--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Mon, 2 Oct 2017 08:39:35 +0200
+Subject: ARM: exynos_defconfig: Enable UAS support for Odroid HC1 board
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+
+[ Upstream commit a99897f550de96841aecb811455a67ad7a4e39a7 ]
+
+Odroid HC1 board has built-in JMicron USB to SATA bridge, which supports
+UAS protocol. Compile-in support for it (instead of enabling it as module)
+to make sure that all built-in storage devices are available for rootfs.
+The bridge itself also supports fallback to standard USB Mass Storage
+protocol, but USB Mass Storage class doesn't bind to it when UAS is
+compiled as module and modules are not (yet) available.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/exynos_defconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/configs/exynos_defconfig
++++ b/arch/arm/configs/exynos_defconfig
+@@ -244,7 +244,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m
+ CONFIG_USB_STORAGE_KARMA=m
+ CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+ CONFIG_USB_STORAGE_ENE_UB6250=m
+-CONFIG_USB_UAS=m
++CONFIG_USB_UAS=y
+ CONFIG_USB_DWC3=y
+ CONFIG_USB_DWC2=y
+ CONFIG_USB_HSIC_USB3503=y
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Jean-François Têtu <jean-francois.tetu@savoirfairelinux.com>
+Date: Fri, 29 Sep 2017 16:19:44 -0400
+Subject: ASoC: codecs: msm8916-wcd-analog: fix micbias level
+
+From: Jean-François Têtu <jean-francois.tetu@savoirfairelinux.com>
+
+
+[ Upstream commit 664611e7e02f76fbc5470ef545b2657ed25c292b ]
+
+The macro used to set the microphone bias level causes the
+snd_soc_write() call to overwrite other fields in the CDC_A_MICB_1_VAL
+register. The macro also does not return the proper level value
+to use. This fixes this by preserving all bits from the register
+that are not the level while setting the level.
+
+Signed-off-by: Jean-François Têtu <jean-francois.tetu@savoirfairelinux.com>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -104,7 +104,7 @@
+ #define CDC_A_MICB_1_VAL (0xf141)
+ #define MICB_MIN_VAL 1600
+ #define MICB_STEP_SIZE 50
+-#define MICB_VOLTAGE_REGVAL(v) ((v - MICB_MIN_VAL)/MICB_STEP_SIZE)
++#define MICB_VOLTAGE_REGVAL(v) (((v - MICB_MIN_VAL)/MICB_STEP_SIZE) << 3)
+ #define MICB_1_VAL_MICB_OUT_VAL_MASK GENMASK(7, 3)
+ #define MICB_1_VAL_MICB_OUT_VAL_V2P70V ((0x16) << 3)
+ #define MICB_1_VAL_MICB_OUT_VAL_V1P80V ((0x4) << 3)
+@@ -349,8 +349,9 @@ static void pm8916_wcd_analog_micbias_en
+ | MICB_1_CTL_EXT_PRECHARG_EN_ENABLE);
+
+ if (wcd->micbias_mv) {
+- snd_soc_write(codec, CDC_A_MICB_1_VAL,
+- MICB_VOLTAGE_REGVAL(wcd->micbias_mv));
++ snd_soc_update_bits(codec, CDC_A_MICB_1_VAL,
++ MICB_1_VAL_MICB_OUT_VAL_MASK,
++ MICB_VOLTAGE_REGVAL(wcd->micbias_mv));
+ /*
+ * Special headset needs MICBIAS as 2.7V so wait for
+ * 50 msec for the MICBIAS to reach 2.7 volts.
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Nicolas Dechesne <nicolas.dechesne@linaro.org>
+Date: Tue, 3 Oct 2017 11:49:51 +0200
+Subject: ASoC: codecs: msm8916-wcd-analog: fix module autoload
+
+From: Nicolas Dechesne <nicolas.dechesne@linaro.org>
+
+
+[ Upstream commit 46d69e141d479585c105a4d5b2337cd2ce6967e5 ]
+
+If the driver is built as a module, autoload won't work because the module
+alias information is not filled. So user-space can't match the registered
+device with the corresponding module.
+
+Export the module alias information using the MODULE_DEVICE_TABLE() macro.
+
+Before this patch:
+
+$ modinfo snd_soc_msm8916_analog | grep alias
+$
+
+After this patch:
+
+$ modinfo snd_soc_msm8916_analog | grep alias
+alias: of:N*T*Cqcom,pm8916-wcd-analog-codecC*
+alias: of:N*T*Cqcom,pm8916-wcd-analog-codec
+
+Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -1242,6 +1242,8 @@ static const struct of_device_id pm8916_
+ { }
+ };
+
++MODULE_DEVICE_TABLE(of, pm8916_wcd_analog_spmi_match_table);
++
+ static struct platform_driver pm8916_wcd_analog_spmi_driver = {
+ .driver = {
+ .name = "qcom,pm8916-wcd-spmi-codec",
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Ed Blake <ed.blake@sondrel.com>
+Date: Mon, 2 Oct 2017 11:00:33 +0100
+Subject: ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
+
+From: Ed Blake <ed.blake@sondrel.com>
+
+
+[ Upstream commit c70458890ff15d858bd347fa9f563818bcd6e457 ]
+
+Add pm_runtime_get_sync and pm_runtime_put calls to set_fmt callback
+function. This fixes a bus error during boot when CONFIG_SUSPEND is
+defined when this function gets called while the device is runtime
+disabled and device registers are accessed while the clock is disabled.
+
+Signed-off-by: Ed Blake <ed.blake@sondrel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/img/img-parallel-out.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/img/img-parallel-out.c
++++ b/sound/soc/img/img-parallel-out.c
+@@ -164,9 +164,11 @@ static int img_prl_out_set_fmt(struct sn
+ return -EINVAL;
+ }
+
++ pm_runtime_get_sync(prl->dev);
+ reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
+ reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
+ img_prl_out_writel(prl, reg, IMG_PRL_OUT_CTL);
++ pm_runtime_put(prl->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Derek Basehore <dbasehore@chromium.org>
+Date: Tue, 29 Aug 2017 13:34:34 -0700
+Subject: backlight: pwm_bl: Fix overflow condition
+
+From: Derek Basehore <dbasehore@chromium.org>
+
+
+[ Upstream commit 5d0c49acebc9488e37db95f1d4a55644e545ffe7 ]
+
+This fixes an overflow condition that can happen with high max
+brightness and period values in compute_duty_cycle. This fixes it by
+using a 64 bit variable for computing the duty cycle.
+
+Signed-off-by: Derek Basehore <dbasehore@chromium.org>
+Acked-by: Thierry Reding <thierry.reding@gmail.com>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/backlight/pwm_bl.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -79,14 +79,17 @@ static void pwm_backlight_power_off(stru
+ static int compute_duty_cycle(struct pwm_bl_data *pb, int brightness)
+ {
+ unsigned int lth = pb->lth_brightness;
+- int duty_cycle;
++ u64 duty_cycle;
+
+ if (pb->levels)
+ duty_cycle = pb->levels[brightness];
+ else
+ duty_cycle = brightness;
+
+- return (duty_cycle * (pb->period - lth) / pb->scale) + lth;
++ duty_cycle *= pb->period - lth;
++ do_div(duty_cycle, pb->scale);
++
++ return duty_cycle + lth;
+ }
+
+ static int pwm_backlight_update_status(struct backlight_device *bl)
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Luca Miccio <lucmiccio@gmail.com>
+Date: Mon, 9 Oct 2017 16:27:21 +0200
+Subject: block,bfq: Disable writeback throttling
+
+From: Luca Miccio <lucmiccio@gmail.com>
+
+
+[ Upstream commit b5dc5d4d1f4ff9032eb6c21a3c571a1317dc9289 ]
+
+Similarly to CFQ, BFQ has its write-throttling heuristics, and it
+is better not to combine them with further write-throttling
+heuristics of a different nature.
+So this commit disables write-back throttling for a device if BFQ
+is used as I/O scheduler for that device.
+
+Signed-off-by: Luca Miccio <lucmiccio@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Tested-by: Lee Tibbert <lee.tibbert@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bfq-iosched.c | 3 ++-
+ block/blk-wbt.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -108,6 +108,7 @@
+ #include "blk-mq-tag.h"
+ #include "blk-mq-sched.h"
+ #include "bfq-iosched.h"
++#include "blk-wbt.h"
+
+ #define BFQ_BFQQ_FNS(name) \
+ void bfq_mark_bfqq_##name(struct bfq_queue *bfqq) \
+@@ -4775,7 +4776,7 @@ static int bfq_init_queue(struct request
+ bfq_init_root_group(bfqd->root_group, bfqd);
+ bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
+
+-
++ wbt_disable_default(q);
+ return 0;
+
+ out_free:
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -654,7 +654,7 @@ void wbt_set_write_cache(struct rq_wb *r
+ }
+
+ /*
+- * Disable wbt, if enabled by default. Only called from CFQ.
++ * Disable wbt, if enabled by default.
+ */
+ void wbt_disable_default(struct request_queue *q)
+ {
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 4 Oct 2017 20:43:36 +0200
+Subject: Bluetooth: hci_bcm: Fix setting of irq trigger type
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+
+[ Upstream commit 227630cccdbb8f8a1b24ac26517b75079c9a69c9 ]
+
+This commit fixes 2 issues with host-wake irq trigger type handling
+in hci_bcm:
+
+1) bcm_setup_sleep sets sleep_params.host_wake_active based on
+bcm_device.irq_polarity, but bcm_request_irq was always requesting
+IRQF_TRIGGER_RISING as trigger type independent of irq_polarity.
+
+This was a problem when the irq is described as a GpioInt rather then
+an Interrupt in the DSDT as for GpioInt-s the value passed to request_irq
+is honored. This commit fixes this by requesting the correct trigger
+type depending on bcm_device.irq_polarity.
+
+2) bcm_device.irq_polarity was used to directly store an ACPI polarity
+value (ACPI_ACTIVE_*). This is undesirable because hci_bcm is also
+used with device-tree and checking for something like ACPI_ACTIVE_LOW
+in a non ACPI specific function like bcm_request_irq feels wrong.
+
+This commit fixes this by renaming irq_polarity to irq_active_low
+and changing its type to a bool.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/hci_bcm.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -68,7 +68,7 @@ struct bcm_device {
+ u32 init_speed;
+ u32 oper_speed;
+ int irq;
+- u8 irq_polarity;
++ bool irq_active_low;
+
+ #ifdef CONFIG_PM
+ struct hci_uart *hu;
+@@ -213,7 +213,9 @@ static int bcm_request_irq(struct bcm_da
+ }
+
+ err = devm_request_irq(&bdev->pdev->dev, bdev->irq, bcm_host_wake,
+- IRQF_TRIGGER_RISING, "host_wake", bdev);
++ bdev->irq_active_low ? IRQF_TRIGGER_FALLING :
++ IRQF_TRIGGER_RISING,
++ "host_wake", bdev);
+ if (err)
+ goto unlock;
+
+@@ -253,7 +255,7 @@ static int bcm_setup_sleep(struct hci_ua
+ struct sk_buff *skb;
+ struct bcm_set_sleep_mode sleep_params = default_sleep_params;
+
+- sleep_params.host_wake_active = !bcm->dev->irq_polarity;
++ sleep_params.host_wake_active = !bcm->dev->irq_active_low;
+
+ skb = __hci_cmd_sync(hu->hdev, 0xfc27, sizeof(sleep_params),
+ &sleep_params, HCI_INIT_TIMEOUT);
+@@ -690,10 +692,8 @@ static const struct acpi_gpio_mapping ac
+ };
+
+ #ifdef CONFIG_ACPI
+-static u8 acpi_active_low = ACPI_ACTIVE_LOW;
+-
+ /* IRQ polarity of some chipsets are not defined correctly in ACPI table. */
+-static const struct dmi_system_id bcm_wrong_irq_dmi_table[] = {
++static const struct dmi_system_id bcm_active_low_irq_dmi_table[] = {
+ {
+ .ident = "Asus T100TA",
+ .matches = {
+@@ -701,7 +701,6 @@ static const struct dmi_system_id bcm_wr
+ "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"),
+ },
+- .driver_data = &acpi_active_low,
+ },
+ {
+ .ident = "Asus T100CHI",
+@@ -710,7 +709,6 @@ static const struct dmi_system_id bcm_wr
+ "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100CHI"),
+ },
+- .driver_data = &acpi_active_low,
+ },
+ { /* Handle ThinkPad 8 tablets with BCM2E55 chipset ACPI ID */
+ .ident = "Lenovo ThinkPad 8",
+@@ -718,7 +716,6 @@ static const struct dmi_system_id bcm_wr
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 8"),
+ },
+- .driver_data = &acpi_active_low,
+ },
+ { }
+ };
+@@ -733,13 +730,13 @@ static int bcm_resource(struct acpi_reso
+ switch (ares->type) {
+ case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
+ irq = &ares->data.extended_irq;
+- dev->irq_polarity = irq->polarity;
++ dev->irq_active_low = irq->polarity == ACPI_ACTIVE_LOW;
+ break;
+
+ case ACPI_RESOURCE_TYPE_GPIO:
+ gpio = &ares->data.gpio;
+ if (gpio->connection_type == ACPI_RESOURCE_GPIO_TYPE_INT)
+- dev->irq_polarity = gpio->polarity;
++ dev->irq_active_low = gpio->polarity == ACPI_ACTIVE_LOW;
+ break;
+
+ case ACPI_RESOURCE_TYPE_SERIAL_BUS:
+@@ -834,11 +831,11 @@ static int bcm_acpi_probe(struct bcm_dev
+ return ret;
+ acpi_dev_free_resource_list(&resources);
+
+- dmi_id = dmi_first_match(bcm_wrong_irq_dmi_table);
++ dmi_id = dmi_first_match(bcm_active_low_irq_dmi_table);
+ if (dmi_id) {
+ bt_dev_warn(dev, "%s: Overwriting IRQ polarity to active low",
+ dmi_id->ident);
+- dev->irq_polarity = *(u8 *)dmi_id->driver_data;
++ dev->irq_active_low = true;
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 4 Oct 2017 20:43:35 +0200
+Subject: Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdev
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+
+[ Upstream commit 7841d554809b518a22349e7e39b6b63f8a48d0fb ]
+
+Fix a NULL pointer deref (hu->tty) when calling hci_uart_set_flow_control
+on hci_uart-s using serdev.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/hci_ldisc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -41,6 +41,7 @@
+ #include <linux/ioctl.h>
+ #include <linux/skbuff.h>
+ #include <linux/firmware.h>
++#include <linux/serdev.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -298,6 +299,12 @@ void hci_uart_set_flow_control(struct hc
+ unsigned int set = 0;
+ unsigned int clear = 0;
+
++ if (hu->serdev) {
++ serdev_device_set_flow_control(hu->serdev, !enable);
++ serdev_device_set_rts(hu->serdev, !enable);
++ return;
++ }
++
+ if (enable) {
+ /* Disable hardware flow control */
+ ktermios = tty->termios;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Thu, 12 Oct 2017 16:36:58 +0800
+Subject: clk: sunxi-ng: nm: Check if requested rate is supported by fractional clock
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 4cdbc40d64d4b8303a97e29a52862e4d99502beb ]
+
+The round_rate callback for N-M-factor style clocks does not check if
+the requested clock rate is supported by the fractional clock mode.
