commit 42b96e19dddd6fa35aba5f57f8bcc284a4c3049d
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Mar 19 08:42:57 2018 +0100

    Linux 4.14.28

commit 1c8b6717a268057ba5bd9e3308bf872cd96b41e8
Author: Anusha Srivatsa <anusha.srivatsa@intel.com>
Date:   Wed Jan 3 11:03:45 2018 -0800

    drm/i915/glk: Disable Guc and HuC on GLK
    
    commit 2afba81c7909ac259720c0d3e7616cf54d4a5368 upstream.
    
    Since the firmwares are not yet released to public repo,
    disable them on Geminilake.
    
    v2: Remove the firmware versions (Michal)
    
    v3: Remove unwanted defines (Rodrigo)
    Correct commit message (Michal)
    
    Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
    Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Anusha Srivatsa <anusha.srivatsa@intel.com>
    Fixes: 90f192c8241e ("drm/i915/GuC/GLK: Load GuC on GLK")
    Fixes: db5ba0d8931e ("drm/i915/GLK/HuC: Load HuC on GLK")
    Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/1515006225-13003-1-git-send-email-anusha.srivatsa@intel.com
    (cherry picked from commit a76050a4837860fcadb6ca11d69d41e08f4090d8)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e09475d698268ac1eb401b20c825dbc153b4cbf6
Author: Sinan Kaya <okaya@codeaurora.org>
Date:   Tue Nov 14 09:55:01 2017 -0500

    dmaengine: qcom_hidma: check pending interrupts
    
    
    [ Upstream commit 38680bc6b1e3592bc9e18adc1d6e259667df27ce ]
    
    Driver is missing the interrupts if two requests are queued up at the same
    time as the interrupt handler is servicing a request that was just
    delivered.
    
    The ISR clears the interrupt at the end but it could be clearing the
    interrupt for an outstanding event. Therefore, second interrupt never
    arrives.
    
    Clear the interrupt first and then check for completions.
    
    Also, make sure that request start and interrupt clear do not overlap in
    time by using a spinlock.
    
    Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4f33fcc68abe7c95f2682b660e2a1d983e24d64f
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Dec 11 12:45:44 2017 +0100

    IB/mlx5: revisit -Wmaybe-uninitialized warning
    
    
    [ Upstream commit 1b19b95169cd52fe82cd442fec0b279fe25cc838 ]
    
    A warning that I thought I had fixed before occasionally comes
    back in rare randconfig builds (I found 7 instances in the last
    100000 builds, originally it was much more frequent):
    
    drivers/infiniband/hw/mlx5/mr.c: In function 'mlx5_ib_reg_user_mr':
    drivers/infiniband/hw/mlx5/mr.c:1229:5: error: 'order' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (order <= mr_cache_max_order(dev)) {
         ^
    drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'ncont' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'page_shift' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    drivers/infiniband/hw/mlx5/mr.c:1260:2: error: 'npages' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    
    I've looked at all those findings again and noticed that they are all
    with CONFIG_INFINIBAND_USER_MEM=n, which means ib_umem_get() returns
    an error unconditionally and we never initialize or use those variables.
    This triggers a condition in gcc iff mr_umem_get() is partially but not
    entirely inlined, which in turn depends on the exact combination of
    optimization settings. This is a known problem with gcc, with no
    easy solution in the compiler, so this adds another workaround that
    should be more reliable than my previous attempt.
    
    Returning an error from mlx5_ib_reg_user_mr() earlier means that we
    can completely bypass the logic that caused the warning, the compiler
    can now see that the variable is never accessed.
    
    Fixes: 14ab8896f5d9 ("IB/mlx5: avoid bogus -Wmaybe-uninitialized warning")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fd6170bf4381adc7d2f021b26b648d71a3c4ac5c
Author: Mimi Zohar <zohar@linux.vnet.ibm.com>
Date:   Wed Nov 8 07:38:28 2017 -0500

    ima: relax requiring a file signature for new files with zero length
    
    
    [ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ]
    
    Custom policies can require file signatures based on LSM labels.  These
    files are normally created and only afterwards labeled, requiring them
    to be signed.
    
    Instead of requiring file signatures based on LSM labels, entire
    filesystems could require file signatures.  In this case, we need the
    ability of writing new files without requiring file signatures.
    
    The definition of a "new" file was originally defined as any file with
    a length of zero.  Subsequent patches redefined a "new" file to be based
    on the FILE_CREATE open flag.  By combining the open flag with a file
    size of zero, this patch relaxes the file signature requirement.
    
    Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE
    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c02dd004559c8ca6e3c1e924e2abafb0e000ffae
Author: Davidlohr Bueso <dave@stgolabs.net>
Date:   Mon May 15 02:07:23 2017 -0700

    locking/locktorture: Fix num reader/writer corner cases
    
    
    [ Upstream commit 2ce77d16db4240dd2e422fc0a5c26d3e2ec03446 ]
    
    Things can explode for locktorture if the user does combinations
    of nwriters_stress=0 nreaders_stress=0. Fix this by not assuming
    we always want to torture writer threads.
    
    Reported-by: Jeremy Linton <jeremy.linton@arm.com>
    Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
    Tested-by: Jeremy Linton <jeremy.linton@arm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09e59383eb1c1a3b45ba7bb131af5ea936868752
Author: SeongJae Park <sj38.park@gmail.com>
Date:   Fri Nov 3 19:17:20 2017 +0900

    rcutorture/configinit: Fix build directory error message
    
    
    [ Upstream commit 2adfa4210f8f35cdfb4e08318cc06b99752964c2 ]
    
    The 'configinit.sh' script checks the format of optional argument for the
    build directory, printing an error message if the format is not valid.
    However, the error message uses the wrong variable, indicating an empty
    string even though the user entered a non-empty (but erroneous) string.
    This commit fixes the script to use the correct variable.
    
    Fixes: c87b9c601ac8 ("rcutorture: Add KVM-based test framework")
    
    Signed-off-by: SeongJae Park <sj38.park@gmail.com>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 17c8c59988571d2c595259b9d54dfc1e529cbf33
Author: Mahesh Bandewar <maheshb@google.com>
Date:   Thu Dec 7 15:15:43 2017 -0800

    ipvlan: add L2 check for packets arriving via virtual devices
    
    
    [ Upstream commit 92ff42645028fa6f9b8aa767718457b9264316b4 ]
    
    Packets that don't have dest mac as the mac of the master device should
    not be entertained by the IPvlan rx-handler. This is mostly true as the
    packet path mostly takes care of that, except when the master device is
    a virtual device. As demonstrated in the following case -
    
      ip netns add ns1
      ip link add ve1 type veth peer name ve2
      ip link add link ve2 name iv1 type ipvlan mode l2
      ip link set dev iv1 netns ns1
      ip link set ve1 up
      ip link set ve2 up
      ip -n ns1 link set iv1 up
      ip addr add 192.168.10.1/24 dev ve1
      ip -n ns1 addr 192.168.10.2/24 dev iv1
      ping -c2 192.168.10.2
      <Works!>
      ip neigh show dev ve1
      ip neigh show 192.168.10.2 lladdr <random> dev ve1
      ping -c2 192.168.10.2
      <Still works! Wrong!!>
    
    This patch adds that missing check in the IPvlan rx-handler.
    
    Reported-by: Amit Sikka <amit.sikka@ericsson.com>
    Signed-off-by: Mahesh Bandewar <maheshb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ced0c46b4181f5df41b0950963f02591198800a
Author: Christophe Leroy <christophe.leroy@c-s.fr>
Date:   Sat Dec 9 17:24:24 2017 +0100

    Fix misannotated out-of-line _copy_to_user()
    
    
    [ Upstream commit a0e94598e6b6c0d1df6a5fa14eb7c767ca817a20 ]
    
    Destination is a kernel pointer and source - a userland one
    in _copy_from_user(); _copy_to_user() is the other way round.
    
    Fixes: d597580d37377 ("generic ...copy_..._user primitives")
    Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4117e8971923846e5723dc5b9c29f838be52ef88
Author: Adrian Hunter <adrian.hunter@intel.com>
Date:   Fri Dec 1 14:55:31 2017 +0200

    mmc: mmc_test: Ensure command queue is disabled for testing
    
    
    [ Upstream commit 23a185254ace8e63dc4ca36e0315aed9440ae749 ]
    
    mmc_test disables the command queue because none of the tests use the
    command queue. However the Reset Test will re-enable it, so disable it in
    that case too.
    
    Fixes: 9d4579a85c84 ("mmc: mmc_test: Disable Command Queue while mmc_test is used")
    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b45ccc79b04afad1f2c95f9fde7b9dded1ff961c
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat Dec 9 14:52:28 2017 +0300

    ASoC: nuc900: Fix a loop timeout test
    
    
    [ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ]
    
    We should be finishing the loop with timeout set to zero but because
    this is a post-op we finish with timeout == -1.
    
    Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 00be5b299063024d0faae26c5bb9f4a60b93c147
Author: Horia Geantă <horia.geanta@nxp.com>
Date:   Tue Nov 28 18:48:08 2017 +0200

    crypto: caam/qi - use correct print specifier for size_t
    
    
    [ Upstream commit 9db09e3bad65393dc23b0279beb7f3754d77065c ]
    
    Fix below warnings on ARMv7 by using %zu for printing size_t values:
    
    drivers/crypto/caam/caamalg_qi.c: In function aead_edesc_alloc:
    drivers/crypto/caam/caamalg_qi.c:417:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
       sizeof(struct qm_sg_entry))
                     ^
    drivers/crypto/caam/caamalg_qi.c:672:16: note: in expansion of macro CAAM_QI_MAX_AEAD_SG
        qm_sg_ents, CAAM_QI_MAX_AEAD_SG);
                    ^
    drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_edesc_alloc:
    drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
       sizeof(struct qm_sg_entry))
                     ^
    drivers/crypto/caam/caamalg_qi.c:909:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG
        qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
                    ^
    drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_giv_edesc_alloc:
    drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=]
       sizeof(struct qm_sg_entry))
                     ^
    drivers/crypto/caam/caamalg_qi.c:1062:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG
        qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG);
                    ^
    
    Fixes: eb9ba37dc15a ("crypto: caam/qi - handle large number of S/Gs case")
    Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8077cba5b1f0b5ba8727fbbb3d9a6c40ad0bded6
Author: Luca Coelho <luciano.coelho@intel.com>
Date:   Sun Oct 29 11:51:10 2017 +0200

    mac80211: remove BUG() when interface type is invalid
    
    
    [ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ]
    
    In the ieee80211_setup_sdata() we check if the interface type is valid
    and, if not, call BUG().  This should never happen, but if there is
    something wrong with the code, it will not be caught until the bug
    happens when an interface is being set up.  Calling BUG() is too
    extreme for this and a WARN_ON() would be better used instead.  Change
    that.
    
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6ae26c0803393b612aa46db6cf831e5f50598f8
Author: Adiel Aloni <adiel.aloni@intel.com>
Date:   Fri Dec 1 13:50:53 2017 +0200

    mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
    
    
    [ Upstream commit e16ea4bb516bc21ea2202f2107718b29218bea59 ]
    
    Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll,
    only if PS_ENABLED was set before.
    This is required due to commit c9491367b759 ("mac80211: always update the
    PM state of a peer on MGMT / DATA frames") that enforces the ap to
    check only mgmt/data frames ps bit, and then update station's power save
    accordingly.
    When sending only ps-poll (control frame) the ap will not be aware that
    the station entered power save.
    Setting ps enable before triggering ps_poll, will send NDP with PM bit
    enabled first.
    
    Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9bece8dda3674fb82139fc9b025cc1fae373fb30
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Dec 8 21:46:16 2017 +0000

    agp/intel: Flush all chipset writes after updating the GGTT
    
    
    [ Upstream commit 8516673a996870ea0ceb337ee4f83c33c5ec3111 ]
    
    Before accessing the GGTT we must flush the PTE writes and make them
    visible to the chipset, or else the indirect access may end up in the
    wrong page. In commit 3497971a71d8 ("agp/intel: Flush chipset writes
    after updating a single PTE"), we noticed corruption of the uploads for
    pwrite and for capturing GPU error states, but it was presumed that the
    explicit calls to intel_gtt_chipset_flush() were sufficient for the
    execbuffer path. However, we have not been flushing the chipset between
    the PTE writes and access via the GTT itself.
    
    For simplicity, do the flush after any PTE update rather than try and
    batch the flushes on a just-in-time basis.
    
