+ }
+
+ if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
+- return;
++ break;
+
+ opcode = buffer[0] & ISCSI_OPCODE_MASK;
+
+@@ -3978,13 +3982,15 @@ static void iscsit_get_rx_pdu(struct isc
+ " while in Discovery Session, rejecting.\n", opcode);
+ iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+ buffer);
+- return;
++ break;
+ }
+
+ ret = iscsi_target_rx_opcode(conn, buffer);
+ if (ret < 0)
+- return;
++ break;
+ }
++
++ kfree(buffer);
+ }
+
+ int iscsi_target_rx_thread(void *arg)
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 8 Sep 2018 11:42:27 +0300
+Subject: scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cbe3fd39d223f14b1c60c80fe9347a3dd08c2edb ]
+
+We should first do the le16_to_cpu endian conversion and then apply the
+FCP_CMD_LENGTH_MASK mask.
+
+Fixes: 5f35509db179 ("qla2xxx: Terminate exchange if corrupted")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Quinn Tran <Quinn.Tran@cavium.com>
+Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_target.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_target.h
++++ b/drivers/scsi/qla2xxx/qla_target.h
+@@ -374,8 +374,8 @@ struct atio_from_isp {
+ static inline int fcpcmd_is_corrupted(struct atio *atio)
+ {
+ if (atio->entry_type == ATIO_TYPE7 &&
+- (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) <
+- FCP_CMD_LENGTH_MIN))
++ ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) <
++ FCP_CMD_LENGTH_MIN))
+ return 1;
+ else
+ return 0;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Tue, 4 Sep 2018 12:47:21 +0200
+Subject: selftests: add headers_install to lib.mk
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit b2d35fa5fc80c27e868e393dcab4c94a0d71737f ]
+
+If the kernel headers aren't installed we can't build all the tests.
+Add a new make target rule 'khdr' in the file lib.mk to generate the
+kernel headers and that gets include for every test-dir Makefile that
+includes lib.mk If the testdir in turn have its own sub-dirs the
+top_srcdir needs to be set to the linux-rootdir to be able to generate
+the kernel headers.
+
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Reviewed-by: Fathi Boudra <fathi.boudra@linaro.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 14 +-------------
+ scripts/subarch.include | 13 +++++++++++++
+ tools/testing/selftests/android/Makefile | 2 +-
+ tools/testing/selftests/android/ion/Makefile | 2 ++
+ tools/testing/selftests/futex/functional/Makefile | 1 +
+ tools/testing/selftests/gpio/Makefile | 7 ++-----
+ tools/testing/selftests/kvm/Makefile | 7 ++-----
+ tools/testing/selftests/lib.mk | 12 ++++++++++++
+ tools/testing/selftests/net/Makefile | 1 +
+ tools/testing/selftests/networking/timestamping/Makefile | 1 +
+ tools/testing/selftests/vm/Makefile | 4 ----
+ 11 files changed, 36 insertions(+), 28 deletions(-)
+ create mode 100644 scripts/subarch.include
+
+--- a/Makefile
++++ b/Makefile
+@@ -298,19 +298,7 @@ KERNELRELEASE = $(shell cat include/conf
+ KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION)
+ export VERSION PATCHLEVEL SUBLEVEL KERNELRELEASE KERNELVERSION
+
+-# SUBARCH tells the usermode build what the underlying arch is. That is set
+-# first, and if a usermode build is happening, the "ARCH=um" on the command
+-# line overrides the setting of ARCH below. If a native build is happening,
+-# then ARCH is assigned, getting whatever value it gets normally, and
+-# SUBARCH is subsequently ignored.
+-
+-SUBARCH := $(shell uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ \
+- -e s/sun4u/sparc64/ \
+- -e s/arm.*/arm/ -e s/sa110/arm/ \
+- -e s/s390x/s390/ -e s/parisc64/parisc/ \
+- -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
+- -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ \
+- -e s/riscv.*/riscv/)
++include scripts/subarch.include
+
+ # Cross compiling and selecting different set of gcc/bin-utils
+ # ---------------------------------------------------------------------------
+--- /dev/null
++++ b/scripts/subarch.include
+@@ -0,0 +1,13 @@
++# SUBARCH tells the usermode build what the underlying arch is. That is set
++# first, and if a usermode build is happening, the "ARCH=um" on the command
++# line overrides the setting of ARCH below. If a native build is happening,
++# then ARCH is assigned, getting whatever value it gets normally, and
++# SUBARCH is subsequently ignored.