+While this doesn't affect usage in practice, since the clock rates
+are also supported through N-M factors, it does not match the set_rate
+code.
+
+Add a check to the round_rate callback so it matches the set_rate
+callback.
+
+Fixes: 6174a1e24b0d ("clk: sunxi-ng: Add N-M-factor clock support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/sunxi-ng/ccu_nm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/sunxi-ng/ccu_nm.c
++++ b/drivers/clk/sunxi-ng/ccu_nm.c
+@@ -99,6 +99,9 @@ static long ccu_nm_round_rate(struct clk
+ struct ccu_nm *nm = hw_to_ccu_nm(hw);
+ struct _ccu_nm _nm;
+
++ if (ccu_frac_helper_has_rate(&nm->common, &nm->frac, rate))
++ return rate;
++
+ _nm.min_n = nm->n.min ?: 1;
+ _nm.max_n = nm->n.max ?: 1 << nm->n.width;
+ _nm.min_m = 1;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Thu, 12 Oct 2017 16:36:57 +0800
+Subject: clk: sunxi-ng: sun5i: Fix bit offset of audio PLL post-divider
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit d51fe3ba9773c8b6fc79f82bbe75d64baf604292 ]
+
+The post-divider for the audio PLL is in bits [29:26], as specified
+in the user manual, not [19:16] as currently programmed in the code.
+The post-divider has a default register value of 2, i.e. a divider
+of 3. This means the clock rate fed to the audio codec would be off.
+
+This was discovered when porting sigma-delta modulation for the PLL
+to sun5i, which needs the post-divider to be 1.
+
+Fix the bit offset, so we do actually force the post-divider to a
+certain value.
+
+Fixes: 5e73761786d6 ("clk: sunxi-ng: Add sun5i CCU driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun5i.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
++++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
+@@ -982,8 +982,8 @@ static void __init sun5i_ccu_init(struct
+
+ /* Force the PLL-Audio-1x divider to 4 */
+ val = readl(reg + SUN5I_PLL_AUDIO_REG);
+- val &= ~GENMASK(19, 16);
+- writel(val | (3 << 16), reg + SUN5I_PLL_AUDIO_REG);
++ val &= ~GENMASK(29, 26);
++ writel(val | (3 << 26), reg + SUN5I_PLL_AUDIO_REG);
+
+ /*
+ * Use the peripheral PLL as the AHB parent, instead of CPU /
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 29 Sep 2017 16:22:54 +0800
+Subject: clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+
+[ Upstream commit 7f3ed79188f2f094d0ee366fa858857fb7f511ba ]
+
+The HDMI DDC clock found in the CCU is the parent of the actual DDC
+clock within the HDMI controller. That clock is also named "hdmi-ddc".
+
+Rename the one in the CCU to "ddc". This makes more sense than renaming
+the one in the HDMI controller to something else.
+
+Fixes: c6e6c96d8fa6 ("clk: sunxi-ng: Add A31/A31s clocks")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+@@ -608,7 +608,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(hdmi_cl
+ 0x150, 0, 4, 24, 2, BIT(31),
+ CLK_SET_RATE_PARENT);
+
+-static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(30), 0);
++static SUNXI_CCU_GATE(hdmi_ddc_clk, "ddc", "osc24M", 0x150, BIT(30), 0);
+
+ static SUNXI_CCU_GATE(ps_clk, "ps", "lcd1-ch1", 0x140, BIT(31), 0);
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Fri, 1 Sep 2017 14:29:56 +1000
+Subject: cpuidle: fix broadcast control when broadcast can not be entered
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+
+[ Upstream commit f187851b9b4a76952b1158b86434563dd2031103 ]
+
+When failing to enter broadcast timer mode for an idle state that
+requires it, a new state is selected that does not require broadcast,
+but the broadcast variable remains set. This causes
+tick_broadcast_exit to be called despite not having entered broadcast
+mode.
+
+This causes the WARN_ON_ONCE(!irqs_disabled()) to trigger in some
+cases. It does not appear to cause problems for code today, but seems
+to violate the interface so should be fixed.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpuidle/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -208,6 +208,7 @@ int cpuidle_enter_state(struct cpuidle_d
+ return -EBUSY;
+ }
+ target_state = &drv->states[index];
++ broadcast = false;
+ }
+
+ /* Take note of the planned idle state. */
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Wed, 4 Oct 2017 01:00:08 +0200
+Subject: crypto: crypto4xx - increase context and scatter ring buffer elements
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+
+[ Upstream commit 778f81d6cdb7d25360f082ac0384d5103f04eca5 ]
+
+If crypto4xx is used in conjunction with dm-crypt, the available
+ring buffer elements are not enough to handle the load properly.
+
+On an aes-cbc-essiv:sha256 encrypted swap partition the read
+performance is abyssal: (tested with hdparm -t)
+
+/dev/mapper/swap_crypt:
+ Timing buffered disk reads: 14 MB in 3.68 seconds = 3.81 MB/sec
+
+The patch increases both PPC4XX_NUM_SD and PPC4XX_NUM_PD to 256.
+This improves the performance considerably:
+
+/dev/mapper/swap_crypt:
+ Timing buffered disk reads: 104 MB in 3.03 seconds = 34.31 MB/sec
+
+Furthermore, PPC4XX_LAST_SD, PPC4XX_LAST_GD and PPC4XX_LAST_PD
+can be easily calculated from their respective PPC4XX_NUM_*
+constant.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/amcc/crypto4xx_core.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/crypto/amcc/crypto4xx_core.h
++++ b/drivers/crypto/amcc/crypto4xx_core.h
+@@ -34,12 +34,12 @@
+ #define PPC405EX_CE_RESET 0x00000008
+
+ #define CRYPTO4XX_CRYPTO_PRIORITY 300
+-#define PPC4XX_LAST_PD 63
+-#define PPC4XX_NUM_PD 64
+-#define PPC4XX_LAST_GD 1023
++#define PPC4XX_NUM_PD 256
++#define PPC4XX_LAST_PD (PPC4XX_NUM_PD - 1)
+ #define PPC4XX_NUM_GD 1024
+-#define PPC4XX_LAST_SD 63
+-#define PPC4XX_NUM_SD 64
++#define PPC4XX_LAST_GD (PPC4XX_NUM_GD - 1)
++#define PPC4XX_NUM_SD 256
++#define PPC4XX_LAST_SD (PPC4XX_NUM_SD - 1)
+ #define PPC4XX_SD_BUFFER_SIZE 2048
+
+ #define PD_ENTRY_INUSE 1
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+Date: Sun, 8 Oct 2017 11:39:49 +0200
+Subject: crypto: lrw - Fix an error handling path in 'create()'
+
+From: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 616129cc6e75fb4da6681c16c981fa82dfe5e4c7 ]
+
+All error handling paths 'goto err_drop_spawn' except this one.
+In order to avoid some resources leak, we should do it as well here.
+
+Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/lrw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -610,8 +610,10 @@ static int create(struct crypto_template
+ ecb_name[len - 1] = 0;
+
+ if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
+- "lrw(%s)", ecb_name) >= CRYPTO_MAX_ALG_NAME)
+- return -ENAMETOOLONG;
++ "lrw(%s)", ecb_name) >= CRYPTO_MAX_ALG_NAME) {
++ err = -ENAMETOOLONG;
++ goto err_drop_spawn;
++ }
+ }
+
+ inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Shashank Sharma <shashank.sharma@intel.com>
+Date: Thu, 12 Oct 2017 22:10:08 +0530
+Subject: drm: Add retries for lspcon mode detection
+
+From: Shashank Sharma <shashank.sharma@intel.com>
+
+
+[ Upstream commit f687e25a7a245952349f1f9f9cc238ac5a3be258 ]
+
+>From the CI builds, its been observed that during a driver
+reload/insert, dp dual mode read function sometimes fails to
+read from LSPCON device over i2c-over-aux channel.
+
+This patch:
+- adds some delay and few retries, allowing a scope for these
+ devices to settle down and respond.
+- changes one error log's level from ERROR->DEBUG as we want
+ to call it an error only after all the retries are exhausted.
+
+V2: Addressed review comments from Jani (for loop for retry)
+V3: Addressed review comments from Imre (break on partial read too)
+V3: Addressed review comments from Ville/Imre (Add the retries
+ exclusively for LSPCON, not for all dp_dual_mode devices)
+V4: Added r-b from Imre, sending it to dri-devel (Jani)
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102294
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102295
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102359
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103186
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Acked-by: Dave Airlie <airlied@gmail.com>
+Signed-off-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1507826408-19322-1-git-send-email-shashank.sharma@intel.com
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_dual_mode_helper.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c
++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
+@@ -410,6 +410,7 @@ int drm_lspcon_get_mode(struct i2c_adapt
+ {
+ u8 data;
+ int ret = 0;
++ int retry;
+
+ if (!mode) {
+ DRM_ERROR("NULL input\n");
+@@ -417,10 +418,19 @@ int drm_lspcon_get_mode(struct i2c_adapt
+ }
+
+ /* Read Status: i2c over aux */
+- ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_LSPCON_CURRENT_MODE,
+- &data, sizeof(data));
++ for (retry = 0; retry < 6; retry++) {
++ if (retry)
++ usleep_range(500, 1000);
++
++ ret = drm_dp_dual_mode_read(adapter,
++ DP_DUAL_MODE_LSPCON_CURRENT_MODE,
++ &data, sizeof(data));
++ if (!ret)
++ break;
++ }
++
+ if (ret < 0) {
+- DRM_ERROR("LSPCON read(0x80, 0x41) failed\n");
++ DRM_DEBUG_KMS("LSPCON read(0x80, 0x41) failed\n");
+ return -EFAULT;
+ }
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Eric Anholt <eric@anholt.net>
+Date: Tue, 15 Aug 2017 16:47:19 -0700
+Subject: drm/vc4: Avoid using vrefresh==0 mode in DSI htotal math.
+
+From: Eric Anholt <eric@anholt.net>
+
+
+[ Upstream commit af2eca53206c59ce9308a4f5f46c4a104a179b6b ]
+
+The incoming mode might have a missing vrefresh field if it came from
+drmModeSetCrtc(), which the kernel is supposed to calculate using
+drm_mode_vrefresh(). We could either use that or the adjusted_mode's
+original vrefresh value.
+
+However, we can maintain a more exact vrefresh value (not just the
+integer approximation), by scaling by the ratio of our clocks.
+
+v2: Use math suggested by Andrzej Hajda instead.
+v3: Simplify math now that adjusted_mode->clock isn't padded.
+v4: Drop some parens.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170815234722.20700-2-eric@anholt.net
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -866,7 +866,8 @@ static bool vc4_dsi_encoder_mode_fixup(s
+ adjusted_mode->clock = pixel_clock_hz / 1000 + 1;
+
+ /* Given the new pixel clock, adjust HFP to keep vrefresh the same. */
+- adjusted_mode->htotal = pixel_clock_hz / (mode->vrefresh * mode->vtotal);
++ adjusted_mode->htotal = adjusted_mode->clock * mode->htotal /
++ mode->clock;
+ adjusted_mode->hsync_end += adjusted_mode->htotal - mode->htotal;
+ adjusted_mode->hsync_start += adjusted_mode->htotal - mode->htotal;
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Mon, 2 Oct 2017 07:17:50 -0700
+Subject: fm10k: ensure we process SM mbx when processing VF mbx
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+
+[ Upstream commit 17a91809942ca32c70026d2d5ba3348a2c4fdf8f ]
+
+When we process VF mailboxes, the driver is likely going to also queue
+up messages to the switch manager. This process merely queues up the
+FIFO, but doesn't actually begin the transmission process. Because we
+hold the mailbox lock during this VF processing, the PF<->SM mailbox is
+not getting processed at this time. Ensure that we actually process the
+PF<->SM mailbox in between each PF<->VF mailbox.