    References: 3497971a71d8 ("agp/intel: Flush chipset writes after updating a single PTE")
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
    Cc: Mika Kuoppala <mika.kuoppala@intel.com>
    Cc: drm-intel-fixes@lists.freedesktop.org
    Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20171208214616.30147-1-chris@chris-wilson.co.uk
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4df57c45f762d43f0a706aebf8e2ee234f85f522
Author: Geert Uytterhoeven <geert+renesas@glider.be>
Date:   Mon Dec 4 11:34:51 2017 +0100

    arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
    
    
    [ Upstream commit f5bbcd533a9d1af97b8a0862a421bb8455f1bf6d ]
    
    Describe the GPIO used to reset the Ethernet PHY for EthernetAVB.
    This allows the driver to reset the PHY during probe and after system
    resume.
    
    This fixes Ethernet operation after resume from s2ram on Salvator-XS,
    where the enable pin of the regulator providing PHY power is connected
    to PRESETn, and PSCI powers down the SoC during system suspend.
    
    On Salvator-X, the enable pin is always pulled high, but the driver may
    still need to reset the PHY if this wasn't done by the bootloader
    before.
    
    Inspired by patches in the BSP for the individual Salvator-X/XS boards
    by Kazuya Mizuguchi.
    
    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9281b0856dcd4f3a168927585f5ac2e985d3d453
Author: Nicholas Piggin <npiggin@gmail.com>
Date:   Fri Nov 17 02:00:50 2017 +1000

    powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
    
    
    [ Upstream commit acb1feab320e38588fccc568e3767761f494976f ]
    
    When an interrupt is returning to a soft-disabled context (which can
    happen for non-maskable interrupts or synchronous interrupts), it goes
    through the motions of soft-disabling again, including calling
    TRACE_DISABLE_INTS (i.e., trace_hardirqs_off()).
    
    This is not necessary, because we must already be soft-disabled in the
    interrupt context, it also may be causing crashes in the irq tracing
    code to re-enter as an nmi. Replace it with a warning to ensure that
    soft-interrupts are still disabled.
    
    Fixes: 7c0482e3d055 ("powerpc/irq: Fix another case of lazy IRQ state getting out of sync")
    Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d744153d67fd259d36ecbfb7487342d39d3ef650
Author: Josh Poimboeuf <jpoimboe@redhat.com>
Date:   Thu Nov 16 11:45:37 2017 -0600

    powerpc/modules: Don't try to restore r2 after a sibling call
    
    
    [ Upstream commit b9eab08d012fa093947b230f9a87257c27fb829b ]
    
    When attempting to load a livepatch module, I got the following error:
    
      module_64: patch_module: Expect noop after relocate, got 3c820000
    
    The error was triggered by the following code in
    unregister_netdevice_queue():
    
      14c:   00 00 00 48     b       14c <unregister_netdevice_queue+0x14c>
                             14c: R_PPC64_REL24      net_set_todo
      150:   00 00 82 3c     addis   r4,r2,0
    
    GCC didn't insert a nop after the branch to net_set_todo() because it's
    a sibling call, so it never returns.  The nop isn't needed after the
    branch in that case.
    
    Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
    Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
    Reviewed-and-tested-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12848af16f9e969d7853427ee2fe884a22986181
Author: Yong Zhao <yong.zhao@amd.com>
Date:   Fri Dec 8 23:08:48 2017 -0500

    drm/amdkfd: Fix memory leaks in kfd topology
    
    
    [ Upstream commit 5108d768408abc80e4e8d99f5b406a73cb04056b ]
    
    Kobject created using kobject_create_and_add() can be freed using
    kobject_put() when there is no referenece any more. However,
    kobject memory allocated with kzalloc() has to set up a release
    callback in order to free it when the counter decreases to 0.
    Otherwise it causes memory leak.
    
    Signed-off-by: Yong Zhao <yong.zhao@amd.com>
    Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
    Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30d45938f2a55402be28a00346c4b8cb924f17dc
Author: Stephen Hemminger <stephen@networkplumber.org>
Date:   Thu Dec 7 15:40:20 2017 -0800

    veth: set peer GSO values
    
    
    [ Upstream commit 72d24955b44a4039db54a1c252b5031969eeaac3 ]
    
    When new veth is created, and GSO values have been configured
    on one device, clone those values to the peer.
    
    For example:
       # ip link add dev vm1 gso_max_size 65530 type veth peer name vm2
    
    This should create vm1 <--> vm2 with both having GSO maximum
    size set to 65530.
    
    Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a80de288d6c5188f734e13302ca83141cd0211d6
Author: John Fastabend <john.fastabend@gmail.com>
Date:   Thu Dec 7 09:56:04 2017 -0800

    net: sched: drop qdisc_reset from dev_graft_qdisc
    
    
    [ Upstream commit 7bbde83b1860c28a1cc35516352c4e7e5172c29a ]
    
    In qdisc_graft_qdisc a "new" qdisc is attached and the 'qdisc_destroy'
    operation is called on the old qdisc. The destroy operation will wait
    a rcu grace period and call qdisc_rcu_free(). At which point
    gso_cpu_skb is free'd along with all stats so no need to zero stats
    and gso_cpu_skb from the graft operation itself.
    
    Further after dropping the qdisc locks we can not continue to call
    qdisc_reset before waiting an rcu grace period so that the qdisc is
    detached from all cpus. By removing the qdisc_reset() here we get
    the correct property of waiting an rcu grace period and letting the
    qdisc_destroy operation clean up the qdisc correctly.
    
    Note, a refcnt greater than 1 would cause the destroy operation to
    be aborted however if this ever happened the reference to the qdisc
    would be lost and we would have a memory leak.
    
    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 127bda4b09129bf8448cfd2f453ff4acab188922
Author: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Date:   Thu Dec 7 13:15:15 2017 +0900

    virtio_net: Disable interrupts if napi_complete_done rescheduled napi
    
    
    [ Upstream commit fdaa767aefc1685f9a41e91f447c9aea94103df6 ]
    
    Since commit 39e6c8208d7b ("net: solve a NAPI race") napi has been able
    to be rescheduled within napi_complete_done() even in non-busypoll case,
    but virtnet_poll() always enabled interrupts before complete, and when
    napi was rescheduled within napi_complete_done() it did not disable
    interrupts.
    This caused more interrupts when event idx is disabled.
    
    According to commit cbdadbbf0c79 ("virtio_net: fix race in RX VQ
    processing") we cannot place virtqueue_enable_cb_prepare() after
    NAPI_STATE_SCHED is cleared, so disable interrupts again if
    napi_complete_done() returned false.
    
    Tested with vhost-user of OVS 2.7 on host, which does not have the event
    idx feature.
    
    * Before patch:
    
    $ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472
    MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET
    Socket  Message  Elapsed      Messages
    Size    Size     Time         Okay Errors   Throughput
    bytes   bytes    secs            #      #   10^6bits/sec
    
    212992    1472   60.00     32763206      0    6430.32
    212992           60.00     23384299           4589.56
    
    Interrupts on guest: 9872369
    Packets/interrupt:   2.37
    
    * After patch
    
    $ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472
    MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET
    Socket  Message  Elapsed      Messages
    Size    Size     Time         Okay Errors   Throughput
    bytes   bytes    secs            #      #   10^6bits/sec
    
    212992    1472   60.00     32794646      0    6436.49
    212992           60.00     32793501           6436.27
    
    Interrupts on guest: 4941299
    Packets/interrupt:   6.64
    
    Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 623f21858691a17b26861fee5be6d2f4f1e26179
Author: Gustavo A. R. Silva <garsilva@embeddedor.com>
Date:   Wed Nov 22 22:34:44 2017 -0500

    media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
    
    
    [ Upstream commit 5a18c2434f8bfc8bc2fb0f8af3e44f7408d63e4f ]
    
    Check return value from call to devm_kzalloc() in order to prevent
    a NULL pointer dereference.
    
    This issue was detected with the help of Coccinelle.
    
    Fixes: 4a5f8ae50b66 ("[media] davinci: vpif_capture: get subdevs from DT when available")
    
    Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b6b70d70331feebee01275cd75990b18f55fff6b
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Nov 9 16:28:14 2017 -0500

    media: cpia2: Fix a couple off by one bugs
    
    
    [ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ]
    
    The cam->buffers[] array has cam->num_frames elements so the > needs to
    be changed to >= to avoid going beyond the end of the array.  The
    ->buffers[] array is allocated in cpia2_allocate_buffers() if you want
    to confirm.
    
    Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8834a75d8acb94e5f840204a296a09b08351757a
Author: Heinz Mauelshagen <heinzm@redhat.com>
Date:   Sat Dec 2 01:03:51 2017 +0100

    dm raid: fix raid set size revalidation
    
    
    [ Upstream commit 61e06e2c3ebd986050958513bfa40dceed756f8f ]
    
    The raid set size is being revalidated unconditionally before a
    reshaping conversion is started.  MD requires the size to only be
    reduced in case of a stripe removing (i.e. shrinking) reshape but not
    when growing because the raid array has to stay small until after the
    growing reshape finishes.
    
    Fix by avoiding the size revalidation in preresume unless a shrinking
    reshape is requested.
    
    Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77ec30a0b35eb9f1cc17555708999c20502aa6ec
Author: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Date:   Mon Dec 4 06:01:11 2017 -0500

    media: vsp1: Prevent suspending and resuming DRM pipelines
    
    
    [ Upstream commit a17d2d6cd9985ca09a9e384f1bc71d710f7e5203 ]
    
    When used as part of a display pipeline, the VSP is stopped and
    restarted explicitly by the DU from its suspend and resume handlers.
    There is thus no need to stop or restart pipelines in the VSP suspend
    and resume handlers, and doing so would cause the hardware to be
    left in a misconfigured state.
    
    Ensure that the VSP suspend and resume handlers do not affect DRM-based
    pipelines.
    
    Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32097005dd7858ef939b1a4c9f8299b81e80dcdb
Author: Xose Vazquez Perez <xose.vazquez@gmail.com>
Date:   Fri Nov 17 22:05:13 2017 +0100

    scsi: dh: add new rdac devices
    
    
    [ Upstream commit 4b3aec2bbbce1c35f50e7475a9fd78d24b9ea4ea ]
    
    Add IBM 3542 and 3552, arrays: FAStT200 and FAStT500.
    
    Add full STK OPENstorage family, arrays: 9176, D173, D178, D210, D220,
    D240 and D280.
    
    Add STK BladeCtlr family, arrays: B210, B220, B240 and B280.
    
    These changes were done in multipath-tools time ago.
    
    Cc: NetApp RDAC team <ng-eseries-upstream-maintainers@netapp.com>
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Christophe Varoqui <christophe.varoqui@opensvc.com>
    Cc: Martin K. Petersen <martin.petersen@oracle.com>
    Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
    Cc: SCSI ML <linux-scsi@vger.kernel.org>
    Cc: device-mapper development <dm-devel@redhat.com>
    Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 97b8a9a878322636f52ce2c13eca607e6685929e
Author: Xose Vazquez Perez <xose.vazquez@gmail.com>
Date:   Fri Nov 17 21:31:36 2017 +0100

    scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
    
    
    [ Upstream commit b369a0471503130cfc74f9f62071db97f48948c3 ]
    
    Commit 56f3d383f37b ("scsi: scsi_devinfo: Add TRY_VPD_PAGES to HITACHI
    OPEN-V blacklist entry") modified some Hitachi entries:
    
        HITACHI is always supporting VPD pages, even though it's claiming to
        support SCSI Revision 3 only.
    
    The same should have been done also for HP-rebranded.
    
    [mkp: checkpatch and tweaked commit message]
    
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Takahiro Yasui <takahiro.yasui@hds.com>
    Cc: Matthias Rudolph <Matthias.Rudolph@hitachivantara.com>
    Cc: Martin K. Petersen <martin.petersen@oracle.com>
    Cc: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
    Cc: SCSI ML <linux-scsi@vger.kernel.org>
    Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a60a3523b398e7372a819f474fbf699edb2204a4
Author: Bart Van Assche <bart.vanassche@wdc.com>
Date:   Mon Dec 4 10:36:31 2017 -0800

    scsi: core: scsi_get_device_flags_keyed(): Always return device flags
    
    
    [ Upstream commit a44c9d36509c83cf64f33b93f6ab2e63822c01eb ]
    
    Since scsi_get_device_flags_keyed() callers do not check whether or not
    the returned value is an error code, change that function such that it
    returns a flags value even if the 'key' argument is invalid.  Note:
    since commit 28a0bc4120d3 ("scsi: sd: Implement blacklist option for
    WRITE SAME w/ UNMAP") bit 31 is a valid device information flag so
    checking whether bit 31 is set in the return value is not sufficient to
    tell the difference between an error code and a flags value.
    
    Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Hannes Reinecke <hare@suse.com>
    Cc: Johannes Thumshirn <jthumshirn@suse.de>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 677794fb0ca277582fa7e901b9cc4f95fe91c7dc
Author: Michael Chan <michael.chan@broadcom.com>
Date:   Wed Dec 6 17:31:22 2017 -0500

    bnxt_en: Don't print "Link speed -1 no longer supported" messages.
    
    
    [ Upstream commit a8168b6cee6e9334dfebb4b9108e8d73794f6088 ]
    
    On some dual port NICs, the 2 ports have to be configured with compatible
    link speeds.  Under some conditions, a port's configured speed may no
    longer be supported.  The firmware will send a message to the driver
    when this happens.
    
    Improve this logic that prints out the warning by only printing it if
    we can determine the link speed that is no longer supported.  If the
    speed is unknown or it is in autoneg mode, skip the warning message.
    
    Reported-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
    Signed-off-by: Michael Chan <michael.chan@broadcom.com>
    Tested-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 564030343299f17d54513a5a21db5124cfb6d5d9
Author: Tobias Jordan <Tobias.Jordan@elektrobit.com>
Date:   Thu Dec 7 15:04:53 2017 +0100

    spi: sun6i: disable/unprepare clocks on remove
    
    
    [ Upstream commit 2d9bbd02c54094ceffa555143b0d68cd06504d63 ]
    
    sun6i_spi_probe() uses sun6i_spi_runtime_resume() to prepare/enable
    clocks, so sun6i_spi_remove() should use sun6i_spi_runtime_suspend() to
    disable/unprepare them if we're not suspended.
    Replacing pm_runtime_disable() by pm_runtime_force_suspend() will ensure
    that sun6i_spi_runtime_suspend() is called if needed.
    
    Found by Linux Driver Verification project (linuxtesting.org).
    
    Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver)
    Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
    Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4309a1e0d1c39b5ad082e421d003085d38d20595
Author: Julien BOIBESSOT <julien.boibessot@armadeus.com>
Date:   Tue Dec 5 18:48:14 2017 +0100

    tools/usbip: fixes build with musl libc toolchain
    
    
    [ Upstream commit 77be4c878c72e411ad22af96b6f81dd45c26450a ]
    
    Indeed musl doesn't define old SIGCLD signal name but only new one SIGCHLD.
    SIGCHLD is the new POSIX name for that signal so it doesn't change
    anything on other libcs.
    
    This fixes this kind of build error:
    
    usbipd.c: In function ‘set_signal’:
    usbipd.c:459:12: error: 'SIGCLD' undeclared (first use in this function)
      sigaction(SIGCLD, &act, NULL);
                ^~~~~~
    usbipd.c:459:12: note: each undeclared identifier is reported only once
            for each function it appears in
    Makefile:407: recipe for target 'usbipd.o' failed
    make[3]: *** [usbipd.o] Error 1
    
    Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com>
    Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c0a007d1efc03f88dab396a00a774b1ca3993ce
Author: Ben Greear <greearb@candelatech.com>
Date:   Sat Dec 2 16:50:49 2017 +0200

    ath10k: fix invalid STS_CAP_OFFSET_MASK
    
    
    [ Upstream commit 8cec57f5277ef0e354e37a0bf909dc71bc1f865b ]
    
    The 10.4 firmware defines this as a 3-bit field, as does the
    mac80211 stack.  The 4th bit is defined as CONF_IMPLICIT_BF
    at least in the firmware header I have seen.  This patch
    fixes the ath10k wmi header to match the firmware.
    
    Signed-off-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c2fa288cfc314180a82aae5f3155f1182fc13ba
Author: Limin Zhu <liminzhu@marvell.com>
Date:   Thu Nov 30 14:22:34 2017 +0800

    mwifiex: cfg80211: do not change virtual interface during scan processing
    
    
    [ Upstream commit c61cfe49f0f0f0d1f8b56d0b045838d597e8c3a3 ]
    
    (1) Change virtual interface operation in cfg80211 process reset and
    reinitilize private data structure.
    (2) Scan result event processed in main process will dereference private
    data structure concurrently, ocassionly crash the kernel.
    
    The cornel case could be trigger by below steps:
    (1) wpa_cli mlan0 scan
    (2) ./hostapd mlan0.conf
    
    Cfg80211 asynchronous scan procedure is not all the time operated
    under rtnl lock, here we add the protect to serialize the cfg80211
    scan and change_virtual interface operation.
    
    Signed-off-by: Limin Zhu <liminzhu@marvell.com>
    Signed-off-by: Xinming Hu <huxm@marvell.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1a7e2b546b0fbd8123b55df771d6f06adad02c99
Author: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Date:   Wed Dec 6 12:11:38 2017 +0000

    clk: qcom: msm8916: fix mnd_width for codec_digcodec
    
    
    [ Upstream commit d8e488e8242ecf129eebc440c92d800a99ca109d ]
    
    This patch fixes missing mnd_width for codec_digital clk, this is now set to
    8 inline with datasheet.
    
    Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support")
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6d6a5eae5600689618feba43f4e8418c0b3cf4d9
Author: Monk Liu <Monk.Liu@amd.com>
Date:   Wed Nov 15 17:10:13 2017 +0800

    drm/amdgpu:fix virtual dce bug
    
    
    [ Upstream commit 129d65c18ecfb249aceb540c31fdaf79bd5a11ff ]
    
    this fix the issue that access memory after freed
    after driver unloaded.
    
    Signed-off-by: Monk Liu <Monk.Liu@amd.com>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd301e538bd65992fa9a2e539b2e3f642fc8e966
Author: Sara Sharon <sara.sharon@intel.com>
Date:   Mon Nov 20 18:02:05 2017 +0200

    iwlwifi: mvm: avoid dumping assert log when device is stopped
    
    
    [ Upstream commit 6362ab721ef5c4ecfa01f53ad4137d3d984f0c6c ]
    
    We might erroneously get to error dumping code when the
    device is already stopped.
    
    In that case the driver will detect a defective value and will try to
    reset the HW, assuming it is only a bus issue.  The driver than
    proceeds with the dumping.
    
    The result has two side effects:
    
    1. The device won't be stopped again, since the transport status is
    already stopped, so the device remains powered on while it actually
    should be stopped.
    
    2. The dump in that case is completely garbaged and useless.
    
    Detect and avoid this.  It will also make debugging such issues
    easier.
    
    Signed-off-by: Sara Sharon <sara.sharon@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e6fb81cb22b795219c1ed673d6532373569e1e53
Author: Thomas Richter <tmricht@linux.vnet.ibm.com>
Date:   Tue Nov 28 08:56:32 2017 +0100

    perf annotate: Fix objdump comment parsing for Intel mov dissassembly
    
    
    [ Upstream commit 35a8a148d8c1ee9e5ae18f9565a880490f816f89 ]
    
    The command 'perf annotate' parses the output of objdump and also
    investigates the comments produced by objdump. For example the
    output of objdump produces (on x86):
    
    23eee:  4c 8b 3d 13 01 21 00 mov 0x210113(%rip),%r15
                                    # 234008 <stderr@@GLIBC_2.2.5+0x9a8>
    
    and the function mov__parse() is called to investigate the complete
    line. Mov__parse() breaks this line into several parts and finally
    calls function comment__symbol() to parse the data after the comment
    character '#'. Comment__symbol() expects a hexadecimal address followed
    by a symbol in '<' and '>' brackets.
    
    However the 2nd parameter given to function comment__symbol()
    always points to the comment character '#'. The address parsing
    always returns 0 because the character '#' is not a digit and
    strtoull() fails without being noticed.
    
    Fix this by advancing the second parameter to function comment__symbol()
    by one byte before invocation and add an error check after strtoull()
    has been called.
    
    Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
    Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
    Acked-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Fixes: 6de783b6f50f ("perf annotate: Resolve symbols using objdump comment")
    Link: http://lkml.kernel.org/r/20171128075632.72182-1-tmricht@linux.vnet.ibm.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f9b186caa07183675c0773f6924f5c675a2256a7
Author: Thomas Richter <tmricht@linux.vnet.ibm.com>
Date:   Fri Nov 24 10:46:37 2017 +0100

    perf annotate: Fix unnecessary memory allocation for s390x
    
    
    [ Upstream commit 36c263607d36c6a3788c09301d9f5fe35404048a ]
    
    This patch fixes a bug introduced with commit d9f8dfa9baf9 ("perf
    annotate s390: Implement jump types for perf annotate").
    
    'perf annotate' displays annotated assembler output by reading output of
    command objdump and parsing the disassembled lines. For each shown
    mnemonic this function sequence is executed:
    
      disasm_line__new()
      |
      +--> disasm_line__init_ins()
           |
           +--> ins__find()
                |
                +--> arch->associate_instruction_ops()
    
    The s390x specific function assigned to function pointer
    associate_instruction_ops refers to function s390__associate_ins_ops().
    
    This function checks for supported mnemonics and assigns a NULL pointer
    to unsupported mnemonics.  However even the NULL pointer is added to the
    architecture dependend instruction array.
    
    This leads to an extremely large architecture instruction array
    (due to array resize logic in function arch__grow_instructions()).
    
    Depending on the objdump output being parsed the array can end up
    with several ten-thousand elements.
    
    This patch checks if a mnemonic is supported and only adds supported
    ones into the architecture instruction array. The array does not contain
    elements with NULL pointers anymore.
    
    Before the patch (With some debug printf output):
    
    [root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxbb
    
    real    8m49.679s
    user    7m13.008s
    sys     0m1.649s
    [root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:'
                            /tmp/xxxbb | tail -1
    __ins__find sorted:1 nr_instructions:87433 ins:0x341583c0
    [root@s35lp76 perf]#
    
    The number of different s390x branch/jump/call/return instructions
    entered into the array is 87433.
    
    After the patch (With some printf debug output:)
    
    [root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxaa
    
    real    1m24.553s
    user    0m0.587s
    sys     0m1.530s
    [root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:'
                            /tmp/xxxaa | tail -1
    __ins__find sorted:1 nr_instructions:56 ins:0x3f406570
    [root@s35lp76 perf]#
    
    The number of different s390x branch/jump/call/return instructions
    entered into the array is 56 which is sensible.
    
    Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
    Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
    Acked-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Link: http://lkml.kernel.org/r/20171124094637.55558-1-tmricht@linux.vnet.ibm.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9334b702531d937775feee0682a6602b3baa445c
Author: Takeshi Kihara <takeshi.kihara.df@renesas.com>
Date:   Thu Nov 16 12:16:00 2017 +0900

    pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
    
    
    [ Upstream commit b16cd900de7911f96af17327a081a2141a0b763f ]
    
    This patch fixes the implementation incorrect of MOD_SEL1 bit[25:24]
    value when STP_ISEN_1_D pin function is selected for IPSR16 bit[27:24].
    
    This is a correction to the incorrect implementation of MOD_SEL register
    pin assignment for R8A7795 SoC specification of R-Car Gen3 Hardware
    User's Manual Rev.0.51E.
    
    Fixes: 0b0ffc96dbe30fa9 ("pinctrl: sh-pfc: Initial R8A7795 PFC support)
    Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
    Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com>
    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 162ee473a0cb0d4ade8387810f153a5cf59a3ce9
Author: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Date:   Tue Nov 14 15:41:17 2017 +0000

    pinctrl: sh-pfc: r8a7791: Add can_clk function
    
    
    [ Upstream commit 57eec02caee60332b8052615e7257f932ae07abc ]
    
    This patch adds can_clk function to r8a7743/r8a7791 which is cleaner,
    and allows for independent configuration.
    We keep the can_clk* pins definitions from within can0_groups and
    can1_groups for uniformity and backwards compatibility.
    
    Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
    Reviewed-by: Ramesh Shanmugasundaram <ramesh.shanmugasundaram@bp.renesas.com>
    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 81a16b68d2548e2d733be2fa8e4d527c73f35cb6
Author: Jernej Skrabec <jernej.skrabec@siol.net>
Date:   Fri Dec 1 07:05:24 2017 +0100

    drm/sun4i: Fix format mask in DE2 driver
    
    
    [ Upstream commit a2407f4bd1f3001d6b46f6d32eb1cc98a60f5a43 ]
    
    Format mask is one bit too short. Fix it.
    