++
++SUBARCH := $(shell uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ \
++ -e s/sun4u/sparc64/ \
++ -e s/arm.*/arm/ -e s/sa110/arm/ \
++ -e s/s390x/s390/ -e s/parisc64/parisc/ \
++ -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
++ -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ \
++ -e s/riscv.*/riscv/)
+--- a/tools/testing/selftests/android/Makefile
++++ b/tools/testing/selftests/android/Makefile
+@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
+
+ include ../lib.mk
+
+-all:
++all: khdr
+ @for DIR in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$DIR; \
+ mkdir $$BUILD_TARGET -p; \
+--- a/tools/testing/selftests/android/ion/Makefile
++++ b/tools/testing/selftests/android/ion/Makefile
+@@ -10,6 +10,8 @@ $(TEST_GEN_FILES): ipcsocket.c ionutils.
+
+ TEST_PROGS := ion_test.sh
+
++KSFT_KHDR_INSTALL := 1
++top_srcdir = ../../../../..
+ include ../../lib.mk
+
+ $(OUTPUT)/ionapp_export: ionapp_export.c ipcsocket.c ionutils.c
+--- a/tools/testing/selftests/futex/functional/Makefile
++++ b/tools/testing/selftests/futex/functional/Makefile
+@@ -18,6 +18,7 @@ TEST_GEN_FILES := \
+
+ TEST_PROGS := run.sh
+
++top_srcdir = ../../../../..
+ include ../../lib.mk
+
+ $(TEST_GEN_FILES): $(HEADERS)
+--- a/tools/testing/selftests/gpio/Makefile
++++ b/tools/testing/selftests/gpio/Makefile
+@@ -21,11 +21,8 @@ endef
+ CFLAGS += -O2 -g -std=gnu99 -Wall -I../../../../usr/include/
+ LDLIBS += -lmount -I/usr/include/libmount
+
+-$(BINARIES): ../../../gpio/gpio-utils.o ../../../../usr/include/linux/gpio.h
++$(BINARIES):| khdr
++$(BINARIES): ../../../gpio/gpio-utils.o
+
+ ../../../gpio/gpio-utils.o:
+ make ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) -C ../../../gpio
+-
+-../../../../usr/include/linux/gpio.h:
+- make -C ../../../.. headers_install INSTALL_HDR_PATH=$(shell pwd)/../../../../usr/
+-
+--- a/tools/testing/selftests/kvm/Makefile
++++ b/tools/testing/selftests/kvm/Makefile
+@@ -32,9 +32,6 @@ $(LIBKVM_OBJ): $(OUTPUT)/%.o: %.c
+ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
+ $(AR) crs $@ $^
+
+-$(LINUX_HDR_PATH):
+- make -C $(top_srcdir) headers_install
+-
+-all: $(STATIC_LIBS) $(LINUX_HDR_PATH)
++all: $(STATIC_LIBS)
+ $(TEST_GEN_PROGS): $(STATIC_LIBS)
+-$(TEST_GEN_PROGS) $(LIBKVM_OBJ): | $(LINUX_HDR_PATH)
++$(STATIC_LIBS):| khdr
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -16,8 +16,20 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)
+ TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
+ TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+
++top_srcdir ?= ../../../..