+
+This should ensure prompt transmission of the messages queued up after
+each VF message is received and handled.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_iov.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
+@@ -126,6 +126,9 @@ process_mbx:
+ struct fm10k_mbx_info *mbx = &vf_info->mbx;
+ u16 glort = vf_info->glort;
+
++ /* process the SM mailbox first to drain outgoing messages */
++ hw->mbx.ops.process(hw, &hw->mbx);
++
+ /* verify port mapping is valid, if not reset port */
+ if (vf_info->vf_flags && !fm10k_glort_valid_pf(hw, glort))
+ hw->iov.ops.reset_lport(hw, vf_info);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Fri, 11 Aug 2017 11:14:58 -0700
+Subject: fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+
+[ Upstream commit 3e256ac5b1ec307e5dd5a4c99fbdbc651446c738 ]
+
+We've had support for setting both a minimum and maximum bandwidth via
+.ndo_set_vf_bw since commit 883a9ccbae56 ("fm10k: Add support for SR-IOV
+to driver", 2014-09-20).
+
+Likely because we do not support minimum rates, the declaration
+mis-ordered the "unused" parameter, which causes warnings when analyzed
+with cppcheck.
+
+Fix this warning by properly declaring the min_rate and max_rate
+variables in the declaration and definition (rather than using
+"unused"). Also rename "rate" to max_rate so as to clarify that we only
+support setting the maximum rate.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k.h | 4 ++--
+ drivers/net/ethernet/intel/fm10k/fm10k_iov.c | 9 +++++----
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/fm10k/fm10k.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k.h
+@@ -526,8 +526,8 @@ s32 fm10k_iov_update_pvid(struct fm10k_i
+ int fm10k_ndo_set_vf_mac(struct net_device *netdev, int vf_idx, u8 *mac);
+ int fm10k_ndo_set_vf_vlan(struct net_device *netdev,
+ int vf_idx, u16 vid, u8 qos, __be16 vlan_proto);
+-int fm10k_ndo_set_vf_bw(struct net_device *netdev, int vf_idx, int rate,
+- int unused);
++int fm10k_ndo_set_vf_bw(struct net_device *netdev, int vf_idx,
++ int __always_unused min_rate, int max_rate);
+ int fm10k_ndo_get_vf_config(struct net_device *netdev,
+ int vf_idx, struct ifla_vf_info *ivi);
+
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
+@@ -482,7 +482,7 @@ int fm10k_ndo_set_vf_vlan(struct net_dev
+ }
+
+ int fm10k_ndo_set_vf_bw(struct net_device *netdev, int vf_idx,
+- int __always_unused unused, int rate)
++ int __always_unused min_rate, int max_rate)
+ {
+ struct fm10k_intfc *interface = netdev_priv(netdev);
+ struct fm10k_iov_data *iov_data = interface->iov_data;
+@@ -493,14 +493,15 @@ int fm10k_ndo_set_vf_bw(struct net_devic
+ return -EINVAL;
+
+ /* rate limit cannot be less than 10Mbs or greater than link speed */
+- if (rate && ((rate < FM10K_VF_TC_MIN) || rate > FM10K_VF_TC_MAX))
++ if (max_rate &&
++ (max_rate < FM10K_VF_TC_MIN || max_rate > FM10K_VF_TC_MAX))
+ return -EINVAL;
+
+ /* store values */
+- iov_data->vf_info[vf_idx].rate = rate;
++ iov_data->vf_info[vf_idx].rate = max_rate;
+
+ /* update hardware configuration */
+- hw->iov.ops.configure_tc(hw, vf_idx, rate);
++ hw->iov.ops.configure_tc(hw, vf_idx, max_rate);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Alan Brady <alan.brady@intel.com>
+Date: Tue, 22 Aug 2017 06:57:53 -0400
+Subject: i40e: fix client notify of VF reset
+
+From: Alan Brady <alan.brady@intel.com>
+
+
+[ Upstream commit c53d11f669c0e7d0daf46a717b6712ad0b09de99 ]
+
+Currently there is a bug in which the PF driver fails to inform clients
+of a VF reset which then causes clients to leak resources. The bug
+exists because we were incorrectly checking the I40E_VF_STATE_PRE_ENABLE
+bit.
+
+When a VF is first init we go through a reset to initialize variables
+and allocate resources but we don't want to inform clients of this first
+reset since the client isn't fully enabled yet so we set a state bit
+signifying we're in a "pre-enabled" client state. During the first
+reset we should be clearing the bit, allowing all following resets to
+notify the client of the reset when the bit is not set. This patch
+fixes the issue by negating the 'test_and_clear_bit' check to accurately
+reflect the behavior we want.
+
+Signed-off-by: Alan Brady <alan.brady@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1008,8 +1008,8 @@ static void i40e_cleanup_reset_vf(struct
+ set_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states);
+ clear_bit(I40E_VF_STATE_DISABLED, &vf->vf_states);
+ /* Do not notify the client during VF init */
+- if (test_and_clear_bit(I40E_VF_STATE_PRE_ENABLE,
+- &vf->vf_states))
++ if (!test_and_clear_bit(I40E_VF_STATE_PRE_ENABLE,
++ &vf->vf_states))
+ i40e_notify_client_of_vf_reset(pf, abs_vf_id);
+ vf->num_vlan = 0;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Tue, 29 Aug 2017 05:32:31 -0400
+Subject: i40e/i40evf: spread CPU affinity hints across online CPUs only
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+
+[ Upstream commit be664cbefc50977aaefc868ba6a1109ec9b7449d ]
+
+Currently, when setting up the IRQ for a q_vector, we set an affinity
+hint based on the v_idx of that q_vector. Meaning a loop iterates on
+v_idx, which is an incremental value, and the cpumask is created based
+on this value.
+
+This is a problem in systems with multiple logical CPUs per core (like in
+simultaneous multithreading (SMT) scenarios). If we disable some logical
+CPUs, by turning SMT off for example, we will end up with a sparse
+cpu_online_mask, i.e., only the first CPU in a core is online, and
+incremental filling in q_vector cpumask might lead to multiple offline
+CPUs being assigned to q_vectors.
+
+Example: if we have a system with 8 cores each one containing 8 logical
+CPUs (SMT == 8 in this case), we have 64 CPUs in total. But if SMT is
+disabled, only the 1st CPU in each core remains online, so the
+cpu_online_mask in this case would have only 8 bits set, in a sparse way.
+
+In general case, when SMT is off the cpu_online_mask has only C bits set:
+0, 1*N, 2*N, ..., C*(N-1) where
+C == # of cores;
+N == # of logical CPUs per core.
+In our example, only bits 0, 8, 16, 24, 32, 40, 48, 56 would be set.
+
+Instead, we should only assign hints for CPUs which are online. Even
+better, the kernel already provides a function, cpumask_local_spread()
+which takes an index and returns a CPU, spreading the interrupts across
+local NUMA nodes first, and then remote ones if necessary.
+
+Since we generally have a 1:1 mapping between vectors and CPUs, there
+is no real advantage to spreading vectors to local CPUs first. In order
+to avoid mismatch of the default XPS hints, we'll pass -1 so that it
+spreads across all CPUs without regard to the node locality.
+
+Note that we don't need to change the q_vector->affinity_mask as this is
+initialized to cpu_possible_mask, until an actual affinity is set and
+then notified back to us.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 16 +++++++++++-----
+ drivers/net/ethernet/intel/i40evf/i40evf_main.c | 9 ++++++---
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2874,14 +2874,15 @@ static void i40e_vsi_free_rx_resources(s
+ static void i40e_config_xps_tx_ring(struct i40e_ring *ring)
+ {
+ struct i40e_vsi *vsi = ring->vsi;
++ int cpu;
+
+ if (!ring->q_vector || !ring->netdev)
+ return;
+
+ if ((vsi->tc_config.numtc <= 1) &&
+ !test_and_set_bit(__I40E_TX_XPS_INIT_DONE, &ring->state)) {
+- netif_set_xps_queue(ring->netdev,
+- get_cpu_mask(ring->q_vector->v_idx),
++ cpu = cpumask_local_spread(ring->q_vector->v_idx, -1);
++ netif_set_xps_queue(ring->netdev, get_cpu_mask(cpu),
+ ring->queue_index);
+ }
+
+@@ -3471,6 +3472,7 @@ static int i40e_vsi_request_irq_msix(str
+ int tx_int_idx = 0;
+ int vector, err;
+ int irq_num;
++ int cpu;
+
+ for (vector = 0; vector < q_vectors; vector++) {
+ struct i40e_q_vector *q_vector = vsi->q_vectors[vector];
+@@ -3506,10 +3508,14 @@ static int i40e_vsi_request_irq_msix(str
+ q_vector->affinity_notify.notify = i40e_irq_affinity_notify;
+ q_vector->affinity_notify.release = i40e_irq_affinity_release;
+ irq_set_affinity_notifier(irq_num, &q_vector->affinity_notify);
+- /* get_cpu_mask returns a static constant mask with
+- * a permanent lifetime so it's ok to use here.
++ /* Spread affinity hints out across online CPUs.
++ *
++ * get_cpu_mask returns a static constant mask with
++ * a permanent lifetime so it's ok to pass to
++ * irq_set_affinity_hint without making a copy.
+ */
+- irq_set_affinity_hint(irq_num, get_cpu_mask(q_vector->v_idx));
++ cpu = cpumask_local_spread(q_vector->v_idx, -1);
++ irq_set_affinity_hint(irq_num, get_cpu_mask(cpu));
+ }
+
+ vsi->irqs_ready = true;
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -546,6 +546,7 @@ i40evf_request_traffic_irqs(struct i40ev
+ unsigned int vector, q_vectors;
+ unsigned int rx_int_idx = 0, tx_int_idx = 0;
+ int irq_num, err;
++ int cpu;
+
+ i40evf_irq_disable(adapter);
+ /* Decrement for Other and TCP Timer vectors */
+@@ -584,10 +585,12 @@ i40evf_request_traffic_irqs(struct i40ev
+ q_vector->affinity_notify.release =
+ i40evf_irq_affinity_release;
+ irq_set_affinity_notifier(irq_num, &q_vector->affinity_notify);
+- /* get_cpu_mask returns a static constant mask with
+- * a permanent lifetime so it's ok to use here.
++ /* Spread the IRQ affinity hints across online CPUs. Note that
++ * get_cpu_mask returns a mask with a permanent lifetime so
++ * it's safe to use as a hint for irq_set_affinity_hint.
+ */
+- irq_set_affinity_hint(irq_num, get_cpu_mask(q_vector->v_idx));
++ cpu = cpumask_local_spread(q_vector->v_idx, -1);
++ irq_set_affinity_hint(irq_num, get_cpu_mask(cpu));
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Lihong Yang <lihong.yang@intel.com>
+Date: Thu, 7 Sep 2017 08:05:46 -0400
+Subject: i40e: use the safe hash table iterator when deleting mac filters
+
+From: Lihong Yang <lihong.yang@intel.com>
+
+
+[ Upstream commit 784548c40d6f43eff2297220ad7800dc04be03c6 ]
+
+This patch replaces hash_for_each function with hash_for_each_safe
+when calling __i40e_del_filter. The hash_for_each_safe function is
+the right one to use when iterating over a hash table to safely remove
+a hash entry. Otherwise, incorrect values may be read from freed memory.
+
+Detected by CoverityScan, CID 1402048 Read from pointer after free
+
+Signed-off-by: Lihong Yang <lihong.yang@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2779,6 +2779,7 @@ int i40e_ndo_set_vf_mac(struct net_devic
+ struct i40e_mac_filter *f;
+ struct i40e_vf *vf;
+ int ret = 0;
++ struct hlist_node *h;
+ int bkt;
+
+ /* validate the request */
+@@ -2817,7 +2818,7 @@ int i40e_ndo_set_vf_mac(struct net_devic
+ /* Delete all the filters for this VSI - we're going to kill it
+ * anyway.
+ */
+- hash_for_each(vsi->mac_filter_hash, bkt, f, hlist)
++ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist)
+ __i40e_del_filter(vsi, f);
+
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Scott Franco <safranco@intel.com>
+Date: Tue, 26 Sep 2017 06:44:13 -0700
+Subject: IB/opa_vnic: Properly clear Mac Table Digest
+
+From: Scott Franco <safranco@intel.com>
+
+
+[ Upstream commit 4bbdfe25600c1909c26747d0b5c39fd0e409bb87 ]
+
+Clear the MAC table digest when the MAC table is freed.
+
+Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Signed-off-by: Scott Franco <safranco@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
++++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
+@@ -139,6 +139,7 @@ void opa_vnic_release_mac_tbl(struct opa
+ rcu_assign_pointer(adapter->mactbl, NULL);
+ synchronize_rcu();
+ opa_vnic_free_mac_tbl(mactbl);
++ adapter->info.vport.mac_tbl_digest = 0;
+ mutex_unlock(&adapter->mactbl_lock);
+ }
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Date: Tue, 26 Sep 2017 06:44:07 -0700
+Subject: IB/opa_vnic: Properly return the total MACs in UC MAC list
+
+From: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+
+
+[ Upstream commit b77eb45e0d9c324245d165656ab3b38b6f386436 ]
+
+Do not include EM specified MAC address in total MACs of the
+UC MAC list.
