diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/boot/dts/dra7.dtsi linux-libre-4.18.12-gnu/arch/arm/boot/dts/dra7.dtsi
--- linux-libre-4.18.11-gnu/arch/arm/boot/dts/dra7.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/boot/dts/dra7.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -1893,7 +1893,7 @@
 			};
 		};
 
-		dcan1: can@481cc000 {
+		dcan1: can@4ae3c000 {
 			compatible = "ti,dra7-d_can";
 			ti,hwmods = "dcan1";
 			reg = <0x4ae3c000 0x2000>;
@@ -1903,7 +1903,7 @@
 			status = "disabled";
 		};
 
-		dcan2: can@481d0000 {
+		dcan2: can@48480000 {
 			compatible = "ti,dra7-d_can";
 			ti,hwmods = "dcan2";
 			reg = <0x48480000 0x2000>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/boot/dts/imx7d.dtsi linux-libre-4.18.12-gnu/arch/arm/boot/dts/imx7d.dtsi
--- linux-libre-4.18.11-gnu/arch/arm/boot/dts/imx7d.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/boot/dts/imx7d.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -125,10 +125,14 @@
 		interrupt-names = "msi";
 		#interrupt-cells = <1>;
 		interrupt-map-mask = <0 0 0 0x7>;
-		interrupt-map = <0 0 0 1 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
-				<0 0 0 2 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
-				<0 0 0 3 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
-				<0 0 0 4 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+		/*
+		 * Reference manual lists pci irqs incorrectly
+		 * Real hardware ordering is same as imx6: D+MSI, C, B, A
+		 */
+		interrupt-map = <0 0 0 1 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
+				<0 0 0 2 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+				<0 0 0 3 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+				<0 0 0 4 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&clks IMX7D_PCIE_CTRL_ROOT_CLK>,
 			 <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>,
 			 <&clks IMX7D_PCIE_PHY_ROOT_CLK>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/boot/dts/ls1021a.dtsi linux-libre-4.18.12-gnu/arch/arm/boot/dts/ls1021a.dtsi
--- linux-libre-4.18.11-gnu/arch/arm/boot/dts/ls1021a.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/boot/dts/ls1021a.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -84,6 +84,7 @@
 			device_type = "cpu";
 			reg = <0xf01>;
 			clocks = <&clockgen 1 0>;
+			#cooling-cells = <2>;
 		};
 	};
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/boot/dts/mt7623.dtsi linux-libre-4.18.12-gnu/arch/arm/boot/dts/mt7623.dtsi
--- linux-libre-4.18.11-gnu/arch/arm/boot/dts/mt7623.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/boot/dts/mt7623.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -92,6 +92,7 @@
 				 <&apmixedsys CLK_APMIXED_MAINPLL>;
 			clock-names = "cpu", "intermediate";
 			operating-points-v2 = <&cpu_opp_table>;
+			#cooling-cells = <2>;
 			clock-frequency = <1300000000>;
 		};
 
@@ -103,6 +104,7 @@
 				 <&apmixedsys CLK_APMIXED_MAINPLL>;
 			clock-names = "cpu", "intermediate";
 			operating-points-v2 = <&cpu_opp_table>;
+			#cooling-cells = <2>;
 			clock-frequency = <1300000000>;
 		};
 
@@ -114,6 +116,7 @@
 				 <&apmixedsys CLK_APMIXED_MAINPLL>;
 			clock-names = "cpu", "intermediate";
 			operating-points-v2 = <&cpu_opp_table>;
+			#cooling-cells = <2>;
 			clock-frequency = <1300000000>;
 		};
 	};
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/boot/dts/omap4-droid4-xt894.dts linux-libre-4.18.12-gnu/arch/arm/boot/dts/omap4-droid4-xt894.dts
--- linux-libre-4.18.11-gnu/arch/arm/boot/dts/omap4-droid4-xt894.dts	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/boot/dts/omap4-droid4-xt894.dts	2018-10-03 19:59:28.000000000 -0400
@@ -351,7 +351,7 @@
 &mmc2 {
 	vmmc-supply = <&vsdio>;
 	bus-width = <8>;
-	non-removable;
+	ti,non-removable;
 };
 
 &mmc3 {
@@ -618,15 +618,6 @@
 		OMAP4_IOPAD(0x10c, PIN_INPUT | MUX_MODE1)	/* abe_mcbsp3_fsx */
 		>;
 	};
-};
-
-&omap4_pmx_wkup {
-	usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
-		/* gpio_wk0 */
-		pinctrl-single,pins = <
-		OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
-		>;
-	};
 
 	vibrator_direction_pin: pinmux_vibrator_direction_pin {
 		pinctrl-single,pins = <
@@ -640,6 +631,15 @@
 		>;
 	};
 };
+
+&omap4_pmx_wkup {
+	usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
+		/* gpio_wk0 */
+		pinctrl-single,pins = <
+		OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
+		>;
+	};
+};
 
 /*
  * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/mach-mvebu/pmsu.c linux-libre-4.18.12-gnu/arch/arm/mach-mvebu/pmsu.c
--- linux-libre-4.18.11-gnu/arch/arm/mach-mvebu/pmsu.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/mach-mvebu/pmsu.c	2018-10-03 19:59:28.000000000 -0400
@@ -116,8 +116,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw
 		PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu));
 }
 
-extern unsigned char mvebu_boot_wa_start;
-extern unsigned char mvebu_boot_wa_end;
+extern unsigned char mvebu_boot_wa_start[];
+extern unsigned char mvebu_boot_wa_end[];
 
 /*
  * This function sets up the boot address workaround needed for SMP
@@ -130,7 +130,7 @@ int mvebu_setup_boot_addr_wa(unsigned in
 			     phys_addr_t resume_addr_reg)
 {
 	void __iomem *sram_virt_base;
-	u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start;
+	u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start;
 
 	mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE);
 	mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/mach-omap2/omap_hwmod.c linux-libre-4.18.12-gnu/arch/arm/mach-omap2/omap_hwmod.c
--- linux-libre-4.18.11-gnu/arch/arm/mach-omap2/omap_hwmod.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/mach-omap2/omap_hwmod.c	2018-10-03 19:59:28.000000000 -0400
@@ -2161,6 +2161,37 @@ static int of_dev_hwmod_lookup(struct de
 }
 
 /**
+ * omap_hwmod_fix_mpu_rt_idx - fix up mpu_rt_idx register offsets
+ *
+ * @oh: struct omap_hwmod *
+ * @np: struct device_node *
+ *
+ * Fix up module register offsets for modules with mpu_rt_idx.
+ * Only needed for cpsw with interconnect target module defined
+ * in device tree while still using legacy hwmod platform data
+ * for rev, sysc and syss registers.
+ *
+ * Can be removed when all cpsw hwmod platform data has been
+ * dropped.
+ */
+static void omap_hwmod_fix_mpu_rt_idx(struct omap_hwmod *oh,
+				      struct device_node *np,
+				      struct resource *res)
+{
+	struct device_node *child = NULL;
+	int error;
+
+	child = of_get_next_child(np, child);
+	if (!child)
+		return;
+
+	error = of_address_to_resource(child, oh->mpu_rt_idx, res);
+	if (error)
+		pr_err("%s: error mapping mpu_rt_idx: %i\n",
+		       __func__, error);
+}
+
+/**
  * omap_hwmod_parse_module_range - map module IO range from device tree
  * @oh: struct omap_hwmod *
  * @np: struct device_node *
@@ -2220,7 +2251,13 @@ int omap_hwmod_parse_module_range(struct
 	size = be32_to_cpup(ranges);
 
 	pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n",
-		 oh->name, np->name, base, size);
+		 oh ? oh->name : "", np->name, base, size);
+
+	if (oh && oh->mpu_rt_idx) {
+		omap_hwmod_fix_mpu_rt_idx(oh, np, res);
+
+		return 0;
+	}
 
 	res->start = base;
 	res->end = base + size - 1;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm/mach-omap2/omap_hwmod_reset.c linux-libre-4.18.12-gnu/arch/arm/mach-omap2/omap_hwmod_reset.c
--- linux-libre-4.18.11-gnu/arch/arm/mach-omap2/omap_hwmod_reset.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm/mach-omap2/omap_hwmod_reset.c	2018-10-03 19:59:28.000000000 -0400
@@ -92,11 +92,13 @@ static void omap_rtc_wait_not_busy(struc
  */
 void omap_hwmod_rtc_unlock(struct omap_hwmod *oh)
 {
-	local_irq_disable();
+	unsigned long flags;
+
+	local_irq_save(flags);
 	omap_rtc_wait_not_busy(oh);
 	omap_hwmod_write(OMAP_RTC_KICK0_VALUE, oh, OMAP_RTC_KICK0_REG);
 	omap_hwmod_write(OMAP_RTC_KICK1_VALUE, oh, OMAP_RTC_KICK1_REG);
-	local_irq_enable();
+	local_irq_restore(flags);
 }
 
 /**
@@ -110,9 +112,11 @@ void omap_hwmod_rtc_unlock(struct omap_h
  */
 void omap_hwmod_rtc_lock(struct omap_hwmod *oh)
 {
-	local_irq_disable();
+	unsigned long flags;
+
+	local_irq_save(flags);
 	omap_rtc_wait_not_busy(oh);
 	omap_hwmod_write(0x0, oh, OMAP_RTC_KICK0_REG);
 	omap_hwmod_write(0x0, oh, OMAP_RTC_KICK1_REG);
-	local_irq_enable();
+	local_irq_restore(flags);
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7795.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7795.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7795.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7795.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -2530,7 +2530,7 @@
 
 		vspd0: vsp@fea20000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea20000 0 0x8000>;
+			reg = <0 0xfea20000 0 0x5000>;
 			interrupts = <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 623>;
 			power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
@@ -2541,7 +2541,7 @@
 
 		vspd1: vsp@fea28000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea28000 0 0x8000>;
+			reg = <0 0xfea28000 0 0x5000>;
 			interrupts = <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 622>;
 			power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
@@ -2552,7 +2552,7 @@
 
 		vspd2: vsp@fea30000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea30000 0 0x8000>;
+			reg = <0 0xfea30000 0 0x5000>;
 			interrupts = <GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 621>;
 			power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -80,7 +80,7 @@
 
 	vspd3: vsp@fea38000 {
 		compatible = "renesas,vsp2";
-		reg = <0 0xfea38000 0 0x8000>;
+		reg = <0 0xfea38000 0 0x5000>;
 		interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cpg CPG_MOD 620>;
 		power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77965.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77965.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77965.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77965.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -1397,7 +1397,7 @@
 
 		vspd0: vsp@fea20000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea20000 0 0x8000>;
+			reg = <0 0xfea20000 0 0x5000>;
 			interrupts = <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 623>;
 			power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
@@ -1416,7 +1416,7 @@
 
 		vspd1: vsp@fea28000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea28000 0 0x8000>;
+			reg = <0 0xfea28000 0 0x5000>;
 			interrupts = <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 622>;
 			power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7796.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7796.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a7796.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a7796.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -2212,7 +2212,7 @@
 
 		vspd0: vsp@fea20000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea20000 0 0x8000>;
+			reg = <0 0xfea20000 0 0x5000>;
 			interrupts = <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 623>;
 			power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
@@ -2223,7 +2223,7 @@
 
 		vspd1: vsp@fea28000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea28000 0 0x8000>;
+			reg = <0 0xfea28000 0 0x5000>;
 			interrupts = <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 622>;
 			power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
@@ -2234,7 +2234,7 @@
 
 		vspd2: vsp@fea30000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea30000 0 0x8000>;
+			reg = <0 0xfea30000 0 0x5000>;
 			interrupts = <GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 621>;
 			power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77970.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77970.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77970.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77970.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -776,7 +776,7 @@
 
 		vspd0: vsp@fea20000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea20000 0 0x8000>;
+			reg = <0 0xfea20000 0 0x5000>;
 			interrupts = <GIC_SPI 169 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 623>;
 			power-domains = <&sysc R8A77970_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77995.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77995.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/r8a77995.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/r8a77995.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -699,7 +699,7 @@
 
 		vspd0: vsp@fea20000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea20000 0 0x8000>;
+			reg = <0 0xfea20000 0 0x5000>;
 			interrupts = <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 623>;
 			power-domains = <&sysc R8A77995_PD_ALWAYS_ON>;
@@ -709,7 +709,7 @@
 
 		vspd1: vsp@fea28000 {
 			compatible = "renesas,vsp2";
-			reg = <0 0xfea28000 0 0x8000>;
+			reg = <0 0xfea28000 0 0x5000>;
 			interrupts = <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 622>;
 			power-domains = <&sysc R8A77995_PD_ALWAYS_ON>;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/salvator-common.dtsi linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/salvator-common.dtsi
--- linux-libre-4.18.11-gnu/arch/arm64/boot/dts/renesas/salvator-common.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/boot/dts/renesas/salvator-common.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -440,7 +440,7 @@
 			};
 		};
 
-		port@10 {
+		port@a {
 			reg = <10>;
 
 			adv7482_txa: endpoint {
@@ -450,7 +450,7 @@
 			};
 		};
 
-		port@11 {
+		port@b {
 			reg = <11>;
 
 			adv7482_txb: endpoint {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/arm64/kvm/guest.c linux-libre-4.18.12-gnu/arch/arm64/kvm/guest.c
--- linux-libre-4.18.11-gnu/arch/arm64/kvm/guest.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/arm64/kvm/guest.c	2018-10-03 19:59:28.000000000 -0400
@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 i
 	return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
 }
 
+static int validate_core_offset(const struct kvm_one_reg *reg)
+{
+	u64 off = core_reg_offset_from_id(reg->id);
+	int size;
+
+	switch (off) {
+	case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
+	     KVM_REG_ARM_CORE_REG(regs.regs[30]):
+	case KVM_REG_ARM_CORE_REG(regs.sp):
+	case KVM_REG_ARM_CORE_REG(regs.pc):
+	case KVM_REG_ARM_CORE_REG(regs.pstate):
+	case KVM_REG_ARM_CORE_REG(sp_el1):
+	case KVM_REG_ARM_CORE_REG(elr_el1):
+	case KVM_REG_ARM_CORE_REG(spsr[0]) ...
+	     KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
+		size = sizeof(__u64);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
+	     KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
+		size = sizeof(__uint128_t);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
+		size = sizeof(__u32);
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	if (KVM_REG_SIZE(reg->id) == size &&
+	    IS_ALIGNED(off, size / sizeof(__u32)))
+		return 0;
+
+	return -EINVAL;
+}
+
 static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 {
 	/*
@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
 		return -EFAULT;
 
@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
 		return -EINVAL;
 
@@ -107,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu
 	}
 
 	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
-		u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK;
+		u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK;
 		switch (mode) {
 		case COMPAT_PSR_MODE_USR:
+			if (!system_supports_32bit_el0())
+				return -EINVAL;
+			break;
 		case COMPAT_PSR_MODE_FIQ:
 		case COMPAT_PSR_MODE_IRQ:
 		case COMPAT_PSR_MODE_SVC:
 		case COMPAT_PSR_MODE_ABT:
 		case COMPAT_PSR_MODE_UND:
+			if (!vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
+			break;
 		case PSR_MODE_EL0t:
 		case PSR_MODE_EL1t:
 		case PSR_MODE_EL1h:
+			if (vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
 			break;
 		default:
 			err = -EINVAL;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/mips/boot/Makefile linux-libre-4.18.12-gnu/arch/mips/boot/Makefile
--- linux-libre-4.18.11-gnu/arch/mips/boot/Makefile	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/mips/boot/Makefile	2018-10-03 19:59:28.000000000 -0400
@@ -118,10 +118,12 @@ ifeq ($(ADDR_BITS),64)
 	itb_addr_cells = 2
 endif
 
+targets += vmlinux.its.S
+
 quiet_cmd_its_cat = CAT     $@
-      cmd_its_cat = cat $^ >$@
+      cmd_its_cat = cat $(filter-out $(PHONY), $^) >$@
 
-$(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS))
+$(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS)) FORCE
 	$(call if_changed,its_cat)
 
 quiet_cmd_cpp_its_S = ITS     $@
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/kernel/exceptions-64s.S linux-libre-4.18.12-gnu/arch/powerpc/kernel/exceptions-64s.S
--- linux-libre-4.18.11-gnu/arch/powerpc/kernel/exceptions-64s.S	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/kernel/exceptions-64s.S	2018-10-03 19:59:28.000000000 -0400
@@ -1321,9 +1321,7 @@ EXC_REAL_BEGIN(denorm_exception_hv, 0x15
 
 #ifdef CONFIG_PPC_DENORMALISATION
 	mfspr	r10,SPRN_HSRR1
-	mfspr	r11,SPRN_HSRR0		/* save HSRR0 */
 	andis.	r10,r10,(HSRR1_DENORM)@h /* denorm? */
-	addi	r11,r11,-4		/* HSRR0 is next instruction */
 	bne+	denorm_assist
 #endif
 
@@ -1389,6 +1387,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
  */
 	XVCPSGNDP32(32)
 denorm_done:
+	mfspr	r11,SPRN_HSRR0
+	subi	r11,r11,4
 	mtspr	SPRN_HSRR0,r11
 	mtcrf	0x80,r9
 	ld	r9,PACA_EXGEN+EX_R9(r13)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/kernel/machine_kexec.c linux-libre-4.18.12-gnu/arch/powerpc/kernel/machine_kexec.c
--- linux-libre-4.18.11-gnu/arch/powerpc/kernel/machine_kexec.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/kernel/machine_kexec.c	2018-10-03 19:59:28.000000000 -0400
@@ -188,7 +188,12 @@ void __init reserve_crashkernel(void)
 			(unsigned long)(crashk_res.start >> 20),
 			(unsigned long)(memblock_phys_mem_size() >> 20));
 
-	memblock_reserve(crashk_res.start, crash_size);
+	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
+	    memblock_reserve(crashk_res.start, crash_size)) {
+		pr_err("Failed to reserve memory for crashkernel!\n");
+		crashk_res.start = crashk_res.end = 0;
+		return;
+	}
 }
 
 int overlaps_crashkernel(unsigned long start, unsigned long size)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/lib/checksum_64.S linux-libre-4.18.12-gnu/arch/powerpc/lib/checksum_64.S
--- linux-libre-4.18.11-gnu/arch/powerpc/lib/checksum_64.S	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/lib/checksum_64.S	2018-10-03 19:59:28.000000000 -0400
@@ -443,6 +443,9 @@ _GLOBAL(csum_ipv6_magic)
 	addc	r0, r8, r9
 	ld	r10, 0(r4)
 	ld	r11, 8(r4)
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+	rotldi	r5, r5, 8
+#endif
 	adde	r0, r0, r10
 	add	r5, r5, r7
 	adde	r0, r0, r11
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/mm/numa.c linux-libre-4.18.12-gnu/arch/powerpc/mm/numa.c
--- linux-libre-4.18.11-gnu/arch/powerpc/mm/numa.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/mm/numa.c	2018-10-03 19:59:28.000000000 -0400
@@ -1452,7 +1452,8 @@ static struct timer_list topology_timer;
 
 static void reset_topology_timer(void)
 {
-	mod_timer(&topology_timer, jiffies + topology_timer_secs * HZ);
+	if (vphn_enabled)
+		mod_timer(&topology_timer, jiffies + topology_timer_secs * HZ);
 }
 
 #ifdef CONFIG_SMP
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/mm/pkeys.c linux-libre-4.18.12-gnu/arch/powerpc/mm/pkeys.c
--- linux-libre-4.18.11-gnu/arch/powerpc/mm/pkeys.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/mm/pkeys.c	2018-10-03 19:59:28.000000000 -0400
@@ -44,7 +44,7 @@ static void scan_pkey_feature(void)
 	 * Since any pkey can be used for data or execute, we will just treat
 	 * all keys as equal and track them as one entity.
 	 */
-	pkeys_total = be32_to_cpu(vals[0]);
+	pkeys_total = vals[0];
 	pkeys_devtree_defined = true;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/powerpc/platforms/powernv/pci-ioda.c linux-libre-4.18.12-gnu/arch/powerpc/platforms/powernv/pci-ioda.c
--- linux-libre-4.18.11-gnu/arch/powerpc/platforms/powernv/pci-ioda.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/powerpc/platforms/powernv/pci-ioda.c	2018-10-03 19:59:28.000000000 -0400
@@ -2841,7 +2841,7 @@ static long pnv_pci_ioda2_table_alloc_pa
 	level_shift = entries_shift + 3;
 	level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
 
-	if ((level_shift - 3) * levels + page_shift >= 60)
+	if ((level_shift - 3) * levels + page_shift >= 55)
 		return -EINVAL;
 
 	/* Allocate TCE table */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/s390/kernel/sysinfo.c linux-libre-4.18.12-gnu/arch/s390/kernel/sysinfo.c
--- linux-libre-4.18.11-gnu/arch/s390/kernel/sysinfo.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/s390/kernel/sysinfo.c	2018-10-03 19:59:28.000000000 -0400
@@ -59,6 +59,8 @@ int stsi(void *sysinfo, int fc, int sel1
 }
 EXPORT_SYMBOL(stsi);
 
+#ifdef CONFIG_PROC_FS
+
 static bool convert_ext_name(unsigned char encoding, char *name, size_t len)
 {
 	switch (encoding) {
@@ -301,6 +303,8 @@ static int __init sysinfo_create_proc(vo
 }
 device_initcall(sysinfo_create_proc);
 
+#endif /* CONFIG_PROC_FS */
+
 /*
  * Service levels interface.
  */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/s390/mm/extmem.c linux-libre-4.18.12-gnu/arch/s390/mm/extmem.c
--- linux-libre-4.18.11-gnu/arch/s390/mm/extmem.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/s390/mm/extmem.c	2018-10-03 19:59:28.000000000 -0400
@@ -80,7 +80,7 @@ struct qin64 {
 struct dcss_segment {
 	struct list_head list;
 	char dcss_name[8];
-	char res_name[15];
+	char res_name[16];
 	unsigned long start_addr;
 	unsigned long end;
 	atomic_t ref_count;
@@ -433,7 +433,7 @@ __segment_load (char *name, int do_nonsh
 	memcpy(&seg->res_name, seg->dcss_name, 8);
 	EBCASC(seg->res_name, 8);
 	seg->res_name[8] = '\0';
-	strncat(seg->res_name, " (DCSS)", 7);
+	strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
 	seg->res->name = seg->res_name;
 	rc = seg->vm_segtype;
 	if (rc == SEG_TYPE_SC ||
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/s390/mm/pgalloc.c linux-libre-4.18.12-gnu/arch/s390/mm/pgalloc.c
--- linux-libre-4.18.11-gnu/arch/s390/mm/pgalloc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/s390/mm/pgalloc.c	2018-10-03 19:59:28.000000000 -0400
@@ -28,7 +28,7 @@ static struct ctl_table page_table_sysct
 		.data		= &page_table_allocate_pgste,
 		.maxlen		= sizeof(int),
 		.mode		= S_IRUGO | S_IWUSR,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
 		.extra1		= &page_table_allocate_pgste_min,
 		.extra2		= &page_table_allocate_pgste_max,
 	},
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/entry/entry_64.S linux-libre-4.18.12-gnu/arch/x86/entry/entry_64.S
--- linux-libre-4.18.11-gnu/arch/x86/entry/entry_64.S	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/entry/entry_64.S	2018-10-03 19:59:28.000000000 -0400
@@ -92,7 +92,7 @@ END(native_usergs_sysret64)
 .endm
 
 .macro TRACE_IRQS_IRETQ_DEBUG
-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
+	btl	$9, EFLAGS(%rsp)		/* interrupts off? */
 	jnc	1f
 	TRACE_IRQS_ON_DEBUG
 1:
@@ -701,7 +701,7 @@ retint_kernel:
 #ifdef CONFIG_PREEMPT
 	/* Interrupts are off */
 	/* Check if we need preemption */
-	bt	$9, EFLAGS(%rsp)		/* were interrupts off? */
+	btl	$9, EFLAGS(%rsp)		/* were interrupts off? */
 	jnc	1f
 0:	cmpl	$0, PER_CPU_VAR(__preempt_count)
 	jnz	1f
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/events/intel/lbr.c linux-libre-4.18.12-gnu/arch/x86/events/intel/lbr.c
--- linux-libre-4.18.11-gnu/arch/x86/events/intel/lbr.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/events/intel/lbr.c	2018-10-03 19:59:28.000000000 -0400
@@ -346,7 +346,7 @@ static void __intel_pmu_lbr_restore(stru
 
 	mask = x86_pmu.lbr_nr - 1;
 	tos = task_ctx->tos;
-	for (i = 0; i < tos; i++) {
+	for (i = 0; i < task_ctx->valid_lbrs; i++) {
 		lbr_idx = (tos - i) & mask;
 		wrlbr_from(lbr_idx, task_ctx->lbr_from[i]);
 		wrlbr_to  (lbr_idx, task_ctx->lbr_to[i]);
@@ -354,6 +354,15 @@ static void __intel_pmu_lbr_restore(stru
 		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
 			wrmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
 	}
+
+	for (; i < x86_pmu.lbr_nr; i++) {
+		lbr_idx = (tos - i) & mask;
+		wrlbr_from(lbr_idx, 0);
+		wrlbr_to(lbr_idx, 0);
+		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
+			wrmsrl(MSR_LBR_INFO_0 + lbr_idx, 0);
+	}
+
 	wrmsrl(x86_pmu.lbr_tos, tos);
 	task_ctx->lbr_stack_state = LBR_NONE;
 }
@@ -361,7 +370,7 @@ static void __intel_pmu_lbr_restore(stru
 static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
 {
 	unsigned lbr_idx, mask;
-	u64 tos;
+	u64 tos, from;
 	int i;
 
 	if (task_ctx->lbr_callstack_users == 0) {
@@ -371,13 +380,17 @@ static void __intel_pmu_lbr_save(struct
 
 	mask = x86_pmu.lbr_nr - 1;
 	tos = intel_pmu_lbr_tos();
-	for (i = 0; i < tos; i++) {
+	for (i = 0; i < x86_pmu.lbr_nr; i++) {
 		lbr_idx = (tos - i) & mask;
-		task_ctx->lbr_from[i] = rdlbr_from(lbr_idx);
+		from = rdlbr_from(lbr_idx);
+		if (!from)
+			break;
+		task_ctx->lbr_from[i] = from;
 		task_ctx->lbr_to[i]   = rdlbr_to(lbr_idx);
 		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
 			rdmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
 	}
+	task_ctx->valid_lbrs = i;
 	task_ctx->tos = tos;
 	task_ctx->lbr_stack_state = LBR_VALID;
 }
@@ -531,7 +544,7 @@ static void intel_pmu_lbr_read_32(struct
  */
 static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
 {
-	bool need_info = false;
+	bool need_info = false, call_stack = false;
 	unsigned long mask = x86_pmu.lbr_nr - 1;
 	int lbr_format = x86_pmu.intel_cap.lbr_format;
 	u64 tos = intel_pmu_lbr_tos();
@@ -542,7 +555,7 @@ static void intel_pmu_lbr_read_64(struct
 	if (cpuc->lbr_sel) {
 		need_info = !(cpuc->lbr_sel->config & LBR_NO_INFO);
 		if (cpuc->lbr_sel->config & LBR_CALL_STACK)
-			num = tos;
+			call_stack = true;
 	}
 
 	for (i = 0; i < num; i++) {
@@ -555,6 +568,13 @@ static void intel_pmu_lbr_read_64(struct
 		from = rdlbr_from(lbr_idx);
 		to   = rdlbr_to(lbr_idx);
 