++include $(top_srcdir)/scripts/subarch.include
++ARCH ?= $(SUBARCH)
++
+ all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+
++.PHONY: khdr
++khdr:
++ make ARCH=$(ARCH) -C $(top_srcdir) headers_install
++
++ifdef KSFT_KHDR_INSTALL
++$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
++endif
++
+ .ONESHELL:
+ define RUN_TEST_PRINT_RESULT
+ TEST_HDR_MSG="selftests: "`basename $$PWD`:" $$BASENAME_TEST"; \
+--- a/tools/testing/selftests/net/Makefile
++++ b/tools/testing/selftests/net/Makefile
+@@ -15,6 +15,7 @@ TEST_GEN_FILES += udpgso udpgso_bench_tx
+ TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
+ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict
+
++KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
+ $(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+--- a/tools/testing/selftests/networking/timestamping/Makefile
++++ b/tools/testing/selftests/networking/timestamping/Makefile
+@@ -5,6 +5,7 @@ TEST_PROGS := hwtstamp_config rxtimestam
+
+ all: $(TEST_PROGS)
+
++top_srcdir = ../../../../..
+ include ../../lib.mk
+
+ clean:
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -25,10 +25,6 @@ TEST_PROGS := run_vmtests
+
+ include ../lib.mk
+
+-$(OUTPUT)/userfaultfd: ../../../../usr/include/linux/kernel.h
+ $(OUTPUT)/userfaultfd: LDLIBS += -lpthread
+
+ $(OUTPUT)/mlock-random-test: LDLIBS += -lcap
+-
+-../../../../usr/include/linux/kernel.h:
+- make -C ../../../.. headers_install
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Fri, 24 Aug 2018 14:49:41 +0200
+Subject: selftests: android: move config up a level
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 88bc243a3f22b9938c0b53c577dee28025cdb920 ]
+
+'make kselftest-merge' assumes that the config files for the tests are
+located under the 'main' test dir, like tools/testing/selftests/android/
+and not in a subdir to android.
+
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/android/{ion => }/config | 0
+ tools/testing/selftests/android/config | 5 +++++
+ tools/testing/selftests/android/ion/config | 5 -----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+ rename tools/testing/selftests/android/{ion => }/config (100%)
+
+--- /dev/null
++++ b/tools/testing/selftests/android/config
+@@ -0,0 +1,5 @@
++CONFIG_ANDROID=y
++CONFIG_STAGING=y
++CONFIG_ION=y
++CONFIG_ION_SYSTEM_HEAP=y
++CONFIG_DRM_VGEM=y
+--- a/tools/testing/selftests/android/ion/config
++++ /dev/null
+@@ -1,5 +0,0 @@
+-CONFIG_ANDROID=y
+-CONFIG_STAGING=y
+-CONFIG_ION=y
+-CONFIG_ION_SYSTEM_HEAP=y
+-CONFIG_DRM_VGEM=y
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Lei Yang <Lei.Yang@windriver.com>
+Date: Wed, 5 Sep 2018 11:14:49 +0800
+Subject: selftests/efivarfs: add required kernel configs
+
+From: Lei Yang <Lei.Yang@windriver.com>
+
+[ Upstream commit 53cf59d6c0ad3edc4f4449098706a8f8986258b6 ]
+
+add config file
+
+Signed-off-by: Lei Yang <Lei.Yang@windriver.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/efivarfs/config | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 tools/testing/selftests/efivarfs/config
+
+--- /dev/null
++++ b/tools/testing/selftests/efivarfs/config
+@@ -0,0 +1 @@
++CONFIG_EFIVAR_FS=y
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Date: Tue, 24 Jul 2018 23:57:25 -0300
+Subject: selftests: kselftest: Remove outdated comment
+
+From: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+
+[ Upstream commit c31d02d1290e1e82a08015199e408228e152991f ]
+
+Commit 3c07aaef6598 ("selftests: kselftest: change KSFT_SKIP=4 instead of
+KSFT_PASS") reverted commit 11867a77eb85 ("selftests: kselftest framework:
+change skip exit code to 0") but missed removing the comment which that
+commit added, so do that now.