+
+Reviewed-by: Sudeep Dutt <sudeep.dutt@intel.com>
+Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/opa_vnic/opa_vnic_vema_iface.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_vema_iface.c
++++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_vema_iface.c
+@@ -348,7 +348,7 @@ void opa_vnic_query_mcast_macs(struct op
+ void opa_vnic_query_ucast_macs(struct opa_vnic_adapter *adapter,
+ struct opa_veswport_iface_macs *macs)
+ {
+- u16 start_idx, tot_macs, num_macs, idx = 0, count = 0;
++ u16 start_idx, tot_macs, num_macs, idx = 0, count = 0, em_macs = 0;
+ struct netdev_hw_addr *ha;
+
+ start_idx = be16_to_cpu(macs->start_idx);
+@@ -359,8 +359,10 @@ void opa_vnic_query_ucast_macs(struct op
+
+ /* Do not include EM specified MAC address */
+ if (!memcmp(adapter->info.vport.base_mac_addr, ha->addr,
+- ARRAY_SIZE(adapter->info.vport.base_mac_addr)))
++ ARRAY_SIZE(adapter->info.vport.base_mac_addr))) {
++ em_macs++;
+ continue;
++ }
+
+ if (start_idx > idx++)
+ continue;
+@@ -383,7 +385,7 @@ void opa_vnic_query_ucast_macs(struct op
+ }
+
+ tot_macs = netdev_hw_addr_list_count(&adapter->netdev->dev_addrs) +
+- netdev_uc_count(adapter->netdev);
++ netdev_uc_count(adapter->netdev) - em_macs;
+ macs->tot_macs_in_lst = cpu_to_be16(tot_macs);
+ macs->num_macs_in_msg = cpu_to_be16(count);
+ macs->gen_count = cpu_to_be16(adapter->info.vport.uc_macs_gen_count);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 8 Sep 2017 15:37:45 +0100
+Subject: IB/rxe: check for allocation failure on elem
+
+From: Colin Ian King <colin.king@canonical.com>
+
+
+[ Upstream commit 4831ca9e4a8e48cb27e0a792f73250390827a228 ]
+
+The allocation for elem may fail (especially because we're using
+GFP_ATOMIC) so best to check for a null return. This fixes a potential
+null pointer dereference when assigning elem->pool.
+
+Detected by CoverityScan CID#1357507 ("Dereference null return value")
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool)
+ elem = kmem_cache_zalloc(pool_cache(pool),
+ (pool->flags & RXE_POOL_ATOMIC) ?
+ GFP_ATOMIC : GFP_KERNEL);
++ if (!elem)
++ return NULL;
+
+ elem->pool = pool;
+ kref_init(&elem->ref_cnt);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Mick Tarsel <mjtarsel@linux.vnet.ibm.com>
+Date: Thu, 28 Sep 2017 13:53:18 -0700
+Subject: ibmvnic: Set state UP
+
+From: Mick Tarsel <mjtarsel@linux.vnet.ibm.com>
+
+
+[ Upstream commit e876a8a7e9dd89dc88c12ca2e81beb478dbe9897 ]
+
+State is initially reported as UNKNOWN. Before register call
+netif_carrier_off(). Once the device is opened, call netif_carrier_on() in
+order to set the state to UP.
+
+Signed-off-by: Mick Tarsel <mjtarsel@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -927,6 +927,7 @@ static int ibmvnic_open(struct net_devic
+ }
+
+ rc = __ibmvnic_open(netdev);
++ netif_carrier_on(netdev);
+ mutex_unlock(&adapter->reset_lock);
+
+ return rc;
+@@ -3899,6 +3900,7 @@ static int ibmvnic_probe(struct vio_dev
+ if (rc)
+ goto ibmvnic_init_fail;
+
++ netif_carrier_off(netdev);
+ rc = register_netdev(netdev);
+ if (rc) {
+ dev_err(&dev->dev, "failed to register netdev rc=%d\n", rc);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 27 Aug 2017 08:39:51 +0200
+Subject: igb: check memory allocation failure
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 18eb86362a52f0af933cc0fd5e37027317eb2d1c ]
+
+Check memory allocation failures and return -ENOMEM in such cases, as
+already done for other memory allocations in this function.
+
+This avoids NULL pointers dereference.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com
+Acked-by: PJ Waskiewicz <peter.waskiewicz.jr@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3162,6 +3162,8 @@ static int igb_sw_init(struct igb_adapte
+ /* Setup and initialize a copy of the hw vlan table array */
+ adapter->shadow_vfta = kcalloc(E1000_VLAN_FILTER_TBL_SIZE, sizeof(u32),
+ GFP_ATOMIC);
++ if (!adapter->shadow_vfta)
++ return -ENOMEM;
+
+ /* This call may decrease the number of queues */
+ if (igb_init_interrupt_scheme(adapter, true)) {
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Wed, 30 Aug 2017 13:50:39 +0200
+Subject: iio: st_sensors: add register mask for status register
+
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+
+
+[ Upstream commit e72a060151e5bb673af24993665e270fc4f674a7 ]
+
+Introduce register mask for data-ready status register since
+pressure sensors (e.g. LPS22HB) export just two channels
+(BIT(0) and BIT(1)) and BIT(2) is marked reserved while in
+st_sensors_new_samples_available() value read from status register
+is masked using 0x7.
+Moreover do not mask status register using active_scan_mask since
+now status value is properly masked and if the result is not zero the
+interrupt has to be consumed by the driver. This fix an issue on LPS25H
+and LPS331AP where channel definition is swapped respect to status
+register.
+Furthermore that change allows to properly support new devices
+(e.g LIS2DW12) that report just ZYXDA (data-ready) field in status register
+to figure out if the interrupt has been generated by the device.
+
+Fixes: 97865fe41322 (iio: st_sensors: verify interrupt event to status)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/st_accel_core.c | 35 ++++++++++++++++-----
+ drivers/iio/common/st_sensors/st_sensors_core.c | 2 -
+ drivers/iio/common/st_sensors/st_sensors_trigger.c | 16 ++-------
+ drivers/iio/gyro/st_gyro_core.c | 15 +++++++--
+ drivers/iio/magnetometer/st_magn_core.c | 10 ++++--
+ drivers/iio/pressure/st_pressure_core.c | 15 +++++++--
+ include/linux/iio/common/st_sensors.h | 7 +++-
+ 7 files changed, 70 insertions(+), 30 deletions(-)
+
+--- a/drivers/iio/accel/st_accel_core.c
++++ b/drivers/iio/accel/st_accel_core.c
+@@ -164,7 +164,10 @@ static const struct st_sensor_settings s
+ .mask_int2 = 0x00,
+ .addr_ihl = 0x25,
+ .mask_ihl = 0x02,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x23,
+@@ -236,7 +239,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x80,
+ .addr_od = 0x22,
+ .mask_od = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x23,
+@@ -318,7 +324,10 @@ static const struct st_sensor_settings s
+ .mask_int2 = 0x00,
+ .addr_ihl = 0x23,
+ .mask_ihl = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ .ig1 = {
+ .en_addr = 0x23,
+ .en_mask = 0x08,
+@@ -389,7 +398,10 @@ static const struct st_sensor_settings s
+ .drdy_irq = {
+ .addr = 0x21,
+ .mask_int1 = 0x04,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x21,
+@@ -451,7 +463,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x80,
+ .addr_od = 0x22,
+ .mask_od = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x21,
+@@ -569,7 +584,10 @@ static const struct st_sensor_settings s
+ .drdy_irq = {
+ .addr = 0x21,
+ .mask_int1 = 0x04,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x21,
+@@ -640,7 +658,10 @@ static const struct st_sensor_settings s
+ .mask_int2 = 0x00,
+ .addr_ihl = 0x25,
+ .mask_ihl = 0x02,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .sim = {
+ .addr = 0x23,
+--- a/drivers/iio/common/st_sensors/st_sensors_core.c
++++ b/drivers/iio/common/st_sensors/st_sensors_core.c
+@@ -470,7 +470,7 @@ int st_sensors_set_dataready_irq(struct
+ * different one. Take into account irq status register
+ * to understand if irq trigger can be properly supported
+ */
+- if (sdata->sensor_settings->drdy_irq.addr_stat_drdy)
++ if (sdata->sensor_settings->drdy_irq.stat_drdy.addr)
+ sdata->hw_irq_trigger = enable;
+ return 0;
+ }
+--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c
++++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c
+@@ -31,7 +31,7 @@ static int st_sensors_new_samples_availa
+ int ret;
+
+ /* How would I know if I can't check it? */
+- if (!sdata->sensor_settings->drdy_irq.addr_stat_drdy)
++ if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr)
+ return -EINVAL;
+
+ /* No scan mask, no interrupt */
+@@ -39,23 +39,15 @@ static int st_sensors_new_samples_availa
+ return 0;
+
+ ret = sdata->tf->read_byte(&sdata->tb, sdata->dev,
+- sdata->sensor_settings->drdy_irq.addr_stat_drdy,
++ sdata->sensor_settings->drdy_irq.stat_drdy.addr,
+ &status);
+ if (ret < 0) {
+ dev_err(sdata->dev,
+ "error checking samples available\n");
+ return ret;
+ }
+- /*
+- * the lower bits of .active_scan_mask[0] is directly mapped
+- * to the channels on the sensor: either bit 0 for
+- * one-dimensional sensors, or e.g. x,y,z for accelerometers,
+- * gyroscopes or magnetometers. No sensor use more than 3
+- * channels, so cut the other status bits here.
+- */
+- status &= 0x07;
+
+- if (status & (u8)indio_dev->active_scan_mask[0])
++ if (status & sdata->sensor_settings->drdy_irq.stat_drdy.mask)
+ return 1;
+
+ return 0;
+@@ -212,7 +204,7 @@ int st_sensors_allocate_trigger(struct i
+ * it was "our" interrupt.
+ */
+ if (sdata->int_pin_open_drain &&
+- sdata->sensor_settings->drdy_irq.addr_stat_drdy)
++ sdata->sensor_settings->drdy_irq.stat_drdy.addr)
+ irq_trig |= IRQF_SHARED;
+
+ err = request_threaded_irq(sdata->get_irq_data_ready(indio_dev),
+--- a/drivers/iio/gyro/st_gyro_core.c
++++ b/drivers/iio/gyro/st_gyro_core.c
+@@ -118,7 +118,10 @@ static const struct st_sensor_settings s
+ * drain settings, but only for INT1 and not
+ * for the DRDY line on INT2.
+ */
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+@@ -188,7 +191,10 @@ static const struct st_sensor_settings s
+ * drain settings, but only for INT1 and not
+ * for the DRDY line on INT2.
+ */
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+@@ -253,7 +259,10 @@ static const struct st_sensor_settings s
+ * drain settings, but only for INT1 and not
+ * for the DRDY line on INT2.
+ */
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+--- a/drivers/iio/magnetometer/st_magn_core.c
++++ b/drivers/iio/magnetometer/st_magn_core.c
+@@ -317,7 +317,10 @@ static const struct st_sensor_settings s
+ },
+ .drdy_irq = {
+ /* drdy line is routed drdy pin */
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x07,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+@@ -361,7 +364,10 @@ static const struct st_sensor_settings s
+ .drdy_irq = {
+ .addr = 0x62,
+ .mask_int1 = 0x01,
+- .addr_stat_drdy = 0x67,
++ .stat_drdy = {
++ .addr = 0x67,
++ .mask = 0x07,
++ },
+ },
+ .multi_read_bit = false,
+ .bootime = 2,
+--- a/drivers/iio/pressure/st_pressure_core.c
++++ b/drivers/iio/pressure/st_pressure_core.c
+@@ -287,7 +287,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x80,
+ .addr_od = 0x22,
+ .mask_od = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x03,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+@@ -395,7 +398,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x80,
+ .addr_od = 0x22,
+ .mask_od = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x03,
++ },
+ },
+ .multi_read_bit = true,
+ .bootime = 2,
+@@ -454,7 +460,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x80,
+ .addr_od = 0x12,
+ .mask_od = 0x40,
+- .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = 0x03,
++ },
+ },
+ .multi_read_bit = false,
+ .bootime = 2,
+--- a/include/linux/iio/common/st_sensors.h
++++ b/include/linux/iio/common/st_sensors.h
+@@ -139,7 +139,7 @@ struct st_sensor_das {
+ * @mask_ihl: mask to enable/disable active low on the INT lines.
+ * @addr_od: address to enable/disable Open Drain on the INT lines.
+ * @mask_od: mask to enable/disable Open Drain on the INT lines.
+- * @addr_stat_drdy: address to read status of DRDY (data ready) interrupt
++ * struct stat_drdy - status register of DRDY (data ready) interrupt.
+ * struct ig1 - represents the Interrupt Generator 1 of sensors.
+ * @en_addr: address of the enable ig1 register.
+ * @en_mask: mask to write the on/off value for enable.
+@@ -152,7 +152,10 @@ struct st_sensor_data_ready_irq {
+ u8 mask_ihl;
+ u8 addr_od;
+ u8 mask_od;
+- u8 addr_stat_drdy;
++ struct {
++ u8 addr;
++ u8 mask;
++ } stat_drdy;
+ struct {
+ u8 en_addr;
+ u8 en_mask;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: William Tu <u9012063@gmail.com>
+Date: Thu, 5 Oct 2017 12:07:12 -0700
+Subject: ip_gre: check packet length and mtu correctly in erspan tx
+
+From: William Tu <u9012063@gmail.com>
+
+
+[ Upstream commit f192970de860d3ab90aa9e2a22853201a57bde78 ]
+
+Similarly to early patch for erspan_xmit(), the ARPHDR_ETHER device
+is the length of the whole ether packet. So skb->len should subtract
+the dev->hard_header_len.