+		/*
+		 * Read LBR call stack entries
+		 * until invalid entry (0s) is detected.
+		 */
+		if (call_stack && !from)
+			break;
+
 		if (lbr_format == LBR_FORMAT_INFO && need_info) {
 			u64 info;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/events/perf_event.h linux-libre-4.18.12-gnu/arch/x86/events/perf_event.h
--- linux-libre-4.18.11-gnu/arch/x86/events/perf_event.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/events/perf_event.h	2018-10-03 19:59:28.000000000 -0400
@@ -648,6 +648,7 @@ struct x86_perf_task_context {
 	u64 lbr_to[MAX_LBR_ENTRIES];
 	u64 lbr_info[MAX_LBR_ENTRIES];
 	int tos;
+	int valid_lbrs;
 	int lbr_callstack_users;
 	int lbr_stack_state;
 };
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/include/asm/fixmap.h linux-libre-4.18.12-gnu/arch/x86/include/asm/fixmap.h
--- linux-libre-4.18.11-gnu/arch/x86/include/asm/fixmap.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/include/asm/fixmap.h	2018-10-03 19:59:28.000000000 -0400
@@ -14,6 +14,16 @@
 #ifndef _ASM_X86_FIXMAP_H
 #define _ASM_X86_FIXMAP_H
 
+/*
+ * Exposed to assembly code for setting up initial page tables. Cannot be
+ * calculated in assembly code (fixmap entries are an enum), but is sanity
+ * checked in the actual fixmap C code to make sure that the fixmap is
+ * covered fully.
+ */
+#define FIXMAP_PMD_NUM	2
+/* fixmap starts downwards from the 507th entry in level2_fixmap_pgt */
+#define FIXMAP_PMD_TOP	507
+
 #ifndef __ASSEMBLY__
 #include <linux/kernel.h>
 #include <asm/acpi.h>
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/include/asm/pgtable_64.h linux-libre-4.18.12-gnu/arch/x86/include/asm/pgtable_64.h
--- linux-libre-4.18.11-gnu/arch/x86/include/asm/pgtable_64.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/include/asm/pgtable_64.h	2018-10-03 19:59:28.000000000 -0400
@@ -14,6 +14,7 @@
 #include <asm/processor.h>
 #include <linux/bitops.h>
 #include <linux/threads.h>
+#include <asm/fixmap.h>
 
 extern p4d_t level4_kernel_pgt[512];
 extern p4d_t level4_ident_pgt[512];
@@ -22,7 +23,7 @@ extern pud_t level3_ident_pgt[512];
 extern pmd_t level2_kernel_pgt[512];
 extern pmd_t level2_fixmap_pgt[512];
 extern pmd_t level2_ident_pgt[512];
-extern pte_t level1_fixmap_pgt[512];
+extern pte_t level1_fixmap_pgt[512 * FIXMAP_PMD_NUM];
 extern pgd_t init_top_pgt[];
 
 #define swapper_pg_dir init_top_pgt
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/kernel/head64.c linux-libre-4.18.12-gnu/arch/x86/kernel/head64.c
--- linux-libre-4.18.11-gnu/arch/x86/kernel/head64.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/kernel/head64.c	2018-10-03 19:59:28.000000000 -0400
@@ -35,6 +35,7 @@
 #include <asm/bootparam_utils.h>
 #include <asm/microcode.h>
 #include <asm/kasan.h>
+#include <asm/fixmap.h>
 
 /*
  * Manage page tables very early on.
@@ -165,7 +166,8 @@ unsigned long __head __startup_64(unsign
 	pud[511] += load_delta;
 
 	pmd = fixup_pointer(level2_fixmap_pgt, physaddr);
-	pmd[506] += load_delta;
+	for (i = FIXMAP_PMD_TOP; i > FIXMAP_PMD_TOP - FIXMAP_PMD_NUM; i--)
+		pmd[i] += load_delta;
 
 	/*
 	 * Set up the identity mapping for the switchover.  These
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/kernel/head_64.S linux-libre-4.18.12-gnu/arch/x86/kernel/head_64.S
--- linux-libre-4.18.11-gnu/arch/x86/kernel/head_64.S	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/kernel/head_64.S	2018-10-03 19:59:28.000000000 -0400
@@ -24,6 +24,7 @@
 #include "../entry/calling.h"
 #include <asm/export.h>
 #include <asm/nospec-branch.h>
+#include <asm/fixmap.h>
 
 #ifdef CONFIG_PARAVIRT
 #include <asm/asm-offsets.h>
@@ -445,13 +446,20 @@ NEXT_PAGE(level2_kernel_pgt)
 		KERNEL_IMAGE_SIZE/PMD_SIZE)
 
 NEXT_PAGE(level2_fixmap_pgt)
-	.fill	506,8,0
-	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
-	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
-	.fill	5,8,0
+	.fill	(512 - 4 - FIXMAP_PMD_NUM),8,0
+	pgtno = 0
+	.rept (FIXMAP_PMD_NUM)
+	.quad level1_fixmap_pgt + (pgtno << PAGE_SHIFT) - __START_KERNEL_map \
+		+ _PAGE_TABLE_NOENC;
+	pgtno = pgtno + 1
+	.endr
+	/* 6 MB reserved space + a 2MB hole */
+	.fill	4,8,0
 
 NEXT_PAGE(level1_fixmap_pgt)
+	.rept (FIXMAP_PMD_NUM)
 	.fill	512,8,0
+	.endr
 
 #undef PMDS
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/kernel/tsc_msr.c linux-libre-4.18.12-gnu/arch/x86/kernel/tsc_msr.c
--- linux-libre-4.18.11-gnu/arch/x86/kernel/tsc_msr.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/kernel/tsc_msr.c	2018-10-03 19:59:28.000000000 -0400
@@ -12,6 +12,7 @@
 #include <asm/setup.h>
 #include <asm/apic.h>
 #include <asm/param.h>
+#include <asm/tsc.h>
 
 #define MAX_NUM_FREQS	9
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/mm/numa_emulation.c linux-libre-4.18.12-gnu/arch/x86/mm/numa_emulation.c
--- linux-libre-4.18.11-gnu/arch/x86/mm/numa_emulation.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/mm/numa_emulation.c	2018-10-03 19:59:28.000000000 -0400
@@ -61,7 +61,7 @@ static int __init emu_setup_memblk(struc
 	eb->nid = nid;
 
 	if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-		emu_nid_to_phys[nid] = nid;
+		emu_nid_to_phys[nid] = pb->nid;
 
 	pb->start += size;
 	if (pb->start >= pb->end) {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/mm/pgtable.c linux-libre-4.18.12-gnu/arch/x86/mm/pgtable.c
--- linux-libre-4.18.11-gnu/arch/x86/mm/pgtable.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/mm/pgtable.c	2018-10-03 19:59:28.000000000 -0400
@@ -577,6 +577,15 @@ void __native_set_fixmap(enum fixed_addr
 {
 	unsigned long address = __fix_to_virt(idx);
 
+#ifdef CONFIG_X86_64
+       /*
+	* Ensure that the static initial page tables are covering the
+	* fixmap completely.
+	*/
+	BUILD_BUG_ON(__end_of_permanent_fixed_addresses >
+		     (FIXMAP_PMD_NUM * PTRS_PER_PTE));
+#endif
+
 	if (idx >= __end_of_fixed_addresses) {
 		BUG();
 		return;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/mm/pti.c linux-libre-4.18.12-gnu/arch/x86/mm/pti.c
--- linux-libre-4.18.11-gnu/arch/x86/mm/pti.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/mm/pti.c	2018-10-03 19:59:28.000000000 -0400
@@ -239,7 +239,7 @@ static pmd_t *pti_user_pagetable_walk_pm
  *
  * Returns a pointer to a PTE on success, or NULL on failure.
  */
-static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
 {
 	gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
 	pmd_t *pmd;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/arch/x86/xen/mmu_pv.c linux-libre-4.18.12-gnu/arch/x86/xen/mmu_pv.c
--- linux-libre-4.18.11-gnu/arch/x86/xen/mmu_pv.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/arch/x86/xen/mmu_pv.c	2018-10-03 19:59:28.000000000 -0400
@@ -1908,7 +1908,7 @@ void __init xen_setup_kernel_pagetable(p
 	/* L3_k[511] -> level2_fixmap_pgt */
 	convert_pfn_mfn(level3_kernel_pgt);
 
-	/* L3_k[511][506] -> level1_fixmap_pgt */
+	/* L3_k[511][508-FIXMAP_PMD_NUM ... 507] -> level1_fixmap_pgt */
 	convert_pfn_mfn(level2_fixmap_pgt);
 
 	/* We get [511][511] and have Xen's version of level2_kernel_pgt */
@@ -1953,7 +1953,11 @@ void __init xen_setup_kernel_pagetable(p
 	set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-	set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
+
+	for (i = 0; i < FIXMAP_PMD_NUM; i++) {
+		set_page_prot(level1_fixmap_pgt + i * PTRS_PER_PTE,
+			      PAGE_KERNEL_RO);
+	}
 
 	/* Pin down new L4 */
 	pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/block/elevator.c linux-libre-4.18.12-gnu/block/elevator.c
--- linux-libre-4.18.11-gnu/block/elevator.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/block/elevator.c	2018-10-03 19:59:28.000000000 -0400
@@ -609,7 +609,7 @@ void elv_drain_elevator(struct request_q
 
 	while (e->type->ops.sq.elevator_dispatch_fn(q, 1))
 		;
-	if (q->nr_sorted && printed++ < 10) {
+	if (q->nr_sorted && !blk_queue_is_zoned(q) && printed++ < 10 ) {
 		printk(KERN_ERR "%s: forced dispatching is broken "
 		       "(nr_sorted=%u), please report this\n",
 		       q->elevator->type->elevator_name, q->nr_sorted);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/crypto/ablkcipher.c linux-libre-4.18.12-gnu/crypto/ablkcipher.c
--- linux-libre-4.18.11-gnu/crypto/ablkcipher.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/crypto/ablkcipher.c	2018-10-03 19:59:28.000000000 -0400
@@ -368,6 +368,7 @@ static int crypto_ablkcipher_report(stru
 	strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
@@ -442,6 +443,7 @@ static int crypto_givcipher_report(struc
 	strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/crypto/blkcipher.c linux-libre-4.18.12-gnu/crypto/blkcipher.c
--- linux-libre-4.18.11-gnu/crypto/blkcipher.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/crypto/blkcipher.c	2018-10-03 19:59:28.000000000 -0400
@@ -510,6 +510,7 @@ static int crypto_blkcipher_report(struc
 	strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/Documentation/hwmon/ina2xx linux-libre-4.18.12-gnu/Documentation/hwmon/ina2xx
--- linux-libre-4.18.11-gnu/Documentation/hwmon/ina2xx	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/Documentation/hwmon/ina2xx	2018-10-03 19:59:28.000000000 -0400
@@ -32,7 +32,7 @@ Supported chips:
     Datasheet: Publicly available at the Texas Instruments website
                http://www.ti.com/
 
-Author: Lothar Felten <l-felten@ti.com>
+Author: Lothar Felten <lothar.felten@gmail.com>
 
 Description
 -----------
diff -druNp --no-dereference linux-libre-4.18.11-gnu/Documentation/process/2.Process.rst linux-libre-4.18.12-gnu/Documentation/process/2.Process.rst
--- linux-libre-4.18.11-gnu/Documentation/process/2.Process.rst	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/Documentation/process/2.Process.rst	2018-10-03 19:59:28.000000000 -0400
@@ -134,7 +134,7 @@ and their maintainers are:
 	4.4	Greg Kroah-Hartman	(very long-term stable kernel)
 	4.9	Greg Kroah-Hartman
 	4.14	Greg Kroah-Hartman
-	======  ======================  ===========================
+	======  ======================  ==============================
 
 The selection of a kernel for long-term support is purely a matter of a
 maintainer having the need and the time to maintain that release.  There
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/acpi/button.c linux-libre-4.18.12-gnu/drivers/acpi/button.c
--- linux-libre-4.18.11-gnu/drivers/acpi/button.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/acpi/button.c	2018-10-03 19:59:28.000000000 -0400
@@ -235,9 +235,6 @@ static int acpi_lid_notify_state(struct
 		button->last_time = ktime_get();
 	}
 
-	if (state)
-		acpi_pm_wakeup_event(&device->dev);
-
 	ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
 	if (ret == NOTIFY_DONE)
 		ret = blocking_notifier_call_chain(&acpi_lid_notifier, state,
@@ -366,7 +363,8 @@ int acpi_lid_open(void)
 }
 EXPORT_SYMBOL(acpi_lid_open);
 
-static int acpi_lid_update_state(struct acpi_device *device)
+static int acpi_lid_update_state(struct acpi_device *device,
+				 bool signal_wakeup)
 {
 	int state;
 
@@ -374,6 +372,9 @@ static int acpi_lid_update_state(struct
 	if (state < 0)
 		return state;
 
+	if (state && signal_wakeup)
+		acpi_pm_wakeup_event(&device->dev);
+
 	return acpi_lid_notify_state(device, state);
 }
 
@@ -384,7 +385,7 @@ static void acpi_lid_initialize_state(st
 		(void)acpi_lid_notify_state(device, 1);
 		break;
 	case ACPI_BUTTON_LID_INIT_METHOD:
-		(void)acpi_lid_update_state(device);
+		(void)acpi_lid_update_state(device, false);
 		break;
 	case ACPI_BUTTON_LID_INIT_IGNORE:
 	default:
@@ -409,7 +410,7 @@ static void acpi_button_notify(struct ac
 			users = button->input->users;
 			mutex_unlock(&button->input->mutex);
 			if (users)
-				acpi_lid_update_state(device);
+				acpi_lid_update_state(device, true);
 		} else {
 			int keycode;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/ata/pata_ftide010.c linux-libre-4.18.12-gnu/drivers/ata/pata_ftide010.c
--- linux-libre-4.18.11-gnu/drivers/ata/pata_ftide010.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/ata/pata_ftide010.c	2018-10-03 19:59:28.000000000 -0400
@@ -256,14 +256,12 @@ static struct ata_port_operations pata_f
 	.qc_issue	= ftide010_qc_issue,
 };
 
-static struct ata_port_info ftide010_port_info[] = {
-	{
-		.flags		= ATA_FLAG_SLAVE_POSS,
-		.mwdma_mask	= ATA_MWDMA2,
-		.udma_mask	= ATA_UDMA6,
-		.pio_mask	= ATA_PIO4,
-		.port_ops	= &pata_ftide010_port_ops,
-	},
+static struct ata_port_info ftide010_port_info = {
+	.flags		= ATA_FLAG_SLAVE_POSS,
+	.mwdma_mask	= ATA_MWDMA2,
+	.udma_mask	= ATA_UDMA6,
+	.pio_mask	= ATA_PIO4,
+	.port_ops	= &pata_ftide010_port_ops,
 };
 
 #if IS_ENABLED(CONFIG_SATA_GEMINI)
@@ -349,6 +347,7 @@ static int pata_ftide010_gemini_cable_de
 }
 
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+				     struct ata_port_info *pi,
 				     bool is_ata1)
 {
 	struct device *dev = ftide->dev;
@@ -373,7 +372,13 @@ static int pata_ftide010_gemini_init(str
 
 	/* Flag port as SATA-capable */
 	if (gemini_sata_bridge_enabled(sg, is_ata1))
-		ftide010_port_info[0].flags |= ATA_FLAG_SATA;
+		pi->flags |= ATA_FLAG_SATA;
+
+	/* This device has broken DMA, only PIO works */
+	if (of_machine_is_compatible("itian,sq201")) {
+		pi->mwdma_mask = 0;
+		pi->udma_mask = 0;
+	}
 
 	/*
 	 * We assume that a simple 40-wire cable is used in the PATA mode.
@@ -435,6 +440,7 @@ static int pata_ftide010_gemini_init(str
 }
 #else
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+				     struct ata_port_info *pi,
 				     bool is_ata1)
 {
 	return -ENOTSUPP;
@@ -446,7 +452,7 @@ static int pata_ftide010_probe(struct pl
 {
 	struct device *dev = &pdev->dev;
 	struct device_node *np = dev->of_node;
-	const struct ata_port_info pi = ftide010_port_info[0];
+	struct ata_port_info pi = ftide010_port_info;
 	const struct ata_port_info *ppi[] = { &pi, NULL };
 	struct ftide010 *ftide;
 	struct resource *res;
@@ -490,6 +496,7 @@ static int pata_ftide010_probe(struct pl
 		 * are ATA0. This will also set up the cable types.
 		 */
 		ret = pata_ftide010_gemini_init(ftide,
+				&pi,
 				(res->start == 0x63400000));
 		if (ret)
 			goto err_dis_clk;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/block/floppy.c linux-libre-4.18.12-gnu/drivers/block/floppy.c
--- linux-libre-4.18.11-gnu/drivers/block/floppy.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/block/floppy.c	2018-10-03 19:59:28.000000000 -0400
@@ -3470,6 +3470,9 @@ static int fd_locked_ioctl(struct block_
 					  (struct floppy_struct **)&outparam);
 		if (ret)
 			return ret;
+		memcpy(&inparam.g, outparam,
+				offsetof(struct floppy_struct, name));
+		outparam = &inparam.g;
 		break;
 	case FDMSGON:
 		UDP->flags |= FTD_MSG;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/bluetooth/btusb.c linux-libre-4.18.12-gnu/drivers/bluetooth/btusb.c
--- linux-libre-4.18.11-gnu/drivers/bluetooth/btusb.c	2018-09-29 08:49:45.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/bluetooth/btusb.c	2018-10-03 21:28:34.000000000 -0400
@@ -374,6 +374,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 
 	/* Additional Realtek 8723DE Bluetooth devices */
+	{ USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 
 	/* Additional Realtek 8821AE Bluetooth devices */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/bus/ti-sysc.c linux-libre-4.18.12-gnu/drivers/bus/ti-sysc.c
--- linux-libre-4.18.11-gnu/drivers/bus/ti-sysc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/bus/ti-sysc.c	2018-10-03 19:59:28.000000000 -0400
@@ -490,32 +490,29 @@ static int sysc_check_registers(struct s
 
 /**
  * syc_ioremap - ioremap register space for the interconnect target module
- * @ddata: deviec driver data
+ * @ddata: device driver data
  *
  * Note that the interconnect target module registers can be anywhere
- * within the first child device address space. For example, SGX has
- * them at offset 0x1fc00 in the 32MB module address space. We just
- * what we need around the interconnect target module registers.
+ * within the interconnect target module range. For example, SGX has
+ * them at offset 0x1fc00 in the 32MB module address space. And cpsw
+ * has them at offset 0x1200 in the CPSW_WR child. Usually the
+ * the interconnect target module registers are at the beginning of
+ * the module range though.
  */
 static int sysc_ioremap(struct sysc *ddata)
 {
-	u32 size = 0;
+	int size;
 
-	if (ddata->offsets[SYSC_SYSSTATUS] >= 0)
-		size = ddata->offsets[SYSC_SYSSTATUS];
-	else if (ddata->offsets[SYSC_SYSCONFIG] >= 0)
-		size = ddata->offsets[SYSC_SYSCONFIG];
-	else if (ddata->offsets[SYSC_REVISION] >= 0)
-		size = ddata->offsets[SYSC_REVISION];
-	else
-		return -EINVAL;
+	size = max3(ddata->offsets[SYSC_REVISION],
+		    ddata->offsets[SYSC_SYSCONFIG],
+		    ddata->offsets[SYSC_SYSSTATUS]);
 
-	size &= 0xfff00;
-	size += SZ_256;
+	if (size < 0 || (size + sizeof(u32)) > ddata->module_size)
+		return -EINVAL;
 
 	ddata->module_va = devm_ioremap(ddata->dev,
 					ddata->module_pa,
-					size);
+					size + sizeof(u32));
 	if (!ddata->module_va)
 		return -EIO;
 
@@ -1178,10 +1175,10 @@ static int sysc_child_suspend_noirq(stru
 	if (!pm_runtime_status_suspended(dev)) {
 		error = pm_generic_runtime_suspend(dev);
 		if (error) {
-			dev_err(dev, "%s error at %i: %i\n",
-				__func__, __LINE__, error);
+			dev_warn(dev, "%s busy at %i: %i\n",
+				 __func__, __LINE__, error);
 
-			return error;
+			return 0;
 		}
 
 		error = sysc_runtime_suspend(ddata->dev);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/clk/x86/clk-st.c linux-libre-4.18.12-gnu/drivers/clk/x86/clk-st.c
--- linux-libre-4.18.11-gnu/drivers/clk/x86/clk-st.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/clk/x86/clk-st.c	2018-10-03 19:59:28.000000000 -0400
@@ -46,7 +46,7 @@ static int st_clk_probe(struct platform_
 		clk_oscout1_parents, ARRAY_SIZE(clk_oscout1_parents),
 		0, st_data->base + CLKDRVSTR2, OSCOUT1CLK25MHZ, 3, 0, NULL);
 
-	clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_25M]->clk);
+	clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_48M]->clk);
 
 	hws[ST_CLK_GATE] = clk_hw_register_gate(NULL, "oscout1", "oscout1_mux",
 		0, st_data->base + MISCCLKCNTL1, OSCCLKENB,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_dev.h linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_dev.h
--- linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_dev.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_dev.h	2018-10-03 19:59:28.000000000 -0400
@@ -35,6 +35,7 @@ struct nitrox_cmdq {
 	/* requests in backlog queues */
 	atomic_t backlog_count;
 
+	int write_idx;
 	/* command size 32B/64B */
 	u8 instr_size;
 	u8 qno;
@@ -87,7 +88,7 @@ struct nitrox_bh {
 	struct bh_data *slc;
 };
 
-/* NITROX-5 driver state */
+/* NITROX-V driver state */
 #define NITROX_UCODE_LOADED	0
 #define NITROX_READY		1
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_lib.c linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_lib.c
--- linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_lib.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_lib.c	2018-10-03 19:59:28.000000000 -0400
@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitro
 	cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN);
 	cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN);
 	cmdq->qsize = (qsize + PKT_IN_ALIGN);
+	cmdq->write_idx = 0;
 
 	spin_lock_init(&cmdq->response_lock);
 	spin_lock_init(&cmdq->cmdq_lock);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
--- linux-libre-4.18.11-gnu/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c	2018-10-03 19:59:28.000000000 -0400
@@ -42,6 +42,16 @@
  *   Invalid flag options in AES-CCM IV.
  */
 
+static inline int incr_index(int index, int count, int max)
+{
+	if ((index + count) >= max)
+		index = index + count - max;
+	else
+		index += count;
+
+	return index;
+}
+
 /**
  * dma_free_sglist - unmap and free the sg lists.
  * @ndev: N5 device
@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_
 			  struct nitrox_cmdq *cmdq)
 {
 	struct nitrox_device *ndev = sr->ndev;
-	union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell;
-	u64 offset;
+	int idx;
 	u8 *ent;
 
 	spin_lock_bh(&cmdq->cmdq_lock);
 
-	/* get the next write offset */
-	offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno);
-	pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset);
+	idx = cmdq->write_idx;
 	/* copy the instruction */
-	ent = cmdq->head + pkt_in_baoff_dbell.s.aoff;
+	ent = cmdq->head + (idx * cmdq->instr_size);
 	memcpy(ent, &sr->instr, cmdq->instr_size);
-	/* flush the command queue updates */
-	dma_wmb();
 
-	sr->tstamp = jiffies;
 	atomic_set(&sr->status, REQ_POSTED);
 	response_list_add(sr, cmdq);
+	sr->tstamp = jiffies;
+	/* flush the command queue updates */
+	dma_wmb();
 