+
+Signed-off-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/kselftest.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/tools/testing/selftests/kselftest.h
++++ b/tools/testing/selftests/kselftest.h
+@@ -19,7 +19,6 @@
+ #define KSFT_FAIL 1
+ #define KSFT_XFAIL 2
+ #define KSFT_XPASS 3
+-/* Treat skip as pass */
+ #define KSFT_SKIP 4
+
+ /* counters */
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Lei Yang <Lei.Yang@windriver.com>
+Date: Wed, 5 Sep 2018 17:57:15 +0800
+Subject: selftests: memory-hotplug: add required configs
+
+From: Lei Yang <Lei.Yang@windriver.com>
+
+[ Upstream commit 4d85af102a66ee6aeefa596f273169e77fb2b48e ]
+
+add CONFIG_MEMORY_HOTREMOVE=y in config
+without this config, /sys/devices/system/memory/memory*/removable
+always return 0, I endup getting an early skip during test
+
+Signed-off-by: Lei Yang <Lei.Yang@windriver.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/memory-hotplug/config | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/testing/selftests/memory-hotplug/config
++++ b/tools/testing/selftests/memory-hotplug/config
+@@ -2,3 +2,4 @@ CONFIG_MEMORY_HOTPLUG=y
+ CONFIG_MEMORY_HOTPLUG_SPARSE=y
+ CONFIG_NOTIFIER_ERROR_INJECTION=y
+ CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m
++CONFIG_MEMORY_HOTREMOVE=y
r8169-fix-network-stalls-due-to-missing-bit-txcfg_auto_fifo.patch
r8169-set-rx_multi_en-bit-in-rxconfig-for-8168f-family-chips.patch
vxlan-fill-ttl-inherit-info.patch
+asoc-dapm-fix-null-pointer-deference-on-codec-to-codec-dais.patch
+asoc-max98373-added-speaker-fs-gain-cotnrol-register-to-volatile.patch
+asoc-rt5514-fix-the-issue-of-the-delay-volume-applied-again.patch
+selftests-android-move-config-up-a-level.patch
+selftests-kselftest-remove-outdated-comment.patch
+asoc-max98373-added-10ms-sleep-after-amp-software-reset.patch
+asoc-wm8804-add-acpi-support.patch
+asoc-sigmadsp-safeload-should-not-have-lower-byte-limit.patch
+asoc-q6routing-initialize-data-correctly.patch
+selftests-add-headers_install-to-lib.mk.patch
+selftests-efivarfs-add-required-kernel-configs.patch
+selftests-memory-hotplug-add-required-configs.patch
+asoc-rsnd-adg-care-clock-frequency-size.patch
+asoc-rsnd-don-t-fallback-to-pio-mode-when-eprobe_defer.patch
+hwmon-nct6775-fix-access-to-fan-pulse-registers.patch
+fix-cg_read_strcmp.patch
+add-tests-for-memory.oom.group.patch
+asoc-amd-ensure-reset-bit-is-cleared-before-configuring.patch
+drm-pl111-make-sure-of_device_id-tables-are-null-terminated.patch
+bluetooth-smp-fix-trying-to-use-non-existent-local-oob-data.patch
+bluetooth-use-correct-tfm-to-generate-oob-data.patch
+bluetooth-hci_ldisc-free-rw_semaphore-on-close.patch
+mfd-omap-usb-host-fix-dts-probe-of-children.patch
+kvm-ppc-book3s-hv-don-t-use-compound_order-to-determine-host-mapping-size.patch
+scsi-iscsi-target-don-t-use-stack-buffer-for-scatterlist.patch
+scsi-qla2xxx-fix-an-endian-bug-in-fcpcmd_is_corrupted.patch
+sound-enable-interrupt-after-dma-buffer-initialization.patch
+sound-don-t-call-skl_init_chip-to-reset-intel-skl-soc.patch
+bpf-btf-fix-end-boundary-calculation-for-type-section.patch
+bpf-use-__gfp_comp-while-allocating-page.patch
+hwmon-nct6775-fix-virtual-temperature-sources-for-nct6796d.patch
+hwmon-nct6775-fix-rpm-output-for-fan7-on-nct6796d.patch