    Fixes: 9d75b8c0b999 (drm/sun4i: add support for Allwinner DE2 mixers)
    
    Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
    Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20171201060550.10392-2-jernej.skrabec@siol.net
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5dc7257b7ca7983fda5c3e40cc5adcf88ef72529
Author: Axel Lin <axel.lin@ingics.com>
Date:   Tue Nov 7 13:18:53 2017 +0800

    pwm: stmpe: Fix wrong register offset for hwpwm=2 case
    
    
    [ Upstream commit 8472b529e113e0863ea064fdee51bf73c3f86fd6 ]
    
    Fix trivial copy/paste bug.
    
    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Fixes: ef1f09eca74a ("pwm: Add a driver for the STMPE PWM")
    Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65722e73086da79b107b1022ce9b07d2402efa2d
Author: Li Dongyang <dongyang.li@anu.edu.au>
Date:   Tue Nov 14 10:48:04 2017 +1100

    scsi: ses: don't ask for diagnostic pages repeatedly during probe
    
    
    [ Upstream commit 9c0a50022b8ac7e863e6ec8342fa476fe5d1d75c ]
    
    We are testing if there is a match with the ses device in a loop by
    calling ses_match_to_enclosure(), which will issue scsi receive
    diagnostics commands to the ses device for every device on the same
    host.  On one of our boxes with 840 disks, it takes a long time to load
    the driver:
    
    [root@g1b-oss06 ~]# time modprobe ses
    
    real    40m48.247s
    user    0m0.001s
    sys     0m0.196s
    
    With the patch:
    
    [root@g1b-oss06 ~]# time modprobe ses
    
    real    0m17.915s
    user    0m0.008s
    sys     0m0.053s
    
    Note that we still need to refresh page 10 when we see a new disk to
    create the link.
    
    Signed-off-by: Li Dongyang <dongyang.li@anu.edu.au>
    Tested-by: Jason Ozolins <jason.ozolins@hpe.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5d8c64ea75f3c9b3a5ba09ec37bd73a720d92b2e
Author: Monk Liu <Monk.Liu@amd.com>
Date:   Tue Oct 24 15:10:11 2017 +0800

    drm/amdgpu:fix random missing of FLR NOTIFY
    
    
    [ Upstream commit 34a4d2bf06b3ab92024b8e26d6049411369d1f1a ]
    
    Signed-off-by: Monk Liu <Monk.Liu@amd.com>
    Acked-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0049457bfde661cf47410eaacad65845c9a2bb45
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Thu Nov 23 14:27:07 2017 +0100

    cpufreq: Fix governor module removal race
    
    
    [ Upstream commit a8b149d32b663c1a4105273295184b78f53d33cf ]
    
    It is possible to remove a cpufreq governor module after
    cpufreq_parse_governor() has returned success in
    store_scaling_governor() and before cpufreq_set_policy()
    acquires a reference to it, because the governor list is
    not protected during that period and nothing prevents the
    governor from being unregistered then.
    
    Prevent that from happening by acquiring an extra reference
    to the governor module temporarily in cpufreq_parse_governor(),
    under cpufreq_governor_mutex, and dropping it in
    store_scaling_governor(), when cpufreq_set_policy() returns.
    
    Note that the second cpufreq_parse_governor() call site is fine,
    because it only cares about the policy member of new_policy.
    
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bde5c6dca065a83714d9a8048793155623a7437d
Author: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
Date:   Mon Nov 6 13:39:31 2017 +0530

    ath10k: update tdls teardown state to target
    
    
    [ Upstream commit 424ea0d174e82365f85c6770225dba098b8f1d5f ]
    
    It is required to update the teardown state of the peer when
    a tdls link with that peer is terminated. This information is
    useful for the target to perform some cleanups wrt the tdls peer.
    
    Without proper cleanup, target assumes that the peer is connected and
    blocks future connection requests, updating the teardown state of the
    peer addresses the problem.
    
    Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version.
    
    Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
    Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6af44accf4ffd300f0d77a170b18d8fe780f5dd6
Author: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
Date:   Fri Oct 27 21:45:38 2017 +0200

    iio: health: max30102: Add power enable parameter to get_temp function
    
    
    [ Upstream commit a9c47abbdd71dceeaf1b923e5ce10e700e036905 ]
    
    Chip must not be in shutdown for reading temperature, so briefly leave
    shutdown if buffer is not already running
    
    Signed-off-by: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
    Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 975486d1f138c4c872265873cc2c868775ffd68c
Author: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Date:   Sat Oct 28 23:12:46 2017 +0200

    iio: adc: ina2xx: Shift bus voltage register to mask flag bits
    
    
    [ Upstream commit 2e64438487697f3f099946edc8acd4ceea6b1ab2 ]
    
    Lower bits of the INA219/220 bus voltage register are conversion
    status flags, properly shift the value.
    
    When reading via IIO buffer, the value is passed on unaltered,
    shifting is the responsibility of the user.
    
    Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cb334409bb0234827355450bf0edebc023916c10
Author: Philipp Zabel <p.zabel@pengutronix.de>
Date:   Fri Dec 1 16:00:41 2017 +0100

    drm/etnaviv: make THERMAL selectable
    
    
    [ Upstream commit 49b82c389d2a40eaef1355aaa35868b367aec9d1 ]
    
    The etnaviv driver causes a link failure if it is built-in but THERMAL
    is built as a module:
    
      drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_bind':
      etnaviv_gpu.c:(.text+0x4c4): undefined reference to `thermal_of_cooling_device_register'
      etnaviv_gpu.c:(.text+0x600): undefined reference to `thermal_cooling_device_unregister'
      drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_unbind':
      etnaviv_gpu.c:(.text+0x2aac): undefined reference to `thermal_cooling_device_unregister'
    
    Adding a Kconfig dependency on THERMAL || !THERMAL to avoid this causes
    a dependency loop on x86_64:
    
      drivers/gpu/drm/tve200/Kconfig:1:error: recursive dependency detected!
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/gpu/drm/tve200/Kconfig:1:       symbol DRM_TVE200 depends on CMA
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      mm/Kconfig:489: symbol CMA is selected by DRM_ETNAVIV
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/gpu/drm/etnaviv/Kconfig:2:      symbol DRM_ETNAVIV depends on THERMAL
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/thermal/Kconfig:5:      symbol THERMAL is selected by ACPI_VIDEO
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/acpi/Kconfig:189:       symbol ACPI_VIDEO is selected by BACKLIGHT_CLASS_DEVICE
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/video/backlight/Kconfig:158:    symbol BACKLIGHT_CLASS_DEVICE is selected by DRM_PARADE_PS8622
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/gpu/drm/bridge/Kconfig:62:      symbol DRM_PARADE_PS8622 depends on DRM_BRIDGE
      For a resolution refer to Documentation/kbuild/kconfig-language.txt
      subsection "Kconfig recursive dependency limitations"
      drivers/gpu/drm/bridge/Kconfig:1:       symbol DRM_BRIDGE is selected by DRM_TVE200
    
    To work around this, add a new option DRM_ETNAVIV_THERMAL to optionally
    enable thermal throttling support and make DRM_ETNAVIV select THERMAL
    at the same time.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
    Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 893bfd501781fc9d719a976f13db7859b8781de6
Author: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date:   Wed Nov 22 21:31:20 2017 +0100

    power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
    
    
    [ Upstream commit 09edcb647542487864e23aa8d2ef26be3e08978a ]
    
    If an error occurs when we enable the backup battery charging, we should
    go through the error handling path directly.
    
    Before commit db43e6c473b5 ("ab8500-bm: Add usb power path support") this
    was the case, but this commit has added some code between the last test and
    the 'out' label.
    So, in case of error, this added code is executed and the error may be
    silently ignored.
    
    Fix it by adding the missing 'goto out', as done in all other error
    handling paths.
    
    Fixes: db43e6c473b5 ("ab8500-bm: Add usb power path support")
    Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 487d43596072b2e66e2bc6037c357e5b3c1bd026
Author: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date:   Wed Nov 22 21:27:31 2017 +0100

    power: supply: ab8500_charger: Fix an error handling path
    
    
    [ Upstream commit bf59fddde1c3eab89eb8dca8f3d3dc097887d2bb ]
    
    'ret' is know to be 0 at this point, because it has not been updated by the
    the previous call to 'abx500_mask_and_set_register_interruptible()'.
    
    Fix it by updating 'ret' before checking if an error occurred.
    
    Fixes: 84edbeeab67c ("ab8500-charger: AB8500 charger driver")
    Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7579edac03e6f155bdb94b354d74a3a2cb9eeaec
Author: Bjorn Andersson <bjorn.andersson@linaro.org>
Date:   Thu Nov 30 21:16:56 2017 -0800

    leds: pm8058: Silence pointer to integer size warning
    
    
    [ Upstream commit 8f52df50d9366f770a894d14ef724e5e04574e98 ]
    
    The pointer returned by of_device_get_match_data() doesn't have the same
    size as u32 on 64-bit architectures, causing a compile warning when
    compile-testing the driver on such platform.
    
    Cast the return value of of_device_get_match_data() to unsigned long and
    then to u32 to silence this warning.
    
    Fixes: 7f866986e705 ("leds: add PM8058 LEDs driver")
    Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Acked-by: Pavel Machek <pavel@ucw.cz>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab3db1af421005b9a33888ebe2b69cce81179b91
Author: Yossef Efraim <yossefe@mellanox.com>
Date:   Tue Nov 28 11:49:28 2017 +0200

    xfrm: Fix xfrm_replay_overflow_offload_esn
    
    
    [ Upstream commit 0ba23a211360af7b6658e4fcfc571970bbbacc55 ]
    
    In case of wrap around, replay_esn->oseq_hi is not updated
    before it is tested for it's actual value, leading function
    to fail with overflow indication and packets being dropped.
    
    This patch updates replay_esn->oseq_hi in the right place.
    
    Fixes: d7dbefc45cf5 ("xfrm: Add xfrm_replay_overflow functions for offloading")
    Signed-off-by: Yossef Efraim <yossefe@mellanox.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5aac93adff9caa5920af52ea1db2a5dc2c1badd9
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Wed Nov 29 17:29:20 2017 -0600

    userns: Don't fail follow_automount based on s_user_ns
    
    
    [ Upstream commit bbc3e471011417598e598707486f5d8814ec9c01 ]
    
    When vfs_submount was added the test to limit automounts from
    filesystems that with s_user_ns != &init_user_ns accidentially left
    in follow_automount.  The test was never about any security concerns
    and was always about how do we implement this for filesystems whose
    s_user_ns != &init_user_ns.
    
    At the moment this check makes no difference as there are no
    filesystems that both set FS_USERNS_MOUNT and implement d_automount.
    
    Remove this check now while I am thinking about it so there will not
    be odd booby traps for someone who does want to make this combination
    work.
    
    vfs_submount still needs improvements to allow this combination to work,
    and vfs_submount contains a check that presents a warning.
    
    The autofs4 filesystem could be modified to set FS_USERNS_MOUNT and it would
    need not work on this code path, as userspace performs the mounts.
    
    Fixes: 93faccbbfa95 ("fs: Better permission checking for submounts")
    Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds")
    Acked-by:  Ian Kent <raven@themaw.net>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 926b261b1ed523f2e64dfcf33eafc59e0af5bcb4
Author: Jagdish Gediya <jagdish.gediya@nxp.com>
Date:   Thu Nov 23 17:04:31 2017 +0530

    mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
    
    
    [ Upstream commit bccb06c353af3764ca86d9da47652458e6c2eb41 ]
    
    Bufnum mask is used to calculate page position in the internal SRAM.
    
    As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
    versions which had 8KB. Hence bufnum mask needs to be updated.
    
    Signed-off-by: Jagdish Gediya <jagdish.gediya@nxp.com>
    Signed-off-by: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
    Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f1f60c4b903f0f5464560783655ff74c9663a92
Author: Andrew F. Davis <afd@ti.com>
Date:   Wed Nov 29 11:13:59 2017 -0600

    ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
    
    
    [ Upstream commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 ]
    
    The correct DT property for specifying a GPIO used for reset
    is "reset-gpios", fix this here.
    
    Fixes: 14e3e295b2b9 ("ARM: dts: omap3-n900: Add TLV320AIC3X support")
    
    Signed-off-by: Andrew F. Davis <afd@ti.com>
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ed43f944a4070d04eddacded8629d0ddb9c8003
Author: Andrew F. Davis <afd@ti.com>
Date:   Wed Nov 29 11:13:56 2017 -0600

    ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
    
    
    [ Upstream commit e153db03c6b7a035c797bcdf35262586f003ee93 ]
    
    The correct DT property for specifying a GPIO used for reset
    is "reset-gpios", fix this here.
    