 	/* Ring doorbell with count 1 */
 	writeq(1, cmdq->dbell_csr_addr);
 	/* orders the doorbell rings */
 	mmiowb();
 
+	cmdq->write_idx = incr_index(idx, 1, ndev->qlen);
+
 	spin_unlock_bh(&cmdq->cmdq_lock);
 }
 
@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitr
 	struct nitrox_softreq *sr, *tmp;
 	int ret = 0;
 
+	if (!atomic_read(&cmdq->backlog_count))
+		return 0;
+
 	spin_lock_bh(&cmdq->backlog_lock);
 
 	list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) {
@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitr
 
 		/* submit until space available */
 		if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
-			ret = -EBUSY;
+			ret = -ENOSPC;
 			break;
 		}
 		/* delete from backlog list */
@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct
 {
 	struct nitrox_cmdq *cmdq = sr->cmdq;
 	struct nitrox_device *ndev = sr->ndev;
-	int ret = -EBUSY;
+
+	/* try to post backlog requests */
+	post_backlog_cmds(cmdq);
 
 	if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
 		if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG))
-			return -EAGAIN;
-
+			return -ENOSPC;
+		/* add to backlog list */
 		backlog_list_add(sr, cmdq);
-	} else {
-		ret = post_backlog_cmds(cmdq);
-		if (ret) {
-			backlog_list_add(sr, cmdq);
-			return ret;
-		}
-		post_se_instr(sr, cmdq);
-		ret = -EINPROGRESS;
+		return -EBUSY;
 	}
-	return ret;
+	post_se_instr(sr, cmdq);
+
+	return -EINPROGRESS;
 }
 
 /**
@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nit
 	 */
 	sr->instr.fdata[0] = *((u64 *)&req->gph);
 	sr->instr.fdata[1] = 0;
-	/* flush the soft_req changes before posting the cmd */
-	wmb();
 
 	ret = nitrox_enqueue_request(sr);
-	if (ret == -EAGAIN)
+	if (ret == -ENOSPC)
 		goto send_fail;
 
 	return ret;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/crypto/chelsio/chtls/chtls.h linux-libre-4.18.12-gnu/drivers/crypto/chelsio/chtls/chtls.h
--- linux-libre-4.18.11-gnu/drivers/crypto/chelsio/chtls/chtls.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/crypto/chelsio/chtls/chtls.h	2018-10-03 19:59:28.000000000 -0400
@@ -96,6 +96,10 @@ enum csk_flags {
 	CSK_CONN_INLINE,	/* Connection on HW */
 };
 
+enum chtls_cdev_state {
+	CHTLS_CDEV_STATE_UP = 1
+};
+
 struct listen_ctx {
 	struct sock *lsk;
 	struct chtls_dev *cdev;
@@ -146,6 +150,7 @@ struct chtls_dev {
 	unsigned int send_page_order;
 	int max_host_sndbuf;
 	struct key_map kmap;
+	unsigned int cdev_state;
 };
 
 struct chtls_hws {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/crypto/chelsio/chtls/chtls_main.c linux-libre-4.18.12-gnu/drivers/crypto/chelsio/chtls/chtls_main.c
--- linux-libre-4.18.11-gnu/drivers/crypto/chelsio/chtls/chtls_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/crypto/chelsio/chtls/chtls_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -160,6 +160,7 @@ static void chtls_register_dev(struct ch
 	tlsdev->hash = chtls_create_hash;
 	tlsdev->unhash = chtls_destroy_hash;
 	tls_register_device(&cdev->tlsdev);
+	cdev->cdev_state = CHTLS_CDEV_STATE_UP;
 }
 
 static void chtls_unregister_dev(struct chtls_dev *cdev)
@@ -281,8 +282,10 @@ static void chtls_free_all_uld(void)
 	struct chtls_dev *cdev, *tmp;
 
 	mutex_lock(&cdev_mutex);
-	list_for_each_entry_safe(cdev, tmp, &cdev_list, list)
-		chtls_free_uld(cdev);
+	list_for_each_entry_safe(cdev, tmp, &cdev_list, list) {
+		if (cdev->cdev_state == CHTLS_CDEV_STATE_UP)
+			chtls_free_uld(cdev);
+	}
 	mutex_unlock(&cdev_mutex);
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/edac/altera_edac.c linux-libre-4.18.12-gnu/drivers/edac/altera_edac.c
--- linux-libre-4.18.11-gnu/drivers/edac/altera_edac.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/edac/altera_edac.c	2018-10-03 19:59:28.000000000 -0400
@@ -730,7 +730,8 @@ static int altr_s10_sdram_probe(struct p
 			 S10_DDR0_IRQ_MASK)) {
 		edac_printk(KERN_ERR, EDAC_MC,
 			    "Error clearing SDRAM ECC count\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err2;
 	}
 
 	if (regmap_update_bits(drvdata->mc_vbase, priv->ecc_irq_en_offset,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/edac/edac_mc_sysfs.c linux-libre-4.18.12-gnu/drivers/edac/edac_mc_sysfs.c
--- linux-libre-4.18.11-gnu/drivers/edac/edac_mc_sysfs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/edac/edac_mc_sysfs.c	2018-10-03 19:59:28.000000000 -0400
@@ -1075,14 +1075,14 @@ int __init edac_mc_sysfs_init(void)
 
 	err = device_add(mci_pdev);
 	if (err < 0)
-		goto out_dev_free;
+		goto out_put_device;
 
 	edac_dbg(0, "device %s created\n", dev_name(mci_pdev));
 
 	return 0;
 
- out_dev_free:
-	kfree(mci_pdev);
+ out_put_device:
+	put_device(mci_pdev);
  out:
 	return err;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/edac/i7core_edac.c linux-libre-4.18.12-gnu/drivers/edac/i7core_edac.c
--- linux-libre-4.18.11-gnu/drivers/edac/i7core_edac.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/edac/i7core_edac.c	2018-10-03 19:59:28.000000000 -0400
@@ -1177,15 +1177,14 @@ static int i7core_create_sysfs_devices(s
 
 	rc = device_add(pvt->addrmatch_dev);
 	if (rc < 0)
-		return rc;
+		goto err_put_addrmatch;
 
 	if (!pvt->is_registered) {
 		pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev),
 					      GFP_KERNEL);
 		if (!pvt->chancounts_dev) {
-			put_device(pvt->addrmatch_dev);
-			device_del(pvt->addrmatch_dev);
-			return -ENOMEM;
+			rc = -ENOMEM;
+			goto err_del_addrmatch;
 		}
 
 		pvt->chancounts_dev->type = &all_channel_counts_type;
@@ -1199,9 +1198,18 @@ static int i7core_create_sysfs_devices(s
 
 		rc = device_add(pvt->chancounts_dev);
 		if (rc < 0)
-			return rc;
+			goto err_put_chancounts;
 	}
 	return 0;
+
+err_put_chancounts:
+	put_device(pvt->chancounts_dev);
+err_del_addrmatch:
+	device_del(pvt->addrmatch_dev);
+err_put_addrmatch:
+	put_device(pvt->addrmatch_dev);
+
+	return rc;
 }
 
 static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci)
@@ -1211,11 +1219,11 @@ static void i7core_delete_sysfs_devices(
 	edac_dbg(1, "\n");
 
 	if (!pvt->is_registered) {
-		put_device(pvt->chancounts_dev);
 		device_del(pvt->chancounts_dev);
+		put_device(pvt->chancounts_dev);
 	}
-	put_device(pvt->addrmatch_dev);
 	device_del(pvt->addrmatch_dev);
+	put_device(pvt->addrmatch_dev);
 }
 
 /****************************************************************************
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpio/gpio-menz127.c linux-libre-4.18.12-gnu/drivers/gpio/gpio-menz127.c
--- linux-libre-4.18.11-gnu/drivers/gpio/gpio-menz127.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpio/gpio-menz127.c	2018-10-03 19:59:28.000000000 -0400
@@ -56,9 +56,9 @@ static int men_z127_debounce(struct gpio
 		rnd = fls(debounce) - 1;
 
 		if (rnd && (debounce & BIT(rnd - 1)))
-			debounce = round_up(debounce, MEN_Z127_DB_MIN_US);
+			debounce = roundup(debounce, MEN_Z127_DB_MIN_US);
 		else
-			debounce = round_down(debounce, MEN_Z127_DB_MIN_US);
+			debounce = rounddown(debounce, MEN_Z127_DB_MIN_US);
 
 		if (debounce > MEN_Z127_DB_MAX_US)
 			debounce = MEN_Z127_DB_MAX_US;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpio/gpio-tegra.c linux-libre-4.18.12-gnu/drivers/gpio/gpio-tegra.c
--- linux-libre-4.18.11-gnu/drivers/gpio/gpio-tegra.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpio/gpio-tegra.c	2018-10-03 19:59:28.000000000 -0400
@@ -323,13 +323,6 @@ static int tegra_gpio_irq_set_type(struc
 		return -EINVAL;
 	}
 
-	ret = gpiochip_lock_as_irq(&tgi->gc, gpio);
-	if (ret) {
-		dev_err(tgi->dev,
-			"unable to lock Tegra GPIO %u as IRQ\n", gpio);
-		return ret;
-	}
-
 	spin_lock_irqsave(&bank->lvl_lock[port], flags);
 
 	val = tegra_gpio_readl(tgi, GPIO_INT_LVL(tgi, gpio));
@@ -342,6 +335,14 @@ static int tegra_gpio_irq_set_type(struc
 	tegra_gpio_mask_write(tgi, GPIO_MSK_OE(tgi, gpio), gpio, 0);
 	tegra_gpio_enable(tgi, gpio);
 
+	ret = gpiochip_lock_as_irq(&tgi->gc, gpio);
+	if (ret) {
+		dev_err(tgi->dev,
+			"unable to lock Tegra GPIO %u as IRQ\n", gpio);
+		tegra_gpio_disable(tgi, gpio);
+		return ret;
+	}
+
 	if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
 		irq_set_handler_locked(d, handle_level_irq);
 	else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c	2018-10-03 19:59:28.000000000 -0400
@@ -975,13 +975,9 @@ static int amdgpu_cs_ib_fill(struct amdg
 		if (r)
 			return r;
 
-		if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) {
-			parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT;
-			if (!parser->ctx->preamble_presented) {
-				parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
-				parser->ctx->preamble_presented = true;
-			}
-		}
+		if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE)
+			parser->job->preamble_status |=
+				AMDGPU_PREAMBLE_IB_PRESENT;
 
 		if (parser->job->ring && parser->job->ring != ring)
 			return -EINVAL;
@@ -1206,6 +1202,12 @@ static int amdgpu_cs_submit(struct amdgp
 
 	amdgpu_cs_post_dependencies(p);
 
+	if ((job->preamble_status & AMDGPU_PREAMBLE_IB_PRESENT) &&
+	    !p->ctx->preamble_presented) {
+		job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
+		p->ctx->preamble_presented = true;
+	}
+
 	cs->out.handle = seq;
 	job->uf_sequence = seq;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c	2018-10-03 19:59:28.000000000 -0400
@@ -164,8 +164,10 @@ int amdgpu_ib_schedule(struct amdgpu_rin
 		return r;
 	}
 
+	need_ctx_switch = ring->current_ctx != fence_ctx;
 	if (ring->funcs->emit_pipeline_sync && job &&
 	    ((tmp = amdgpu_sync_get_fence(&job->sched_sync, NULL)) ||
+	     (amdgpu_sriov_vf(adev) && need_ctx_switch) ||
 	     amdgpu_vm_need_pipeline_sync(ring, job))) {
 		need_pipe_sync = true;
 		dma_fence_put(tmp);
@@ -196,7 +198,6 @@ int amdgpu_ib_schedule(struct amdgpu_rin
 	}
 
 	skip_preamble = ring->current_ctx == fence_ctx;
-	need_ctx_switch = ring->current_ctx != fence_ctx;
 	if (job && ring->funcs->emit_cntxcntl) {
 		if (need_ctx_switch)
 			status |= AMDGPU_HAVE_CTX_SWITCH;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c	2018-10-03 19:59:28.000000000 -0400
@@ -123,6 +123,7 @@ static void amdgpu_vm_bo_base_init(struc
 	 * is validated on next vm use to avoid fault.
 	 * */
 	list_move_tail(&base->vm_status, &vm->evicted);
+	base->moved = true;
 }
 
 /**
@@ -303,7 +304,6 @@ static int amdgpu_vm_clear_bo(struct amd
 	uint64_t addr;
 	int r;
 
-	addr = amdgpu_bo_gpu_offset(bo);
 	entries = amdgpu_bo_size(bo) / 8;
 
 	if (pte_support_ats) {
@@ -335,6 +335,7 @@ static int amdgpu_vm_clear_bo(struct amd
 	if (r)
 		goto error;
 
+	addr = amdgpu_bo_gpu_offset(bo);
 	if (ats_entries) {
 		uint64_t ats_value;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c	2018-09-29 08:28:55.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c	2018-10-03 21:09:14.000000000 -0400
@@ -5540,6 +5540,11 @@ static int gfx_v8_0_set_powergating_stat
 	if (amdgpu_sriov_vf(adev))
 		return 0;
 
+	if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+				AMD_PG_SUPPORT_RLC_SMU_HS |
+				AMD_PG_SUPPORT_CP |
+				AMD_PG_SUPPORT_GFX_DMG))
+		adev->gfx.rlc.funcs->enter_safe_mode(adev);
 	switch (adev->asic_type) {
 	case CHIP_CARRIZO:
 	case CHIP_STONEY:
@@ -5589,7 +5594,11 @@ static int gfx_v8_0_set_powergating_stat
 	default:
 		break;
 	}
-
+	if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+				AMD_PG_SUPPORT_RLC_SMU_HS |
+				AMD_PG_SUPPORT_CP |
+				AMD_PG_SUPPORT_GFX_DMG))
+		adev->gfx.rlc.funcs->exit_safe_mode(adev);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/kv_dpm.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/kv_dpm.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/kv_dpm.c	2018-10-03 19:59:28.000000000 -0400
@@ -1354,8 +1354,6 @@ static int kv_dpm_enable(struct amdgpu_d
 		return ret;
 	}
 
-	kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
-
 	if (adev->irq.installed &&
 	    amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
 		ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
@@ -3061,7 +3059,7 @@ static int kv_dpm_hw_init(void *handle)
 	else
 		adev->pm.dpm_enabled = true;
 	mutex_unlock(&adev->pm.mutex);
-
+	amdgpu_pm_compute_clocks(adev);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/si_dpm.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/si_dpm.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/amdgpu/si_dpm.c	2018-09-29 08:30:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/amdgpu/si_dpm.c	2018-10-03 21:10:23.000000000 -0400
@@ -6878,7 +6878,6 @@ static int si_dpm_enable(struct amdgpu_d
 
 	si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
 	si_thermal_start_thermal_controller(adev);
-	ni_update_current_ps(adev, boot_ps);
 
 	return 0;
 }
@@ -7755,7 +7754,7 @@ static int si_dpm_hw_init(void *handle)
 	else
 		adev->pm.dpm_enabled = true;
 	mutex_unlock(&adev->pm.mutex);
-
+	amdgpu_pm_compute_clocks(adev);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c	2018-10-03 19:59:28.000000000 -0400
@@ -133,7 +133,7 @@ static bool calculate_fb_and_fractional_
 	uint64_t feedback_divider;
 
 	feedback_divider =
-		(uint64_t)(target_pix_clk_khz * ref_divider * post_divider);
+		(uint64_t)target_pix_clk_khz * ref_divider * post_divider;
 	feedback_divider *= 10;
 	/* additional factor, since we divide by 10 afterwards */
 	feedback_divider *= (uint64_t)(calc_pll_cs->fract_fb_divider_factor);
@@ -145,8 +145,8 @@ static bool calculate_fb_and_fractional_
  * of fractional feedback decimal point and the fractional FB Divider precision
  * is 2 then the equation becomes (ullfeedbackDivider + 5*100) / (10*100))*/
 
-	feedback_divider += (uint64_t)
-			(5 * calc_pll_cs->fract_fb_divider_precision_factor);
+	feedback_divider += 5ULL *
+			    calc_pll_cs->fract_fb_divider_precision_factor;
 	feedback_divider =
 		div_u64(feedback_divider,
 			calc_pll_cs->fract_fb_divider_precision_factor * 10);
@@ -203,8 +203,8 @@ static bool calc_fb_divider_checking_tol
 			&fract_feedback_divider);
 
 	/*Actual calculated value*/
-	actual_calc_clk_khz = (uint64_t)(feedback_divider *
-					calc_pll_cs->fract_fb_divider_factor) +
+	actual_calc_clk_khz = (uint64_t)feedback_divider *
+					calc_pll_cs->fract_fb_divider_factor +
 							fract_feedback_divider;
 	actual_calc_clk_khz *= calc_pll_cs->ref_freq_khz;
 	actual_calc_clk_khz =
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c	2018-10-03 19:59:28.000000000 -0400
@@ -239,6 +239,8 @@ void dml1_extract_rq_regs(
 	extract_rq_sizing_regs(mode_lib, &(rq_regs->rq_regs_l), rq_param.sizing.rq_l);
 	if (rq_param.yuv420)
 		extract_rq_sizing_regs(mode_lib, &(rq_regs->rq_regs_c), rq_param.sizing.rq_c);
+	else
+		memset(&(rq_regs->rq_regs_c), 0, sizeof(rq_regs->rq_regs_c));
 
 	rq_regs->rq_regs_l.swath_height = dml_log2(rq_param.dlg.rq_l.swath_height);
 	rq_regs->rq_regs_c.swath_height = dml_log2(rq_param.dlg.rq_c.swath_height);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_debugfs.c linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_debugfs.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_debugfs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_debugfs.c	2018-10-03 19:59:28.000000000 -0400
@@ -37,7 +37,9 @@ static int gem_show(struct seq_file *m,
 		return ret;
 
 	seq_printf(m, "All Objects:\n");
+	mutex_lock(&priv->list_lock);
 	omap_gem_describe_objects(&priv->obj_list, m);
+	mutex_unlock(&priv->list_lock);
 
 	mutex_unlock(&dev->struct_mutex);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_drv.c linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_drv.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_drv.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_drv.c	2018-10-03 19:59:28.000000000 -0400
@@ -540,7 +540,7 @@ static int omapdrm_init(struct omap_drm_
 	priv->omaprev = soc ? (unsigned int)soc->data : 0;
 	priv->wq = alloc_ordered_workqueue("omapdrm", 0);
 
-	spin_lock_init(&priv->list_lock);
+	mutex_init(&priv->list_lock);
 	INIT_LIST_HEAD(&priv->obj_list);
 
 	/* Allocate and initialize the DRM device. */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_drv.h linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_drv.h
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_drv.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_drv.h	2018-10-03 19:59:28.000000000 -0400
@@ -71,7 +71,7 @@ struct omap_drm_private {
 	struct workqueue_struct *wq;
 
 	/* lock for obj_list below */
-	spinlock_t list_lock;
+	struct mutex list_lock;
 
 	/* list of GEM objects: */
 	struct list_head obj_list;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_gem.c linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_gem.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/omapdrm/omap_gem.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/omapdrm/omap_gem.c	2018-10-03 19:59:28.000000000 -0400
@@ -1001,6 +1001,7 @@ int omap_gem_resume(struct drm_device *d
 	struct omap_gem_object *omap_obj;
 	int ret = 0;
 
+	mutex_lock(&priv->list_lock);
 	list_for_each_entry(omap_obj, &priv->obj_list, mm_list) {
 		if (omap_obj->block) {
 			struct drm_gem_object *obj = &omap_obj->base;
@@ -1012,12 +1013,14 @@ int omap_gem_resume(struct drm_device *d
 					omap_obj->roll, true);
 			if (ret) {
 				dev_err(dev->dev, "could not repin: %d\n", ret);
-				return ret;
+				goto done;
 			}
 		}
 	}
 
-	return 0;
+done:
+	mutex_unlock(&priv->list_lock);
+	return ret;
 }
 #endif
 
@@ -1085,9 +1088,9 @@ void omap_gem_free_object(struct drm_gem
 
 	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
 
-	spin_lock(&priv->list_lock);
+	mutex_lock(&priv->list_lock);
 	list_del(&omap_obj->mm_list);
-	spin_unlock(&priv->list_lock);
+	mutex_unlock(&priv->list_lock);
 
 	/* this means the object is still pinned.. which really should
 	 * not happen.  I think..
@@ -1206,9 +1209,9 @@ struct drm_gem_object *omap_gem_new(stru
 			goto err_release;
 	}
 
-	spin_lock(&priv->list_lock);
+	mutex_lock(&priv->list_lock);
 	list_add(&omap_obj->mm_list, &priv->obj_list);
-	spin_unlock(&priv->list_lock);
+	mutex_unlock(&priv->list_lock);
 
 	return obj;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/sun4i/sun4i_drv.c linux-libre-4.18.12-gnu/drivers/gpu/drm/sun4i/sun4i_drv.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/sun4i/sun4i_drv.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/sun4i/sun4i_drv.c	2018-10-03 19:59:28.000000000 -0400
@@ -283,7 +283,6 @@ static int sun4i_drv_add_endpoints(struc
 		remote = of_graph_get_remote_port_parent(ep);
 		if (!remote) {
 			DRM_DEBUG_DRIVER("Error retrieving the output node\n");
-			of_node_put(remote);
 			continue;
 		}
 
@@ -297,11 +296,13 @@ static int sun4i_drv_add_endpoints(struc
 
 			if (of_graph_parse_endpoint(ep, &endpoint)) {
 				DRM_DEBUG_DRIVER("Couldn't parse endpoint\n");
+				of_node_put(remote);
 				continue;
 			}
 
 			if (!endpoint.id) {
 				DRM_DEBUG_DRIVER("Endpoint is our panel... skipping\n");
+				of_node_put(remote);
 				continue;
 			}
 		}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c linux-libre-4.18.12-gnu/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c	2018-10-03 19:59:28.000000000 -0400
@@ -477,13 +477,15 @@ int sun8i_hdmi_phy_probe(struct sun8i_dw
 			dev_err(dev, "Couldn't create the PHY clock\n");
 			goto err_put_clk_pll0;
 		}
+
+		clk_prepare_enable(phy->clk_phy);
 	}
 
 	phy->rst_phy = of_reset_control_get_shared(node, "phy");
 	if (IS_ERR(phy->rst_phy)) {
 		dev_err(dev, "Could not get phy reset control\n");
 		ret = PTR_ERR(phy->rst_phy);
-		goto err_put_clk_pll0;
+		goto err_disable_clk_phy;
 	}
 
 	ret = reset_control_deassert(phy->rst_phy);
@@ -514,6 +516,8 @@ err_deassert_rst_phy:
 	reset_control_assert(phy->rst_phy);
 err_put_rst_phy:
 	reset_control_put(phy->rst_phy);
+err_disable_clk_phy:
+	clk_disable_unprepare(phy->clk_phy);
 err_put_clk_pll0:
 	if (phy->variant->has_phy_clk)
 		clk_put(phy->clk_pll0);
@@ -531,6 +535,7 @@ void sun8i_hdmi_phy_remove(struct sun8i_
 
 	clk_disable_unprepare(phy->clk_mod);
 	clk_disable_unprepare(phy->clk_bus);
+	clk_disable_unprepare(phy->clk_phy);
 
 	reset_control_assert(phy->rst_phy);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/v3d/v3d_drv.h linux-libre-4.18.12-gnu/drivers/gpu/drm/v3d/v3d_drv.h
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/v3d/v3d_drv.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/v3d/v3d_drv.h	2018-10-03 19:59:28.000000000 -0400
@@ -85,6 +85,11 @@ struct v3d_dev {
 	 */
 	struct mutex reset_lock;
 
+	/* Lock taken when creating and pushing the GPU scheduler
+	 * jobs, to keep the sched-fence seqnos in order.
+	 */
+	struct mutex sched_lock;
+
 	struct {
 		u32 num_allocated;
 		u32 pages_allocated;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/v3d/v3d_gem.c linux-libre-4.18.12-gnu/drivers/gpu/drm/v3d/v3d_gem.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/v3d/v3d_gem.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/v3d/v3d_gem.c	2018-10-03 19:59:28.000000000 -0400
@@ -550,6 +550,7 @@ v3d_submit_cl_ioctl(struct drm_device *d
 	if (ret)
 		goto fail;
 
+	mutex_lock(&v3d->sched_lock);
 	if (exec->bin.start != exec->bin.end) {
 		ret = drm_sched_job_init(&exec->bin.base,
 					 &v3d->queue[V3D_BIN].sched,
@@ -576,6 +577,7 @@ v3d_submit_cl_ioctl(struct drm_device *d
 	kref_get(&exec->refcount); /* put by scheduler job completion */
 	drm_sched_entity_push_job(&exec->render.base,
 				  &v3d_priv->sched_entity[V3D_RENDER]);
+	mutex_unlock(&v3d->sched_lock);
 
 	v3d_attach_object_fences(exec);
 
@@ -594,6 +596,7 @@ v3d_submit_cl_ioctl(struct drm_device *d
 	return 0;
 
 fail_unreserve:
+	mutex_unlock(&v3d->sched_lock);
 	v3d_unlock_bo_reservations(dev, exec, &acquire_ctx);
 fail:
 	v3d_exec_put(exec);
@@ -615,6 +618,7 @@ v3d_gem_init(struct drm_device *dev)
 	spin_lock_init(&v3d->job_lock);
 	mutex_init(&v3d->bo_lock);
 	mutex_init(&v3d->reset_lock);
+	mutex_init(&v3d->sched_lock);
 