+stmmac-fix-valid-numbers-of-unicast-filter-entries.patch
+hwmon-nct6775-use-different-register-to-get-fan-rpm-for-fan7.patch
+net-ethernet-ti-add-missing-generic_allocator-dependency.patch
+net-macb-disable-scatter-gather-for-macb-on-sama5d3.patch
+arm-dts-at91-add-new-compatibility-string-for-macb-on-sama5d3.patch
+pci-hv-support-reporting-serial-number-as-slot-information.patch
+hv_netvsc-pair-vf-based-on-serial-number.patch
+clk-x86-add-ether_clk-alias-for-bay-trail-cherry-trail.patch
+clk-x86-stop-marking-clocks-as-clk_is_critical.patch
+pinctrl-cannonlake-fix-gpio-base-for-gpp-e.patch
+x86-kvm-lapic-always-disable-mmio-interface-in-x2apic-mode.patch
+drm-amdgpu-fix-sdma-hqd-destroy-error-on-gfx_v7.patch
+drm-amdkfd-change-the-control-stack-mtype-from-uc-to-nc-on-gfx9.patch
+drm-amdkfd-fix-ats-capablity-was-not-reported-correctly-on-some-apus.patch
+mm-slowly-shrink-slabs-with-a-relatively-small-number-of-objects.patch
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Yu Zhao <yuzhao@google.com>
+Date: Tue, 11 Sep 2018 15:15:16 -0600
+Subject: sound: don't call skl_init_chip() to reset intel skl soc
+
+From: Yu Zhao <yuzhao@google.com>
+
+[ Upstream commit 75383f8d39d4c0fb96083dd460b7b139fbdac492 ]
+
+Internally, skl_init_chip() calls snd_hdac_bus_init_chip() which
+1) sets bus->chip_init to prevent multiple entrances before device
+is stopped; 2) enables interrupt.
+
+We shouldn't use it for the purpose of resetting device only because
+1) when we really want to initialize device, we won't be able to do
+so; 2) we are ready to handle interrupt yet, and kernel crashes when
+interrupt comes in.
+
+Rename azx_reset() to snd_hdac_bus_reset_link(), and use it to reset
+device properly.
+
+Fixes: 60767abcea3d ("ASoC: Intel: Skylake: Reset the controller in probe")
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/hdaudio.h | 1 +
+ sound/hda/hdac_controller.c | 7 ++++---
+ sound/soc/intel/skylake/skl.c | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/include/sound/hdaudio.h
++++ b/include/sound/hdaudio.h
+@@ -355,6 +355,7 @@ void snd_hdac_bus_init_cmd_io(struct hda
+ void snd_hdac_bus_stop_cmd_io(struct hdac_bus *bus);
+ void snd_hdac_bus_enter_link_reset(struct hdac_bus *bus);
+ void snd_hdac_bus_exit_link_reset(struct hdac_bus *bus);
++int snd_hdac_bus_reset_link(struct hdac_bus *bus, bool full_reset);
+
+ void snd_hdac_bus_update_rirb(struct hdac_bus *bus);
+ int snd_hdac_bus_handle_stream_irq(struct hdac_bus *bus, unsigned int status,
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -385,7 +385,7 @@ void snd_hdac_bus_exit_link_reset(struct
+ EXPORT_SYMBOL_GPL(snd_hdac_bus_exit_link_reset);
+
+ /* reset codec link */
+-static int azx_reset(struct hdac_bus *bus, bool full_reset)
++int snd_hdac_bus_reset_link(struct hdac_bus *bus, bool full_reset)
+ {
+ if (!full_reset)
+ goto skip_reset;
+@@ -410,7 +410,7 @@ static int azx_reset(struct hdac_bus *bu
+ skip_reset:
+ /* check to see if controller is ready */
+ if (!snd_hdac_chip_readb(bus, GCTL)) {
+- dev_dbg(bus->dev, "azx_reset: controller not ready!\n");
++ dev_dbg(bus->dev, "controller not ready!\n");
+ return -EBUSY;
+ }
+
+@@ -425,6 +425,7 @@ static int azx_reset(struct hdac_bus *bu
+
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(snd_hdac_bus_reset_link);