+
+Fixes: 1a66a836da63 ("gre: add collect_md mode to ERSPAN tunnel")
+Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN")
+Signed-off-by: William Tu <u9012063@gmail.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: David Laight <David.Laight@aculab.com>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_gre.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -579,8 +579,8 @@ static void erspan_fb_xmit(struct sk_buf
+ if (gre_handle_offloads(skb, false))
+ goto err_free_rt;
+
+- if (skb->len > dev->mtu) {
+- pskb_trim(skb, dev->mtu);
++ if (skb->len > dev->mtu + dev->hard_header_len) {
++ pskb_trim(skb, dev->mtu + dev->hard_header_len);
+ truncate = true;
+ }
+
+@@ -731,8 +731,8 @@ static netdev_tx_t erspan_xmit(struct sk
+ if (skb_cow_head(skb, dev->needed_headroom))
+ goto free_skb;
+
+- if (skb->len - dev->hard_header_len > dev->mtu) {
+- pskb_trim(skb, dev->mtu);
++ if (skb->len > dev->mtu + dev->hard_header_len) {
++ pskb_trim(skb, dev->mtu + dev->hard_header_len);
+ truncate = true;
+ }
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Wei Wang <weiwan@google.com>
+Date: Fri, 6 Oct 2017 12:06:04 -0700
+Subject: ipv6: grab rt->rt6i_ref before allocating pcpu rt
+
+From: Wei Wang <weiwan@google.com>
+
+
+[ Upstream commit a94b9367e044ba672c9f4105eb1516ff6ff4948a ]
+
+After rwlock is replaced with rcu and spinlock, ip6_pol_route() will be
+called with only rcu held. That means rt6 route deletion could happen
+simultaneously with rt6_make_pcpu_rt(). This could potentially cause
+memory leak if rt6_release() is called right before rt6_make_pcpu_rt()
+on the same route.
+
+This patch grabs rt->rt6i_ref safely before calling rt6_make_pcpu_rt()
+to make sure rt6_release() will not get triggered while
+rt6_make_pcpu_rt() is in progress. And rt6_release() is called after
+rt6_make_pcpu_rt() is finished.
+
+Note: As we are incrementing rt->rt6i_ref in ip6_pol_route(), there is a
+very slim chance that fib6_purge_rt() will be triggered unnecessarily
+when deleting a route if ip6_pol_route() running on another thread picks
+this route as well and tries to make pcpu cache for it.
+
+Signed-off-by: Wei Wang <weiwan@google.com>
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/route.c | 58 +++++++++++++++++++++++++++----------------------------
+ 1 file changed, 29 insertions(+), 29 deletions(-)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1055,7 +1055,6 @@ static struct rt6_info *rt6_get_pcpu_rou
+
+ static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
+ {
+- struct fib6_table *table = rt->rt6i_table;
+ struct rt6_info *pcpu_rt, *prev, **p;
+
+ pcpu_rt = ip6_rt_pcpu_alloc(rt);
+@@ -1066,28 +1065,20 @@ static struct rt6_info *rt6_make_pcpu_ro
+ return net->ipv6.ip6_null_entry;
+ }
+
+- read_lock_bh(&table->tb6_lock);
+- if (rt->rt6i_pcpu) {
+- p = this_cpu_ptr(rt->rt6i_pcpu);
+- prev = cmpxchg(p, NULL, pcpu_rt);
+- if (prev) {
+- /* If someone did it before us, return prev instead */
+- dst_release_immediate(&pcpu_rt->dst);
+- pcpu_rt = prev;
+- }
+- } else {
+- /* rt has been removed from the fib6 tree
+- * before we have a chance to acquire the read_lock.
+- * In this case, don't brother to create a pcpu rt
+- * since rt is going away anyway. The next
+- * dst_check() will trigger a re-lookup.
+- */
++ dst_hold(&pcpu_rt->dst);
++ p = this_cpu_ptr(rt->rt6i_pcpu);
++ prev = cmpxchg(p, NULL, pcpu_rt);
++ if (prev) {
++ /* If someone did it before us, return prev instead */
++ /* release refcnt taken by ip6_rt_pcpu_alloc() */
++ dst_release_immediate(&pcpu_rt->dst);
++ /* release refcnt taken by above dst_hold() */
+ dst_release_immediate(&pcpu_rt->dst);
+- pcpu_rt = rt;
++ dst_hold(&prev->dst);
++ pcpu_rt = prev;
+ }
+- dst_hold(&pcpu_rt->dst);
++
+ rt6_dst_from_metrics_check(pcpu_rt);
+- read_unlock_bh(&table->tb6_lock);
+ return pcpu_rt;
+ }
+
+@@ -1177,19 +1168,28 @@ redo_rt6_select:
+ if (pcpu_rt) {
+ read_unlock_bh(&table->tb6_lock);
+ } else {
+- /* We have to do the read_unlock first
+- * because rt6_make_pcpu_route() may trigger
+- * ip6_dst_gc() which will take the write_lock.
+- */
+- dst_hold(&rt->dst);
+- read_unlock_bh(&table->tb6_lock);
+- pcpu_rt = rt6_make_pcpu_route(rt);
+- dst_release(&rt->dst);
++ /* atomic_inc_not_zero() is needed when using rcu */
++ if (atomic_inc_not_zero(&rt->rt6i_ref)) {
++ /* We have to do the read_unlock first
++ * because rt6_make_pcpu_route() may trigger
++ * ip6_dst_gc() which will take the write_lock.
++ *
++ * No dst_hold() on rt is needed because grabbing
++ * rt->rt6i_ref makes sure rt can't be released.
++ */
++ read_unlock_bh(&table->tb6_lock);
++ pcpu_rt = rt6_make_pcpu_route(rt);
++ rt6_release(rt);
++ } else {
++ /* rt is already removed from tree */
++ read_unlock_bh(&table->tb6_lock);
++ pcpu_rt = net->ipv6.ip6_null_entry;
++ dst_hold(&pcpu_rt->dst);
++ }
+ }
+
+ trace_fib6_table_lookup(net, pcpu_rt, table->tb6_id, fl6);
+ return pcpu_rt;
+-
+ }
+ }
+ EXPORT_SYMBOL_GPL(ip6_pol_route);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+Date: Mon, 11 Sep 2017 14:21:31 -0700
+Subject: ixgbe: fix use of uninitialized padding
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+
+[ Upstream commit dcfd6b839c998bc9838e2a47f44f37afbdf3099c ]
+
+This patch is resolving Coverity hits where padding in a structure could
+be used uninitialized.
+
+- Initialize fwd_cmd.pad/2 before ixgbe_calculate_checksum()
+
+- Initialize buffer.pad2/3 before ixgbe_hic_unlocked()
+
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 4 ++--
+ drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -3781,10 +3781,10 @@ s32 ixgbe_set_fw_drv_ver_generic(struct
+ fw_cmd.ver_build = build;
+ fw_cmd.ver_sub = sub;
+ fw_cmd.hdr.checksum = 0;
+- fw_cmd.hdr.checksum = ixgbe_calculate_checksum((u8 *)&fw_cmd,
+- (FW_CEM_HDR_LEN + fw_cmd.hdr.buf_len));
+ fw_cmd.pad = 0;
+ fw_cmd.pad2 = 0;
++ fw_cmd.hdr.checksum = ixgbe_calculate_checksum((u8 *)&fw_cmd,
++ (FW_CEM_HDR_LEN + fw_cmd.hdr.buf_len));
+
+ for (i = 0; i <= FW_CEM_MAX_RETRIES; i++) {
+ ret_val = ixgbe_host_interface_command(hw, &fw_cmd,
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+@@ -900,6 +900,8 @@ static s32 ixgbe_read_ee_hostif_buffer_X
+ /* convert offset from words to bytes */
+ buffer.address = cpu_to_be32((offset + current_word) * 2);
+ buffer.length = cpu_to_be16(words_to_read * 2);
++ buffer.pad2 = 0;
++ buffer.pad3 = 0;
+
+ status = ixgbe_hic_unlocked(hw, (u32 *)&buffer, sizeof(buffer),
+ IXGBE_HI_COMMAND_TIMEOUT);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Shakeel Butt <shakeelb@google.com>
+Date: Thu, 5 Oct 2017 18:07:24 -0700
+Subject: kvm, mm: account kvm related kmem slabs to kmemcg
+
+From: Shakeel Butt <shakeelb@google.com>
+
+
+[ Upstream commit 46bea48ac241fe0b413805952dda74dd0c09ba8b ]
+
+The kvm slabs can consume a significant amount of system memory
+and indeed in our production environment we have observed that
+a lot of machines are spending significant amount of memory that
+can not be left as system memory overhead. Also the allocations
+from these slabs can be triggered directly by user space applications
+which has access to kvm and thus a buggy application can leak
+such memory. So, these caches should be accounted to kmemcg.
+
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/mmu.c | 4 ++--
+ virt/kvm/kvm_main.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5476,13 +5476,13 @@ int kvm_mmu_module_init(void)
+
+ pte_list_desc_cache = kmem_cache_create("pte_list_desc",
+ sizeof(struct pte_list_desc),
+- 0, 0, NULL);
++ 0, SLAB_ACCOUNT, NULL);
+ if (!pte_list_desc_cache)
+ goto nomem;
+
+ mmu_page_header_cache = kmem_cache_create("kvm_mmu_page_header",
+ sizeof(struct kvm_mmu_page),
+- 0, 0, NULL);
++ 0, SLAB_ACCOUNT, NULL);
+ if (!mmu_page_header_cache)
+ goto nomem;
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -4018,7 +4018,7 @@ int kvm_init(void *opaque, unsigned vcpu
+ if (!vcpu_align)
+ vcpu_align = __alignof__(struct kvm_vcpu);
+ kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
+- 0, NULL);
++ SLAB_ACCOUNT, NULL);
+ if (!kvm_vcpu_cache) {
+ r = -ENOMEM;
+ goto out_free_3;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Andrew Jeffery <andrew@aj.id.au>
+Date: Fri, 1 Sep 2017 15:08:58 +0930
+Subject: leds: pca955x: Don't invert requested value in pca955x_gpio_set_value()
+
+From: Andrew Jeffery <andrew@aj.id.au>
+
+
+[ Upstream commit 52ca7d0f7bdad832b291ed979146443533ee79c0 ]
+
+The PCA9552 lines can be used either for driving LEDs or as GPIOs. The
+manual states that for LEDs, the operation is open-drain:
+
+ The LSn LED select registers determine the source of the LED data.
+
+ 00 = output is set LOW (LED on)
+ 01 = output is set high-impedance (LED off; default)
+ 10 = output blinks at PWM0 rate
+ 11 = output blinks at PWM1 rate
+
+For GPIOs it suggests a pull-up so that the open-case drives the line
+high:
+
+ For use as output, connect external pull-up resistor to the pin
+ and size it according to the DC recommended operating
+ characteristics. LED output pin is HIGH when the output is
+ programmed as high-impedance, and LOW when the output is
+ programmed LOW through the ‘LED selector’ register. The output
+ can be pulse-width controlled when PWM0 or PWM1 are used.
+
+Now, I have a hardware design that uses the LED controller to control
+LEDs. However, for $reasons, we're using the leds-gpio driver to drive
+the them. The reasons are here are a tangent but lead to the discovery
+of the inversion, which manifested as the LEDs being set to full
+brightness at boot when we expected them to be off.
+
+As we're driving the LEDs through leds-gpio, this means wending our way
+through the gpiochip abstractions. So with that in mind we need to
+describe an active-low GPIO configuration to drive the LEDs as though
+they were GPIOs.
+
+The set() gpiochip callback in leds-pca955x does the following:
+
+ ...
+ if (val)
+ pca955x_led_set(&led->led_cdev, LED_FULL);
+ else
+ pca955x_led_set(&led->led_cdev, LED_OFF);
+ ...
+
+Where LED_FULL = 255. pca955x_led_set() in turn does:
+
+ ...
+ switch (value) {
+ case LED_FULL:
+ ls = pca955x_ledsel(ls, ls_led, PCA955X_LS_LED_ON);
+ break;
+ ...
+
+Where PCA955X_LS_LED_ON is defined as:
+
+ #define PCA955X_LS_LED_ON 0x0 /* Output LOW */
+
+So here we have some type confusion: We've crossed domains from GPIO
+behaviour to LED behaviour without accounting for possible inversions
+in the process.
+
+Stepping back to leds-gpio for a moment, during probe() we call
+create_gpio_led(), which eventually executes:
+
+ if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP) {
+ state = gpiod_get_value_cansleep(led_dat->gpiod);
+ if (state < 0)
+ return state;
+ } else {
+ state = (template->default_state == LEDS_GPIO_DEFSTATE_ON);
+ }
+ ...
+ ret = gpiod_direction_output(led_dat->gpiod, state);
+
+In the devicetree the GPIO is annotated as active-low, and
+gpiod_get_value_cansleep() handles this for us:
+
+ int gpiod_get_value_cansleep(const struct gpio_desc *desc)
+ {
+ int value;
+
+ might_sleep_if(extra_checks);
+ VALIDATE_DESC(desc);
+ value = _gpiod_get_raw_value(desc);
+ if (value < 0)
+ return value;
+
+ if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+ value = !value;
+
+ return value;
+ }
+
+_gpiod_get_raw_value() in turn calls through the get() callback for the
+gpiochip implementation, so returning to our get() implementation in
+leds-pca955x we find we extract the raw value from hardware:
+
+ static int pca955x_gpio_get_value(struct gpio_chip *gc, unsigned int offset)
+ {
+ struct pca955x *pca955x = gpiochip_get_data(gc);
+ struct pca955x_led *led = &pca955x->leds[offset];
+ u8 reg = pca955x_read_input(pca955x->client, led->led_num / 8);
+
+ return !!(reg & (1 << (led->led_num % 8)));
+ }
+
+This behaviour is not symmetric with that of set(), where the val is
+inverted by the driver.
+
+Closing the loop on the GPIO_ACTIVE_LOW inversions,
+gpiod_direction_output(), like gpiod_get_value_cansleep(), handles it
+for us:
+
+ int gpiod_direction_output(struct gpio_desc *desc, int value)
+ {
+ VALIDATE_DESC(desc);
+ if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+ value = !value;
+ else
+ value = !!value;
+ return _gpiod_direction_output_raw(desc, value);
+ }
+
+All-in-all, with a value of 'keep' for default-state property in a
+leds-gpio child node, the current state of the hardware will in-fact be
+inverted; precisely the opposite of what was intended.