    Fixes: 4341881d0562 ("ARM: dts: Add devicetree for Gumstix Pepper board")
    
    Signed-off-by: Andrew F. Davis <afd@ti.com>
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5132282f9c4b39e21b51ec024237533ecaa98fd2
Author: Sunil Goutham <sgoutham@cavium.com>
Date:   Fri Nov 24 15:04:03 2017 +0300

    net: thunderx: Set max queue count taking XDP_TX into account
    
    
    [ Upstream commit 87de083857aa269fb171ef0b39696b2888361c58 ]
    
    on T81 there are only 4 cores, hence setting max queue count to 4
    would leave nothing for XDP_TX. This patch fixes this by doubling
    max queue count in above scenarios.
    
    Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
    Signed-off-by: cjacob <cjacob@caviumnetworks.com>
    Signed-off-by: Aleksey Makarov <aleksey.makarov@cavium.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ab1fcc7a5f7cce9ac077ab88ab7ac19c23f32fd
Author: Miquel Raynal <miquel.raynal@free-electrons.com>
Date:   Wed Nov 8 17:00:27 2017 +0100

    mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
    
    
    [ Upstream commit df467899da0b71465760b4e35127bce837244eee ]
    
    Some drivers (like nand_hynix.c) call ->cmdfunc() with NAND_CMD_NONE
    and a column address and expect the controller to only send address
    cycles. Right now, the default ->cmdfunc() implementations provided by
    the core do not filter out the command cycle in this case and forwards
    the request to the controller driver through the ->cmd_ctrl() method.
    The thing is, NAND controller drivers can get this wrong and send a
    command cycle with a NAND_CMD_NONE opcode and since NAND_CMD_NONE is
    -1, and the command field is usually casted to an u8, we end up sending
    the 0xFF command which is actually a RESET operation.
    
    Add conditions in nand_command[_lp]() functions to sending the initial
    command cycle when command == NAND_CMD_NONE.
    
    Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
    Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd174cd107d03e07dcf53767449d0ad09cd6c5b1
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Mon Nov 20 19:26:02 2017 +0900

    net: xfrm: allow clearing socket xfrm policies.
    
    
    [ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ]
    
    Currently it is possible to add or update socket policies, but
    not clear them. Therefore, once a socket policy has been applied,
    the socket cannot be used for unencrypted traffic.
    
    This patch allows (privileged) users to clear socket policies by
    passing in a NULL pointer and zero length argument to the
    {IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both
    the incoming and outgoing policies being cleared.
    
    The simple approach taken in this patch cannot clear socket
    policies in only one direction. If desired this could be added
    in the future, for example by continuing to pass in a length of
    zero (which currently is guaranteed to return EMSGSIZE) and
    making the policy be a pointer to an integer that contains one
    of the XFRM_POLICY_{IN,OUT} enum values.
    
    An alternative would have been to interpret the length as a
    signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the
    input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output
    policy.
    
    Tested: https://android-review.googlesource.com/539816
    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f113f794410a5c88f8cadf41b3f2499cc859da24
Author: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date:   Sat Nov 18 00:15:58 2017 +0300

    rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
    
    
    [ Upstream commit f2eef045de9defbc6fc6b72b17f0941cbe26c81d ]
    
    brcmstb_waketmr_probe() does not disable timer->clk on error paths.
    
    Found by Linux Driver Verification project (linuxtesting.org).
    
    Fixes: c4f07ecee22e ("rtc: brcmstb-waketimer: Add Broadcom STB wake-timer")
    Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31a0f45021086f57bc48c5572c26fde44fe92ee0
Author: Michael Hennerich <michael.hennerich@analog.com>
Date:   Tue Nov 28 13:53:12 2017 +0100

    net: ieee802154: adf7242: Fix bug if defined DEBUG
    
    
    [ Upstream commit 388b3b2b03701f3b3c10975c272892d7f78080df ]
    
    This fixes undefined reference to struct adf7242_local *lp in
    case DEBUG is defined.
    
    Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
    Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 00c7a2690dcc36d4fa77f844302a3d4687c536fa
Author: Luis R. Rodriguez <mcgrof@kernel.org>
Date:   Mon Nov 20 09:45:35 2017 -0800

    test_firmware: fix setting old custom fw path back on exit
    
    
    [ Upstream commit 65c79230576873b312c3599479c1e42355c9f349 ]
    
    The file /sys/module/firmware_class/parameters/path can be used
    to set a custom firmware path. The fw_filesystem.sh script creates
    a temporary directory to add a test firmware file to be used during
    testing, in order for this to work it uses the custom path syfs file
    and it was supposed to reset back the file on execution exit. The
    script failed to do this due to a typo, it was using OLD_PATH instead
    of OLD_FWPATH, since its inception since v3.17.
    
    Its not as easy to just keep the old setting, it turns out that
    resetting an empty setting won't actually do what we want, we need
    to check if it was empty and set an empty space.
    
    Without this we end up having the temporary path always set after
    we run these tests.
    
    Fixes: 0a8adf58475 ("test: add firmware_class loader test")
    Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 919ba939de1a2778376b41cba5163be7e76129d1
Author: Colin Ian King <colin.king@canonical.com>
Date:   Wed Nov 15 12:37:19 2017 +0000

    crypto: cavium - fix memory leak on info
    
    
    [ Upstream commit 87aae50af730a28dc1d8846d86dca5e9aa724a9f ]
    
    The object info is being leaked on an error return path, fix this
    by setting ret to -ENOMEM and exiting via the request_cleanup path
    that will free info.
    
    Detected by CoverityScan, CID#1408439 ("Resource Leak")
    
    Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90cf769aeb5a0a8bd9a24beafb83d97ee49002af
Author: Pierre <pinaraf@pinaraf.info>
Date:   Sun Nov 12 15:24:32 2017 +0100

    crypto: ecc - Fix NULL pointer deref. on no default_rng
    
    
    [ Upstream commit 4c0e22c90510308433272d7ba281b1eb4eda8209 ]
    
    If crypto_get_default_rng returns an error, the
    function ecc_gen_privkey should return an error.
    Instead, it currently tries to use the default_rng
    nevertheless, thus creating a kernel panic with a
    NULL pointer dereference.
    Returning the error directly, as was supposedly
    intended when looking at the code, fixes this.
    
    Signed-off-by: Pierre Ducroquet <pinaraf@pinaraf.info>
    Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cebb9043093e60c81227b4131188ce72acbba677
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Fri Oct 13 16:24:28 2017 -0700

    sched: Stop resched_cpu() from sending IPIs to offline CPUs
    
    
    [ Upstream commit a0982dfa03efca6c239c52cabebcea4afb93ea6b ]
    
    The rcutorture test suite occasionally provokes a splat due to invoking
    resched_cpu() on an offline CPU:
    
    WARNING: CPU: 2 PID: 8 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
    Modules linked in:
    CPU: 2 PID: 8 Comm: rcu_preempt Not tainted 4.14.0-rc4+ #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
    task: ffff902ede9daf00 task.stack: ffff96c50010c000
    RIP: 0010:native_smp_send_reschedule+0x37/0x40
    RSP: 0018:ffff96c50010fdb8 EFLAGS: 00010096
    RAX: 000000000000002e RBX: ffff902edaab4680 RCX: 0000000000000003
    RDX: 0000000080000003 RSI: 0000000000000000 RDI: 00000000ffffffff
    RBP: ffff96c50010fdb8 R08: 0000000000000000 R09: 0000000000000001
    R10: 0000000000000000 R11: 00000000299f36ae R12: 0000000000000001
    R13: ffffffff9de64240 R14: 0000000000000001 R15: ffffffff9de64240
    FS:  0000000000000000(0000) GS:ffff902edfc80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000f7d4c642 CR3: 000000001e0e2000 CR4: 00000000000006e0
    Call Trace:
     resched_curr+0x8f/0x1c0
     resched_cpu+0x2c/0x40
     rcu_implicit_dynticks_qs+0x152/0x220
     force_qs_rnp+0x147/0x1d0
     ? sync_rcu_exp_select_cpus+0x450/0x450
     rcu_gp_kthread+0x5a9/0x950
     kthread+0x142/0x180
     ? force_qs_rnp+0x1d0/0x1d0
     ? kthread_create_on_node+0x40/0x40
     ret_from_fork+0x27/0x40
    Code: 14 01 0f 92 c0 84 c0 74 14 48 8b 05 14 4f f4 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 38 89 ca 9d e8 e5 56 08 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 52 9e 37 02 85 c0 75 38 55 48
    ---[ end trace 26df9e5df4bba4ac ]---
    
    This splat cannot be generated by expedited grace periods because they
    always invoke resched_cpu() on the current CPU, which is good because
    expedited grace periods require that resched_cpu() unconditionally
    succeed.  However, other parts of RCU can tolerate resched_cpu() acting
    as a no-op, at least as long as it doesn't happen too often.
    
    This commit therefore makes resched_cpu() invoke resched_curr() only if
    the CPU is either online or is the current CPU.
    
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c2825526d967036ccd0ac5405422a253c9ffe1f
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Fri Oct 13 17:00:18 2017 -0700

    sched: Stop switched_to_rt() from sending IPIs to offline CPUs
    
    
    [ Upstream commit 2fe2582649aa2355f79acddb86bd4d6c5363eb63 ]
    
    The rcutorture test suite occasionally provokes a splat due to invoking
    rt_mutex_lock() which needs to boost the priority of a task currently
    sitting on a runqueue that belongs to an offline CPU:
    
    WARNING: CPU: 0 PID: 12 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40
    Modules linked in:
    CPU: 0 PID: 12 Comm: rcub/7 Not tainted 4.14.0-rc4+ #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
    task: ffff9ed3de5f8cc0 task.stack: ffffbbf80012c000
    RIP: 0010:native_smp_send_reschedule+0x37/0x40
    RSP: 0018:ffffbbf80012fd10 EFLAGS: 00010082
    RAX: 000000000000002f RBX: ffff9ed3dd9cb300 RCX: 0000000000000004
    RDX: 0000000080000004 RSI: 0000000000000086 RDI: 00000000ffffffff
    RBP: ffffbbf80012fd10 R08: 000000000009da7a R09: 0000000000007b9d
    R10: 0000000000000001 R11: ffffffffbb57c2cd R12: 000000000000000d
    R13: ffff9ed3de5f8cc0 R14: 0000000000000061 R15: ffff9ed3ded59200
    FS:  0000000000000000(0000) GS:ffff9ed3dea00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000080686f0 CR3: 000000001b9e0000 CR4: 00000000000006f0
    Call Trace:
     resched_curr+0x61/0xd0
     switched_to_rt+0x8f/0xa0
     rt_mutex_setprio+0x25c/0x410
     task_blocks_on_rt_mutex+0x1b3/0x1f0
     rt_mutex_slowlock+0xa9/0x1e0
     rt_mutex_lock+0x29/0x30
     rcu_boost_kthread+0x127/0x3c0
     kthread+0x104/0x140
     ? rcu_report_unblock_qs_rnp+0x90/0x90
     ? kthread_create_on_node+0x40/0x40
     ret_from_fork+0x22/0x30
    Code: f0 00 0f 92 c0 84 c0 74 14 48 8b 05 34 74 c5 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 a0 c6 fc b9 e8 d5 b5 06 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 a2 d1 13 02 85 c0 75 38 55 48
    
    But the target task's priority has already been adjusted, so the only
    purpose of switched_to_rt() invoking resched_curr() is to wake up the
    CPU running some task that needs to be preempted by the boosted task.
    But the CPU is offline, which presumably means that the task must be
    migrated to some other CPU, and that this other CPU will undertake any
    needed preemption at the time of migration.  Because the runqueue lock
    is held when resched_curr() is invoked, we know that the boosted task
    cannot go anywhere, so it is not necessary to invoke resched_curr()
    in this particular case.
    
    This commit therefore makes switched_to_rt() refrain from invoking
    resched_curr() when the target CPU is offline.
    
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 872181a79b3537aa3ce1b43891bd46d772f720ea
Author: Johan Hovold <johan@kernel.org>
Date:   Thu Nov 9 18:07:22 2017 +0100

    USB: ledtrig-usbport: fix of-node leak
    
    
    [ Upstream commit 03310a15484ab6a8f6d91bbf7fe486b17275c09a ]
    
    This code looks up a USB device node from a given parent USB device but
    never dropped its reference to the returned node.
    