 	/* Note: We don't allocate address 0.  Various bits of HW
 	 * treat 0 as special, such as the occlusion query counters
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/gpu/drm/vc4/vc4_plane.c linux-libre-4.18.12-gnu/drivers/gpu/drm/vc4/vc4_plane.c
--- linux-libre-4.18.11-gnu/drivers/gpu/drm/vc4/vc4_plane.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/gpu/drm/vc4/vc4_plane.c	2018-10-03 19:59:28.000000000 -0400
@@ -543,6 +543,7 @@ static int vc4_plane_mode_set(struct drm
 	/* Control word */
 	vc4_dlist_write(vc4_state,
 			SCALER_CTL0_VALID |
+			VC4_SET_FIELD(SCALER_CTL0_RGBA_EXPAND_ROUND, SCALER_CTL0_RGBA_EXPAND) |
 			(format->pixel_order << SCALER_CTL0_ORDER_SHIFT) |
 			(format->hvs << SCALER_CTL0_PIXEL_FORMAT_SHIFT) |
 			VC4_SET_FIELD(tiling, SCALER_CTL0_TILING) |
@@ -874,7 +875,9 @@ static bool vc4_format_mod_supported(str
 	case DRM_FORMAT_YUV420:
 	case DRM_FORMAT_YVU420:
 	case DRM_FORMAT_NV12:
+	case DRM_FORMAT_NV21:
 	case DRM_FORMAT_NV16:
+	case DRM_FORMAT_NV61:
 	default:
 		return (modifier == DRM_FORMAT_MOD_LINEAR);
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/hid/hid-ntrig.c linux-libre-4.18.12-gnu/drivers/hid/hid-ntrig.c
--- linux-libre-4.18.11-gnu/drivers/hid/hid-ntrig.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/hid/hid-ntrig.c	2018-10-03 19:59:28.000000000 -0400
@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device
 
 	ret = sysfs_create_group(&hdev->dev.kobj,
 			&ntrig_attribute_group);
+	if (ret)
+		hid_err(hdev, "cannot create sysfs group\n");
 
 	return 0;
 err_free:
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/hid/i2c-hid/i2c-hid.c linux-libre-4.18.12-gnu/drivers/hid/i2c-hid/i2c-hid.c
--- linux-libre-4.18.11-gnu/drivers/hid/i2c-hid/i2c-hid.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/hid/i2c-hid/i2c-hid.c	2018-10-03 19:59:28.000000000 -0400
@@ -1004,18 +1004,18 @@ static int i2c_hid_probe(struct i2c_clie
 		return client->irq;
 	}
 
-	ihid = kzalloc(sizeof(struct i2c_hid), GFP_KERNEL);
+	ihid = devm_kzalloc(&client->dev, sizeof(*ihid), GFP_KERNEL);
 	if (!ihid)
 		return -ENOMEM;
 
 	if (client->dev.of_node) {
 		ret = i2c_hid_of_probe(client, &ihid->pdata);
 		if (ret)
-			goto err;
+			return ret;
 	} else if (!platform_data) {
 		ret = i2c_hid_acpi_pdata(client, &ihid->pdata);
 		if (ret)
-			goto err;
+			return ret;
 	} else {
 		ihid->pdata = *platform_data;
 	}
@@ -1128,7 +1128,6 @@ err_regulator:
 
 err:
 	i2c_hid_free_buffers(ihid);
-	kfree(ihid);
 	return ret;
 }
 
@@ -1152,8 +1151,6 @@ static int i2c_hid_remove(struct i2c_cli
 
 	regulator_disable(ihid->pdata.supply);
 
-	kfree(ihid);
-
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/hwmon/adt7475.c linux-libre-4.18.12-gnu/drivers/hwmon/adt7475.c
--- linux-libre-4.18.11-gnu/drivers/hwmon/adt7475.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/hwmon/adt7475.c	2018-10-03 19:59:28.000000000 -0400
@@ -303,14 +303,18 @@ static inline u16 volt2reg(int channel,
 	return clamp_val(reg, 0, 1023) & (0xff << 2);
 }
 
-static u16 adt7475_read_word(struct i2c_client *client, int reg)
+static int adt7475_read_word(struct i2c_client *client, int reg)
 {
-	u16 val;
+	int val1, val2;
 
-	val = i2c_smbus_read_byte_data(client, reg);
-	val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
+	val1 = i2c_smbus_read_byte_data(client, reg);
+	if (val1 < 0)
+		return val1;
+	val2 = i2c_smbus_read_byte_data(client, reg + 1);
+	if (val2 < 0)
+		return val2;
 
-	return val;
+	return val1 | (val2 << 8);
 }
 
 static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/hwmon/ina2xx.c linux-libre-4.18.12-gnu/drivers/hwmon/ina2xx.c
--- linux-libre-4.18.11-gnu/drivers/hwmon/ina2xx.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/hwmon/ina2xx.c	2018-10-03 19:59:28.000000000 -0400
@@ -17,7 +17,7 @@
  * Bi-directional Current/Power Monitor with I2C Interface
  * Datasheet: http://www.ti.com/product/ina230
  *
- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
+ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
  * Thanks to Jan Volkering
  *
  * This program is free software; you can redistribute it and/or modify
@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2x
 	return 0;
 }
 
+static ssize_t ina2xx_show_shunt(struct device *dev,
+			      struct device_attribute *da,
+			      char *buf)
+{
+	struct ina2xx_data *data = dev_get_drvdata(dev);
+
+	return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
+}
+
 static ssize_t ina2xx_store_shunt(struct device *dev,
 				  struct device_attribute *da,
 				  const char *buf, size_t count)
@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input,
 
 /* shunt resistance */
 static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
-			  ina2xx_show_value, ina2xx_store_shunt,
+			  ina2xx_show_shunt, ina2xx_store_shunt,
 			  INA2XX_CALIBRATION);
 
 /* update interval (ina226 only) */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/hwtracing/intel_th/core.c linux-libre-4.18.12-gnu/drivers/hwtracing/intel_th/core.c
--- linux-libre-4.18.11-gnu/drivers/hwtracing/intel_th/core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/hwtracing/intel_th/core.c	2018-10-03 19:59:28.000000000 -0400
@@ -139,7 +139,8 @@ static int intel_th_remove(struct device
 			th->thdev[i] = NULL;
 		}
 
-		th->num_thdevs = lowest;
+		if (lowest >= 0)
+			th->num_thdevs = lowest;
 	}
 
 	if (thdrv->attr_group)
@@ -487,7 +488,7 @@ static const struct intel_th_subdevice {
 				.flags	= IORESOURCE_MEM,
 			},
 			{
-				.start	= TH_MMIO_SW,
+				.start	= 1, /* use resource[1] */
 				.end	= 0,
 				.flags	= IORESOURCE_MEM,
 			},
@@ -580,6 +581,7 @@ intel_th_subdevice_alloc(struct intel_th
 	struct intel_th_device *thdev;
 	struct resource res[3];
 	unsigned int req = 0;
+	bool is64bit = false;
 	int r, err;
 
 	thdev = intel_th_device_alloc(th, subdev->type, subdev->name,
@@ -589,12 +591,18 @@ intel_th_subdevice_alloc(struct intel_th
 
 	thdev->drvdata = th->drvdata;
 
+	for (r = 0; r < th->num_resources; r++)
+		if (th->resource[r].flags & IORESOURCE_MEM_64) {
+			is64bit = true;
+			break;
+		}
+
 	memcpy(res, subdev->res,
 	       sizeof(struct resource) * subdev->nres);
 
 	for (r = 0; r < subdev->nres; r++) {
 		struct resource *devres = th->resource;
-		int bar = TH_MMIO_CONFIG;
+		int bar = 0; /* cut subdevices' MMIO from resource[0] */
 
 		/*
 		 * Take .end == 0 to mean 'take the whole bar',
@@ -603,6 +611,8 @@ intel_th_subdevice_alloc(struct intel_th
 		 */
 		if (!res[r].end && res[r].flags == IORESOURCE_MEM) {
 			bar = res[r].start;
+			if (is64bit)
+				bar *= 2;
 			res[r].start = 0;
 			res[r].end = resource_size(&devres[bar]) - 1;
 		}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/i2c/busses/i2c-i801.c linux-libre-4.18.12-gnu/drivers/i2c/busses/i2c-i801.c
--- linux-libre-4.18.11-gnu/drivers/i2c/busses/i2c-i801.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/i2c/busses/i2c-i801.c	2018-10-03 19:59:28.000000000 -0400
@@ -1417,6 +1417,13 @@ static void i801_add_tco(struct i801_pri
 }
 
 #ifdef CONFIG_ACPI
+static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
+				      acpi_physical_address address)
+{
+	return address >= priv->smba &&
+	       address <= pci_resource_end(priv->pci_dev, SMBBAR);
+}
+
 static acpi_status
 i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
 		     u64 *value, void *handler_context, void *region_context)
@@ -1432,7 +1439,7 @@ i801_acpi_io_handler(u32 function, acpi_
 	 */
 	mutex_lock(&priv->acpi_lock);
 
-	if (!priv->acpi_reserved) {
+	if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
 		priv->acpi_reserved = true;
 
 		dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/iio/accel/adxl345_core.c linux-libre-4.18.12-gnu/drivers/iio/accel/adxl345_core.c
--- linux-libre-4.18.11-gnu/drivers/iio/accel/adxl345_core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/iio/accel/adxl345_core.c	2018-10-03 19:59:28.000000000 -0400
@@ -21,6 +21,8 @@
 #define ADXL345_REG_DATAX0		0x32
 #define ADXL345_REG_DATAY0		0x34
 #define ADXL345_REG_DATAZ0		0x36
+#define ADXL345_REG_DATA_AXIS(index)	\
+	(ADXL345_REG_DATAX0 + (index) * sizeof(__le16))
 
 #define ADXL345_POWER_CTL_MEASURE	BIT(3)
 #define ADXL345_POWER_CTL_STANDBY	0x00
@@ -47,19 +49,19 @@ struct adxl345_data {
 	u8 data_range;
 };
 
-#define ADXL345_CHANNEL(reg, axis) {					\
+#define ADXL345_CHANNEL(index, axis) {					\
 	.type = IIO_ACCEL,						\
 	.modified = 1,							\
 	.channel2 = IIO_MOD_##axis,					\
-	.address = reg,							\
+	.address = index,						\
 	.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),			\
 	.info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),		\
 }
 
 static const struct iio_chan_spec adxl345_channels[] = {
-	ADXL345_CHANNEL(ADXL345_REG_DATAX0, X),
-	ADXL345_CHANNEL(ADXL345_REG_DATAY0, Y),
-	ADXL345_CHANNEL(ADXL345_REG_DATAZ0, Z),
+	ADXL345_CHANNEL(0, X),
+	ADXL345_CHANNEL(1, Y),
+	ADXL345_CHANNEL(2, Z),
 };
 
 static int adxl345_read_raw(struct iio_dev *indio_dev,
@@ -67,7 +69,7 @@ static int adxl345_read_raw(struct iio_d
 			    int *val, int *val2, long mask)
 {
 	struct adxl345_data *data = iio_priv(indio_dev);
-	__le16 regval;
+	__le16 accel;
 	int ret;
 
 	switch (mask) {
@@ -77,12 +79,13 @@ static int adxl345_read_raw(struct iio_d
 		 * ADXL345_REG_DATA(X0/Y0/Z0) contain the least significant byte
 		 * and ADXL345_REG_DATA(X0/Y0/Z0) + 1 the most significant byte
 		 */
-		ret = regmap_bulk_read(data->regmap, chan->address, &regval,
-				       sizeof(regval));
+		ret = regmap_bulk_read(data->regmap,
+				       ADXL345_REG_DATA_AXIS(chan->address),
+				       &accel, sizeof(accel));
 		if (ret < 0)
 			return ret;
 
-		*val = sign_extend32(le16_to_cpu(regval), 12);
+		*val = sign_extend32(le16_to_cpu(accel), 12);
 		return IIO_VAL_INT;
 	case IIO_CHAN_INFO_SCALE:
 		*val = 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/iio/adc/ina2xx-adc.c linux-libre-4.18.12-gnu/drivers/iio/adc/ina2xx-adc.c
--- linux-libre-4.18.11-gnu/drivers/iio/adc/ina2xx-adc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/iio/adc/ina2xx-adc.c	2018-10-03 19:59:28.000000000 -0400
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/regmap.h>
+#include <linux/sched/task.h>
 #include <linux/util_macros.h>
 
 #include <linux/platform_data/ina2xx.h>
@@ -826,6 +827,7 @@ static int ina2xx_buffer_enable(struct i
 {
 	struct ina2xx_chip_info *chip = iio_priv(indio_dev);
 	unsigned int sampling_us = SAMPLING_PERIOD(chip);
+	struct task_struct *task;
 
 	dev_dbg(&indio_dev->dev, "Enabling buffer w/ scan_mask %02x, freq = %d, avg =%u\n",
 		(unsigned int)(*indio_dev->active_scan_mask),
@@ -835,11 +837,17 @@ static int ina2xx_buffer_enable(struct i
 	dev_dbg(&indio_dev->dev, "Async readout mode: %d\n",
 		chip->allow_async_readout);
 
-	chip->task = kthread_run(ina2xx_capture_thread, (void *)indio_dev,
-				 "%s:%d-%uus", indio_dev->name, indio_dev->id,
-				 sampling_us);
+	task = kthread_create(ina2xx_capture_thread, (void *)indio_dev,
+			      "%s:%d-%uus", indio_dev->name, indio_dev->id,
+			      sampling_us);
+	if (IS_ERR(task))
+		return PTR_ERR(task);
 
-	return PTR_ERR_OR_ZERO(chip->task);
+	get_task_struct(task);
+	wake_up_process(task);
+	chip->task = task;
+
+	return 0;
 }
 
 static int ina2xx_buffer_disable(struct iio_dev *indio_dev)
@@ -848,6 +856,7 @@ static int ina2xx_buffer_disable(struct
 
 	if (chip->task) {
 		kthread_stop(chip->task);
+		put_task_struct(chip->task);
 		chip->task = NULL;
 	}
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/iio/counter/104-quad-8.c linux-libre-4.18.12-gnu/drivers/iio/counter/104-quad-8.c
--- linux-libre-4.18.11-gnu/drivers/iio/counter/104-quad-8.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/iio/counter/104-quad-8.c	2018-10-03 19:59:28.000000000 -0400
@@ -138,7 +138,7 @@ static int quad8_write_raw(struct iio_de
 			outb(val >> (8 * i), base_offset);
 
 		/* Reset Borrow, Carry, Compare, and Sign flags */
-		outb(0x02, base_offset + 1);
+		outb(0x04, base_offset + 1);
 		/* Reset Error flag */
 		outb(0x06, base_offset + 1);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/core/rw.c linux-libre-4.18.12-gnu/drivers/infiniband/core/rw.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/core/rw.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/core/rw.c	2018-10-03 19:59:28.000000000 -0400
@@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib
 	}
 
 	ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE);
-	if (ret < nents) {
+	if (ret < 0 || ret < nents) {
 		ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr);
 		return -EINVAL;
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/core/uverbs_cmd.c linux-libre-4.18.12-gnu/drivers/infiniband/core/uverbs_cmd.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/core/uverbs_cmd.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/core/uverbs_cmd.c	2018-10-03 19:59:28.000000000 -0400
@@ -2812,6 +2812,9 @@ static struct ib_uflow_resources *flow_r
 	if (!resources)
 		goto err_res;
 
+	if (!num_specs)
+		goto out;
+
 	resources->counters =
 		kcalloc(num_specs, sizeof(*resources->counters), GFP_KERNEL);
 
@@ -2824,8 +2827,8 @@ static struct ib_uflow_resources *flow_r
 	if (!resources->collection)
 		goto err_collection;
 
+out:
 	resources->max = num_specs;
-
 	return resources;
 
 err_collection:
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/core/uverbs_main.c linux-libre-4.18.12-gnu/drivers/infiniband/core/uverbs_main.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/core/uverbs_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/core/uverbs_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -429,6 +429,7 @@ static int ib_uverbs_comp_event_close(st
 			list_del(&entry->obj_list);
 		kfree(entry);
 	}
+	file->ev_queue.is_closed = 1;
 	spin_unlock_irq(&file->ev_queue.lock);
 
 	uverbs_close_fd(filp);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/bnxt_re/qplib_fp.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/bnxt_re/qplib_fp.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/bnxt_re/qplib_fp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/bnxt_re/qplib_fp.c	2018-10-03 19:59:28.000000000 -0400
@@ -2354,7 +2354,7 @@ static int bnxt_qplib_cq_process_res_rc(
 		srq = qp->srq;
 		if (!srq)
 			return -EINVAL;
-		if (wr_id_idx > srq->hwq.max_elements) {
+		if (wr_id_idx >= srq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process RC ");
 			dev_err(&cq->hwq.pdev->dev,
@@ -2369,7 +2369,7 @@ static int bnxt_qplib_cq_process_res_rc(
 		*pcqe = cqe;
 	} else {
 		rq = &qp->rq;
-		if (wr_id_idx > rq->hwq.max_elements) {
+		if (wr_id_idx >= rq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process RC ");
 			dev_err(&cq->hwq.pdev->dev,
@@ -2437,7 +2437,7 @@ static int bnxt_qplib_cq_process_res_ud(
 		if (!srq)
 			return -EINVAL;
 
-		if (wr_id_idx > srq->hwq.max_elements) {
+		if (wr_id_idx >= srq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process UD ");
 			dev_err(&cq->hwq.pdev->dev,
@@ -2452,7 +2452,7 @@ static int bnxt_qplib_cq_process_res_ud(
 		*pcqe = cqe;
 	} else {
 		rq = &qp->rq;
-		if (wr_id_idx > rq->hwq.max_elements) {
+		if (wr_id_idx >= rq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process UD ");
 			dev_err(&cq->hwq.pdev->dev,
@@ -2546,7 +2546,7 @@ static int bnxt_qplib_cq_process_res_raw
 				"QPLIB: FP: SRQ used but not defined??");
 			return -EINVAL;
 		}
-		if (wr_id_idx > srq->hwq.max_elements) {
+		if (wr_id_idx >= srq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process Raw/QP1 ");
 			dev_err(&cq->hwq.pdev->dev,
@@ -2561,7 +2561,7 @@ static int bnxt_qplib_cq_process_res_raw
 		*pcqe = cqe;
 	} else {
 		rq = &qp->rq;
-		if (wr_id_idx > rq->hwq.max_elements) {
+		if (wr_id_idx >= rq->hwq.max_elements) {
 			dev_err(&cq->hwq.pdev->dev,
 				"QPLIB: FP: CQ Process Raw/QP1 RQ wr_id ");
 			dev_err(&cq->hwq.pdev->dev,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/bnxt_re/qplib_sp.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/bnxt_re/qplib_sp.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/bnxt_re/qplib_sp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/bnxt_re/qplib_sp.c	2018-10-03 19:59:28.000000000 -0400
@@ -197,7 +197,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qpli
 			struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
 			struct bnxt_qplib_gid *gid)
 {
-	if (index > sgid_tbl->max) {
+	if (index >= sgid_tbl->max) {
 		dev_err(&res->pdev->dev,
 			"QPLIB: Index %d exceeded SGID table max (%d)",
 			index, sgid_tbl->max);
@@ -402,7 +402,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qpli
 		*pkey = 0xFFFF;
 		return 0;
 	}
-	if (index > pkey_tbl->max) {
+	if (index >= pkey_tbl->max) {
 		dev_err(&res->pdev->dev,
 			"QPLIB: Index %d exceeded PKEY table max (%d)",
 			index, pkey_tbl->max);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/chip.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/chip.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/chip.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/chip.c	2018-10-03 19:59:28.000000000 -0400
@@ -6733,6 +6733,7 @@ void start_freeze_handling(struct hfi1_p
 	struct hfi1_devdata *dd = ppd->dd;
 	struct send_context *sc;
 	int i;
+	int sc_flags;
 
 	if (flags & FREEZE_SELF)
 		write_csr(dd, CCE_CTRL, CCE_CTRL_SPC_FREEZE_SMASK);
@@ -6743,11 +6744,13 @@ void start_freeze_handling(struct hfi1_p
 	/* notify all SDMA engines that they are going into a freeze */
 	sdma_freeze_notify(dd, !!(flags & FREEZE_LINK_DOWN));
 
+	sc_flags = SCF_FROZEN | SCF_HALTED | (flags & FREEZE_LINK_DOWN ?
+					      SCF_LINK_DOWN : 0);
 	/* do halt pre-handling on all enabled send contexts */
 	for (i = 0; i < dd->num_send_contexts; i++) {
 		sc = dd->send_contexts[i].sc;
 		if (sc && (sc->flags & SCF_ENABLED))
-			sc_stop(sc, SCF_FROZEN | SCF_HALTED);
+			sc_stop(sc, sc_flags);
 	}
 
 	/* Send context are frozen. Notify user space */
@@ -10665,6 +10668,7 @@ int set_link_state(struct hfi1_pportdata
 		add_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK);
 
 		handle_linkup_change(dd, 1);
+		pio_kernel_linkup(dd);
 
 		/*
 		 * After link up, a new link width will have been set.
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/pio.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/pio.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/pio.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/pio.c	2018-10-03 19:59:28.000000000 -0400
@@ -86,6 +86,7 @@ void pio_send_control(struct hfi1_devdat
 	unsigned long flags;
 	int write = 1;	/* write sendctrl back */
 	int flush = 0;	/* re-read sendctrl to make sure it is flushed */
+	int i;
 
 	spin_lock_irqsave(&dd->sendctrl_lock, flags);
 
@@ -95,9 +96,13 @@ void pio_send_control(struct hfi1_devdat
 		reg |= SEND_CTRL_SEND_ENABLE_SMASK;
 	/* Fall through */
 	case PSC_DATA_VL_ENABLE:
+		mask = 0;
+		for (i = 0; i < ARRAY_SIZE(dd->vld); i++)
+			if (!dd->vld[i].mtu)
+				mask |= BIT_ULL(i);
 		/* Disallow sending on VLs not enabled */
-		mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
-				SEND_CTRL_UNSUPPORTED_VL_SHIFT;
+		mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
+			SEND_CTRL_UNSUPPORTED_VL_SHIFT;
 		reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask;
 		break;
 	case PSC_GLOBAL_DISABLE:
@@ -921,20 +926,18 @@ void sc_free(struct send_context *sc)
 void sc_disable(struct send_context *sc)
 {
 	u64 reg;
-	unsigned long flags;
 	struct pio_buf *pbuf;
 
 	if (!sc)
 		return;
 
 	/* do all steps, even if already disabled */
-	spin_lock_irqsave(&sc->alloc_lock, flags);
+	spin_lock_irq(&sc->alloc_lock);
 	reg = read_kctxt_csr(sc->dd, sc->hw_context, SC(CTRL));
 	reg &= ~SC(CTRL_CTXT_ENABLE_SMASK);
 	sc->flags &= ~SCF_ENABLED;
 	sc_wait_for_packet_egress(sc, 1);
 	write_kctxt_csr(sc->dd, sc->hw_context, SC(CTRL), reg);
-	spin_unlock_irqrestore(&sc->alloc_lock, flags);
 
 	/*
 	 * Flush any waiters.  Once the context is disabled,
@@ -944,7 +947,7 @@ void sc_disable(struct send_context *sc)
 	 * proceed with the flush.
 	 */
 	udelay(1);
-	spin_lock_irqsave(&sc->release_lock, flags);
+	spin_lock(&sc->release_lock);
 	if (sc->sr) {	/* this context has a shadow ring */
 		while (sc->sr_tail != sc->sr_head) {
 			pbuf = &sc->sr[sc->sr_tail].pbuf;
@@ -955,7 +958,8 @@ void sc_disable(struct send_context *sc)
 				sc->sr_tail = 0;
 		}
 	}
-	spin_unlock_irqrestore(&sc->release_lock, flags);
+	spin_unlock(&sc->release_lock);
+	spin_unlock_irq(&sc->alloc_lock);
 }
 
 /* return SendEgressCtxtStatus.PacketOccupancy */
@@ -1178,11 +1182,39 @@ void pio_kernel_unfreeze(struct hfi1_dev
 		sc = dd->send_contexts[i].sc;
 		if (!sc || !(sc->flags & SCF_FROZEN) || sc->type == SC_USER)
 			continue;
+		if (sc->flags & SCF_LINK_DOWN)
+			continue;
 
 		sc_enable(sc);	/* will clear the sc frozen flag */
 	}
 }
 
+/**
+ * pio_kernel_linkup() - Re-enable send contexts after linkup event
+ * @dd: valid devive data
+ *
+ * When the link goes down, the freeze path is taken.  However, a link down
+ * event is different from a freeze because if the send context is re-enabled
+ * whowever is sending data will start sending data again, which will hang
+ * any QP that is sending data.
+ *
+ * The freeze path now looks at the type of event that occurs and takes this
+ * path for link down event.
+ */
+void pio_kernel_linkup(struct hfi1_devdata *dd)
+{
+	struct send_context *sc;
+	int i;
+
+	for (i = 0; i < dd->num_send_contexts; i++) {
+		sc = dd->send_contexts[i].sc;
+		if (!sc || !(sc->flags & SCF_LINK_DOWN) || sc->type == SC_USER)
+			continue;
+
+		sc_enable(sc);	/* will clear the sc link down flag */
+	}
+}
+
 /*
  * Wait for the SendPioInitCtxt.PioInitInProgress bit to clear.
  * Returns:
@@ -1382,11 +1414,10 @@ void sc_stop(struct send_context *sc, in
 {
 	unsigned long flags;
 