+
+Rework leds-pca955x so that we avoid the incorrect inversion and clarify
+the semantics with respect to GPIO.
+
+Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Joel Stanley <joel@jms.id.au>
+Tested-by: Matt Spinler <mspinler@linux.vnet.ibm.com>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/leds-pca955x.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/leds/leds-pca955x.c
++++ b/drivers/leds/leds-pca955x.c
+@@ -61,6 +61,10 @@
+ #define PCA955X_LS_BLINK0 0x2 /* Blink at PWM0 rate */
+ #define PCA955X_LS_BLINK1 0x3 /* Blink at PWM1 rate */
+
++#define PCA955X_GPIO_INPUT LED_OFF
++#define PCA955X_GPIO_HIGH LED_OFF
++#define PCA955X_GPIO_LOW LED_FULL
++
+ enum pca955x_type {
+ pca9550,
+ pca9551,
+@@ -329,9 +333,9 @@ static int pca955x_set_value(struct gpio
+ struct pca955x_led *led = &pca955x->leds[offset];
+
+ if (val)
+- return pca955x_led_set(&led->led_cdev, LED_FULL);
+- else
+- return pca955x_led_set(&led->led_cdev, LED_OFF);
++ return pca955x_led_set(&led->led_cdev, PCA955X_GPIO_HIGH);
++
++ return pca955x_led_set(&led->led_cdev, PCA955X_GPIO_LOW);
+ }
+
+ static void pca955x_gpio_set_value(struct gpio_chip *gc, unsigned int offset,
+@@ -355,8 +359,11 @@ static int pca955x_gpio_get_value(struct
+ static int pca955x_gpio_direction_input(struct gpio_chip *gc,
+ unsigned int offset)
+ {
+- /* To use as input ensure pin is not driven */
+- return pca955x_set_value(gc, offset, 0);
++ struct pca955x *pca955x = gpiochip_get_data(gc);
++ struct pca955x_led *led = &pca955x->leds[offset];
++
++ /* To use as input ensure pin is not driven. */
++ return pca955x_led_set(&led->led_cdev, PCA955X_GPIO_INPUT);
+ }
+
+ static int pca955x_gpio_direction_output(struct gpio_chip *gc,
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Mon, 9 Oct 2017 10:32:48 +0800
+Subject: md: always set THREAD_WAKEUP and wake up wqueue if thread existed
+
+From: Guoqing Jiang <gqjiang@suse.com>
+
+
+[ Upstream commit d1d90147c9680aaec4a5757932c2103c42c9c23b ]
+
+Since commit 4ad23a976413 ("MD: use per-cpu counter for writes_pending"),
+the wait_queue is only got invoked if THREAD_WAKEUP is not set previously.
+
+With above change, I can see process_metadata_update could always hang on
+the wait queue, because mddev->thread could stay on 'D' status and the
+THREAD_WAKEUP flag is not cleared since there are lots of place to wake up
+mddev->thread. Then deadlock happened as follows:
+
+linux175:~ # ps aux|grep md|grep D
+root 20117 0.0 0.0 0 0 ? D 03:45 0:00 [md0_raid1]
+root 20125 0.0 0.0 0 0 ? D 03:45 0:00 [md0_cluster_rec]
+linux175:~ # cat /proc/20117/stack
+[<ffffffffa0635604>] dlm_lock_sync+0x94/0xd0 [md_cluster]
+[<ffffffffa0635674>] lock_token+0x34/0xd0 [md_cluster]
+[<ffffffffa0635804>] metadata_update_start+0x64/0x110 [md_cluster]
+[<ffffffffa04d985b>] md_update_sb.part.58+0x9b/0x860 [md_mod]
+[<ffffffffa04da035>] md_update_sb+0x15/0x30 [md_mod]
+[<ffffffffa04dc066>] md_check_recovery+0x266/0x490 [md_mod]
+[<ffffffffa06450e2>] raid1d+0x42/0x810 [raid1]
+[<ffffffffa04d2252>] md_thread+0x122/0x150 [md_mod]
+[<ffffffff81091741>] kthread+0x101/0x140
+linux175:~ # cat /proc/20125/stack
+[<ffffffffa0636679>] recv_daemon+0x3f9/0x5c0 [md_cluster]
+[<ffffffffa04d2252>] md_thread+0x122/0x150 [md_mod]
+[<ffffffff81091741>] kthread+0x101/0x140
+
+So let's revert the part of code in the commit to resovle the problem since
+we can't get lots of benefits of previous change.
+
+Fixes: 4ad23a976413 ("MD: use per-cpu counter for writes_pending")
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7468,8 +7468,8 @@ void md_wakeup_thread(struct md_thread *
+ {
+ if (thread) {
+ pr_debug("md: waking up MD thread %s.\n", thread->tsk->comm);
+- if (!test_and_set_bit(THREAD_WAKEUP, &thread->flags))
+- wake_up(&thread->wqueue);
++ set_bit(THREAD_WAKEUP, &thread->flags);
++ wake_up(&thread->wqueue);
+ }
+ }
+ EXPORT_SYMBOL(md_wakeup_thread);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Mike Manning <mmanning@brocade.com>
+Date: Mon, 25 Sep 2017 22:01:36 +0100
+Subject: net: ipv6: send NS for DAD when link operationally up
+
+From: Mike Manning <mmanning@brocade.com>
+
+
+[ Upstream commit 1f372c7bfb23286d2bf4ce0423ab488e86b74bb2 ]
+
+The NS for DAD are sent on admin up as long as a valid qdisc is found.
+A race condition exists by which these packets will not egress the
+interface if the operational state of the lower device is not yet up.
+The solution is to delay DAD until the link is operationally up
+according to RFC2863. Rather than only doing this, follow the existing
+code checks by deferring IPv6 device initialization altogether. The fix
+allows DAD on devices like tunnels that are controlled by userspace
+control plane. The fix has no impact on regular deployments, but means
+that there is no IPv6 connectivity until the port has been opened in
+the case of port-based network access control, which should be
+desirable.
+
+Signed-off-by: Mike Manning <mmanning@brocade.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -303,10 +303,10 @@ static struct ipv6_devconf ipv6_devconf_
+ .disable_policy = 0,
+ };
+
+-/* Check if a valid qdisc is available */
+-static inline bool addrconf_qdisc_ok(const struct net_device *dev)
++/* Check if link is ready: is it up and is a valid qdisc available */
++static inline bool addrconf_link_ready(const struct net_device *dev)
+ {
+- return !qdisc_tx_is_noop(dev);
++ return netif_oper_up(dev) && !qdisc_tx_is_noop(dev);
+ }
+
+ static void addrconf_del_rs_timer(struct inet6_dev *idev)
+@@ -451,7 +451,7 @@ static struct inet6_dev *ipv6_add_dev(st
+
+ ndev->token = in6addr_any;
+
+- if (netif_running(dev) && addrconf_qdisc_ok(dev))
++ if (netif_running(dev) && addrconf_link_ready(dev))
+ ndev->if_flags |= IF_READY;
+
+ ipv6_mc_init_dev(ndev);
+@@ -3404,7 +3404,7 @@ static int addrconf_notify(struct notifi
+ /* restore routes for permanent addresses */
+ addrconf_permanent_addr(dev);
+
+- if (!addrconf_qdisc_ok(dev)) {
++ if (!addrconf_link_ready(dev)) {
+ /* device is not ready yet. */
+ pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+ dev->name);
+@@ -3419,7 +3419,7 @@ static int addrconf_notify(struct notifi
+ run_pending = 1;
+ }
+ } else if (event == NETDEV_CHANGE) {
+- if (!addrconf_qdisc_ok(dev)) {
++ if (!addrconf_link_ready(dev)) {
+ /* device is still not ready. */
+ break;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Dan Murphy <dmurphy@ti.com>
+Date: Tue, 10 Oct 2017 12:42:56 -0500
+Subject: net: phy: at803x: Change error to EINVAL for invalid MAC
+
+From: Dan Murphy <dmurphy@ti.com>
+
+
+[ Upstream commit fc7556877d1748ac00958822a0a3bba1d4bd9e0d ]
+
+Change the return error code to EINVAL if the MAC
+address is not valid in the set_wol function.
+
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/at803x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -167,7 +167,7 @@ static int at803x_set_wol(struct phy_dev
+ mac = (const u8 *) ndev->dev_addr;
+
+ if (!is_valid_ether_addr(mac))
+- return -EFAULT;
++ return -EINVAL;
+
+ for (i = 0; i < 3; i++) {
+ phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
--- /dev/null
+From f044113113dd95ba73916bde10e804d3cdfa2662 Mon Sep 17 00:00:00 2001
+From: Jens Wiklander <jens.wiklander@linaro.org>
+Date: Mon, 9 Oct 2017 11:11:49 +0200
+Subject: optee: fix invalid of_node_put() in optee_driver_init()
+
+From: Jens Wiklander <jens.wiklander@linaro.org>
+
+commit f044113113dd95ba73916bde10e804d3cdfa2662 upstream.
+
+The first node supplied to of_find_matching_node() has its reference
+counter decreased as part of call to that function. In optee_driver_init()
+after calling of_find_matching_node() it's invalid to call of_node_put() on
+the supplied node again.
+
+So remove the invalid call to of_node_put().
+
+Reported-by: Alex Shi <alex.shi@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Cc: <andi@linux-stable.l.notmuch.email>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tee/optee/core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -590,7 +590,6 @@ static int __init optee_driver_init(void
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+- of_node_put(fw_np);
+ if (!np)
+ return -ENODEV;
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Gabriele Paoloni <gabriele.paoloni@huawei.com>
+Date: Thu, 28 Sep 2017 15:33:05 +0100
+Subject: PCI/AER: Report non-fatal errors only to the affected endpoint
+
+From: Gabriele Paoloni <gabriele.paoloni@huawei.com>
+
+
+[ Upstream commit 86acc790717fb60fb51ea3095084e331d8711c74 ]
+
+Previously, if an non-fatal error was reported by an endpoint, we
+called report_error_detected() for the endpoint, every sibling on the
+bus, and their descendents. If any of them did not implement the
+.error_detected() method, do_recovery() failed, leaving all these
+devices unrecovered.
+
+For example, the system described in the bugzilla below has two devices:
+
+ 0000:74:02.0 [19e5:a230] SAS controller, driver has .error_detected()
+ 0000:74:03.0 [19e5:a235] SATA controller, driver lacks .error_detected()
+
+When a device such as 74:02.0 reported a non-fatal error, do_recovery()
+failed because 74:03.0 lacked an .error_detected() method. But per PCIe
+r3.1, sec 6.2.2.2.2, such an error does not compromise the Link and
+does not affect 74:03.0:
+
+ Non-fatal errors are uncorrectable errors which cause a particular
+ transaction to be unreliable but the Link is otherwise fully functional.
+ Isolating Non-fatal from Fatal errors provides Requester/Receiver logic
+ in a device or system management software the opportunity to recover from
+ the error without resetting the components on the Link and disturbing
+ other transactions in progress. Devices not associated with the
+ transaction in error are not impacted by the error.
+
+Report non-fatal errors only to the endpoint that reported them. We really
+want to check for AER_NONFATAL here, but the current code structure doesn't
+allow that. Looking for pci_channel_io_normal is the best we can do now.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197055
+Fixes: 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver")
+Signed-off-by: Gabriele Paoloni <gabriele.paoloni@huawei.com>
+Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pcie/aer/aerdrv_core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/aer/aerdrv_core.c
++++ b/drivers/pci/pcie/aer/aerdrv_core.c
+@@ -390,7 +390,14 @@ static pci_ers_result_t broadcast_error_
+ * If the error is reported by an end point, we think this
+ * error is related to the upstream link of the end point.
+ */
+- pci_walk_bus(dev->bus, cb, &result_data);
++ if (state == pci_channel_io_normal)
++ /*
++ * the error is non fatal so the bus is ok, just invoke
++ * the callback for the function that logged the error.
++ */
++ cb(dev, &result_data);
++ else
++ pci_walk_bus(dev->bus, cb, &result_data);
+ }
+
+ return result_data.result;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: David Daney <david.daney@cavium.com>
+Date: Fri, 8 Sep 2017 10:10:31 +0200
+Subject: PCI: Avoid bus reset if bridge itself is broken
+
+From: David Daney <david.daney@cavium.com>
+
+
+[ Upstream commit 357027786f3523d26f42391aa4c075b8495e5d28 ]
+
+When checking to see if a PCI bus can safely be reset, we previously
+checked to see if any of the children had their PCI_DEV_FLAGS_NO_BUS_RESET
+flag set. Children marked with that flag are known not to behave well
+after a bus reset.
+
+Some PCIe root port bridges also do not behave well after a bus reset,
+sometimes causing the devices behind the bridge to become unusable.
+
+Add a check for PCI_DEV_FLAGS_NO_BUS_RESET being set in the bridge device
+to allow these bridges to be flagged, and prevent their secondary buses
+from being reset.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+[jglauber@cavium.com: fixed typo]
+Signed-off-by: Jan Glauber <jglauber@cavium.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4356,6 +4356,10 @@ static bool pci_bus_resetable(struct pci
+ {
+ struct pci_dev *dev;
+
++
++ if (bus->self && (bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ return false;
++
+ list_for_each_entry(dev, &bus->devices, bus_list) {
+ if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+ (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+Date: Wed, 4 Oct 2017 10:57:52 -0500
+Subject: PCI: Create SR-IOV virtfn/physfn links before attaching driver
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+
+[ Upstream commit 27d6162944b9b34c32cd5841acd21786637ee743 ]
+
+When creating virtual functions, create the "virtfn%u" and "physfn" links
+in sysfs *before* attaching the driver instead of after. When we attach
+the driver to the new virtual network interface first, there is a race when
+the driver attaches to the new sends out an "add" udev event, and the
+network interface naming software (biosdevname or systemd, for example)
+tries to look at these links.