    As only the address of the node is used for a later matching, the
    reference can be dropped immediately.
    
    Note that this trigger implementation confuses the description of the
    USB device connected to a port with the port itself (which does not have
    a device-tree representation).
    
    Fixes: 4f04c210d031 ("usb: core: read USB ports from DT in the usbport LED trigger driver")
    Cc: Rafał Miłecki <rafal@milecki.pl>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9faab6a01e92a679968be32c19995a4851d0cae
Author: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Date:   Tue Nov 21 14:12:12 2017 +0000

    typec: tcpm: fusb302: Resolve out of order messaging events
    
    
    [ Upstream commit ab69f61321140ff632d560775bc226259a78dfa2 ]
    
    The expectation in the FUSB302 driver is that a TX_SUCCESS event
    should occur after a message has been sent, but before a GCRCSENT
    event is raised to indicate successful receipt of a message from
    the partner. However in some circumstances it is possible to see
    the hardware raise a GCRCSENT event before a TX_SUCCESS event
    is raised. The upshot of this is that the GCRCSENT handling portion
    of code ends up reporting the GoodCRC message to TCPM because the
    TX_SUCCESS event hasn't yet arrived to trigger a consumption of it.
    When TX_SUCCESS is then raised by the chip it ends up consuming the
    actual message that was meant for TCPM, and this incorrect sequence
    results in a hard reset from TCPM.
    
    To avoid this problem, this commit updates the message reading
    code to check whether a GoodCRC message was received or not. Based
    on this check it will either report that the previous transmission
    has completed or it will pass the msg data to TCPM for futher
    processing. This way the incorrect ordering of the events no longer
    matters.
    
    Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
    Reviewed-by: Guenter Roeck <linux@roeck-us.net>
    Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc3173bf6ccbfb0965c12bf4c412699eab549d55
Author: Colin Ian King <colin.king@canonical.com>
Date:   Fri Nov 17 14:50:55 2017 +0000

    staging: rtl8822be: fix missing null check on dev_alloc_skb return
    
    
    [ Upstream commit 3eb23426e1749a0483bc4c9b18e51f657569e3ed ]
    
    dev_alloc_skb can potentially return NULL, so add a null check to
    avoid a null pointer dereference on skb
    
    Detected by CoverityScan, CID#1454558 ("Dereference on null return")
    
    Fixes: 7e5b796cde7e ("staging: r8822be: Add the driver code")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e2685fef97d48350290acaf1a9bda810efd3fe9
Author: Felix Kuehling <Felix.Kuehling@amd.com>
Date:   Mon Nov 27 18:29:43 2017 -0500

    drm/amdgpu: fix get_max_engine_clock_in_mhz
    
    
    [ Upstream commit a9efcc19161e20623c285fac967a32842972cebe ]
    
    Use proper powerplay function. This fixes OpenCL initialization
    problems.
    
    Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
    Acked-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc743e97389504d816d8a21188f973f5078b44bf
Author: Simon Shields <simon@lineageos.org>
Date:   Tue Nov 21 22:24:24 2017 +1100

    ARM: dts: exynos: Correct Trats2 panel reset line
    
    
    [ Upstream commit 1b377924841df1e13ab5b225be3a83f807a92b52 ]
    
    Trats2 uses gpf2-1 as the panel reset GPIO. gpy4-5 was only used
    on early revisions of the board.
    
    Fixes: 420ae8451a22 ("ARM: dts: exynos4412-trats2: add panel node")
    Signed-off-by: Simon Shields <simon@lineageos.org>
    Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7299cd29f12c641c3b93634b829d3976db784623
Author: Yixun Lan <yixun.lan@amlogic.com>
Date:   Tue Nov 7 22:12:23 2017 +0800

    clk: meson: gxbb: fix wrong clock for SARADC/SANA
    
    
    [ Upstream commit 75eccf5ed83250c0aeaeeb76f7288254ac0a87b4 ]
    
    According to the datasheet, in Meson-GXBB/GXL series,
    The clock gate bit for SARADC is HHI_GCLK_MPEG2 bit[22],
    while clock gate bit for SANA is HHI_GCLK_MPEG0 bit[10].
    
    Test passed at gxl-s905x-p212 board.
    
    The following published datasheets are wrong and should be updated
    [1] GXBB v1.1.4
    [2] GXL v0.3_20170314
    
    Fixes: 738f66d3211d ("clk: gxbb: add AmLogic GXBB clk controller driver")
    Tested-by: Xingyu Chen <xingyu.chen@amlogic.com>
    Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>
    Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ac03f5260e47748712e83c54c6a1074927b1f74
Author: Simon Horman <horms+renesas@verge.net.au>
Date:   Thu Nov 2 10:18:05 2017 +0100

    ARM: dts: koelsch: Move cec_clock to root node
    
    
    [ Upstream commit d72f4f03854d1225c72d682bf0e01377e7016419 ]
    
    cec-clock is a fixed clock generator that is not controlled by i2c5 and
    thus should not be a child of the i2c5 bus node. Rather, it should be
    a child of the root node of the DT.
    
    Fixes: 02a5ab18d366 ("ARM: dts: koelsch: Add CEC clock for HDMI transmitter")
    Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cc218843b44df0d1d1271f8d88877ba5cb2eebdf
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Oct 19 21:36:04 2017 +0300

    iwlwifi: mvm: rs: don't override the rate history in the search cycle
    
    
    [ Upstream commit 992172e3aec19e5b0ea5b757ba40a146b9282d1e ]
    
    When we are in a search cycle, we try different combinations
    of parameters. Those combinations are called 'columns'.
    When we switch to a new column, we first need to check if
    this column has a suitable rate, if not, we can't try it.
    This means we must not erase the statistics we gathered
    for the previous column until we are sure that we are
    indeed switching column.
    
    The code that tries to switch to a new column first sets
    a whole bunch of things for the new column, and only then
    checks that we can find suitable rates in that column.
    While doing that, the code mistakenly erased the rate
    statistics. This code was right until
    struct iwl_scale_tbl_info grew up for TPC.
    
    Fix this to make sure we don't erase the rate statistics
    until we are sure that we can indeed switch to the new
    column.
    
    Note that this bug is really harmless since it causes a
    change in the behavior only when we can't find any rate
    in the new column which should really not happen. In the
    case we do find a suitable we reset the rate statistics
    a few lines later anyway.
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f0ab595c2de0fd8fec27177fa80d001f22fb1b6c
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Wed Nov 22 11:19:51 2017 +0100

    HID: elo: clear BTN_LEFT mapping
    
    
    [ Upstream commit 9abd04af951e5734c9d5cfee9b49790844b734cf ]
    
    ELO devices have one Button usage in GenDesk field, which makes hid-input map
    it to BTN_LEFT; that confuses userspace, which then considers the device to be
    a mouse/touchpad instead of touchscreen.
    
    Fix that by unmapping BTN_LEFT and keeping only BTN_TOUCH in place.
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit addf1ae9fcb239fe67a03d41606e0f239887873f
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Nov 22 12:57:09 2017 +0100

    HID: multitouch: Only look at non touch fields in first packet of a frame
    
    
    [ Upstream commit 55746d28d66860bccaae20a67b55b9d5db7c14af ]
    
    Devices in "single finger hybrid mode" will send one report per finger,
    on some devices only the first report of such a multi-packet frame will
    contain a value for BTN_LEFT, in subsequent reports (if multiple fingers
    are down) the value is always 0, causing hid-mt to report BTN_LEFT going
    1 - 0 - 1 - 0 when pressing a clickpad and putting down a second finger.
    This happens for example on USB 0603:0002 mt touchpads.
    
    This commit fixes this by only reporting non touch fields for the first
    packet of a (possibly) multi-packet frame.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2bbda4c374c4d9cbe8fee21d52341f45da5414f
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date:   Mon Nov 13 19:04:18 2017 +0200

    video/hdmi: Allow "empty" HDMI infoframes
    
    
    [ Upstream commit 593f4b19a094c4426bd1e1e3cbab87a48bd13c71 ]
    
    HDMI 2.0 Appendix F suggest that we should keep sending the infoframe
    when switching from 3D to 2D mode, even if the infoframe isn't strictly
    necessary (ie. not needed to transmit the VIC or stereo information).
    This is a workaround against some sinks that fail to realize that they
    should switch from 3D to 2D mode when the source stop transmitting
    the infoframe.
    
    v2: Handle unpack() as well
        Pull the length calculation into a helper
    
    Cc: Shashank Sharma <shashank.sharma@intel.com>
    Cc: Andrzej Hajda <a.hajda@samsung.com>
    Cc: Thierry Reding <thierry.reding@gmail.com>
    Cc: Hans Verkuil <hans.verkuil@cisco.com>
    Cc: linux-media@vger.kernel.org
    Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> #v1
    Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20171113170427.4150-2-ville.syrjala@linux.intel.com
    Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 182c594668e7835aba759b4322ac081fe4eeaf1d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Nov 14 16:27:19 2017 +0000

    dma-buf/fence: Fix lock inversion within dma-fence-array
    
    
    [ Upstream commit 03e4e0a9e02cf703da331ff6cfd57d0be9bf5692 ]
    
    Ages ago Rob Clark noted,
    
    "Currently with fence-array, we have a potential deadlock situation.  If
    we fence_add_callback() on an array-fence, the array-fence's lock is
    acquired first, and in it's ->enable_signaling() callback, it will install
    cbs on it's array-member fences, so the array-member's lock is acquired
    second.
    
    But in the signal path, the array-member's lock is acquired first, and
    the array-fence's lock acquired second."
    
    Rob proposed either extensive changes to dma-fence to unnest the
    fence-array signaling, or to defer the signaling onto a workqueue. This
    is a more refined version of the later, that should keep the latency
    of the fence signaling to a minimum by using an irq-work, which is
    executed asap.
    
    Reported-by: Rob Clark <robdclark@gmail.com>
    Suggested-by: Rob Clark <robdclark@gmail.com>
    References: 1476635975-21981-1-git-send-email-robdclark@gmail.com
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Rob Clark <robdclark@gmail.com>
    Cc: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Cc: Sumit Semwal <sumit.semwal@linaro.org>
    Cc: Christian König <christian.koenig@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20171114162719.30958-1-chris@chris-wilson.co.uk
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e19df194b50e48d67b5794479fe92a8cd5564ba5
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Wed Nov 1 16:20:58 2017 +0200

    drm/edid: set ELD connector type in drm_edid_to_eld()
    
    
    [ Upstream commit 1d1c36650752b7fb81cee515a9bba4131cac4b7c ]
    
    Since drm_edid_to_eld() knows the connector type, we can set the type in
    ELD while at it. Most connectors this gets called on are not DP
    encoders, and with the HDMI type being 0, this does not change behaviour
    for non-DP.
    
    For i915 having this in place earlier would have saved a considerable
    amount of debugging that lead to the fix 2d8f63297b9f ("drm/i915: always
    update ELD connector type after get modes"). I don't see other drivers,
    even the ones calling drm_edid_to_eld() on DP connectors, setting the
    connector type in ELD.
    
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Cc: Christian König <christian.koenig@amd.com>
    Cc: Archit Taneja <architt@codeaurora.org>
    Cc: Andrzej Hajda <a.hajda@samsung.com>
    Cc: Russell King <linux@armlinux.org.uk>
    Cc: CK Hu <ck.hu@mediatek.com>
    Cc: Philipp Zabel <p.zabel@pengutronix.de>
    Cc: Ben Skeggs <bskeggs@redhat.com>
    Cc: Mark Yao <mark.yao@rock-chips.com>
    Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
    Cc: Vincent Abriou <vincent.abriou@st.com>
    Cc: Thierry Reding <thierry.reding@gmail.com>
    Cc: Eric Anholt <eric@anholt.net>
    Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Acked-by: Thierry Reding <treding@nvidia.com>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/d527b31619528c477c2c136f25cdf118bc0cfc1d.1509545641.git.jani.nikula@intel.com
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b0509fa4afe6e44c9a70bd770387b7a06dd5d23
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Mar 16 15:00:50 2018 +0100

    Revert "btrfs: use proper endianness accessors for super_copy"
    
    This reverts commit 3c181c12c431fe33b669410d663beb9cceefcd1b as it
    causes breakage on big endian systems with btrfs images.
    
    Reported-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
    Cc: Anand Jain <anand.jain@oracle.com>
    Cc: Liu Bo <bo.li.liu@oracle.com>
    Cc: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d916e453942be7b5ab7b38037fa1abad1c25ada6
Author: Steffen Maier <maier@linux.vnet.ibm.com>
Date:   Wed Mar 14 15:33:06 2018 +0100

    dm mpath: fix passing integrity data
    
    commit 8c5c147339d2e201108169327b1f99aa6d57d2cd upstream.
    