+
+ /* enable interrupts */
+ static void azx_int_enable(struct hdac_bus *bus)
+@@ -479,7 +480,7 @@ bool snd_hdac_bus_init_chip(struct hdac_
+ return false;
+
+ /* reset controller */
+- azx_reset(bus, full_reset);
++ snd_hdac_bus_reset_link(bus, full_reset);
+
+ /* clear interrupts */
+ azx_int_clear(bus);
+--- a/sound/soc/intel/skylake/skl.c
++++ b/sound/soc/intel/skylake/skl.c
+@@ -844,7 +844,7 @@ static int skl_first_init(struct hdac_ex
+ return -ENXIO;
+ }
+
+- skl_init_chip(bus, true);
++ snd_hdac_bus_reset_link(bus, true);
+
+ snd_hdac_bus_parse_capabilities(bus);
+
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Yu Zhao <yuzhao@google.com>
+Date: Tue, 11 Sep 2018 15:14:04 -0600
+Subject: sound: enable interrupt after dma buffer initialization
+
+From: Yu Zhao <yuzhao@google.com>
+
+[ Upstream commit b61749a89f826eb61fc59794d9e4697bd246eb61 ]
+
+In snd_hdac_bus_init_chip(), we enable interrupt before
+snd_hdac_bus_init_cmd_io() initializing dma buffers. If irq has
+been acquired and irq handler uses the dma buffer, kernel may crash
+when interrupt comes in.
+
+Fix the problem by postponing enabling irq after dma buffer
+initialization. And warn once on null dma buffer pointer during the
+initialization.
+
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/hdac_controller.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac
+ */
+ void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus)
+ {
++ WARN_ON_ONCE(!bus->rb.area);
++
+ spin_lock_irq(&bus->reg_lock);
+ /* CORB set up */
+ bus->corb.addr = bus->rb.addr;
+@@ -479,13 +481,15 @@ bool snd_hdac_bus_init_chip(struct hdac_
+ /* reset controller */
+ azx_reset(bus, full_reset);
+
+- /* initialize interrupts */
++ /* clear interrupts */
+ azx_int_clear(bus);
+- azx_int_enable(bus);
+
+ /* initialize the codec command I/O */
+ snd_hdac_bus_init_cmd_io(bus);
+
++ /* enable interrupts after CORB/RIRB buffers are initialized above */
++ azx_int_enable(bus);
++
+ /* program the position buffer */
+ if (bus->use_posbuf && bus->posbuf.addr) {
+ snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr);
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Jongsung Kim <neidhard.kim@lge.com>
+Date: Thu, 13 Sep 2018 18:32:21 +0900
+Subject: stmmac: fix valid numbers of unicast filter entries
+
+From: Jongsung Kim <neidhard.kim@lge.com>
+
+[ Upstream commit edf2ef7242805e53ec2e0841db26e06d8bc7da70 ]
+
+Synopsys DWC Ethernet MAC can be configured to have 1..32, 64, or
+128 unicast filter entries. (Table 7-8 MAC Address Registers from
+databook) Fix dwmac1000_validate_ucast_entries() to accept values
+between 1 and 32 in addition.
+
+Signed-off-by: Jongsung Kim <neidhard.kim@lge.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -67,7 +67,7 @@ static int dwmac1000_validate_mcast_bins
+ * Description:
+ * This function validates the number of Unicast address entries supported
+ * by a particular Synopsys 10/100/1000 controller. The Synopsys controller
+- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter
++ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter
+ * logic. This function validates a valid, supported configuration is
+ * selected, and defaults to 1 Unicast address if an unsupported
+ * configuration is selected.