+
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/iov.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -162,7 +162,6 @@ int pci_iov_add_virtfn(struct pci_dev *d
+
+ pci_device_add(virtfn, virtfn->bus);
+
+- pci_bus_add_device(virtfn);
+ sprintf(buf, "virtfn%u", id);
+ rc = sysfs_create_link(&dev->dev.kobj, &virtfn->dev.kobj, buf);
+ if (rc)
+@@ -173,6 +172,8 @@ int pci_iov_add_virtfn(struct pci_dev *d
+
+ kobject_uevent(&virtfn->dev.kobj, KOBJ_CHANGE);
+
++ pci_bus_add_device(virtfn);
++
+ return 0;
+
+ failed2:
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Tue, 3 Oct 2017 18:29:49 -0400
+Subject: percpu: don't forget to free the temporary struct pcpu_alloc_info
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+
+[ Upstream commit 438a50618095061920d3a30d4c5ca1ef2e0ff860 ]
+
+Unlike the SMP case, the !SMP case does not free the memory for struct
+pcpu_alloc_info allocated in setup_per_cpu_areas(). And to give it a
+chance of being reused by the page allocator later, align it to a page
+boundary just like its size.
+
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Acked-by: Dennis Zhou <dennisszhou@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/percpu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1856,7 +1856,7 @@ struct pcpu_alloc_info * __init pcpu_all
+ __alignof__(ai->groups[0].cpu_map[0]));
+ ai_size = base_size + nr_units * sizeof(ai->groups[0].cpu_map[0]);
+
+- ptr = memblock_virt_alloc_nopanic(PFN_ALIGN(ai_size), 0);
++ ptr = memblock_virt_alloc_nopanic(PFN_ALIGN(ai_size), PAGE_SIZE);
+ if (!ptr)
+ return NULL;
+ ai = ptr;
+@@ -2719,6 +2719,7 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
++ pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Fri, 29 Sep 2017 14:39:49 -0300
+Subject: PM / OPP: Move error message to debug level
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+
+[ Upstream commit 035ed07208dc501d023873447113f3f178592156 ]
+
+On some i.MX6 platforms which do not have speed grading
+check, opp table will not be created in platform code,
+so cpufreq driver prints the following error message:
+
+cpu cpu0: dev_pm_opp_get_opp_count: OPP table not found (-19)
+
+However, this is not really an error in this case because the
+imx6q-cpufreq driver first calls dev_pm_opp_get_opp_count()
+and if it fails, it means that platform code does not provide
+OPP and then dev_pm_opp_of_add_table() will be called.
+
+In order to avoid such confusing error message, move it to
+debug level.
+
+It is up to the caller of dev_pm_opp_get_opp_count() to check its
+return value and decide if it will print an error or not.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/opp/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/power/opp/core.c
++++ b/drivers/base/power/opp/core.c
+@@ -296,7 +296,7 @@ int dev_pm_opp_get_opp_count(struct devi
+ opp_table = _find_opp_table(dev);
+ if (IS_ERR(opp_table)) {
+ count = PTR_ERR(opp_table);
+- dev_err(dev, "%s: OPP table not found (%d)\n",
++ dev_dbg(dev, "%s: OPP table not found (%d)\n",
+ __func__, count);
+ return count;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Fri, 29 Sep 2017 13:29:39 +1000
+Subject: powerpc/watchdog: Do not trigger SMP crash from touch_nmi_watchdog
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+
+[ Upstream commit 80e4d70b06863e0104e5a0dc78aa3710297fbd4b ]
+
+In xmon, touch_nmi_watchdog() is not expected to be checking that
+other CPUs have not touched the watchdog, so the code will just call
+touch_nmi_watchdog() once before re-enabling hard interrupts.
+
+Just update our CPU's state, and ignore apparently stuck SMP threads.
+
+Arguably touch_nmi_watchdog should check for SMP lockups, and callers
+should be fixed, but that's not trivial for the input code of xmon.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/watchdog.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/watchdog.c
++++ b/arch/powerpc/kernel/watchdog.c
+@@ -276,9 +276,12 @@ void arch_touch_nmi_watchdog(void)
+ {
+ unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000;
+ int cpu = smp_processor_id();
++ u64 tb = get_tb();
+
+- if (get_tb() - per_cpu(wd_timer_tb, cpu) >= ticks)
+- watchdog_timer_interrupt(cpu);
++ if (tb - per_cpu(wd_timer_tb, cpu) >= ticks) {
++ per_cpu(wd_timer_tb, cpu) = tb;
++ wd_smp_clear_cpu_pending(cpu, tb);
++ }
+ }
+ EXPORT_SYMBOL(arch_touch_nmi_watchdog);
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Fri, 29 Sep 2017 13:29:40 +1000
+Subject: powerpc/xmon: Avoid tripping SMP hardlockup watchdog
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+
+[ Upstream commit 064996d62a33ffe10264b5af5dca92d54f60f806 ]
+
+The SMP hardlockup watchdog cross-checks other CPUs for lockups, which
+causes xmon headaches because it's assuming interrupts hard disabled
+means no watchdog troubles. Try to improve that by calling
+touch_nmi_watchdog() in obvious places where secondaries are spinning.
+
+Also annotate these spin loops with spin_begin/end calls.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/xmon/xmon.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -530,14 +530,19 @@ static int xmon_core(struct pt_regs *reg
+
+ waiting:
+ secondary = 1;
++ spin_begin();
+ while (secondary && !xmon_gate) {
+ if (in_xmon == 0) {
+- if (fromipi)
++ if (fromipi) {
++ spin_end();
+ goto leave;
++ }
+ secondary = test_and_set_bit(0, &in_xmon);
+ }
+- barrier();
++ spin_cpu_relax();
++ touch_nmi_watchdog();
+ }
++ spin_end();
+
+ if (!secondary && !xmon_gate) {
+ /* we are the first cpu to come in */
+@@ -568,21 +573,25 @@ static int xmon_core(struct pt_regs *reg
+ mb();
+ xmon_gate = 1;
+ barrier();
++ touch_nmi_watchdog();
+ }
+
+ cmdloop:
+ while (in_xmon) {
+ if (secondary) {
++ spin_begin();
+ if (cpu == xmon_owner) {
+ if (!test_and_set_bit(0, &xmon_taken)) {
+ secondary = 0;
++ spin_end();
+ continue;
+ }
+ /* missed it */
+ while (cpu == xmon_owner)
+- barrier();
++ spin_cpu_relax();
+ }
+- barrier();
++ spin_cpu_relax();
++ touch_nmi_watchdog();
+ } else {
+ cmd = cmds(regs);
+ if (cmd != 0) {
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: "Wei Hu(Xavier)" <xavier.huwei@huawei.com>
+Date: Fri, 29 Sep 2017 23:10:12 +0800
+Subject: RDMA/hns: Avoid NULL pointer exception
+
+From: "Wei Hu(Xavier)" <xavier.huwei@huawei.com>
+
+
+[ Upstream commit 5e437b1d7e8d31ff9a4b8e898eb3a6cee309edd9 ]
+
+After the loop in hns_roce_v1_mr_free_work_fn function, it is possible that
+all qps will have been freed (in which case ne will be 0). If that
+happens, then later in the function when we dereference hr_qp we will
+get an exception. Check ne is not 0 to make sure we actually have an
+hr_qp left to work on.
+
+This patch fixes the smatch error as below:
+drivers/infiniband/hw/hns/hns_roce_hw_v1.c:1009 hns_roce_v1_mr_free_work_fn()
+error: we previously assumed 'hr_qp' could be null
+
+Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Shaobo Xu <xushaobo2@huawei.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+@@ -1001,6 +1001,11 @@ static void hns_roce_v1_mr_free_work_fn(
+ }
+ }
+
++ if (!ne) {
++ dev_err(dev, "Reseved loop qp is absent!\n");
++ goto free_work;
++ }
++
+ do {
+ ret = hns_roce_v1_poll_cq(&mr_free_cq->ib_cq, ne, wc);
+ if (ret < 0) {
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 29 Sep 2017 11:22:15 +0100
+Subject: rtc: pl031: make interrupt optional
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 5b64a2965dfdfca8039e93303c64e2b15c19ff0c ]
+
+On some platforms, the interrupt for the PL031 is optional. Avoid
+trying to claim the interrupt if it's not specified.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-pl031.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -308,7 +308,8 @@ static int pl031_remove(struct amba_devi
+
+ dev_pm_clear_wake_irq(&adev->dev);
+ device_init_wakeup(&adev->dev, false);
+- free_irq(adev->irq[0], ldata);
++ if (adev->irq[0])
++ free_irq(adev->irq[0], ldata);
+ rtc_device_unregister(ldata->rtc);
+ iounmap(ldata->base);
+ kfree(ldata);
+@@ -381,12 +382,13 @@ static int pl031_probe(struct amba_devic
+ goto out_no_rtc;
+ }
+
+- if (request_irq(adev->irq[0], pl031_interrupt,
+- vendor->irqflags, "rtc-pl031", ldata)) {
+- ret = -EIO;
+- goto out_no_irq;
++ if (adev->irq[0]) {
++ ret = request_irq(adev->irq[0], pl031_interrupt,
++ vendor->irqflags, "rtc-pl031", ldata);
++ if (ret)
++ goto out_no_irq;
++ dev_pm_set_wake_irq(&adev->dev, adev->irq[0]);
+ }
+- dev_pm_set_wake_irq(&adev->dev, adev->irq[0]);
+ return 0;
+
+ out_no_irq:
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 28 Sep 2017 13:53:27 +0200
+Subject: rtc: set the alarm to the next expiring timer
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+
+[ Upstream commit 74717b28cb32e1ad3c1042cafd76b264c8c0f68d ]
+
+If there is any non expired timer in the queue, the RTC alarm is never set.
+This is an issue when adding a timer that expires before the next non
+expired timer.
+
+Ensure the RTC alarm is set in that case.
+
+Fixes: 2b2f5ff00f63 ("rtc: interface: ignore expired timers when enqueuing new timers")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -779,7 +779,7 @@ static int rtc_timer_enqueue(struct rtc_
+ }
+
+ timerqueue_add(&rtc->timerqueue, &timer->node);
+- if (!next) {
++ if (!next || ktime_before(timer->node.expires, next->expires)) {
+ struct rtc_wkalrm alarm;
+ int err;
+ alarm.time = rtc_ktime_to_tm(timer->node.expires);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Varun Prakash <varun@chelsio.com>
+Date: Wed, 11 Oct 2017 19:33:07 +0530
+Subject: scsi: cxgb4i: fix Tx skb leak
+
+From: Varun Prakash <varun@chelsio.com>
+
+
+[ Upstream commit 9b3a081fb62158b50bcc90522ca2423017544367 ]
+
+In case of connection reset Tx skb queue can have some skbs which are
+not transmitted so purge Tx skb queue in release_offload_resources() to
+avoid skb leak.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+@@ -1575,6 +1575,7 @@ static void release_offload_resources(st
+ csk, csk->state, csk->flags, csk->tid);
+
+ cxgbi_sock_free_cpl_skbs(csk);
++ cxgbi_sock_purge_write_queue(csk);
+ if (csk->wr_cred != csk->wr_max_cred) {
+ cxgbi_sock_purge_wr_queue(csk);
+ cxgbi_sock_reset_wr_list(csk);
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+Date: Fri, 29 Sep 2017 17:34:42 -0700
+Subject: scsi: lpfc: Fix secure firmware updates
+
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+
+
+[ Upstream commit 184fc2b9a8bcbda9c14d0a1e7fbecfc028c7702e ]
+
+Firmware update fails with: status x17 add_status x56 on the final write
+
+If multiple DMA buffers are used for the download, some firmware revs
+have difficulty with signatures and crcs split across the dma buffer
+boundaries. Resolve by making all writes be a single 4k page in length.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_hw4.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_hw4.h
++++ b/drivers/scsi/lpfc/lpfc_hw4.h
+@@ -3636,7 +3636,7 @@ struct lpfc_mbx_get_port_name {
+ #define MB_CEQ_STATUS_QUEUE_FLUSHING 0x4
+ #define MB_CQE_STATUS_DMA_FAILED 0x5
+
+-#define LPFC_MBX_WR_CONFIG_MAX_BDE 8
++#define LPFC_MBX_WR_CONFIG_MAX_BDE 1
+ struct lpfc_mbx_wr_object {
+ struct mbox_header header;
+ union {
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+Date: Fri, 29 Sep 2017 17:34:31 -0700
+Subject: scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined
+
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+
+
+[ Upstream commit 2299e4323d2bf6e0728fdc6b9e8e9704978d2dd7 ]
+
+Warning messages when NVME_TARGET_FC not defined on ppc builds
+
+The lpfc_nvmet_replenish_context() function is only meaningful when NVME
+target mode enabled. Surround the function body with ifdefs for target
+mode enablement.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_nvmet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1464,6 +1464,7 @@ static struct lpfc_nvmet_ctxbuf *
+ lpfc_nvmet_replenish_context(struct lpfc_hba *phba,
+ struct lpfc_nvmet_ctx_info *current_infop)
+ {
++#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+ struct lpfc_nvmet_ctxbuf *ctx_buf = NULL;
+ struct lpfc_nvmet_ctx_info *get_infop;
+ int i;
+@@ -1511,6 +1512,7 @@ lpfc_nvmet_replenish_context(struct lpfc
+ get_infop = get_infop->nvmet_ctx_next_cpu;
+ }
+
++#endif
+ /* Nothing found, all contexts for the MRQ are in-flight */
+ return NULL;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+Date: Fri, 29 Sep 2017 17:34:32 -0700
+Subject: scsi: lpfc: PLOGI failures during NPIV testing
+
+From: Dick Kennedy <dick.kennedy@broadcom.com>
+
+
+[ Upstream commit e8bcf0ae4c0346fdc78ebefe0eefcaa6a6622d38 ]
+
+Local Reject/Invalid RPI errors seen during discovery.