    After v4.12 commit e2460f2a4bc7 ("dm: mark targets that pass integrity
    data"), dm-multipath, e.g. on DIF+DIX SCSI disk paths, does not support
    block integrity any more. So add it to the whitelist.
    
    This is also a pre-requisite to use block integrity with other dm layer(s)
    on top of multipath, such as kpartx partitions (dm-linear) or LVM.
    
    Also, bump target version to reflect this fix.
    
    Fixes: e2460f2a4bc7 ("dm: mark targets that pass integrity data")
    Cc: <stable@vger.kernel.org> #4.12+
    Bisected-by: Fedor Loshakov <loshakov@linux.vnet.ibm.com>
    Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
    Reviewed-by: Hannes Reinecke <hare@suse.com>
    Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dbacf552cdbf935a40278e769b2bda4e8e87bdbb
Author: Greentime Hu <green.hu@gmail.com>
Date:   Tue Feb 13 17:09:08 2018 +0800

    earlycon: add reg-offset to physical address before mapping
    
    commit 1f66dd36bb18437397ea0d7882c52f7e3c476e15 upstream.
    
    It will get the wrong virtual address because port->mapbase is not added
    the correct reg-offset yet. We have to update it before earlycon_map()
    is called
    
    Signed-off-by: Greentime Hu <greentime@andestech.com>
    Acked-by: Arnd Bergmann <arnd@arndb.de>
    Cc: Peter Hurley <peter@hurleysoftware.com>
    Cc: stable@vger.kernel.org
    Fixes: 088da2a17619 ("of: earlycon: Initialize port fields from DT properties")
    Acked-by: Rob Herring <robh@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0da58aed9edc8acf09ca3711597a5fff96632577
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Sat Feb 3 12:27:23 2018 +0100

    serial: core: mark port as initialized in autoconfig
    
    commit 714569064adee3c114a2a6490735b94abe269068 upstream.
    
    This is a followup on 44117a1d1732 ("serial: core: mark port as
    initialized after successful IRQ change").
    Nikola has been using autoconfig via setserial and reported a crash
    similar to what I fixed in the earlier mentioned commit. Here I do the
    same fixup for the autoconfig. I wasn't sure that this is the right
    approach. Nikola confirmed that it fixes his crash.
    
    Fixes: b3b576461864 ("tty: serial_core: convert uart_open to use tty_port_open")
    Link: http://lkml.kernel.org/r/20180131072000.GD1853@localhost.localdomain
    Reported-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
    Tested-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Tested-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
    Acked-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 099d055f8ab9e4e4431484b3a4b8ca8fc826293a
Author: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Date:   Tue Feb 13 15:04:46 2018 +0100

    serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
    
    commit 9f2068f35729948bde84d87a40d135015911345d upstream.
    
    Add PCI ids for two variants of Brainboxes UC-260 quad port
    PCI serial cards.
    
    Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Signed-off-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e52fb772cb1da00d117da821ebabffe79862c25b
Author: Roger Quadros <rogerq@ti.com>
Date:   Tue Feb 27 12:41:41 2018 +0200

    usb: dwc3: Fix lock-up on ID change during system suspend/resume
    
    commit 084a804e01205bcd74cd0849bc72cb5c88f8e648 upstream.
    
    To reproduce the lock up do the following
    - connect otg host adapter and a USB device to the dual-role port
    so that it is in host mode.
    - suspend to mem.
    - disconnect otg adapter.
    - resume the system.
    
    If we call dwc3_host_exit() before tasks are thawed
    xhci_plat_remove() seems to lock up at the second usb_remove_hcd() call.
    
    To work around this we queue the _dwc3_set_mode() work on
    the system_freezable_wq.
    
    Fixes: 41ce1456e1db ("usb: dwc3: core: make dwc3_set_mode() work properly")
    Cc: <stable@vger.kernel.org> # v4.12+
    Suggested-by: Manu Gautam <mgautam@codeaurora.org>
    Signed-off-by: Roger Quadros <rogerq@ti.com>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99d7fb05c1e91c1585b2ee922e79a1d46f7d3380
Author: Xinyong <xinyong.fang@linux.alibaba.com>
Date:   Fri Mar 2 19:20:07 2018 +0800

    usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
    
    commit 1a087f032111a88e826877449dfb93ceb22b78b9 upstream.
    
    When I debug a kernel crash issue in funcitonfs, found ffs_data.ref
    overflowed, While functionfs is unmounting, ffs_data is put twice.
    
    Commit 43938613c6fd ("drivers, usb: convert ffs_data.ref from atomic_t to
    refcount_t") can avoid refcount overflow, but that is risk some situations.
    So no need put ffs data in ffs_fs_kill_sb, already put in ffs_data_closed.
    
    The issue can be reproduced in Mediatek mt6763 SoC, ffs for ADB device.
    KASAN enabled configuration reports use-after-free errro.
    
    BUG: KASAN: use-after-free in refcount_dec_and_test+0x14/0xe0 at addr ffffffc0579386a0
    Read of size 4 by task umount/4650
    ====================================================
    BUG kmalloc-512 (Tainted: P        W  O   ): kasan: bad access detected
    -----------------------------------------------------------------------------
    
    INFO: Allocated in ffs_fs_mount+0x194/0x844 age=22856 cpu=2 pid=566
        alloc_debug_processing+0x1ac/0x1e8
        ___slab_alloc.constprop.63+0x640/0x648
        __slab_alloc.isra.57.constprop.62+0x24/0x34
        kmem_cache_alloc_trace+0x1a8/0x2bc
        ffs_fs_mount+0x194/0x844
        mount_fs+0x6c/0x1d0
        vfs_kern_mount+0x50/0x1b4
        do_mount+0x258/0x1034
    INFO: Freed in ffs_data_put+0x25c/0x320 age=0 cpu=3 pid=4650
        free_debug_processing+0x22c/0x434
        __slab_free+0x2d8/0x3a0
        kfree+0x254/0x264
        ffs_data_put+0x25c/0x320
        ffs_data_closed+0x124/0x15c
        ffs_fs_kill_sb+0xb8/0x110
        deactivate_locked_super+0x6c/0x98
        deactivate_super+0xb0/0xbc
    INFO: Object 0xffffffc057938600 @offset=1536 fp=0x          (null)
    ......
    Call trace:
    [<ffffff900808cf5c>] dump_backtrace+0x0/0x250
    [<ffffff900808d3a0>] show_stack+0x14/0x1c
    [<ffffff90084a8c04>] dump_stack+0xa0/0xc8
    [<ffffff900826c2b4>] print_trailer+0x158/0x260
    [<ffffff900826d9d8>] object_err+0x3c/0x40
    [<ffffff90082745f0>] kasan_report_error+0x2a8/0x754
    [<ffffff9008274f84>] kasan_report+0x5c/0x60
    [<ffffff9008273208>] __asan_load4+0x70/0x88
    [<ffffff90084cd81c>] refcount_dec_and_test+0x14/0xe0
    [<ffffff9008d98f9c>] ffs_data_put+0x80/0x320
    [<ffffff9008d9d904>] ffs_fs_kill_sb+0xc8/0x110
    [<ffffff90082852a0>] deactivate_locked_super+0x6c/0x98
    [<ffffff900828537c>] deactivate_super+0xb0/0xbc
    [<ffffff90082af0c0>] cleanup_mnt+0x64/0xec
    [<ffffff90082af1b0>] __cleanup_mnt+0x10/0x18
    [<ffffff90080d9e68>] task_work_run+0xcc/0x124
    [<ffffff900808c8c0>] do_notify_resume+0x60/0x70
    [<ffffff90080866e4>] work_pending+0x10/0x14
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Xinyong <xinyong.fang@linux.alibaba.com>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 59b0613d3f40f0ba621bb9c7ddf06dea2948e0b7
Author: Pete Zaitcev <zaitcev@kotori.zaitcev.us>
Date:   Fri Mar 9 00:21:14 2018 -0600

    usb: usbmon: Read text within supplied buffer size
    
    commit a5f596830e27e15f7a0ecd6be55e433d776986d8 upstream.
    
    This change fixes buffer overflows and silent data corruption with the
    usbmon device driver text file read operations.
    
    Signed-off-by: Fredrik Noring <noring@nocrew.org>
    Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42b8dfefbb1b4b49e028aeb5bbbcf41f1028756e
Author: Danilo Krummrich <danilokrummrich@dk-develop.de>
Date:   Tue Mar 6 09:38:49 2018 +0100

    usb: quirks: add control message delay for 1b1c:1b20
    
    commit cb88a0588717ba6c756cb5972d75766b273a6817 upstream.
    
    Corsair Strafe RGB keyboard does not respond to usb control messages
    sometimes and hence generates timeouts.
    
    Commit de3af5bf259d ("usb: quirks: add delay init quirk for Corsair
    Strafe RGB keyboard") tried to fix those timeouts by adding
    USB_QUIRK_DELAY_INIT.
    
    Unfortunately, even with this quirk timeouts of usb_control_msg()
    can still be seen, but with a lower frequency (approx. 1 out of 15):
    
    [   29.103520] usb 1-8: string descriptor 0 read error: -110
    [   34.363097] usb 1-8: can't set config #1, error -110
    
    Adding further delays to different locations where usb control
    messages are issued just moves the timeouts to other locations,
    e.g.:
    
    [   35.400533] usbhid 1-8:1.0: can't add hid device: -110
    [   35.401014] usbhid: probe of 1-8:1.0 failed with error -110
    
    The only way to reliably avoid those issues is having a pause after
    each usb control message. In approx. 200 boot cycles no more timeouts
    were seen.
    
    Addionaly, keep USB_QUIRK_DELAY_INIT as it turned out to be necessary
    to have the delay in hub_port_connect() after hub_port_init().
    
    The overall boot time seems not to be influenced by these additional
    delays, even on fast machines and lightweight distributions.
    
    Fixes: de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard")
    Cc: stable@vger.kernel.org
    Signed-off-by: Danilo Krummrich <danilokrummrich@dk-develop.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d4f0bf4525fd55e90886714fb24a1ca7e7653fb2
Author: Colin Ian King <colin.king@canonical.com>
Date:   Thu Feb 22 17:39:17 2018 +0000

    usbip: vudc: fix null pointer dereference on udc->lock
    
    commit df3334c223a033f562645712e832ca4cbb326bbf upstream.
    
    Currently the driver attempts to spin lock on udc->lock before a NULL
    pointer check is performed on udc, hence there is a potential null
    pointer dereference on udc->lock.  Fix this by moving the null check
    on udc before the lock occurs.
    
    Fixes: ea6873a45a22 ("usbip: vudc: Add SysFS infrastructure for VUDC")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
    Reviewed-by: Krzysztof Opasiak <k.opasiak@samsung.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8187fd2aedaf573163a7ac1308c8014580aa4a0
Author: Teijo Kinnunen <teijo.kinnunen@code-q.fi>
Date:   Thu Mar 1 19:34:29 2018 +0200

    USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
    
    commit 5126a504b63d82785eaece3a9c30c660b313785a upstream.
    
    This USB-SATA controller seems to be similar with JMicron bridge
    152d:2566 already on the list. Adding it here fixes "Invalid
    field in cdb" errors.
    
    Signed-off-by: Teijo Kinnunen <teijo.kinnunen@code-q.fi>
    Cc: stable@vger.kernel.org
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6de9ee2f302078073ca8736434a06450843828b5
Author: Joel Fernandes <joelaf@google.com>
Date:   Fri Feb 16 11:02:01 2018 -0800

    staging: android: ashmem: Fix lockdep issue during llseek
    
    commit cb57469c9573f6018cd1302953dd45d6e05aba7b upstream.
    
    ashmem_mutex create a chain of dependencies like so:
    
    (1)
    mmap syscall ->
      mmap_sem ->  (acquired)
      ashmem_mmap
      ashmem_mutex (try to acquire)
      (block)
    
    (2)
    llseek syscall ->
      ashmem_llseek ->
      ashmem_mutex ->  (acquired)
      inode_lock ->
      inode->i_rwsem (try to acquire)
      (block)
    
    (3)
    getdents ->
      iterate_dir ->
      inode_lock ->
      inode->i_rwsem   (acquired)
      copy_to_user ->
      mmap_sem         (try to acquire)
    
    There is a lock ordering created between mmap_sem and inode->i_rwsem
    causing a lockdep splat [2] during a syzcaller test, this patch fixes
    the issue by unlocking the mutex earlier. Functionally that's Ok since
    we don't need to protect vfs_llseek.
    