-	/* mark the context */
-	sc->flags |= flag;
-
 	/* stop buffer allocations */
 	spin_lock_irqsave(&sc->alloc_lock, flags);
+	/* mark the context */
+	sc->flags |= flag;
 	sc->flags &= ~SCF_ENABLED;
 	spin_unlock_irqrestore(&sc->alloc_lock, flags);
 	wake_up(&sc->halt_wait);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/pio.h linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/pio.h
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/pio.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/pio.h	2018-10-03 19:59:28.000000000 -0400
@@ -139,6 +139,7 @@ struct send_context {
 #define SCF_IN_FREE 0x02
 #define SCF_HALTED  0x04
 #define SCF_FROZEN  0x08
+#define SCF_LINK_DOWN 0x10
 
 struct send_context_info {
 	struct send_context *sc;	/* allocated working context */
@@ -306,6 +307,7 @@ void set_pio_integrity(struct send_conte
 void pio_reset_all(struct hfi1_devdata *dd);
 void pio_freeze(struct hfi1_devdata *dd);
 void pio_kernel_unfreeze(struct hfi1_devdata *dd);
+void pio_kernel_linkup(struct hfi1_devdata *dd);
 
 /* global PIO send control operations */
 #define PSC_GLOBAL_ENABLE 0
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/user_sdma.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/user_sdma.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/user_sdma.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/user_sdma.c	2018-10-03 19:59:28.000000000 -0400
@@ -828,7 +828,7 @@ static int user_sdma_send_pkts(struct us
 			if (READ_ONCE(iovec->offset) == iovec->iov.iov_len) {
 				if (++req->iov_idx == req->data_iovs) {
 					ret = -EFAULT;
-					goto free_txreq;
+					goto free_tx;
 				}
 				iovec = &req->iovs[req->iov_idx];
 				WARN_ON(iovec->offset);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/verbs.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/verbs.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/hfi1/verbs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/hfi1/verbs.c	2018-10-03 19:59:28.000000000 -0400
@@ -1590,6 +1590,7 @@ static int hfi1_check_ah(struct ib_devic
 	struct hfi1_pportdata *ppd;
 	struct hfi1_devdata *dd;
 	u8 sc5;
+	u8 sl;
 
 	if (hfi1_check_mcast(rdma_ah_get_dlid(ah_attr)) &&
 	    !(rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH))
@@ -1598,8 +1599,13 @@ static int hfi1_check_ah(struct ib_devic
 	/* test the mapping for validity */
 	ibp = to_iport(ibdev, rdma_ah_get_port_num(ah_attr));
 	ppd = ppd_from_ibp(ibp);
-	sc5 = ibp->sl_to_sc[rdma_ah_get_sl(ah_attr)];
 	dd = dd_from_ppd(ppd);
+
+	sl = rdma_ah_get_sl(ah_attr);
+	if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
+		return -EINVAL;
+
+	sc5 = ibp->sl_to_sc[sl];
 	if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
 		return -EINVAL;
 	return 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/i40iw/i40iw_verbs.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/i40iw/i40iw_verbs.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/i40iw/i40iw_verbs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/i40iw/i40iw_verbs.c	2018-10-03 19:59:28.000000000 -0400
@@ -1409,6 +1409,7 @@ static void i40iw_set_hugetlb_values(u64
 	struct vm_area_struct *vma;
 	struct hstate *h;
 
+	down_read(&current->mm->mmap_sem);
 	vma = find_vma(current->mm, addr);
 	if (vma && is_vm_hugetlb_page(vma)) {
 		h = hstate_vma(vma);
@@ -1417,6 +1418,7 @@ static void i40iw_set_hugetlb_values(u64
 			iwmr->page_msk = huge_page_mask(h);
 		}
 	}
+	up_read(&current->mm->mmap_sem);
 }
 
 /**
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/mlx4/qp.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/mlx4/qp.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/mlx4/qp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/mlx4/qp.c	2018-10-03 19:59:28.000000000 -0400
@@ -4047,9 +4047,9 @@ static void to_rdma_ah_attr(struct mlx4_
 	u8 port_num = path->sched_queue & 0x40 ? 2 : 1;
 
 	memset(ah_attr, 0, sizeof(*ah_attr));
-	ah_attr->type = rdma_ah_find_type(&ibdev->ib_dev, port_num);
 	if (port_num == 0 || port_num > dev->caps.num_ports)
 		return;
+	ah_attr->type = rdma_ah_find_type(&ibdev->ib_dev, port_num);
 
 	if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE)
 		rdma_ah_set_sl(ah_attr, ((path->sched_queue >> 3) & 0x7) |
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/hw/mlx5/main.c linux-libre-4.18.12-gnu/drivers/infiniband/hw/mlx5/main.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/hw/mlx5/main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/hw/mlx5/main.c	2018-10-03 19:59:28.000000000 -0400
@@ -2699,7 +2699,7 @@ static int parse_flow_attr(struct mlx5_c
 			 IPPROTO_GRE);
 
 		MLX5_SET(fte_match_set_misc, misc_params_c, gre_protocol,
-			 0xffff);
+			 ntohs(ib_spec->gre.mask.protocol));
 		MLX5_SET(fte_match_set_misc, misc_params_v, gre_protocol,
 			 ntohs(ib_spec->gre.val.protocol));
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/infiniband/ulp/srp/ib_srp.c linux-libre-4.18.12-gnu/drivers/infiniband/ulp/srp/ib_srp.c
--- linux-libre-4.18.11-gnu/drivers/infiniband/ulp/srp/ib_srp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/infiniband/ulp/srp/ib_srp.c	2018-10-03 19:59:28.000000000 -0400
@@ -2954,7 +2954,7 @@ static int srp_reset_device(struct scsi_
 {
 	struct srp_target_port *target = host_to_target(scmnd->device->host);
 	struct srp_rdma_ch *ch;
-	int i;
+	int i, j;
 	u8 status;
 
 	shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
@@ -2968,8 +2968,8 @@ static int srp_reset_device(struct scsi_
 
 	for (i = 0; i < target->ch_count; i++) {
 		ch = &target->ch[i];
-		for (i = 0; i < target->req_ring_size; ++i) {
-			struct srp_request *req = &ch->req_ring[i];
+		for (j = 0; j < target->req_ring_size; ++j) {
+			struct srp_request *req = &ch->req_ring[j];
 
 			srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
 		}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/input/misc/xen-kbdfront.c linux-libre-4.18.12-gnu/drivers/input/misc/xen-kbdfront.c
--- linux-libre-4.18.11-gnu/drivers/input/misc/xen-kbdfront.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/input/misc/xen-kbdfront.c	2018-10-03 19:59:28.000000000 -0400
@@ -229,7 +229,7 @@ static int xenkbd_probe(struct xenbus_de
 		}
 	}
 
-	touch = xenbus_read_unsigned(dev->nodename,
+	touch = xenbus_read_unsigned(dev->otherend,
 				     XENKBD_FIELD_FEAT_MTOUCH, 0);
 	if (touch) {
 		ret = xenbus_write(XBT_NIL, dev->nodename,
@@ -304,13 +304,13 @@ static int xenkbd_probe(struct xenbus_de
 		if (!mtouch)
 			goto error_nomem;
 
-		num_cont = xenbus_read_unsigned(info->xbdev->nodename,
+		num_cont = xenbus_read_unsigned(info->xbdev->otherend,
 						XENKBD_FIELD_MT_NUM_CONTACTS,
 						1);
-		width = xenbus_read_unsigned(info->xbdev->nodename,
+		width = xenbus_read_unsigned(info->xbdev->otherend,
 					     XENKBD_FIELD_MT_WIDTH,
 					     XENFB_WIDTH);
-		height = xenbus_read_unsigned(info->xbdev->nodename,
+		height = xenbus_read_unsigned(info->xbdev->otherend,
 					      XENKBD_FIELD_MT_HEIGHT,
 					      XENFB_HEIGHT);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/input/mouse/elantech.c linux-libre-4.18.12-gnu/drivers/input/mouse/elantech.c
--- linux-libre-4.18.11-gnu/drivers/input/mouse/elantech.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/input/mouse/elantech.c	2018-10-03 19:59:28.000000000 -0400
@@ -1178,6 +1178,8 @@ static const struct dmi_system_id elante
 static const char * const middle_button_pnp_ids[] = {
 	"LEN2131", /* ThinkPad P52 w/ NFC */
 	"LEN2132", /* ThinkPad P52 */
+	"LEN2133", /* ThinkPad P72 w/ NFC */
+	"LEN2134", /* ThinkPad P72 */
 	NULL
 };
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/iommu/amd_iommu.c linux-libre-4.18.12-gnu/drivers/iommu/amd_iommu.c
--- linux-libre-4.18.11-gnu/drivers/iommu/amd_iommu.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/iommu/amd_iommu.c	2018-10-03 19:59:28.000000000 -0400
@@ -2405,9 +2405,9 @@ static void __unmap_single(struct dma_op
 	}
 
 	if (amd_iommu_unmap_flush) {
-		dma_ops_free_iova(dma_dom, dma_addr, pages);
 		domain_flush_tlb(&dma_dom->domain);
 		domain_flush_complete(&dma_dom->domain);
+		dma_ops_free_iova(dma_dom, dma_addr, pages);
 	} else {
 		pages = __roundup_pow_of_two(pages);
 		queue_iova(&dma_dom->iovad, dma_addr >> PAGE_SHIFT, pages, 0);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/iommu/msm_iommu.c linux-libre-4.18.12-gnu/drivers/iommu/msm_iommu.c
--- linux-libre-4.18.11-gnu/drivers/iommu/msm_iommu.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/iommu/msm_iommu.c	2018-10-03 19:59:28.000000000 -0400
@@ -395,20 +395,15 @@ static int msm_iommu_add_device(struct d
 	struct msm_iommu_dev *iommu;
 	struct iommu_group *group;
 	unsigned long flags;
-	int ret = 0;
 
 	spin_lock_irqsave(&msm_iommu_lock, flags);
-
 	iommu = find_iommu_for_dev(dev);
+	spin_unlock_irqrestore(&msm_iommu_lock, flags);
+
 	if (iommu)
 		iommu_device_link(&iommu->iommu, dev);
 	else
-		ret = -ENODEV;
-
-	spin_unlock_irqrestore(&msm_iommu_lock, flags);
-
-	if (ret)
-		return ret;
+		return -ENODEV;
 
 	group = iommu_group_get_for_dev(dev);
 	if (IS_ERR(group))
@@ -425,13 +420,12 @@ static void msm_iommu_remove_device(stru
 	unsigned long flags;
 
 	spin_lock_irqsave(&msm_iommu_lock, flags);
-
 	iommu = find_iommu_for_dev(dev);
+	spin_unlock_irqrestore(&msm_iommu_lock, flags);
+
 	if (iommu)
 		iommu_device_unlink(&iommu->iommu, dev);
 
-	spin_unlock_irqrestore(&msm_iommu_lock, flags);
-
 	iommu_group_remove_device(dev);
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/md/md-cluster.c linux-libre-4.18.12-gnu/drivers/md/md-cluster.c
--- linux-libre-4.18.11-gnu/drivers/md/md-cluster.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/md/md-cluster.c	2018-10-03 19:59:28.000000000 -0400
@@ -304,15 +304,6 @@ static void recover_bitmaps(struct md_th
 	while (cinfo->recovery_map) {
 		slot = fls64((u64)cinfo->recovery_map) - 1;
 
-		/* Clear suspend_area associated with the bitmap */
-		spin_lock_irq(&cinfo->suspend_lock);
-		list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
-			if (slot == s->slot) {
-				list_del(&s->list);
-				kfree(s);
-			}
-		spin_unlock_irq(&cinfo->suspend_lock);
-
 		snprintf(str, 64, "bitmap%04d", slot);
 		bm_lockres = lockres_init(mddev, str, NULL, 1);
 		if (!bm_lockres) {
@@ -331,6 +322,16 @@ static void recover_bitmaps(struct md_th
 			pr_err("md-cluster: Could not copy data from bitmap %d\n", slot);
 			goto clear_bit;
 		}
+
+		/* Clear suspend_area associated with the bitmap */
+		spin_lock_irq(&cinfo->suspend_lock);
+		list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
+			if (slot == s->slot) {
+				list_del(&s->list);
+				kfree(s);
+			}
+		spin_unlock_irq(&cinfo->suspend_lock);
+
 		if (hi > 0) {
 			if (lo < mddev->recovery_cp)
 				mddev->recovery_cp = lo;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/i2c/ov772x.c linux-libre-4.18.12-gnu/drivers/media/i2c/ov772x.c
--- linux-libre-4.18.11-gnu/drivers/media/i2c/ov772x.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/i2c/ov772x.c	2018-10-03 19:59:28.000000000 -0400
@@ -542,9 +542,19 @@ static struct ov772x_priv *to_ov772x(str
 	return container_of(sd, struct ov772x_priv, subdev);
 }
 
-static inline int ov772x_read(struct i2c_client *client, u8 addr)
+static int ov772x_read(struct i2c_client *client, u8 addr)
 {
-	return i2c_smbus_read_byte_data(client, addr);
+	int ret;
+	u8 val;
+
+	ret = i2c_master_send(client, &addr, 1);
+	if (ret < 0)
+		return ret;
+	ret = i2c_master_recv(client, &val, 1);
+	if (ret < 0)
+		return ret;
+
+	return val;
 }
 
 static inline int ov772x_write(struct i2c_client *client, u8 addr, u8 value)
@@ -1136,7 +1146,7 @@ static int ov772x_set_fmt(struct v4l2_su
 static int ov772x_video_probe(struct ov772x_priv *priv)
 {
 	struct i2c_client  *client = v4l2_get_subdevdata(&priv->subdev);
-	u8                  pid, ver;
+	int		    pid, ver, midh, midl;
 	const char         *devname;
 	int		    ret;
 
@@ -1146,7 +1156,11 @@ static int ov772x_video_probe(struct ov7
 
 	/* Check and show product ID and manufacturer ID. */
 	pid = ov772x_read(client, PID);
+	if (pid < 0)
+		return pid;
 	ver = ov772x_read(client, VER);
+	if (ver < 0)
+		return ver;
 
 	switch (VERSION(pid, ver)) {
 	case OV7720:
@@ -1162,13 +1176,17 @@ static int ov772x_video_probe(struct ov7
 		goto done;
 	}
 
+	midh = ov772x_read(client, MIDH);
+	if (midh < 0)
+		return midh;
+	midl = ov772x_read(client, MIDL);
+	if (midl < 0)
+		return midl;
+
 	dev_info(&client->dev,
 		 "%s Product ID %0x:%0x Manufacturer ID %x:%x\n",
-		 devname,
-		 pid,
-		 ver,
-		 ov772x_read(client, MIDH),
-		 ov772x_read(client, MIDL));
+		 devname, pid, ver, midh, midl);
+
 	ret = v4l2_ctrl_handler_setup(&priv->hdl);
 
 done:
@@ -1255,13 +1273,11 @@ static int ov772x_probe(struct i2c_clien
 		return -EINVAL;
 	}
 
-	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
-					      I2C_FUNC_PROTOCOL_MANGLING)) {
+	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		dev_err(&adapter->dev,
-			"I2C-Adapter doesn't support SMBUS_BYTE_DATA or PROTOCOL_MANGLING\n");
+			"I2C-Adapter doesn't support SMBUS_BYTE_DATA\n");
 		return -EIO;
 	}
-	client->flags |= I2C_CLIENT_SCCB;
 
 	priv = devm_kzalloc(&client->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/i2c/soc_camera/ov772x.c linux-libre-4.18.12-gnu/drivers/media/i2c/soc_camera/ov772x.c
--- linux-libre-4.18.11-gnu/drivers/media/i2c/soc_camera/ov772x.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/i2c/soc_camera/ov772x.c	2018-10-03 19:59:28.000000000 -0400
@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov77
 	 * set COM8
 	 */
 	if (priv->band_filter) {
-		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1);
+		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF);
 		if (!ret)
 			ret = ov772x_mask_set(client, BDBASE,
 					      0xff, 256 - priv->band_filter);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c linux-libre-4.18.12-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c
--- linux-libre-4.18.11-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c	2018-10-03 19:59:28.000000000 -0400
@@ -384,12 +384,17 @@ static void __isp_video_try_fmt(struct f
 				struct v4l2_pix_format_mplane *pixm,
 				const struct fimc_fmt **fmt)
 {
-	*fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
+	const struct fimc_fmt *__fmt;
+
+	__fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
+
+	if (fmt)
+		*fmt = __fmt;
 
 	pixm->colorspace = V4L2_COLORSPACE_SRGB;
 	pixm->field = V4L2_FIELD_NONE;
-	pixm->num_planes = (*fmt)->memplanes;
-	pixm->pixelformat = (*fmt)->fourcc;
+	pixm->num_planes = __fmt->memplanes;
+	pixm->pixelformat = __fmt->fourcc;
 	/*
 	 * TODO: double check with the docmentation these width/height
 	 * constraints are correct.
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/platform/fsl-viu.c linux-libre-4.18.12-gnu/drivers/media/platform/fsl-viu.c
--- linux-libre-4.18.11-gnu/drivers/media/platform/fsl-viu.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/platform/fsl-viu.c	2018-10-03 19:59:28.000000000 -0400
@@ -1414,7 +1414,7 @@ static int viu_of_probe(struct platform_
 				     sizeof(struct viu_reg), DRV_NAME)) {
 		dev_err(&op->dev, "Error while requesting mem region\n");
 		ret = -EBUSY;
-		goto err;
+		goto err_irq;
 	}
 
 	/* remap registers */
@@ -1422,7 +1422,7 @@ static int viu_of_probe(struct platform_
 	if (!viu_regs) {
 		dev_err(&op->dev, "Can't map register set\n");
 		ret = -ENOMEM;
-		goto err;
+		goto err_irq;
 	}
 
 	/* Prepare our private structure */
@@ -1430,7 +1430,7 @@ static int viu_of_probe(struct platform_
 	if (!viu_dev) {
 		dev_err(&op->dev, "Can't allocate private structure\n");
 		ret = -ENOMEM;
-		goto err;
+		goto err_irq;
 	}
 
 	viu_dev->vr = viu_regs;
@@ -1446,16 +1446,21 @@ static int viu_of_probe(struct platform_
 	ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev);
 	if (ret < 0) {
 		dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret);
-		goto err;
+		goto err_irq;
 	}
 
 	ad = i2c_get_adapter(0);
+	if (!ad) {
+		ret = -EFAULT;
+		dev_err(&op->dev, "couldn't get i2c adapter\n");
+		goto err_v4l2;
+	}
 
 	v4l2_ctrl_handler_init(&viu_dev->hdl, 5);
 	if (viu_dev->hdl.error) {
 		ret = viu_dev->hdl.error;
 		dev_err(&op->dev, "couldn't register control\n");
-		goto err_vdev;
+		goto err_i2c;
 	}
 	/* This control handler will inherit the control(s) from the
 	   sub-device(s). */
@@ -1471,7 +1476,7 @@ static int viu_of_probe(struct platform_
 	vdev = video_device_alloc();
 	if (vdev == NULL) {
 		ret = -ENOMEM;
-		goto err_vdev;
+		goto err_hdl;
 	}
 
 	*vdev = viu_template;
@@ -1492,7 +1497,7 @@ static int viu_of_probe(struct platform_
 	ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1);
 	if (ret < 0) {
 		video_device_release(viu_dev->vdev);
-		goto err_vdev;
+		goto err_unlock;
 	}
 
 	/* enable VIU clock */
@@ -1500,12 +1505,12 @@ static int viu_of_probe(struct platform_
 	if (IS_ERR(clk)) {
 		dev_err(&op->dev, "failed to lookup the clock!\n");
 		ret = PTR_ERR(clk);
-		goto err_clk;
+		goto err_vdev;
 	}
 	ret = clk_prepare_enable(clk);
 	if (ret) {
 		dev_err(&op->dev, "failed to enable the clock!\n");
-		goto err_clk;
+		goto err_vdev;
 	}
 	viu_dev->clk = clk;
 
@@ -1516,7 +1521,7 @@ static int viu_of_probe(struct platform_
 	if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) {
 		dev_err(&op->dev, "Request VIU IRQ failed.\n");
 		ret = -ENODEV;
-		goto err_irq;
+		goto err_clk;
 	}
 
 	mutex_unlock(&viu_dev->lock);
@@ -1524,16 +1529,19 @@ static int viu_of_probe(struct platform_
 	dev_info(&op->dev, "Freescale VIU Video Capture Board\n");
 	return ret;
 
-err_irq:
-	clk_disable_unprepare(viu_dev->clk);
 err_clk:
-	video_unregister_device(viu_dev->vdev);
+	clk_disable_unprepare(viu_dev->clk);
 err_vdev:
-	v4l2_ctrl_handler_free(&viu_dev->hdl);
+	video_unregister_device(viu_dev->vdev);
+err_unlock:
 	mutex_unlock(&viu_dev->lock);
+err_hdl:
+	v4l2_ctrl_handler_free(&viu_dev->hdl);
+err_i2c:
 	i2c_put_adapter(ad);
+err_v4l2:
 	v4l2_device_unregister(&viu_dev->v4l2_dev);
-err:
+err_irq:
 	irq_dispose_mapping(viu_irq);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/platform/omap3isp/isp.c linux-libre-4.18.12-gnu/drivers/media/platform/omap3isp/isp.c
--- linux-libre-4.18.11-gnu/drivers/media/platform/omap3isp/isp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/platform/omap3isp/isp.c	2018-10-03 19:59:28.000000000 -0400
@@ -300,7 +300,7 @@ static struct clk *isp_xclk_src_get(stru
 static int isp_xclk_init(struct isp_device *isp)
 {
 	struct device_node *np = isp->dev->of_node;
-	struct clk_init_data init;
+	struct clk_init_data init = { 0 };
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/platform/s3c-camif/camif-capture.c linux-libre-4.18.12-gnu/drivers/media/platform/s3c-camif/camif-capture.c
--- linux-libre-4.18.11-gnu/drivers/media/platform/s3c-camif/camif-capture.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/platform/s3c-camif/camif-capture.c	2018-10-03 19:59:28.000000000 -0400
@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif
 
 	if (camif->sensor.power_count == !on)
 		err = v4l2_subdev_call(sensor->sd, core, s_power, on);
+	if (err == -ENOIOCTLCMD)
+		err = 0;
 	if (!err)
 		sensor->power_count += on ? 1 : -1;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/usb/tm6000/tm6000-dvb.c linux-libre-4.18.12-gnu/drivers/media/usb/tm6000/tm6000-dvb.c
--- linux-libre-4.18.11-gnu/drivers/media/usb/tm6000/tm6000-dvb.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/usb/tm6000/tm6000-dvb.c	2018-10-03 19:59:28.000000000 -0400
@@ -266,6 +266,11 @@ static int register_dvb(struct tm6000_co
 
 	ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T",
 					THIS_MODULE, &dev->udev->dev, adapter_nr);
+	if (ret < 0) {
+		pr_err("tm6000: couldn't register the adapter!\n");
+		goto err;
+	}
+
 	dvb->adapter.priv = dev;
 
 	if (dvb->frontend) {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/v4l2-core/v4l2-event.c linux-libre-4.18.12-gnu/drivers/media/v4l2-core/v4l2-event.c
--- linux-libre-4.18.11-gnu/drivers/media/v4l2-core/v4l2-event.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/v4l2-core/v4l2-event.c	2018-10-03 19:59:28.000000000 -0400
@@ -115,14 +115,6 @@ static void __v4l2_event_queue_fh(struct
 	if (sev == NULL)
 		return;
 
-	/*
-	 * If the event has been added to the fh->subscribed list, but its
-	 * add op has not completed yet elems will be 0, treat this as
-	 * not being subscribed.
-	 */
-	if (!sev->elems)
-		return;
-
 	/* Increase event sequence number on fh. */
 	fh->sequence++;
 
@@ -208,6 +200,7 @@ int v4l2_event_subscribe(struct v4l2_fh
 	struct v4l2_subscribed_event *sev, *found_ev;
 	unsigned long flags;
 	unsigned i;
+	int ret = 0;
 
 	if (sub->type == V4L2_EVENT_ALL)
 		return -EINVAL;
@@ -225,31 +218,36 @@ int v4l2_event_subscribe(struct v4l2_fh
 	sev->flags = sub->flags;
 	sev->fh = fh;
 	sev->ops = ops;
+	sev->elems = elems;
+
+	mutex_lock(&fh->subscribe_lock);
 
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
-	if (!found_ev)
-		list_add(&sev->list, &fh->subscribed);
 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
 	if (found_ev) {
+		/* Already listening */
 		kvfree(sev);
-		return 0; /* Already listening */
+		goto out_unlock;
 	}
 
 	if (sev->ops && sev->ops->add) {
-		int ret = sev->ops->add(sev, elems);
+		ret = sev->ops->add(sev, elems);
 		if (ret) {
-			sev->ops = NULL;
-			v4l2_event_unsubscribe(fh, sub);
-			return ret;
+			kvfree(sev);
+			goto out_unlock;
 		}
 	}
 
-	/* Mark as ready for use */
-	sev->elems = elems;
+	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+	list_add(&sev->list, &fh->subscribed);
+	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
-	return 0;
+out_unlock:
+	mutex_unlock(&fh->subscribe_lock);
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
 