+
+Temporary RPI cleanup was occurring regardless of SLI rev. It's only
+necessary on SLI-4.
+
+Adjust the test for whether cleanup is necessary.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4983,7 +4983,8 @@ lpfc_nlp_remove(struct lpfc_vport *vport
+ lpfc_cancel_retry_delay_tmo(vport, ndlp);
+ if ((ndlp->nlp_flag & NLP_DEFER_RM) &&
+ !(ndlp->nlp_flag & NLP_REG_LOGIN_SEND) &&
+- !(ndlp->nlp_flag & NLP_RPI_REGISTERED)) {
++ !(ndlp->nlp_flag & NLP_RPI_REGISTERED) &&
++ phba->sli_rev != LPFC_SLI_REV4) {
+ /* For this case we need to cleanup the default rpi
+ * allocated by the firmware.
+ */
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Tue, 10 Oct 2017 18:41:18 +0530
+Subject: scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+
+[ Upstream commit 2ce9a3645299ba1752873d333d73f67620f4550b ]
+
+Whenever an I/O for a RAID volume fails with IOCStatus
+MPI2_IOCSTATUS_SCSI_IOC_TERMINATED and SCSIStatus equal to
+(MPI2_SCSI_STATE_TERMINATED | MPI2_SCSI_STATE_NO_SCSI_STATUS) then
+return the I/O to SCSI midlayer with "DID_RESET" (i.e. retry the IO
+infinite times) set in the host byte.
+
+Previously, the driver was completing the I/O with "DID_SOFT_ERROR"
+which causes the I/O to be quickly retried. However, firmware needed
+more time and hence I/Os were failing.
+
+Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4804,6 +4804,11 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ } else if (log_info == VIRTUAL_IO_FAILED_RETRY) {
+ scmd->result = DID_RESET << 16;
+ break;
++ } else if ((scmd->device->channel == RAID_CHANNEL) &&
++ (scsi_state == (MPI2_SCSI_STATE_TERMINATED |
++ MPI2_SCSI_STATE_NO_SCSI_STATUS))) {
++ scmd->result = DID_RESET << 16;
++ break;
+ }
+ scmd->result = DID_SOFT_ERROR << 16;
+ break;
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Tue, 3 Oct 2017 19:20:08 -0300
+Subject: sctp: silence warns on sctp_stream_init allocations
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+
+[ Upstream commit 1ae2eaaa229bc350b6f38fbf4ab9c873532aecfb ]
+
+As SCTP supports up to 65535 streams, that can lead to very large
+allocations in sctp_stream_init(). As Xin Long noticed, systems with
+small amounts of memory are more prone to not have enough memory and
+dump warnings on dmesg initiated by user actions. Thus, silence them.
+
+Also, if the reallocation of stream->out is not necessary, skip it and
+keep the memory we already have.
+
+Reported-by: Xin Long <lucien.xin@gmail.com>
+Tested-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/stream.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -40,9 +40,14 @@ int sctp_stream_init(struct sctp_stream
+ {
+ int i;
+
++ gfp |= __GFP_NOWARN;
++
+ /* Initial stream->out size may be very big, so free it and alloc
+- * a new one with new outcnt to save memory.
++ * a new one with new outcnt to save memory if needed.
+ */
++ if (outcnt == stream->outcnt)
++ goto in;
++
+ kfree(stream->out);
+
+ stream->out = kcalloc(outcnt, sizeof(*stream->out), gfp);
+@@ -53,6 +58,7 @@ int sctp_stream_init(struct sctp_stream
+ for (i = 0; i < stream->outcnt; i++)
+ stream->out[i].state = SCTP_STREAM_OPEN;
+
++in:
+ if (!incnt)
+ return 0;
+
x86-cpufeatures-enable-new-sse-avx-avx512-cpu-features.patch
x86-cpuid-replace-set-clear_bit32.patch
x86-cpufeatures-re-tabulate-the-x86_feature-definitions.patch
+optee-fix-invalid-of_node_put-in-optee_driver_init.patch
+backlight-pwm_bl-fix-overflow-condition.patch
+drm-add-retries-for-lspcon-mode-detection.patch
+clk-sunxi-ng-nm-check-if-requested-rate-is-supported-by-fractional-clock.patch
+clk-sunxi-ng-sun5i-fix-bit-offset-of-audio-pll-post-divider.patch
+crypto-crypto4xx-increase-context-and-scatter-ring-buffer-elements.patch
+crypto-lrw-fix-an-error-handling-path-in-create.patch
+rtc-pl031-make-interrupt-optional.patch
+kvm-mm-account-kvm-related-kmem-slabs-to-kmemcg.patch
+net-phy-at803x-change-error-to-einval-for-invalid-mac.patch
+pci-avoid-bus-reset-if-bridge-itself-is-broken.patch
+scsi-cxgb4i-fix-tx-skb-leak.patch
+scsi-mpt3sas-fix-io-error-occurs-on-pulling-out-a-drive-from-raid1-volume-created-on-two-sata-drive.patch
+pci-create-sr-iov-virtfn-physfn-links-before-attaching-driver.patch
+pm-opp-move-error-message-to-debug-level.patch
+igb-check-memory-allocation-failure.patch
+i40e-use-the-safe-hash-table-iterator-when-deleting-mac-filters.patch
+iio-st_sensors-add-register-mask-for-status-register.patch
+ixgbe-fix-use-of-uninitialized-padding.patch
+ib-rxe-check-for-allocation-failure-on-elem.patch
+block-bfq-disable-writeback-throttling.patch
+md-always-set-thread_wakeup-and-wake-up-wqueue-if-thread-existed.patch
+ip_gre-check-packet-length-and-mtu-correctly-in-erspan-tx.patch
+ipv6-grab-rt-rt6i_ref-before-allocating-pcpu-rt.patch
+leds-pca955x-don-t-invert-requested-value-in-pca955x_gpio_set_value.patch
+bluetooth-hci_uart_set_flow_control-fix-null-deref-when-using-serdev.patch
+bluetooth-hci_bcm-fix-setting-of-irq-trigger-type.patch
+i40e-i40evf-spread-cpu-affinity-hints-across-online-cpus-only.patch
+pci-aer-report-non-fatal-errors-only-to-the-affected-endpoint.patch
+tracing-exclude-generic-fields-from-histograms.patch
+percpu-don-t-forget-to-free-the-temporary-struct-pcpu_alloc_info.patch
+asoc-codecs-msm8916-wcd-analog-fix-micbias-level.patch
+asoc-img-parallel-out-add-pm_runtime_get-put-to-set_fmt-callback.patch
+powerpc-xmon-avoid-tripping-smp-hardlockup-watchdog.patch
+powerpc-watchdog-do-not-trigger-smp-crash-from-touch_nmi_watchdog.patch
+sctp-silence-warns-on-sctp_stream_init-allocations.patch
+asoc-codecs-msm8916-wcd-analog-fix-module-autoload.patch
+fm10k-fix-mis-ordered-parameters-in-declaration-for-.ndo_set_vf_bw.patch
+scsi-lpfc-fix-secure-firmware-updates.patch
+scsi-lpfc-plogi-failures-during-npiv-testing.patch
+scsi-lpfc-fix-warning-messages-when-nvme_target_fc-not-defined.patch
+i40e-fix-client-notify-of-vf-reset.patch
+vfio-pci-virtualize-maximum-payload-size.patch
+arm-exynos_defconfig-enable-uas-support-for-odroid-hc1-board.patch
+fm10k-ensure-we-process-sm-mbx-when-processing-vf-mbx.patch
+ibmvnic-set-state-up.patch
+net-ipv6-send-ns-for-dad-when-link-operationally-up.patch
+rdma-hns-avoid-null-pointer-exception.patch
+staging-greybus-light-release-memory-obtained-by-kasprintf.patch
+clk-sunxi-ng-sun6i-rename-hdmi-ddc-clock-to-avoid-name-collision.patch
+tcp-fix-under-evaluated-ssthresh-in-tcp-vegas.patch
+rtc-set-the-alarm-to-the-next-expiring-timer.patch
+cpuidle-fix-broadcast-control-when-broadcast-can-not-be-entered.patch
+drm-vc4-avoid-using-vrefresh-0-mode-in-dsi-htotal-math.patch
+ib-opa_vnic-properly-clear-mac-table-digest.patch
+ib-opa_vnic-properly-return-the-total-macs-in-uc-mac-list.patch
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Sat, 23 Sep 2017 13:25:30 +0530
+Subject: staging: greybus: light: Release memory obtained by kasprintf
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+
+[ Upstream commit 04820da21050b35eed68aa046115d810163ead0c ]
+
+Free memory region, if gb_lights_channel_config is not successful.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/greybus/light.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -925,6 +925,8 @@ static void __gb_lights_led_unregister(s
+ return;
+
+ led_classdev_unregister(cdev);
++ kfree(cdev->name);
++ cdev->name = NULL;
+ channel->led = NULL;
+ }
+
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Hoang Tran <tranviethoang.vn@gmail.com>
+Date: Wed, 27 Sep 2017 18:30:58 +0200
+Subject: tcp: fix under-evaluated ssthresh in TCP Vegas
+
+From: Hoang Tran <tranviethoang.vn@gmail.com>
+
+
+[ Upstream commit cf5d74b85ef40c202c76d90959db4d850f301b95 ]
+
+With the commit 76174004a0f19785 (tcp: do not slow start when cwnd equals
+ssthresh), the comparison to the reduced cwnd in tcp_vegas_ssthresh() would
+under-evaluate the ssthresh.
+
+Signed-off-by: Hoang Tran <hoang.tran@uclouvain.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_vegas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_vegas.c
++++ b/net/ipv4/tcp_vegas.c
+@@ -158,7 +158,7 @@ EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);
+
+ static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp)
+ {
+- return min(tp->snd_ssthresh, tp->snd_cwnd-1);
++ return min(tp->snd_ssthresh, tp->snd_cwnd);
+ }
+
+ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Tom Zanussi <tom.zanussi@linux.intel.com>
+Date: Fri, 22 Sep 2017 14:58:17 -0500
+Subject: tracing: Exclude 'generic fields' from histograms
+
+From: Tom Zanussi <tom.zanussi@linux.intel.com>
+
+
+[ Upstream commit a15f7fc20389a8827d5859907568b201234d4b79 ]
+
+There are a small number of 'generic fields' (comm/COMM/cpu/CPU) that
+are found by trace_find_event_field() but are only meant for
+filtering. Specifically, they unlike normal fields, they have a size
+of 0 and thus wreak havoc when used as a histogram key.
+
+Exclude these (return -EINVAL) when used as histogram keys.
+
+Link: http://lkml.kernel.org/r/956154cbc3e8a4f0633d619b886c97f0f0edf7b4.1506105045.git.tom.zanussi@linux.intel.com
+
+Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_hist.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -450,7 +450,7 @@ static int create_val_field(struct hist_
+ }
+
+ field = trace_find_event_field(file->event_call, field_name);
+- if (!field) {
++ if (!field || !field->size) {
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -548,7 +548,7 @@ static int create_key_field(struct hist_
+ }
+
+ field = trace_find_event_field(file->event_call, field_name);
+- if (!field) {
++ if (!field || !field->size) {
+ ret = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From foo@baz Wed Dec 20 18:17:52 CET 2017
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Mon, 2 Oct 2017 12:39:09 -0600
+Subject: vfio/pci: Virtualize Maximum Payload Size
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+
+[ Upstream commit 523184972b282cd9ca17a76f6ca4742394856818 ]
+
+With virtual PCI-Express chipsets, we now see userspace/guest drivers
+trying to match the physical MPS setting to a virtual downstream port.
+Of course a lone physical device surrounded by virtual interconnects
+cannot make a correct decision for a proper MPS setting. Instead,
+let's virtualize the MPS control register so that writes through to
+hardware are disallowed. Userspace drivers like QEMU assume they can
+write anything to the device and we'll filter out anything dangerous.
+Since mismatched MPS can lead to AER and other faults, let's add it
+to the kernel side rather than relying on userspace virtualization to
+handle it.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -849,11 +849,13 @@ static int __init init_pci_cap_exp_perm(
+
+ /*
+ * Allow writes to device control fields, except devctl_phantom,
+- * which could confuse IOMMU, and the ARI bit in devctl2, which
++ * which could confuse IOMMU, MPS, which can break communication
++ * with other physical devices, and the ARI bit in devctl2, which
+ * is set at probe time. FLR gets virtualized via our writefn.
+ */
+ p_setw(perm, PCI_EXP_DEVCTL,
+- PCI_EXP_DEVCTL_BCR_FLR, ~PCI_EXP_DEVCTL_PHANTOM);
++ PCI_EXP_DEVCTL_BCR_FLR | PCI_EXP_DEVCTL_PAYLOAD,
++ ~PCI_EXP_DEVCTL_PHANTOM);
+ p_setw(perm, PCI_EXP_DEVCTL2, NO_VIRT, ~PCI_EXP_DEVCTL2_ARI);
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