    [1] https://patchwork.kernel.org/patch/10185031/
    [2] https://lkml.org/lkml/2018/1/10/48
    
    Acked-by: Todd Kjos <tkjos@google.com>
    Cc: Arve Hjonnevag <arve@android.com>
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com
    Signed-off-by: Joel Fernandes <joelaf@google.com>
    Acked-by: Greg Hackmann <ghackmann@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4c2d71dd0f90ceace162d47524f151bd29706abf
Author: Frank Mori Hess <fmh6jj@gmail.com>
Date:   Thu Feb 15 15:13:42 2018 -0500

    staging: comedi: fix comedi_nsamples_left.
    
    commit a42ae5905140c324362fe5036ae1dbb16e4d359c upstream.
    
    A rounding error was causing comedi_nsamples_left to
    return the wrong value when nsamples was not a multiple
    of the scan length.
    
    Cc: <stable@vger.kernel.org> # v4.4+
    Signed-off-by: Frank Mori Hess <fmh6jj@gmail.com>
    Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fdd0f1b2efc7ad006c38070b9e034f44995357f5
Author: Oliver Neukum <oneukum@suse.com>
Date:   Tue Mar 6 15:04:24 2018 +0100

    uas: fix comparison for error code
    
    commit 9a513c905bb95bef79d96feb08621c1ec8d8c4bb upstream.
    
    A typo broke the comparison.
    
    Fixes: cbeef22fd611 ("usb: uas: unconditionally bring back host after reset")
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    CC: stable@kernel.org
    Acked-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c8e0474f543dfa58a3f192ec6b7a7397306be4b
Author: Jonas Danielsson <jonas@orbital-systems.com>
Date:   Mon Jan 29 12:39:15 2018 +0100

    tty/serial: atmel: add new version check for usart
    
    commit fd63a8903a2c40425a9811c3371dd4d0f42c0ad3 upstream.
    
    On our at91sam9260 based board the usart0 and usart1 ports report
    their versions (ATMEL_US_VERSION) as 0x10302. This version is not
    included in the current checks in the driver.
    
    Signed-off-by: Jonas Danielsson <jonas@orbital-systems.com>
    Acked-by: Richard Genoud <richard.genoud@gmail.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6a8916de0db0468dbc34b100a2065555f1078d3
Author: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
Date:   Thu Feb 15 13:02:27 2018 +0100

    serial: sh-sci: prevent lockup on full TTY buffers
    
    commit 7842055bfce4bf0170d0f61df8b2add8399697be upstream.
    
    When the TTY buffers fill up to the configured maximum, a system lockup
    occurs:
    
    [  598.820128] INFO: rcu_preempt detected stalls on CPUs/tasks:
    [  598.825796]  0-...!: (1 GPs behind) idle=5a6/2/0 softirq=1974/1974 fqs=1
    [  598.832577]  (detected by 3, t=62517 jiffies, g=296, c=295, q=126)
    [  598.838755] Task dump for CPU 0:
    [  598.841977] swapper/0       R  running task        0     0      0 0x00000022
    [  598.849023] Call trace:
    [  598.851476]  __switch_to+0x98/0xb0
    [  598.854870]            (null)
    
    This can be prevented by doing a dummy read of the RX data register.
    
    This issue affects both HSCIF and SCIF ports. Reported for R-Car H3 ES2.0;
    reproduced and fixed on H3 ES1.1. Probably affects other R-Car platforms
    as well.
    
    Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Signed-off-by: Ulrich Hecht <ulrich.hecht+renesas@gmail.com>
    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Cc: stable <stable@vger.kernel.org>
    Tested-by: Nguyen Viet Dung <dung.nguyen.aj@renesas.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d03fbfded594ed91f329a0101a80b23720aad010
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date:   Thu Mar 8 17:17:14 2018 +0200

    xhci: fix endpoint context tracer output
    
    commit 97ef0faf575e03b352553f92c9430cb4c0431436 upstream.
    
    Fix incorrent values showed for max Primary stream and
    Linear stream array (LSA) values in the endpoint context
    decoder.
    
    Fixes: 19a7d0d65c4a ("usb: host: xhci: add Slot and EP Context tracers")
    Cc: <stable@vger.kernel.org> # v4.12+
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7c3836cd166b6ca6a8efa7f05933973da71d7ee
Author: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date:   Thu Mar 8 17:17:17 2018 +0200

    xhci: Fix front USB ports on ASUS PRIME B350M-A
    
    commit 191edc5e2e515aab1075a3f0ef23599e80be5f59 upstream.
    
    When a USB device gets plugged on ASUS PRIME B350M-A's front ports, the
    xHC stops working:
    [  549.114587] xhci_hcd 0000:02:00.0: WARN: xHC CMD_RUN timeout
    [  549.114608] suspend_common(): xhci_pci_suspend+0x0/0xc0 returns -110
    [  549.114638] xhci_hcd 0000:02:00.0: can't suspend (hcd_pci_runtime_suspend returned -110)
    
    Delay before running xHC command CMD_RUN can workaround the issue.
    
    Use a new quirk to make the delay only targets to the affected xHC.
    
    Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 490869f59f58bace1a5bf3588af76c5e068bb6f4
Author: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date:   Tue Feb 27 17:15:20 2018 +0900

    usb: host: xhci-rcar: add support for r8a77965
    
    commit 015dbeb2282030bf56762e21d25f09422edfd750 upstream.
    
    This patch adds support for r8a77965 (R-Car M3-N).
    
    Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
    Reviewed-by: Rob Herring <robh@kernel.org>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 92d77052462518e382bb45145e35819f73fb73d7
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Sun Feb 18 23:01:44 2018 +0100

    ASoC: rt5651: Fix regcache sync errors on resume
    
    commit 2d30e9494f1ea320aaaad0cff9ddd92c87eac355 upstream.
    
    The ALC5651 does not like multi-write accesses, avoid them. This fixes:
    
    rt5651 i2c-10EC5651:00: Unable to sync registers 0x27-0x28. -121
    
    Errors on resume (and all registers after the registers in the error not
    being synced).
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 57e2eb2d13dbda924b53597a0084fb3c284348b0
Author: Richard Fitzgerald <rf@opensource.cirrus.com>
Date:   Wed Feb 28 10:31:10 2018 +0000

    ASoC: wm_adsp: For TLV controls only register TLV get/set
    
    commit d7789f5bcdb298c4a302db471b1b20f74a20de95 upstream.
    
    Normal 512-byte get/set of a TLV isn't supported but we were
    registering the normal get/set anyway and relying on omitting
    the SNDRV_CTL_ELEM_ACCESS_[READ|WRITE] flags to prevent them
    being called.
    
    Trouble is if this gets broken in the core ALSA code - as it has
    been since at least 4.14 - the standard get/set can be called
    unexpectedly and corrupt memory.
    
    There's no point providing functions that won't be called and
    it's a trivial change. The benefit is that if the ALSA core gets
    broken again we get a big fat immediate NULL dereference instead
    of a memory corruption timebomb.
    
    Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90442512a6c63ffc57323c8d5038220375115b13
Author: Fabio Estevam <fabio.estevam@nxp.com>
Date:   Fri Feb 16 11:58:54 2018 -0200

    ASoC: sgtl5000: Fix suspend/resume
    
    commit a8992973edbb2555e956b90f6fe97c4bc14d761d upstream.
    
    Commit 8419caa72702 ("ASoC: sgtl5000: Do not disable regulators in
    SND_SOC_BIAS_OFF") causes the sgtl5000 to fail after a suspend/resume
    sequence:
    
    Playing WAVE '/media/a2002011001-e02.wav' : Signed 16 bit Little
    Endian, Rate 44100 Hz, Stereo
    aplay: pcm_write:2051: write error: Input/output error
    
    The problem is caused by the fact that the aforementioned commit
    dropped the cache handling, so re-introduce the register map
    resync to fix the problem.
    
    Suggested-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 577ad1c9bcfda68273784fb937281872b7655c54
Author: Yong Deng <yong.deng@magewell.com>
Date:   Mon Feb 26 10:43:52 2018 +0800

    ASoC: sun4i-i2s: Fix RX slot number of SUN8I
    
    commit 5a3386790a172cf738194e1574f631cd43c6140a upstream.
    
    I2S's RX slot number of SUN8I should be shifted 4 bit to left.
    
    Fixes: 7d2993811a1e ("ASoC: sun4i-i2s: Add support for H3")
    Signed-off-by: Yong Deng <yong.deng@magewell.com>
    Reviewed-by: Chen-Yu Tsai <wens@csie.org>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a971fc44c94b6e20f492a93e3e6e5f1735d8afb8
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Feb 7 14:20:09 2018 -0800

    x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
    
    commit b21ebf2fb4cde1618915a97cc773e287ff49173e upstream.
    
    On i386, there are 2 types of PLTs, PIC and non-PIC.  PIE and shared
    objects must use PIC PLT.  To use PIC PLT, you need to load
    _GLOBAL_OFFSET_TABLE_ into EBX first.  There is no need for that on
    x86-64 since x86-64 uses PC-relative PLT.
    
    On x86-64, for 32-bit PC-relative branches, we can generate PLT32
    relocation, instead of PC32 relocation, which can also be used as
    a marker for 32-bit PC-relative branches.  Linker can always reduce
    PLT32 relocation to PC32 if function is defined locally.   Local
    functions should use PC32 relocation.  As far as Linux kernel is
    concerned, R_X86_64_PLT32 can be treated the same as R_X86_64_PC32
    since Linux kernel doesn't use PLT.
    
    R_X86_64_PLT32 for 32-bit PC-relative branches has been enabled in
    binutils master branch which will become binutils 2.31.
    
    [ hjl is working on having better documentation on this all, but a few
      more notes from him:
    
       "PLT32 relocation is used as marker for PC-relative branches. Because
        of EBX, it looks odd to generate PLT32 relocation on i386 when EBX
        doesn't have GOT.
    
        As for symbol resolution, PLT32 and PC32 relocations are almost
        interchangeable. But when linker sees PLT32 relocation against a
        protected symbol, it can resolved locally at link-time since it is
        used on a branch instruction. Linker can't do that for PC32
        relocation"
    
      but for the kernel use, the two are basically the same, and this
      commit gets things building and working with the current binutils
      master   - Linus ]
    
    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Matthias Kaehlcke <mka@chromium.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6bccf8962b7874a2e66c2f78c9e48e0a7012c541
Author: Andrew Lunn <andrew@lunn.ch>
Date:   Tue Feb 27 01:56:06 2018 +0100

    net: phy: Restore phy_resume() locking assumption
    
    commit 9c2c2e62df3fa30fb13fbeb7512a4eede729383b upstream.
    
    commit f5e64032a799 ("net: phy: fix resume handling") changes the
    locking semantics for phy_resume() such that the caller now needs to
    hold the phy mutex. Not all call sites were adopted to this new
    semantic, resulting in warnings from the added
    WARN_ON(!mutex_is_locked(&phydev->lock)).  Rather than change the
    semantics, add a __phy_resume() and restore the old behavior of
    phy_resume().
    
    Reported-by: Heiner Kallweit <hkallweit1@gmail.com>
    Fixes: f5e64032a799 ("net: phy: fix resume handling")
    Signed-off-by: Andrew Lunn <andrew@lunn.ch>
    Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76fbc152cd8c95369b0527b5d5cb1e166033ab84
Author: Russell King <rmk+kernel@armlinux.org.uk>
Date:   Tue Dec 12 10:45:36 2017 +0000

    net: phy: fix resume handling
    
    [ Upstream commit f5e64032a799d4f54decc7eb6aafcdffb67f9ad9 ]
    
    When a PHY has the BMCR_PDOWN bit set, it may decide to ignore writes
    to other registers, or reset the registers to power-on defaults.
    Micrel PHYs do this for their interrupt registers.
    
    The current structure of phylib tries to enable interrupts before
    resuming (and releasing) the BMCR_PDOWN bit.  This fails, causing
    Micrel PHYs to stop working after a suspend/resume sequence if they
    are using interrupts.
    
    Fix this by ensuring that the PHY driver resume methods do not take
    the phydev->lock mutex themselves, but the callers of phy_resume()
    take that lock.  This then allows us to move the call to phy_resume()
    before we enable interrupts in phy_start().
    
    Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>