@@ -288,6 +286,8 @@ int v4l2_event_unsubscribe(struct v4l2_f
 		return 0;
 	}
 
+	mutex_lock(&fh->subscribe_lock);
+
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
 	sev = v4l2_event_subscribed(fh, sub->type, sub->id);
@@ -305,6 +305,8 @@ int v4l2_event_unsubscribe(struct v4l2_f
 	if (sev && sev->ops && sev->ops->del)
 		sev->ops->del(sev);
 
+	mutex_unlock(&fh->subscribe_lock);
+
 	kvfree(sev);
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/media/v4l2-core/v4l2-fh.c linux-libre-4.18.12-gnu/drivers/media/v4l2-core/v4l2-fh.c
--- linux-libre-4.18.11-gnu/drivers/media/v4l2-core/v4l2-fh.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/media/v4l2-core/v4l2-fh.c	2018-10-03 19:59:28.000000000 -0400
@@ -45,6 +45,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, st
 	INIT_LIST_HEAD(&fh->available);
 	INIT_LIST_HEAD(&fh->subscribed);
 	fh->sequence = -1;
+	mutex_init(&fh->subscribe_lock);
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_init);
 
@@ -90,6 +91,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
 		return;
 	v4l_disable_media_source(fh->vdev);
 	v4l2_event_unsubscribe_all(fh);
+	mutex_destroy(&fh->subscribe_lock);
 	fh->vdev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_exit);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/misc/ibmvmc.c linux-libre-4.18.12-gnu/drivers/misc/ibmvmc.c
--- linux-libre-4.18.11-gnu/drivers/misc/ibmvmc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/misc/ibmvmc.c	2018-10-03 19:59:28.000000000 -0400
@@ -273,7 +273,7 @@ static void *alloc_dma_buffer(struct vio
 			      dma_addr_t *dma_handle)
 {
 	/* allocate memory */
-	void *buffer = kzalloc(size, GFP_KERNEL);
+	void *buffer = kzalloc(size, GFP_ATOMIC);
 
 	if (!buffer) {
 		*dma_handle = 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/misc/sram.c linux-libre-4.18.12-gnu/drivers/misc/sram.c
--- linux-libre-4.18.11-gnu/drivers/misc/sram.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/misc/sram.c	2018-10-03 19:59:28.000000000 -0400
@@ -391,23 +391,23 @@ static int sram_probe(struct platform_de
 	if (IS_ERR(sram->pool))
 		return PTR_ERR(sram->pool);
 
-	ret = sram_reserve_regions(sram, res);
-	if (ret)
-		return ret;
-
 	sram->clk = devm_clk_get(sram->dev, NULL);
 	if (IS_ERR(sram->clk))
 		sram->clk = NULL;
 	else
 		clk_prepare_enable(sram->clk);
 
+	ret = sram_reserve_regions(sram, res);
+	if (ret)
+		goto err_disable_clk;
+
 	platform_set_drvdata(pdev, sram);
 
 	init_func = of_device_get_match_data(&pdev->dev);
 	if (init_func) {
 		ret = init_func();
 		if (ret)
-			goto err_disable_clk;
+			goto err_free_partitions;
 	}
 
 	dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
@@ -415,10 +415,11 @@ static int sram_probe(struct platform_de
 
 	return 0;
 
+err_free_partitions:
+	sram_free_partitions(sram);
 err_disable_clk:
 	if (sram->clk)
 		clk_disable_unprepare(sram->clk);
-	sram_free_partitions(sram);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/misc/tsl2550.c linux-libre-4.18.12-gnu/drivers/misc/tsl2550.c
--- linux-libre-4.18.11-gnu/drivers/misc/tsl2550.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/misc/tsl2550.c	2018-10-03 19:59:28.000000000 -0400
@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0,
 		} else
 			lux = 0;
 	else
-		return -EAGAIN;
+		return 0;
 
 	/* LUX range check */
 	return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/misc/vmw_vmci/vmci_queue_pair.c linux-libre-4.18.12-gnu/drivers/misc/vmw_vmci/vmci_queue_pair.c
--- linux-libre-4.18.11-gnu/drivers/misc/vmw_vmci/vmci_queue_pair.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/misc/vmw_vmci/vmci_queue_pair.c	2018-10-03 19:59:28.000000000 -0400
@@ -668,7 +668,7 @@ static int qp_host_get_user_memory(u64 p
 	retval = get_user_pages_fast((uintptr_t) produce_uva,
 				     produce_q->kernel_if->num_pages, 1,
 				     produce_q->kernel_if->u.h.header_page);
-	if (retval < produce_q->kernel_if->num_pages) {
+	if (retval < (int)produce_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
 			retval);
 		qp_release_pages(produce_q->kernel_if->u.h.header_page,
@@ -680,7 +680,7 @@ static int qp_host_get_user_memory(u64 p
 	retval = get_user_pages_fast((uintptr_t) consume_uva,
 				     consume_q->kernel_if->num_pages, 1,
 				     consume_q->kernel_if->u.h.header_page);
-	if (retval < consume_q->kernel_if->num_pages) {
+	if (retval < (int)consume_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
 			retval);
 		qp_release_pages(consume_q->kernel_if->u.h.header_page,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/mmc/host/android-goldfish.c linux-libre-4.18.12-gnu/drivers/mmc/host/android-goldfish.c
--- linux-libre-4.18.11-gnu/drivers/mmc/host/android-goldfish.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/mmc/host/android-goldfish.c	2018-10-03 19:59:28.000000000 -0400
@@ -217,7 +217,7 @@ static void goldfish_mmc_xfer_done(struc
 			 * We don't really have DMA, so we need
 			 * to copy from our platform driver buffer
 			 */
-			sg_copy_to_buffer(data->sg, 1, host->virt_base,
+			sg_copy_from_buffer(data->sg, 1, host->virt_base,
 					data->sg->length);
 		}
 		host->data->bytes_xfered += data->sg->length;
@@ -393,7 +393,7 @@ static void goldfish_mmc_prepare_data(st
 		 * We don't really have DMA, so we need to copy to our
 		 * platform driver buffer
 		 */
-		sg_copy_from_buffer(data->sg, 1, host->virt_base,
+		sg_copy_to_buffer(data->sg, 1, host->virt_base,
 				data->sg->length);
 	}
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/mmc/host/atmel-mci.c linux-libre-4.18.12-gnu/drivers/mmc/host/atmel-mci.c
--- linux-libre-4.18.11-gnu/drivers/mmc/host/atmel-mci.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/mmc/host/atmel-mci.c	2018-10-03 19:59:28.000000000 -0400
@@ -1976,7 +1976,7 @@ static void atmci_read_data_pio(struct a
 	do {
 		value = atmci_readl(host, ATMCI_RDR);
 		if (likely(offset + 4 <= sg->length)) {
-			sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
+			sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
 
 			offset += 4;
 			nbytes += 4;
@@ -1993,7 +1993,7 @@ static void atmci_read_data_pio(struct a
 		} else {
 			unsigned int remaining = sg->length - offset;
 
-			sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
+			sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
 			nbytes += remaining;
 
 			flush_dcache_page(sg_page(sg));
@@ -2003,7 +2003,7 @@ static void atmci_read_data_pio(struct a
 				goto done;
 
 			offset = 4 - remaining;
-			sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
+			sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
 					offset, 0);
 			nbytes += offset;
 		}
@@ -2042,7 +2042,7 @@ static void atmci_write_data_pio(struct
 
 	do {
 		if (likely(offset + 4 <= sg->length)) {
-			sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
+			sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
 			atmci_writel(host, ATMCI_TDR, value);
 
 			offset += 4;
@@ -2059,7 +2059,7 @@ static void atmci_write_data_pio(struct
 			unsigned int remaining = sg->length - offset;
 
 			value = 0;
-			sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
+			sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
 			nbytes += remaining;
 
 			host->sg = sg = sg_next(sg);
@@ -2070,7 +2070,7 @@ static void atmci_write_data_pio(struct
 			}
 
 			offset = 4 - remaining;
-			sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
+			sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
 					offset, 0);
 			atmci_writel(host, ATMCI_TDR, value);
 			nbytes += offset;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/mtd/nand/raw/atmel/nand-controller.c linux-libre-4.18.12-gnu/drivers/mtd/nand/raw/atmel/nand-controller.c
--- linux-libre-4.18.11-gnu/drivers/mtd/nand/raw/atmel/nand-controller.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/mtd/nand/raw/atmel/nand-controller.c	2018-10-03 19:59:28.000000000 -0400
@@ -129,6 +129,11 @@
 #define DEFAULT_TIMEOUT_MS			1000
 #define MIN_DMA_LEN				128
 
+static bool atmel_nand_avoid_dma __read_mostly;
+
+MODULE_PARM_DESC(avoiddma, "Avoid using DMA");
+module_param_named(avoiddma, atmel_nand_avoid_dma, bool, 0400);
+
 enum atmel_nand_rb_type {
 	ATMEL_NAND_NO_RB,
 	ATMEL_NAND_NATIVE_RB,
@@ -1977,7 +1982,7 @@ static int atmel_nand_controller_init(st
 		return ret;
 	}
 
-	if (nc->caps->has_dma) {
+	if (nc->caps->has_dma && !atmel_nand_avoid_dma) {
 		dma_cap_mask_t mask;
 
 		dma_cap_zero(mask);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c linux-libre-4.18.12-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c	2018-09-29 08:40:36.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c	2018-10-03 21:19:50.000000000 -0400
@@ -5703,7 +5703,7 @@ static int init_one(struct pci_dev *pdev
 		if (t4_read_reg(adapter, LE_DB_CONFIG_A) & HASHEN_F) {
 			u32 hash_base, hash_reg;
 
-			if (chip <= CHELSIO_T5) {
+			if (chip_ver <= CHELSIO_T5) {
 				hash_reg = LE_DB_TID_HASHBASE_A;
 				hash_base = t4_read_reg(adapter, hash_reg);
 				adapter->tids.hash_base = hash_base / 4;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns/hnae.h linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns/hnae.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns/hnae.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns/hnae.h	2018-10-03 19:59:28.000000000 -0400
@@ -220,10 +220,10 @@ struct hnae_desc_cb {
 
 	/* priv data for the desc, e.g. skb when use with ip stack*/
 	void *priv;
-	u16 page_offset;
-	u16 reuse_flag;
+	u32 page_offset;
+	u32 length;     /* length of the buffer */
 
-	u16 length;     /* length of the buffer */
+	u16 reuse_flag;
 
        /* desc type, used by the ring user to mark the type of the priv data */
 	u16 type;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns/hns_enet.c linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns/hns_enet.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns/hns_enet.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns/hns_enet.c	2018-10-03 19:59:28.000000000 -0400
@@ -530,7 +530,7 @@ static void hns_nic_reuse_page(struct sk
 	}
 
 	skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
-			size - pull_len, truesize - pull_len);
+			size - pull_len, truesize);
 
 	 /* avoid re-using remote pages,flag default unreuse */
 	if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h	2018-10-03 19:59:28.000000000 -0400
@@ -290,11 +290,11 @@ struct hns3_desc_cb {
 
 	/* priv data for the desc, e.g. skb when use with ip stack*/
 	void *priv;
-	u16 page_offset;
-	u16 reuse_flag;
-
+	u32 page_offset;
 	u32 length;     /* length of the buffer */
 
+	u16 reuse_flag;
+
        /* desc type, used by the ring user to mark the type of the priv data */
 	u16 type;
 };
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c	2018-10-03 19:59:28.000000000 -0400
@@ -201,7 +201,9 @@ static u32 hns3_lb_check_rx_ring(struct
 		rx_group = &ring->tqp_vector->rx_group;
 		pre_rx_pkt = rx_group->total_packets;
 
+		preempt_disable();
 		hns3_clean_rx_ring(ring, budget, hns3_lb_check_skb_data);
+		preempt_enable();
 
 		rcv_good_pkt_total += (rx_group->total_packets - pre_rx_pkt);
 		rx_group->total_packets = pre_rx_pkt;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c	2018-10-03 19:59:28.000000000 -0400
@@ -1223,6 +1223,10 @@ static int hclge_mac_pause_setup_hw(stru
 		tx_en = true;
 		rx_en = true;
 		break;
+	case HCLGE_FC_PFC:
+		tx_en = false;
+		rx_en = false;
+		break;
 	default:
 		tx_en = true;
 		rx_en = true;
@@ -1240,8 +1244,9 @@ int hclge_pause_setup_hw(struct hclge_de
 	if (ret)
 		return ret;
 
-	if (hdev->tm_info.fc_mode != HCLGE_FC_PFC)
-		return hclge_mac_pause_setup_hw(hdev);
+	ret = hclge_mac_pause_setup_hw(hdev);
+	if (ret)
+		return ret;
 
 	/* Only DCB-supported dev supports qset back pressure and pfc cmd */
 	if (!hnae3_dev_dcb_supported(hdev))
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -648,8 +648,17 @@ static int hclgevf_unmap_ring_from_vecto
 static int hclgevf_put_vector(struct hnae3_handle *handle, int vector)
 {
 	struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+	int vector_id;
 
-	hclgevf_free_vector(hdev, vector);
+	vector_id = hclgevf_get_vector_index(hdev, vector);
+	if (vector_id < 0) {
+		dev_err(&handle->pdev->dev,
+			"hclgevf_put_vector get vector index fail. ret =%d\n",
+			vector_id);
+		return vector_id;
+	}
+
+	hclgevf_free_vector(hdev, vector_id);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c	2018-10-03 19:59:28.000000000 -0400
@@ -208,7 +208,8 @@ void hclgevf_mbx_handler(struct hclgevf_
 
 			/* tail the async message in arq */
 			msg_q = hdev->arq.msg_q[hdev->arq.tail];
-			memcpy(&msg_q[0], req->msg, HCLGE_MBX_MAX_ARQ_MSG_SIZE);
+			memcpy(&msg_q[0], req->msg,
+			       HCLGE_MBX_MAX_ARQ_MSG_SIZE * sizeof(u16));
 			hclge_mbx_tail_ptr_move_arq(hdev->arq);
 			hdev->arq.count++;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c	2018-10-03 19:59:28.000000000 -0400
@@ -624,14 +624,14 @@ static int e1000_set_ringparam(struct ne
 		adapter->tx_ring = tx_old;
 		e1000_free_all_rx_resources(adapter);
 		e1000_free_all_tx_resources(adapter);
-		kfree(tx_old);
-		kfree(rx_old);
 		adapter->rx_ring = rxdr;
 		adapter->tx_ring = txdr;
 		err = e1000_up(adapter);
 		if (err)
 			goto err_setup;
 	}
+	kfree(tx_old);
+	kfree(rx_old);
 
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return 0;
@@ -644,7 +644,8 @@ err_setup_rx:
 err_alloc_rx:
 	kfree(txdr);
 err_alloc_tx:
-	e1000_up(adapter);
+	if (netif_running(adapter->netdev))
+		e1000_up(adapter);
 err_setup:
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return err;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/i40e/i40e_ethtool.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/i40e/i40e_ethtool.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/i40e/i40e_ethtool.c	2018-10-03 19:59:28.000000000 -0400
@@ -1903,7 +1903,7 @@ static void i40e_get_stat_strings(struct
 		data += ETH_GSTRING_LEN;
 	}
 
-	WARN_ONCE(p - data != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
+	WARN_ONCE(data - p != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
 		  "stat strings count mismatch!");
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -5121,15 +5121,17 @@ static int i40e_vsi_configure_bw_alloc(s
 				       u8 *bw_share)
 {
 	struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
+	struct i40e_pf *pf = vsi->back;
 	i40e_status ret;
 	int i;
 
-	if (vsi->back->flags & I40E_FLAG_TC_MQPRIO)
+	/* There is no need to reset BW when mqprio mode is on.  */
+	if (pf->flags & I40E_FLAG_TC_MQPRIO)
 		return 0;
-	if (!vsi->mqprio_qopt.qopt.hw) {
+	if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) {
 		ret = i40e_set_bw_limit(vsi, vsi->seid, 0);
 		if (ret)
-			dev_info(&vsi->back->pdev->dev,
+			dev_info(&pf->pdev->dev,
 				 "Failed to reset tx rate for vsi->seid %u\n",
 				 vsi->seid);
 		return ret;
@@ -5138,12 +5140,11 @@ static int i40e_vsi_configure_bw_alloc(s
 	for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
 		bw_data.tc_bw_credits[i] = bw_share[i];
 
-	ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
-				       NULL);
+	ret = i40e_aq_config_vsi_tc_bw(&pf->hw, vsi->seid, &bw_data, NULL);
 	if (ret) {
-		dev_info(&vsi->back->pdev->dev,
+		dev_info(&pf->pdev->dev,
 			 "AQ command Config VSI BW allocation per TC failed = %d\n",
-			 vsi->back->hw.aq.asq_last_status);
+			 pf->hw.aq.asq_last_status);
 		return -EINVAL;
 	}
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h	2018-10-03 19:59:28.000000000 -0400
@@ -329,19 +329,19 @@ struct ice_aqc_vsi_props {
 	/* VLAN section */
 	__le16 pvid; /* VLANS include priority bits */
 	u8 pvlan_reserved[2];
-	u8 port_vlan_flags;
-#define ICE_AQ_VSI_PVLAN_MODE_S	0
-#define ICE_AQ_VSI_PVLAN_MODE_M	(0x3 << ICE_AQ_VSI_PVLAN_MODE_S)
-#define ICE_AQ_VSI_PVLAN_MODE_UNTAGGED	0x1
-#define ICE_AQ_VSI_PVLAN_MODE_TAGGED	0x2
-#define ICE_AQ_VSI_PVLAN_MODE_ALL	0x3
+	u8 vlan_flags;
+#define ICE_AQ_VSI_VLAN_MODE_S	0
+#define ICE_AQ_VSI_VLAN_MODE_M	(0x3 << ICE_AQ_VSI_VLAN_MODE_S)
+#define ICE_AQ_VSI_VLAN_MODE_UNTAGGED	0x1
+#define ICE_AQ_VSI_VLAN_MODE_TAGGED	0x2
+#define ICE_AQ_VSI_VLAN_MODE_ALL	0x3
 #define ICE_AQ_VSI_PVLAN_INSERT_PVID	BIT(2)
-#define ICE_AQ_VSI_PVLAN_EMOD_S	3
-#define ICE_AQ_VSI_PVLAN_EMOD_M	(0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH	(0x0 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_UP	(0x1 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR	(0x2 << ICE_AQ_VSI_PVLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_NOTHING	(0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_S		3
+#define ICE_AQ_VSI_VLAN_EMOD_M		(0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_BOTH	(0x0 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_UP	(0x1 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR	(0x2 << ICE_AQ_VSI_VLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_NOTHING	(0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
 	u8 pvlan_reserved2[3];
 	/* ingress egress up sections */
 	__le32 ingress_table; /* bitmap, 3 bits per up */
@@ -594,6 +594,7 @@ struct ice_sw_rule_lg_act {
 #define ICE_LG_ACT_GENERIC_OFFSET_M	(0x7 << ICE_LG_ACT_GENERIC_OFFSET_S)
 #define ICE_LG_ACT_GENERIC_PRIORITY_S	22
 #define ICE_LG_ACT_GENERIC_PRIORITY_M	(0x7 << ICE_LG_ACT_GENERIC_PRIORITY_S)
+#define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX	7
 
 	/* Action = 7 - Set Stat count */
 #define ICE_LG_ACT_STAT_COUNT		0x7
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_common.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_common.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_common.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_common.c	2018-10-03 19:59:28.000000000 -0400
@@ -1483,7 +1483,7 @@ enum ice_status ice_get_link_status(stru
 	struct ice_phy_info *phy_info;
 	enum ice_status status = 0;
 
-	if (!pi)
+	if (!pi || !link_up)
 		return ICE_ERR_PARAM;
 
 	phy_info = &pi->phy;
@@ -1619,20 +1619,23 @@ __ice_aq_get_set_rss_lut(struct ice_hw *
 	}
 
 	/* LUT size is only valid for Global and PF table types */
-	if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128) {
-		flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG <<
-			  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
-			 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-	} else if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512) {
+	switch (lut_size) {
+	case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128:
+		break;
+	case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512:
 		flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512_FLAG <<
 			  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
 			 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-	} else if ((lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K) &&
-		   (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF)) {
-		flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
-			  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
-			 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-	} else {
+		break;
+	case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K:
+		if (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF) {
+			flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
+				  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+				 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+			break;
+		}
+		/* fall-through */
+	default:
 		status = ICE_ERR_PARAM;
 		goto ice_aq_get_set_rss_lut_exit;
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_controlq.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_controlq.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_controlq.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_controlq.c	2018-10-03 19:59:28.000000000 -0400
@@ -597,10 +597,14 @@ static enum ice_status ice_init_check_ad
 	return 0;
 
 init_ctrlq_free_rq:
-	ice_shutdown_rq(hw, cq);
-	ice_shutdown_sq(hw, cq);
-	mutex_destroy(&cq->sq_lock);
-	mutex_destroy(&cq->rq_lock);
+	if (cq->rq.head) {
+		ice_shutdown_rq(hw, cq);
+		mutex_destroy(&cq->rq_lock);
+	}
+	if (cq->sq.head) {
+		ice_shutdown_sq(hw, cq);
+		mutex_destroy(&cq->sq_lock);
+	}
 	return status;
 }
 
@@ -706,10 +710,14 @@ static void ice_shutdown_ctrlq(struct ic
 		return;
 	}
 
-	ice_shutdown_sq(hw, cq);
-	ice_shutdown_rq(hw, cq);
-	mutex_destroy(&cq->sq_lock);
-	mutex_destroy(&cq->rq_lock);
+	if (cq->sq.head) {
+		ice_shutdown_sq(hw, cq);
+		mutex_destroy(&cq->sq_lock);
+	}
+	if (cq->rq.head) {
+		ice_shutdown_rq(hw, cq);
+		mutex_destroy(&cq->rq_lock);
+	}
 }
 
 /**
@@ -1057,8 +1065,11 @@ ice_clean_rq_elem(struct ice_hw *hw, str
 
 clean_rq_elem_out:
 	/* Set pending if needed, unlock and return */
-	if (pending)
+	if (pending) {
+		/* re-read HW head to calculate actual pending messages */
+		ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
 		*pending = (u16)((ntc > ntu ? cq->rq.count : 0) + (ntu - ntc));
+	}
 clean_rq_elem_err:
 	mutex_unlock(&cq->rq_lock);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_ethtool.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_ethtool.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_ethtool.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_ethtool.c	2018-10-03 19:59:28.000000000 -0400
@@ -26,7 +26,7 @@ static int ice_q_stats_len(struct net_de
 {
 	struct ice_netdev_priv *np = netdev_priv(netdev);
 
-	return ((np->vsi->num_txq + np->vsi->num_rxq) *
+	return ((np->vsi->alloc_txq + np->vsi->alloc_rxq) *
 		(sizeof(struct ice_q_stats) / sizeof(u64)));
 }
 
@@ -218,7 +218,7 @@ static void ice_get_strings(struct net_d
 			p += ETH_GSTRING_LEN;
 		}
 
-		ice_for_each_txq(vsi, i) {
+		ice_for_each_alloc_txq(vsi, i) {
 			snprintf(p, ETH_GSTRING_LEN,
 				 "tx-queue-%u.tx_packets", i);
 			p += ETH_GSTRING_LEN;
@@ -226,7 +226,7 @@ static void ice_get_strings(struct net_d
 			p += ETH_GSTRING_LEN;
 		}
 
-		ice_for_each_rxq(vsi, i) {
+		ice_for_each_alloc_rxq(vsi, i) {
 			snprintf(p, ETH_GSTRING_LEN,
 				 "rx-queue-%u.rx_packets", i);
 			p += ETH_GSTRING_LEN;
@@ -253,6 +253,24 @@ static int ice_get_sset_count(struct net
 {
 	switch (sset) {
 	case ETH_SS_STATS:
+		/* The number (and order) of strings reported *must* remain
+		 * constant for a given netdevice. This function must not
+		 * report a different number based on run time parameters
+		 * (such as the number of queues in use, or the setting of
+		 * a private ethtool flag). This is due to the nature of the
+		 * ethtool stats API.
+		 *
+		 * User space programs such as ethtool must make 3 separate
+		 * ioctl requests, one for size, one for the strings, and
+		 * finally one for the stats. Since these cross into
+		 * user space, changes to the number or size could result in
+		 * undefined memory access or incorrect string<->value
+		 * correlations for statistics.
+		 *
+		 * Even if it appears to be safe, changes to the size or
+		 * order of strings will suffer from race conditions and are
+		 * not safe.
+		 */
 		return ICE_ALL_STATS_LEN(netdev);
 	default:
 		return -EOPNOTSUPP;
@@ -280,18 +298,26 @@ ice_get_ethtool_stats(struct net_device
 	/* populate per queue stats */
 	rcu_read_lock();
 
-	ice_for_each_txq(vsi, j) {
+	ice_for_each_alloc_txq(vsi, j) {
 		ring = READ_ONCE(vsi->tx_rings[j]);
-		if (!ring)
-			continue;
-		data[i++] = ring->stats.pkts;
-		data[i++] = ring->stats.bytes;
+		if (ring) {
+			data[i++] = ring->stats.pkts;
+			data[i++] = ring->stats.bytes;
+		} else {
+			data[i++] = 0;
+			data[i++] = 0;
+		}
 	}
 
-	ice_for_each_rxq(vsi, j) {
+	ice_for_each_alloc_rxq(vsi, j) {
 		ring = READ_ONCE(vsi->rx_rings[j]);
-		data[i++] = ring->stats.pkts;
-		data[i++] = ring->stats.bytes;
+		if (ring) {
+			data[i++] = ring->stats.pkts;
+			data[i++] = ring->stats.bytes;
+		} else {
+			data[i++] = 0;
+			data[i++] = 0;
+		}
 	}
 
 	rcu_read_unlock();
@@ -519,7 +545,7 @@ ice_set_ringparam(struct net_device *net
 		goto done;
 	}
 