+@@ -77,8 +77,7 @@ static int dwmac1000_validate_ucast_entr
+ int x = ucast_entries;
+
+ switch (x) {
+- case 1:
+- case 32:
++ case 1 ... 32:
+ case 64:
+ case 128:
+ break;
--- /dev/null
+From foo@baz Tue Oct 16 11:10:21 CEST 2018
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Thu, 2 Aug 2018 17:08:16 +0200
+Subject: x86/kvm/lapic: always disable MMIO interface in x2APIC mode
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit d1766202779e81d0f2a94c4650a6ba31497d369d ]
+
+When VMX is used with flexpriority disabled (because of no support or
+if disabled with module parameter) MMIO interface to lAPIC is still
+available in x2APIC mode while it shouldn't be (kvm-unit-tests):
+
+PASS: apic_disable: Local apic enabled in x2APIC mode
+PASS: apic_disable: CPUID.1H:EDX.APIC[bit 9] is set
+FAIL: apic_disable: *0xfee00030: 50014
+
+The issue appears because we basically do nothing while switching to
+x2APIC mode when APIC access page is not used. apic_mmio_{read,write}
+only check if lAPIC is disabled before proceeding to actual write.
+
+When APIC access is virtualized we correctly manipulate with VMX controls
+in vmx_set_virtual_apic_mode() and we don't get vmexits from memory writes
+in x2APIC mode so there's no issue.
+
+Disabling MMIO interface seems to be easy. The question is: what do we
+do with these reads and writes? If we add apic_x2apic_mode() check to
+apic_mmio_in_range() and return -EOPNOTSUPP these reads and writes will
+go to userspace. When lAPIC is in kernel, Qemu uses this interface to
+inject MSIs only (see kvm_apic_mem_write() in hw/i386/kvm/apic.c). This
+somehow works with disabled lAPIC but when we're in xAPIC mode we will
+get a real injected MSI from every write to lAPIC. Not good.
+
+The simplest solution seems to be to just ignore writes to the region
+and return ~0 for all reads when we're in x2APIC mode. This is what this
+patch does. However, this approach is inconsistent with what currently
+happens when flexpriority is enabled: we allocate APIC access page and
+create KVM memory region so in x2APIC modes all reads and writes go to
+this pre-allocated page which is, btw, the same for all vCPUs.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/uapi/asm/kvm.h | 1 +
+ arch/x86/kvm/lapic.c | 22 +++++++++++++++++++---
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/include/uapi/asm/kvm.h
++++ b/arch/x86/include/uapi/asm/kvm.h
+@@ -377,5 +377,6 @@ struct kvm_sync_regs {
+
+ #define KVM_X86_QUIRK_LINT0_REENABLED (1 << 0)
+ #define KVM_X86_QUIRK_CD_NW_CLEARED (1 << 1)
++#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE (1 << 2)
+
+ #endif /* _ASM_X86_KVM_H */
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1291,9 +1291,8 @@ EXPORT_SYMBOL_GPL(kvm_lapic_reg_read);
+
+ static int apic_mmio_in_range(struct kvm_lapic *apic, gpa_t addr)
+ {
+- return kvm_apic_hw_enabled(apic) &&
+- addr >= apic->base_address &&
+- addr < apic->base_address + LAPIC_MMIO_LENGTH;
++ return addr >= apic->base_address &&
++ addr < apic->base_address + LAPIC_MMIO_LENGTH;
+ }
+
+ static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
+@@ -1305,6 +1304,15 @@ static int apic_mmio_read(struct kvm_vcp
+ if (!apic_mmio_in_range(apic, address))
+ return -EOPNOTSUPP;
+
++ if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) {
++ if (!kvm_check_has_quirk(vcpu->kvm,
++ KVM_X86_QUIRK_LAPIC_MMIO_HOLE))
++ return -EOPNOTSUPP;
++
++ memset(data, 0xff, len);
++ return 0;
++ }
++
+ kvm_lapic_reg_read(apic, offset, len, data);
+
+ return 0;
+@@ -1864,6 +1872,14 @@ static int apic_mmio_write(struct kvm_vc
+ if (!apic_mmio_in_range(apic, address))
+ return -EOPNOTSUPP;
+
++ if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) {
++ if (!kvm_check_has_quirk(vcpu->kvm,
++ KVM_X86_QUIRK_LAPIC_MMIO_HOLE))
++ return -EOPNOTSUPP;
++
++ return 0;
++ }
++
+ /*
+ * APIC register must be aligned on 128-bits boundary.
+ * 32/64/128 bits registers must be accessed thru 32 bits.
projects / thirdparty / kernel / stable-queue.git / commitdiff