-	for (i = 0; i < vsi->num_txq; i++) {
+	for (i = 0; i < vsi->alloc_txq; i++) {
 		/* clone ring and setup updated count */
 		tx_rings[i] = *vsi->tx_rings[i];
 		tx_rings[i].count = new_tx_cnt;
@@ -551,7 +577,7 @@ process_rx:
 		goto done;
 	}
 
-	for (i = 0; i < vsi->num_rxq; i++) {
+	for (i = 0; i < vsi->alloc_rxq; i++) {
 		/* clone ring and setup updated count */
 		rx_rings[i] = *vsi->rx_rings[i];
 		rx_rings[i].count = new_rx_cnt;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice.h linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice.h	2018-10-03 19:59:28.000000000 -0400
@@ -89,6 +89,13 @@ extern const char ice_drv_ver[];
 #define ice_for_each_rxq(vsi, i) \
 	for ((i) = 0; (i) < (vsi)->num_rxq; (i)++)
 
+/* Macros for each allocated tx/rx ring whether used or not in a VSI */
+#define ice_for_each_alloc_txq(vsi, i) \
+	for ((i) = 0; (i) < (vsi)->alloc_txq; (i)++)
+
+#define ice_for_each_alloc_rxq(vsi, i) \
+	for ((i) = 0; (i) < (vsi)->alloc_rxq; (i)++)
+
 struct ice_tc_info {
 	u16 qoffset;
 	u16 qcount;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_main.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_main.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -917,13 +917,27 @@ static int __ice_clean_ctrlq(struct ice_
 }
 
 /**
+ * ice_ctrlq_pending - check if there is a difference between ntc and ntu
+ * @hw: pointer to hardware info
+ * @cq: control queue information
+ *
+ * returns true if there are pending messages in a queue, false if there aren't
+ */
+static bool ice_ctrlq_pending(struct ice_hw *hw, struct ice_ctl_q_info *cq)
+{
+	u16 ntu;
+
+	ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
+	return cq->rq.next_to_clean != ntu;
+}
+
+/**
  * ice_clean_adminq_subtask - clean the AdminQ rings
  * @pf: board private structure
  */
 static void ice_clean_adminq_subtask(struct ice_pf *pf)
 {
 	struct ice_hw *hw = &pf->hw;
-	u32 val;
 
 	if (!test_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state))
 		return;
@@ -933,9 +947,13 @@ static void ice_clean_adminq_subtask(str
 
 	clear_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state);
 
-	/* re-enable Admin queue interrupt causes */
-	val = rd32(hw, PFINT_FW_CTL);
-	wr32(hw, PFINT_FW_CTL, (val | PFINT_FW_CTL_CAUSE_ENA_M));
+	/* There might be a situation where new messages arrive to a control
+	 * queue between processing the last message and clearing the
+	 * EVENT_PENDING bit. So before exiting, check queue head again (using
+	 * ice_ctrlq_pending) and process new messages if any.
+	 */
+	if (ice_ctrlq_pending(hw, &hw->adminq))
+		__ice_clean_ctrlq(pf, ICE_CTL_Q_ADMIN);
 
 	ice_flush(hw);
 }
@@ -1295,11 +1313,8 @@ static void ice_vsi_setup_q_map(struct i
 		qcount = numq_tc;
 	}
 
-	/* find higher power-of-2 of qcount */
-	pow = ilog2(qcount);
-
-	if (!is_power_of_2(qcount))
-		pow++;
+	/* find the (rounded up) power-of-2 of qcount */
+	pow = order_base_2(qcount);
 
 	for (i = 0; i < ICE_MAX_TRAFFIC_CLASS; i++) {
 		if (!(vsi->tc_cfg.ena_tc & BIT(i))) {
@@ -1352,14 +1367,15 @@ static void ice_set_dflt_vsi_ctx(struct
 	ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE;
 	/* Traffic from VSI can be sent to LAN */
 	ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA;
-	/* Allow all packets untagged/tagged */
-	ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL &
-				       ICE_AQ_VSI_PVLAN_MODE_M) >>
-				      ICE_AQ_VSI_PVLAN_MODE_S);
-	/* Show VLAN/UP from packets in Rx descriptors */
-	ctxt->info.port_vlan_flags |= ((ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH &
-					ICE_AQ_VSI_PVLAN_EMOD_M) >>
-				       ICE_AQ_VSI_PVLAN_EMOD_S);
+
+	/* By default bits 3 and 4 in vlan_flags are 0's which results in legacy
+	 * behavior (show VLAN, DEI, and UP) in descriptor. Also, allow all
+	 * packets untagged/tagged.
+	 */
+	ctxt->info.vlan_flags = ((ICE_AQ_VSI_VLAN_MODE_ALL &
+				  ICE_AQ_VSI_VLAN_MODE_M) >>
+				 ICE_AQ_VSI_VLAN_MODE_S);
+
 	/* Have 1:1 UP mapping for both ingress/egress tables */
 	table |= ICE_UP_TABLE_TRANSLATE(0, 0);
 	table |= ICE_UP_TABLE_TRANSLATE(1, 1);
@@ -2058,15 +2074,13 @@ static int ice_req_irq_msix_misc(struct
 skip_req_irq:
 	ice_ena_misc_vector(pf);
 
-	val = (pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
-	      (ICE_RX_ITR & PFINT_OICR_CTL_ITR_INDX_M) |
-	      PFINT_OICR_CTL_CAUSE_ENA_M;
+	val = ((pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
+	       PFINT_OICR_CTL_CAUSE_ENA_M);
 	wr32(hw, PFINT_OICR_CTL, val);
 
 	/* This enables Admin queue Interrupt causes */
-	val = (pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
-	      (ICE_RX_ITR & PFINT_FW_CTL_ITR_INDX_M) |
-	      PFINT_FW_CTL_CAUSE_ENA_M;
+	val = ((pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
+	       PFINT_FW_CTL_CAUSE_ENA_M);
 	wr32(hw, PFINT_FW_CTL, val);
 
 	itr_gran = hw->itr_gran_200;
@@ -3246,8 +3260,10 @@ static void ice_clear_interrupt_scheme(s
 	if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
 		ice_dis_msix(pf);
 
-	devm_kfree(&pf->pdev->dev, pf->irq_tracker);
-	pf->irq_tracker = NULL;
+	if (pf->irq_tracker) {
+		devm_kfree(&pf->pdev->dev, pf->irq_tracker);
+		pf->irq_tracker = NULL;
+	}
 }
 
 /**
@@ -3720,10 +3736,10 @@ static int ice_vsi_manage_vlan_insertion
 	enum ice_status status;
 
 	/* Here we are configuring the VSI to let the driver add VLAN tags by
-	 * setting port_vlan_flags to ICE_AQ_VSI_PVLAN_MODE_ALL. The actual VLAN
-	 * tag insertion happens in the Tx hot path, in ice_tx_map.
+	 * setting vlan_flags to ICE_AQ_VSI_VLAN_MODE_ALL. The actual VLAN tag
+	 * insertion happens in the Tx hot path, in ice_tx_map.
 	 */
-	ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_MODE_ALL;
+	ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_ALL;
 
 	ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
 	ctxt.vsi_num = vsi->vsi_num;
@@ -3735,7 +3751,7 @@ static int ice_vsi_manage_vlan_insertion
 		return -EIO;
 	}
 
-	vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+	vsi->info.vlan_flags = ctxt.info.vlan_flags;
 	return 0;
 }
 
@@ -3757,12 +3773,15 @@ static int ice_vsi_manage_vlan_stripping
 	 */
 	if (ena) {
 		/* Strip VLAN tag from Rx packet and put it in the desc */
-		ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH;
+		ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_STR_BOTH;
 	} else {
 		/* Disable stripping. Leave tag in packet */
-		ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_NOTHING;
+		ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_NOTHING;
 	}
 
+	/* Allow all packets untagged/tagged */
+	ctxt.info.vlan_flags |= ICE_AQ_VSI_VLAN_MODE_ALL;
+
 	ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
 	ctxt.vsi_num = vsi->vsi_num;
 
@@ -3773,7 +3792,7 @@ static int ice_vsi_manage_vlan_stripping
 		return -EIO;
 	}
 
-	vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+	vsi->info.vlan_flags = ctxt.info.vlan_flags;
 	return 0;
 }
 
@@ -4098,11 +4117,12 @@ static int ice_vsi_cfg(struct ice_vsi *v
 {
 	int err;
 
-	ice_set_rx_mode(vsi->netdev);
-
-	err = ice_restore_vlan(vsi);
-	if (err)
-		return err;
+	if (vsi->netdev) {
+		ice_set_rx_mode(vsi->netdev);
+		err = ice_restore_vlan(vsi);
+		if (err)
+			return err;
+	}
 
 	err = ice_vsi_cfg_txqs(vsi);
 	if (!err)
@@ -4868,7 +4888,7 @@ int ice_down(struct ice_vsi *vsi)
  */
 static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
 {
-	int i, err;
+	int i, err = 0;
 
 	if (!vsi->num_txq) {
 		dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Tx queues\n",
@@ -4893,7 +4913,7 @@ static int ice_vsi_setup_tx_rings(struct
  */
 static int ice_vsi_setup_rx_rings(struct ice_vsi *vsi)
 {
-	int i, err;
+	int i, err = 0;
 
 	if (!vsi->num_rxq) {
 		dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Rx queues\n",
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_switch.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_switch.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ice/ice_switch.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ice/ice_switch.c	2018-10-03 19:59:28.000000000 -0400
@@ -645,14 +645,14 @@ ice_add_marker_act(struct ice_hw *hw, st
 	act |= (1 << ICE_LG_ACT_GENERIC_VALUE_S) & ICE_LG_ACT_GENERIC_VALUE_M;
 	lg_act->pdata.lg_act.act[1] = cpu_to_le32(act);
 
-	act = (7 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
+	act = (ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX <<
+	       ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_OFFSET_M;
 
 	/* Third action Marker value */
 	act |= ICE_LG_ACT_GENERIC;
 	act |= (sw_marker << ICE_LG_ACT_GENERIC_VALUE_S) &
 		ICE_LG_ACT_GENERIC_VALUE_M;
 
-	act |= (0 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
 	lg_act->pdata.lg_act.act[2] = cpu_to_le32(act);
 
 	/* call the fill switch rule to fill the lookup tx rx structure */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c	2018-10-03 19:59:28.000000000 -0400
@@ -688,8 +688,13 @@ static int ixgbe_set_vf_macvlan(struct i
 static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 {
 	struct ixgbe_hw *hw = &adapter->hw;
+	struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ];
 	struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
+	u32 q_per_pool = __ALIGN_MASK(1, ~vmdq->mask);
 	u8 num_tcs = adapter->hw_tcs;
+	u32 reg_val;
+	u32 queue;
+	u32 word;
 
 	/* remove VLAN filters beloning to this VF */
 	ixgbe_clear_vf_vlans(adapter, vf);
@@ -726,6 +731,27 @@ static inline void ixgbe_vf_reset_event(
 
 	/* reset VF api back to unknown */
 	adapter->vfinfo[vf].vf_api = ixgbe_mbox_api_10;
+
+	/* Restart each queue for given VF */
+	for (queue = 0; queue < q_per_pool; queue++) {
+		unsigned int reg_idx = (vf * q_per_pool) + queue;
+
+		reg_val = IXGBE_READ_REG(hw, IXGBE_PVFTXDCTL(reg_idx));
+
+		/* Re-enabling only configured queues */
+		if (reg_val) {
+			reg_val |= IXGBE_TXDCTL_ENABLE;
+			IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+			reg_val &= ~IXGBE_TXDCTL_ENABLE;
+			IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+		}
+	}
+
+	/* Clear VF's mailbox memory */
+	for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
+		IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
+
+	IXGBE_WRITE_FLUSH(hw);
 }
 
 static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h	2018-10-03 19:59:28.000000000 -0400
@@ -2518,6 +2518,7 @@ enum {
 /* Translated register #defines */
 #define IXGBE_PVFTDH(P)		(0x06010 + (0x40 * (P)))
 #define IXGBE_PVFTDT(P)		(0x06018 + (0x40 * (P)))
+#define IXGBE_PVFTXDCTL(P)	(0x06028 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAL(P)	(0x06038 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAH(P)	(0x0603C + (0x40 * (P)))
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.c linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.c
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.c	2018-10-03 19:59:28.000000000 -0400
@@ -48,7 +48,7 @@
 #include "qed_reg_addr.h"
 #include "qed_sriov.h"
 
-#define CHIP_MCP_RESP_ITER_US 10
+#define QED_MCP_RESP_ITER_US	10
 
 #define QED_DRV_MB_MAX_RETRIES	(500 * 1000)	/* Account for 5 sec */
 #define QED_MCP_RESET_RETRIES	(50 * 1000)	/* Account for 500 msec */
@@ -183,18 +183,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn
 	return 0;
 }
 
+/* Maximum of 1 sec to wait for the SHMEM ready indication */
+#define QED_MCP_SHMEM_RDY_MAX_RETRIES	20
+#define QED_MCP_SHMEM_RDY_ITER_MS	50
+
 static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
 	struct qed_mcp_info *p_info = p_hwfn->mcp_info;
+	u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
+	u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
 	u32 drv_mb_offsize, mfw_mb_offsize;
 	u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
 
 	p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
-	if (!p_info->public_base)
-		return 0;
+	if (!p_info->public_base) {
+		DP_NOTICE(p_hwfn,
+			  "The address of the MCP scratch-pad is not configured\n");
+		return -EINVAL;
+	}
 
 	p_info->public_base |= GRCBASE_MCP;
 
+	/* Get the MFW MB address and number of supported messages */
+	mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
+				SECTION_OFFSIZE_ADDR(p_info->public_base,
+						     PUBLIC_MFW_MB));
+	p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
+	p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
+					    p_info->mfw_mb_addr +
+					    offsetof(struct public_mfw_mb,
+						     sup_msgs));
+
+	/* The driver can notify that there was an MCP reset, and might read the
+	 * SHMEM values before the MFW has completed initializing them.
+	 * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
+	 * data ready indication.
+	 */
+	while (!p_info->mfw_mb_length && --cnt) {
+		msleep(msec);
+		p_info->mfw_mb_length =
+			(u16)qed_rd(p_hwfn, p_ptt,
+				    p_info->mfw_mb_addr +
+				    offsetof(struct public_mfw_mb, sup_msgs));
+	}
+
+	if (!cnt) {
+		DP_NOTICE(p_hwfn,
+			  "Failed to get the SHMEM ready notification after %d msec\n",
+			  QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
+		return -EBUSY;
+	}
+
 	/* Calculate the driver and MFW mailbox address */
 	drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
 				SECTION_OFFSIZE_ADDR(p_info->public_base,
@@ -204,13 +243,6 @@ static int qed_load_mcp_offsets(struct q
 		   "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
 		   drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
 
-	/* Set the MFW MB address */
-	mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
-				SECTION_OFFSIZE_ADDR(p_info->public_base,
-						     PUBLIC_MFW_MB));
-	p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
-	p_info->mfw_mb_length =	(u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
-
 	/* Get the current driver mailbox sequence before sending
 	 * the first command
 	 */
@@ -285,9 +317,15 @@ static void qed_mcp_reread_offsets(struc
 
 int qed_mcp_reset(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-	u32 org_mcp_reset_seq, seq, delay = CHIP_MCP_RESP_ITER_US, cnt = 0;
+	u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0;
 	int rc = 0;
 
+	if (p_hwfn->mcp_info->b_block_cmd) {
+		DP_NOTICE(p_hwfn,
+			  "The MFW is not responsive. Avoid sending MCP_RESET mailbox command.\n");
+		return -EBUSY;
+	}
+
 	/* Ensure that only a single thread is accessing the mailbox */
 	spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
 
@@ -413,14 +451,41 @@ static void __qed_mcp_cmd_and_union(stru
 		   (p_mb_params->cmd | seq_num), p_mb_params->param);
 }
 
+static void qed_mcp_cmd_set_blocking(struct qed_hwfn *p_hwfn, bool block_cmd)
+{
+	p_hwfn->mcp_info->b_block_cmd = block_cmd;
+
+	DP_INFO(p_hwfn, "%s sending of mailbox commands to the MFW\n",
+		block_cmd ? "Block" : "Unblock");
+}
+
+static void qed_mcp_print_cpu_info(struct qed_hwfn *p_hwfn,
+				   struct qed_ptt *p_ptt)
+{
+	u32 cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2;
+	u32 delay = QED_MCP_RESP_ITER_US;
+
+	cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+	cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+	cpu_pc_0 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+	udelay(delay);
+	cpu_pc_1 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+	udelay(delay);
+	cpu_pc_2 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+
+	DP_NOTICE(p_hwfn,
+		  "MCP CPU info: mode 0x%08x, state 0x%08x, pc {0x%08x, 0x%08x, 0x%08x}\n",
+		  cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2);
+}
+
 static int
 _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 		       struct qed_ptt *p_ptt,
 		       struct qed_mcp_mb_params *p_mb_params,
-		       u32 max_retries, u32 delay)
+		       u32 max_retries, u32 usecs)
 {
+	u32 cnt = 0, msecs = DIV_ROUND_UP(usecs, 1000);
 	struct qed_mcp_cmd_elem *p_cmd_elem;
-	u32 cnt = 0;
 	u16 seq_num;
 	int rc = 0;
 
@@ -443,7 +508,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
 			goto err;
 
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
-		udelay(delay);
+
+		if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+			msleep(msecs);
+		else
+			udelay(usecs);
 	} while (++cnt < max_retries);
 
 	if (cnt >= max_retries) {
@@ -472,7 +541,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
 		 * The spinlock stays locked until the list element is removed.
 		 */
 
-		udelay(delay);
+		if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+			msleep(msecs);
+		else
+			udelay(usecs);
+
 		spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
 
 		if (p_cmd_elem->b_is_completed)
@@ -491,11 +564,15 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
 		DP_NOTICE(p_hwfn,
 			  "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
 			  p_mb_params->cmd, p_mb_params->param);
+		qed_mcp_print_cpu_info(p_hwfn, p_ptt);
 
 		spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
 		qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
 		spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
 
+		if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+			qed_mcp_cmd_set_blocking(p_hwfn, true);
+
 		return -EAGAIN;
 	}
 
@@ -507,7 +584,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
 		   "MFW mailbox: response 0x%08x param 0x%08x [after %d.%03d ms]\n",
 		   p_mb_params->mcp_resp,
 		   p_mb_params->mcp_param,
-		   (cnt * delay) / 1000, (cnt * delay) % 1000);
+		   (cnt * usecs) / 1000, (cnt * usecs) % 1000);
 
 	/* Clear the sequence number from the MFW response */
 	p_mb_params->mcp_resp &= FW_MSG_CODE_MASK;
@@ -525,7 +602,7 @@ static int qed_mcp_cmd_and_union(struct
 {
 	size_t union_data_size = sizeof(union drv_union_data);
 	u32 max_retries = QED_DRV_MB_MAX_RETRIES;
-	u32 delay = CHIP_MCP_RESP_ITER_US;
+	u32 usecs = QED_MCP_RESP_ITER_US;
 
 	/* MCP not initialized */
 	if (!qed_mcp_is_init(p_hwfn)) {
@@ -533,6 +610,13 @@ static int qed_mcp_cmd_and_union(struct
 		return -EBUSY;
 	}
 
+	if (p_hwfn->mcp_info->b_block_cmd) {
+		DP_NOTICE(p_hwfn,
+			  "The MFW is not responsive. Avoid sending mailbox command 0x%08x [param 0x%08x].\n",
+			  p_mb_params->cmd, p_mb_params->param);
+		return -EBUSY;
+	}
+
 	if (p_mb_params->data_src_size > union_data_size ||
 	    p_mb_params->data_dst_size > union_data_size) {
 		DP_ERR(p_hwfn,
@@ -542,8 +626,13 @@ static int qed_mcp_cmd_and_union(struct
 		return -EINVAL;
 	}
 
+	if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) {
+		max_retries = DIV_ROUND_UP(max_retries, 1000);
+		usecs *= 1000;
+	}
+
 	return _qed_mcp_cmd_and_union(p_hwfn, p_ptt, p_mb_params, max_retries,
-				      delay);
+				      usecs);
 }
 
 int qed_mcp_cmd(struct qed_hwfn *p_hwfn,
@@ -760,6 +849,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hw
 	mb_params.data_src_size = sizeof(load_req);
 	mb_params.p_data_dst = &load_rsp;
 	mb_params.data_dst_size = sizeof(load_rsp);
+	mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
 
 	DP_VERBOSE(p_hwfn, QED_MSG_SP,
 		   "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n",
@@ -981,7 +1071,8 @@ int qed_mcp_load_req(struct qed_hwfn *p_
 
 int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-	u32 wol_param, mcp_resp, mcp_param;
+	struct qed_mcp_mb_params mb_params;
+	u32 wol_param;
 
 	switch (p_hwfn->cdev->wol_config) {
 	case QED_OV_WOL_DISABLED:
@@ -999,8 +1090,12 @@ int qed_mcp_unload_req(struct qed_hwfn *
 		wol_param = DRV_MB_PARAM_UNLOAD_WOL_MCP;
 	}
 
-	return qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_UNLOAD_REQ, wol_param,
-			   &mcp_resp, &mcp_param);
+	memset(&mb_params, 0, sizeof(mb_params));
+	mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ;
+	mb_params.param = wol_param;
+	mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
+
+	return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params);
 }
 
 int qed_mcp_unload_done(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
@@ -2075,31 +2170,65 @@ qed_mcp_send_drv_version(struct qed_hwfn
 	return rc;
 }
 
+/* A maximal 100 msec waiting time for the MCP to halt */
+#define QED_MCP_HALT_SLEEP_MS		10
+#define QED_MCP_HALT_MAX_RETRIES	10
+
 int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-	u32 resp = 0, param = 0;
+	u32 resp = 0, param = 0, cpu_state, cnt = 0;
 	int rc;
 
 	rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
 			 &param);
-	if (rc)
+	if (rc) {
 		DP_ERR(p_hwfn, "MCP response failure, aborting\n");
+		return rc;
+	}
 
-	return rc;
+	do {
+		msleep(QED_MCP_HALT_SLEEP_MS);
+		cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+		if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
+			break;
+	} while (++cnt < QED_MCP_HALT_MAX_RETRIES);
+
+	if (cnt == QED_MCP_HALT_MAX_RETRIES) {
+		DP_NOTICE(p_hwfn,
+			  "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+			  qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
+		return -EBUSY;
+	}
+
+	qed_mcp_cmd_set_blocking(p_hwfn, true);
+
+	return 0;
 }
 
+#define QED_MCP_RESUME_SLEEP_MS	10
+
 int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-	u32 value, cpu_mode;
+	u32 cpu_mode, cpu_state;
 
 	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
 
-	value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
-	value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
-	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
 	cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+	cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
+	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
+	msleep(QED_MCP_RESUME_SLEEP_MS);
+	cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
 
-	return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
+	if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
+		DP_NOTICE(p_hwfn,
+			  "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+			  cpu_mode, cpu_state);
+		return -EBUSY;
+	}
+
+	qed_mcp_cmd_set_blocking(p_hwfn, false);
+
+	return 0;
 }
 
 int qed_mcp_ov_update_current_config(struct qed_hwfn *p_hwfn,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.h linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_mcp.h	2018-10-03 19:59:28.000000000 -0400
@@ -635,11 +635,14 @@ struct qed_mcp_info {
 	 */
 	spinlock_t				cmd_lock;
 
+	/* Flag to indicate whether sending a MFW mailbox command is blocked */
+	bool					b_block_cmd;
+
 	/* Spinlock used for syncing SW link-changes and link-changes
 	 * originating from attention context.
 	 */
 	spinlock_t				link_lock;
-	bool					block_mb_sending;
+
 	u32					public_base;
 	u32					drv_mb_addr;
 	u32					mfw_mb_addr;
@@ -660,14 +663,20 @@ struct qed_mcp_info {
 };
 
 struct qed_mcp_mb_params {
-	u32			cmd;
-	u32			param;
-	void			*p_data_src;
-	u8			data_src_size;
-	void			*p_data_dst;
-	u8			data_dst_size;
-	u32			mcp_resp;
-	u32			mcp_param;
+	u32 cmd;
+	u32 param;
+	void *p_data_src;
+	void *p_data_dst;
+	u8 data_src_size;
+	u8 data_dst_size;
+	u32 mcp_resp;
+	u32 mcp_param;
+	u32 flags;
+#define QED_MB_FLAG_CAN_SLEEP	(0x1 << 0)
+#define QED_MB_FLAG_AVOID_BLOCK	(0x1 << 1)
+#define QED_MB_FLAGS_IS_SET(params, flag) \
+	({ typeof(params) __params = (params); \
+	   (__params && (__params->flags & QED_MB_FLAG_ ## flag)); })
 };
 
 struct qed_drv_tlv_hdr {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
--- linux-libre-4.18.11-gnu/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h	2018-10-03 19:59:28.000000000 -0400
@@ -562,8 +562,10 @@
 	0
 #define MCP_REG_CPU_STATE \
 	0xe05004UL
+#define MCP_REG_CPU_STATE_SOFT_HALTED	(0x1UL << 10)
 #define MCP_REG_CPU_EVENT_MASK \
 	0xe05008UL
+#define MCP_REG_CPU_PROGRAM_COUNTER	0xe0501cUL
 #define PGLUE_B_REG_PF_BAR0_SIZE \
 	0x2aae60UL
 #define PGLUE_B_REG_PF_BAR1_SIZE \
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/phy/xilinx_gmii2rgmii.c linux-libre-4.18.12-gnu/drivers/net/phy/xilinx_gmii2rgmii.c
--- linux-libre-4.18.11-gnu/drivers/net/phy/xilinx_gmii2rgmii.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/phy/xilinx_gmii2rgmii.c	2018-10-03 19:59:28.000000000 -0400
@@ -40,8 +40,11 @@ static int xgmiitorgmii_read_status(stru
 {
 	struct gmii2rgmii *priv = phydev->priv;
 	u16 val = 0;
+	int err;
 
-	priv->phy_drv->read_status(phydev);
+	err = priv->phy_drv->read_status(phydev);
+	if (err < 0)
+		return err;
 
 	val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG);
 	val &= ~XILINX_GMII2RGMII_SPEED_MASK;
@@ -81,6 +84,11 @@ static int xgmiitorgmii_probe(struct mdi
 		return -EPROBE_DEFER;
 	}
 
+	if (!priv->phy_dev->drv) {
+		dev_info(dev, "Attached phy not ready\n");
+		return -EPROBE_DEFER;
+	}
+
 	priv->addr = mdiodev->addr;
 	priv->phy_drv = priv->phy_dev->drv;
 	memcpy(&priv->conv_phy_drv, priv->phy_dev->drv,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/ce.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/ce.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/ce.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/ce.c	2018-10-03 19:59:28.000000000 -0400
@@ -1512,7 +1512,7 @@ ath10k_ce_alloc_src_ring_64(struct ath10
 		ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries);
 		if (ret) {
 			dma_free_coherent(ar->dev,
-					  (nentries * sizeof(struct ce_desc) +
+					  (nentries * sizeof(struct ce_desc_64) +
 					   CE_DESC_RING_ALIGN),
 					  src_ring->base_addr_owner_space_unaligned,
 					  base_addr);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/htt_rx.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/htt_rx.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/htt_rx.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/htt_rx.c	2018-10-03 19:59:28.000000000 -0400
@@ -268,11 +268,12 @@ int ath10k_htt_rx_ring_refill(struct ath
 	spin_lock_bh(&htt->rx_ring.lock);
 	ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
 					      htt->rx_ring.fill_cnt));
-	spin_unlock_bh(&htt->rx_ring.lock);
 
 	if (ret)
 		ath10k_htt_rx_ring_free(htt);
 
+	spin_unlock_bh(&htt->rx_ring.lock);
+
 	return ret;
 }
 
@@ -284,7 +285,9 @@ void ath10k_htt_rx_free(struct ath10k_ht
 	skb_queue_purge(&htt->rx_in_ord_compl_q);
 	skb_queue_purge(&htt->tx_fetch_ind_q);
 
+	spin_lock_bh(&htt->rx_ring.lock);
 	ath10k_htt_rx_ring_free(htt);
+	spin_unlock_bh(&htt->rx_ring.lock);
 
 	dma_free_coherent(htt->ar->dev,
 			  ath10k_htt_get_rx_ring_size(htt),
@@ -1089,7 +1092,7 @@ static void ath10k_htt_rx_h_queue_msdu(s
 	status = IEEE80211_SKB_RXCB(skb);
 	*status = *rx_status;
 
-	__skb_queue_tail(&ar->htt.rx_msdus_q, skb);
+	skb_queue_tail(&ar->htt.rx_msdus_q, skb);
 }
 
 static void ath10k_process_rx(struct ath10k *ar, struct sk_buff *skb)
@@ -2810,7 +2813,7 @@ bool ath10k_htt_t2h_msg_handler(struct a
 		break;
 	}
 	case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
-		__skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
+		skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
 		return false;
 	}
 	case HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND:
@@ -2874,7 +2877,7 @@ static int ath10k_htt_rx_deliver_msdu(st
 		if (skb_queue_empty(&ar->htt.rx_msdus_q))
 			break;
 
-		skb = __skb_dequeue(&ar->htt.rx_msdus_q);
+		skb = skb_dequeue(&ar->htt.rx_msdus_q);
 		if (!skb)
 			break;
 		ath10k_process_rx(ar, skb);
@@ -2905,7 +2908,7 @@ int ath10k_htt_txrx_compl_task(struct at
 		goto exit;
 	}
 
-	while ((skb = __skb_dequeue(&htt->rx_in_ord_compl_q))) {
+	while ((skb = skb_dequeue(&htt->rx_in_ord_compl_q))) {
 		spin_lock_bh(&htt->rx_ring.lock);
 		ret = ath10k_htt_rx_in_ord_ind(ar, skb);
 		spin_unlock_bh(&htt->rx_ring.lock);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/mac.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/mac.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/mac.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/mac.c	2018-10-03 19:59:28.000000000 -0400
@@ -4054,6 +4054,7 @@ void ath10k_mac_tx_push_pending(struct a
 	rcu_read_unlock();
 	spin_unlock_bh(&ar->txqs_lock);
 }
+EXPORT_SYMBOL(ath10k_mac_tx_push_pending);
 
 /************/
 /* Scanning */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/sdio.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/sdio.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/sdio.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/sdio.c	2018-10-03 19:59:28.000000000 -0400
@@ -30,6 +30,7 @@
 #include "debug.h"
 #include "hif.h"
 #include "htc.h"
+#include "mac.h"
 #include "targaddrs.h"
 #include "trace.h"
 #include "sdio.h"
@@ -396,6 +397,7 @@ static int ath10k_sdio_mbox_rx_process_p
 	int ret;
 
 	payload_len = le16_to_cpu(htc_hdr->len);
+	skb->len = payload_len + sizeof(struct ath10k_htc_hdr);
 
 	if (trailer_present) {
 		trailer = skb->data + sizeof(*htc_hdr) +
@@ -434,12 +436,14 @@ static int ath10k_sdio_mbox_rx_process_p
 	enum ath10k_htc_ep_id id;
 	int ret, i, *n_lookahead_local;
 	u32 *lookaheads_local;
+	int lookahead_idx = 0;
 
 	for (i = 0; i < ar_sdio->n_rx_pkts; i++) {
 		lookaheads_local = lookaheads;
 		n_lookahead_local = n_lookahead;
 
-		id = ((struct ath10k_htc_hdr *)&lookaheads[i])->eid;
+		id = ((struct ath10k_htc_hdr *)
+		      &lookaheads[lookahead_idx++])->eid;
 
 		if (id >= ATH10K_HTC_EP_COUNT) {
 			ath10k_warn(ar, "invalid endpoint in look-ahead: %d\n",
@@ -462,6 +466,7 @@ static int ath10k_sdio_mbox_rx_process_p
 			/* Only read lookahead's from RX trailers
 			 * for the last packet in a bundle.
 			 */
+			lookahead_idx--;
 			lookaheads_local = NULL;
 			n_lookahead_local = NULL;
 		}
@@ -1342,6 +1347,8 @@ static void ath10k_sdio_irq_handler(stru
 			break;
 	} while (time_before(jiffies, timeout) && !done);
 
+	ath10k_mac_tx_push_pending(ar);
+
 	sdio_claim_host(ar_sdio->func);
 
 	if (ret && ret != -ECANCELED)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/snoc.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/snoc.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/snoc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/snoc.c	2018-10-03 19:59:28.000000000 -0400
@@ -449,7 +449,7 @@ static void ath10k_snoc_htt_rx_cb(struct
 
 static void ath10k_snoc_rx_replenish_retry(struct timer_list *t)
 {
-	struct ath10k_pci *ar_snoc = from_timer(ar_snoc, t, rx_post_retry);
+	struct ath10k_snoc *ar_snoc = from_timer(ar_snoc, t, rx_post_retry);
 	struct ath10k *ar = ar_snoc->ar;
 
 	ath10k_snoc_rx_post(ar);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/wmi.c linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/wmi.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ath/ath10k/wmi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ath/ath10k/wmi.c	2018-10-03 19:59:28.000000000 -0400
@@ -4602,10 +4602,6 @@ void ath10k_wmi_event_pdev_tpc_config(st
 
 	ev = (struct wmi_pdev_tpc_config_event *)skb->data;
 
-	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
-	if (!tpc_stats)
-		return;
-
 	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
 
 	if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
@@ -4614,6 +4610,10 @@ void ath10k_wmi_event_pdev_tpc_config(st
 		return;
 	}
 
+	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
+	if (!tpc_stats)
+		return;
+
 	ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
 					    num_tx_chain);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_qmath.c linux-libre-4.18.12-gnu/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_qmath.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_qmath.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_qmath.c	2018-10-03 19:59:28.000000000 -0400
@@ -213,7 +213,7 @@ static const s16 log_table[] = {
 	30498,
 	31267,
 	32024,
-	32768
+	32767
 };
 
 #define LOG_TABLE_SIZE 32       /* log_table size */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c linux-libre-4.18.12-gnu/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c	2018-10-03 19:59:28.000000000 -0400
@@ -439,15 +439,13 @@ mt76x2_mac_fill_tx_status(struct mt76x2_
 	if (last_rate < IEEE80211_TX_MAX_RATES - 1)
 		rate[last_rate + 1].idx = -1;
 
-	cur_idx = rate[last_rate].idx + st->retry;
+	cur_idx = rate[last_rate].idx + last_rate;
 	for (i = 0; i <= last_rate; i++) {
 		rate[i].flags = rate[last_rate].flags;
 		rate[i].idx = max_t(int, 0, cur_idx - i);
 		rate[i].count = 1;
 	}
-
-	if (last_rate > 0)
-		rate[last_rate - 1].count = st->retry + 1 - last_rate;
+	rate[last_rate].count = st->retry + 1 - last_rate;
 
 	info->status.ampdu_len = n_frames;
 	info->status.ampdu_ack_len = st->success ? n_frames : 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/rndis_wlan.c linux-libre-4.18.12-gnu/drivers/net/wireless/rndis_wlan.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/rndis_wlan.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/rndis_wlan.c	2018-10-03 19:59:28.000000000 -0400
@@ -2928,6 +2928,8 @@ static void rndis_wlan_auth_indication(s
 
 	while (buflen >= sizeof(*auth_req)) {
 		auth_req = (void *)buf;
+		if (buflen < le32_to_cpu(auth_req->length))
+			return;
 		type = "unknown";
 		flags = le32_to_cpu(auth_req->flags);
 		pairwise_error = false;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/net/wireless/ti/wlcore/cmd.c linux-libre-4.18.12-gnu/drivers/net/wireless/ti/wlcore/cmd.c
--- linux-libre-4.18.11-gnu/drivers/net/wireless/ti/wlcore/cmd.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/net/wireless/ti/wlcore/cmd.c	2018-10-03 19:59:28.000000000 -0400
@@ -35,6 +35,7 @@
 #include "wl12xx_80211.h"
 #include "cmd.h"
 #include "event.h"
+#include "ps.h"
 #include "tx.h"
 #include "hw_ops.h"
 
@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout
 
 	timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
 
+	ret = wl1271_ps_elp_wakeup(wl);
+	if (ret < 0)
+		return ret;
+
 	do {
 		if (time_after(jiffies, timeout_time)) {
 			wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout
 	} while (!event);
 
 out:
+	wl1271_ps_elp_sleep(wl);
 	kfree(events_vector);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/nvme/target/fcloop.c linux-libre-4.18.12-gnu/drivers/nvme/target/fcloop.c
--- linux-libre-4.18.11-gnu/drivers/nvme/target/fcloop.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/nvme/target/fcloop.c	2018-10-03 19:59:28.000000000 -0400
@@ -311,7 +311,7 @@ fcloop_tgt_lsrqst_done_work(struct work_
 	struct fcloop_tport *tport = tls_req->tport;
 	struct nvmefc_ls_req *lsreq = tls_req->lsreq;
 
-	if (tport->remoteport)
+	if (!tport || tport->remoteport)
 		lsreq->done(lsreq, tls_req->status);
 }
 
@@ -329,6 +329,7 @@ fcloop_ls_req(struct nvme_fc_local_port
 
 	if (!rport->targetport) {
 		tls_req->status = -ECONNREFUSED;
+		tls_req->tport = NULL;
 		schedule_work(&tls_req->work);
 		return ret;
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/pci/hotplug/acpiphp_glue.c linux-libre-4.18.12-gnu/drivers/pci/hotplug/acpiphp_glue.c
--- linux-libre-4.18.11-gnu/drivers/pci/hotplug/acpiphp_glue.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/pci/hotplug/acpiphp_glue.c	2018-10-03 19:59:28.000000000 -0400
@@ -457,17 +457,18 @@ static void acpiphp_native_scan_bridge(s
 /**
  * enable_slot - enable, configure a slot
  * @slot: slot to be enabled
+ * @bridge: true if enable is for the whole bridge (not a single slot)
  *
  * This function should be called per *physical slot*,
  * not per each slot object in ACPI namespace.
  */
-static void enable_slot(struct acpiphp_slot *slot)
+static void enable_slot(struct acpiphp_slot *slot, bool bridge)
 {
 	struct pci_dev *dev;
 	struct pci_bus *bus = slot->bus;
 	struct acpiphp_func *func;
 
-	if (bus->self && hotplug_is_native(bus->self)) {
+	if (bridge && bus->self && hotplug_is_native(bus->self)) {
 		/*
 		 * If native hotplug is used, it will take care of hotplug
 		 * slot management and resource allocation for hotplug
@@ -701,7 +702,7 @@ static void acpiphp_check_bridge(struct
 					trim_stale_devices(dev);
 
 			/* configure all functions */
-			enable_slot(slot);
+			enable_slot(slot, true);
 		} else {
 			disable_slot(slot);
 		}
@@ -785,7 +786,7 @@ static void hotplug_event(u32 type, stru
 		if (bridge)
 			acpiphp_check_bridge(bridge);
 		else if (!(slot->flags & SLOT_IS_GOING_AWAY))
-			enable_slot(slot);
+			enable_slot(slot, false);
 
 		break;
 
@@ -973,7 +974,7 @@ int acpiphp_enable_slot(struct acpiphp_s
 
 	/* configure all functions */
 	if (!(slot->flags & SLOT_ENABLED))
-		enable_slot(slot);
+		enable_slot(slot, false);
 
 	pci_unlock_rescan_remove();
 	return 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/platform/x86/asus-wireless.c linux-libre-4.18.12-gnu/drivers/platform/x86/asus-wireless.c
--- linux-libre-4.18.11-gnu/drivers/platform/x86/asus-wireless.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/platform/x86/asus-wireless.c	2018-10-03 19:59:28.000000000 -0400
@@ -52,13 +52,12 @@ static const struct acpi_device_id devic
 };
 MODULE_DEVICE_TABLE(acpi, device_ids);
 
-static u64 asus_wireless_method(acpi_handle handle, const char *method,
-				int param)
+static acpi_status asus_wireless_method(acpi_handle handle, const char *method,
+					int param, u64 *ret)
 {
 	struct acpi_object_list p;
 	union acpi_object obj;
 	acpi_status s;
-	u64 ret;
 
 	acpi_handle_debug(handle, "Evaluating method %s, parameter %#x\n",
 			  method, param);
@@ -67,24 +66,27 @@ static u64 asus_wireless_method(acpi_han
 	p.count = 1;
 	p.pointer = &obj;
 
-	s = acpi_evaluate_integer(handle, (acpi_string) method, &p, &ret);
+	s = acpi_evaluate_integer(handle, (acpi_string) method, &p, ret);
 	if (ACPI_FAILURE(s))
 		acpi_handle_err(handle,
 				"Failed to eval method %s, param %#x (%d)\n",
 				method, param, s);
-	acpi_handle_debug(handle, "%s returned %#llx\n", method, ret);
-	return ret;
+	else
+		acpi_handle_debug(handle, "%s returned %#llx\n", method, *ret);
+
+	return s;
 }
 
 static enum led_brightness led_state_get(struct led_classdev *led)
 {
 	struct asus_wireless_data *data;
-	int s;
+	acpi_status s;
+	u64 ret;
 
 	data = container_of(led, struct asus_wireless_data, led);
 	s = asus_wireless_method(acpi_device_handle(data->adev), "HSWC",
-				 data->hswc_params->status);
-	if (s == data->hswc_params->on)
+				 data->hswc_params->status, &ret);
+	if (ACPI_SUCCESS(s) && ret == data->hswc_params->on)
 		return LED_FULL;
 	return LED_OFF;
 }
@@ -92,10 +94,11 @@ static enum led_brightness led_state_get
 static void led_state_update(struct work_struct *work)
 {
 	struct asus_wireless_data *data;
+	u64 ret;
 
 	data = container_of(work, struct asus_wireless_data, led_work);
 	asus_wireless_method(acpi_device_handle(data->adev), "HSWC",
-			     data->led_state);
+			     data->led_state, &ret);
 }
 
 static void led_state_set(struct led_classdev *led, enum led_brightness value)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/power/reset/vexpress-poweroff.c linux-libre-4.18.12-gnu/drivers/power/reset/vexpress-poweroff.c
--- linux-libre-4.18.11-gnu/drivers/power/reset/vexpress-poweroff.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/power/reset/vexpress-poweroff.c	2018-10-03 19:59:28.000000000 -0400
@@ -35,6 +35,7 @@ static void vexpress_reset_do(struct dev
 }
 
 static struct device *vexpress_power_off_device;
+static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0);
 
 static void vexpress_power_off(void)
 {
@@ -99,10 +100,13 @@ static int _vexpress_register_restart_ha
 	int err;
 
 	vexpress_restart_device = dev;
-	err = register_restart_handler(&vexpress_restart_nb);
-	if (err) {
-		dev_err(dev, "cannot register restart handler (err=%d)\n", err);
-		return err;
+	if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) {
+		err = register_restart_handler(&vexpress_restart_nb);
+		if (err) {
+			dev_err(dev, "cannot register restart handler (err=%d)\n", err);
+			atomic_dec(&vexpress_restart_nb_refcnt);
+			return err;
+		}
 	}
 	device_create_file(dev, &dev_attr_active);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/power/supply/axp288_charger.c linux-libre-4.18.12-gnu/drivers/power/supply/axp288_charger.c
--- linux-libre-4.18.11-gnu/drivers/power/supply/axp288_charger.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/power/supply/axp288_charger.c	2018-10-03 19:59:28.000000000 -0400
@@ -718,7 +718,7 @@ static int charger_init_hw_regs(struct a
 	}
 
 	/* Determine charge current limit */
-	cc = (ret & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
+	cc = (val & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
 	cc = (cc * CHRG_CCCV_CC_LSB_RES) + CHRG_CCCV_CC_OFFSET;
 	info->cc = cc;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/power/supply/power_supply_core.c linux-libre-4.18.12-gnu/drivers/power/supply/power_supply_core.c
--- linux-libre-4.18.11-gnu/drivers/power/supply/power_supply_core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/power/supply/power_supply_core.c	2018-10-03 19:59:28.000000000 -0400
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/notifier.h>
 #include <linux/err.h>
@@ -140,8 +141,13 @@ static void power_supply_deferred_regist
 	struct power_supply *psy = container_of(work, struct power_supply,
 						deferred_register_work.work);
 
-	if (psy->dev.parent)
-		mutex_lock(&psy->dev.parent->mutex);
+	if (psy->dev.parent) {
+		while (!mutex_trylock(&psy->dev.parent->mutex)) {
+			if (psy->removing)
+				return;
+			msleep(10);
+		}
+	}
 
 	power_supply_changed(psy);
 
@@ -1082,6 +1088,7 @@ EXPORT_SYMBOL_GPL(devm_power_supply_regi
 void power_supply_unregister(struct power_supply *psy)
 {
 	WARN_ON(atomic_dec_return(&psy->use_cnt));
+	psy->removing = true;
 	cancel_work_sync(&psy->changed_work);
 	cancel_delayed_work_sync(&psy->deferred_register_work);
 	sysfs_remove_link(&psy->dev.kobj, "powers");
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/regulator/core.c linux-libre-4.18.12-gnu/drivers/regulator/core.c
--- linux-libre-4.18.11-gnu/drivers/regulator/core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/regulator/core.c	2018-10-03 19:59:28.000000000 -0400
@@ -3147,7 +3147,7 @@ static inline int regulator_suspend_togg
 	if (!rstate->changeable)
 		return -EPERM;
 
-	rstate->enabled = en;
+	rstate->enabled = (en) ? ENABLE_IN_SUSPEND : DISABLE_IN_SUSPEND;
 
 	return 0;
 }
@@ -4381,13 +4381,13 @@ regulator_register(const struct regulato
 	    !rdev->desc->fixed_uV)
 		rdev->is_switch = true;
 
+	dev_set_drvdata(&rdev->dev, rdev);
 	ret = device_register(&rdev->dev);
 	if (ret != 0) {
 		put_device(&rdev->dev);
 		goto unset_supplies;
 	}
 
-	dev_set_drvdata(&rdev->dev, rdev);
 	rdev_init_debugfs(rdev);
 
 	/* try to resolve regulators supply since a new one was registered */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/regulator/of_regulator.c linux-libre-4.18.12-gnu/drivers/regulator/of_regulator.c
--- linux-libre-4.18.11-gnu/drivers/regulator/of_regulator.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/regulator/of_regulator.c	2018-10-03 19:59:28.000000000 -0400
@@ -213,8 +213,6 @@ static void of_get_regulation_constraint
 		else if (of_property_read_bool(suspend_np,
 					"regulator-off-in-suspend"))
 			suspend_state->enabled = DISABLE_IN_SUSPEND;
-		else
-			suspend_state->enabled = DO_NOTHING_IN_SUSPEND;
 
 		if (!of_property_read_u32(np, "regulator-suspend-min-microvolt",
 					  &pval))
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/s390/block/dasd.c linux-libre-4.18.12-gnu/drivers/s390/block/dasd.c
--- linux-libre-4.18.11-gnu/drivers/s390/block/dasd.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/s390/block/dasd.c	2018-10-03 19:59:28.000000000 -0400
@@ -3127,6 +3127,7 @@ static int dasd_alloc_queue(struct dasd_
 	block->tag_set.nr_hw_queues = nr_hw_queues;
 	block->tag_set.queue_depth = queue_depth;
 	block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
+	block->tag_set.numa_node = NUMA_NO_NODE;
 
 	rc = blk_mq_alloc_tag_set(&block->tag_set);
 	if (rc)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/s390/block/scm_blk.c linux-libre-4.18.12-gnu/drivers/s390/block/scm_blk.c
--- linux-libre-4.18.11-gnu/drivers/s390/block/scm_blk.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/s390/block/scm_blk.c	2018-10-03 19:59:28.000000000 -0400
@@ -455,6 +455,7 @@ int scm_blk_dev_setup(struct scm_blk_dev
 	bdev->tag_set.nr_hw_queues = nr_requests;
 	bdev->tag_set.queue_depth = nr_requests_per_io * nr_requests;
 	bdev->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
+	bdev->tag_set.numa_node = NUMA_NO_NODE;
 
 	ret = blk_mq_alloc_tag_set(&bdev->tag_set);
 	if (ret)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c linux-libre-4.18.12-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c
--- linux-libre-4.18.11-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c	2018-10-03 19:59:28.000000000 -0400
@@ -2727,6 +2727,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i
 					      BNX2X_DOORBELL_PCI_BAR);
 		reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
 		ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
+		if (!ep->qp.ctx_base)
+			return -ENOMEM;
 		goto arm_cq;
 	}
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/scsi/hisi_sas/hisi_sas.h linux-libre-4.18.12-gnu/drivers/scsi/hisi_sas/hisi_sas.h
--- linux-libre-4.18.11-gnu/drivers/scsi/hisi_sas/hisi_sas.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/scsi/hisi_sas/hisi_sas.h	2018-10-03 19:59:28.000000000 -0400
@@ -277,6 +277,7 @@ struct hisi_hba {
 
 	int n_phy;
 	spinlock_t lock;
+	struct semaphore sem;
 
 	struct timer_list timer;
 	struct workqueue_struct *wq;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/scsi/hisi_sas/hisi_sas_main.c linux-libre-4.18.12-gnu/drivers/scsi/hisi_sas/hisi_sas_main.c
--- linux-libre-4.18.11-gnu/drivers/scsi/hisi_sas/hisi_sas_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/scsi/hisi_sas/hisi_sas_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -914,7 +914,9 @@ static void hisi_sas_dev_gone(struct dom
 
 		hisi_sas_dereg_device(hisi_hba, device);
 
+		down(&hisi_hba->sem);
 		hisi_hba->hw->clear_itct(hisi_hba, sas_dev);
+		up(&hisi_hba->sem);
 		device->lldd_dev = NULL;
 	}
 
@@ -1364,6 +1366,7 @@ static int hisi_sas_controller_reset(str
 	if (test_and_set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
 		return -1;
 
+	down(&hisi_hba->sem);
 	dev_info(dev, "controller resetting...\n");
 	old_state = hisi_hba->hw->get_phys_state(hisi_hba);
 
@@ -1378,6 +1381,7 @@ static int hisi_sas_controller_reset(str
 	if (rc) {
 		dev_warn(dev, "controller reset failed (%d)\n", rc);
 		clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
+		up(&hisi_hba->sem);
 		scsi_unblock_requests(shost);
 		goto out;
 	}
@@ -1388,6 +1392,7 @@ static int hisi_sas_controller_reset(str
 	hisi_hba->hw->phys_init(hisi_hba);
 	msleep(1000);
 	hisi_sas_refresh_port_id(hisi_hba);
+	up(&hisi_hba->sem);
 
 	if (hisi_hba->reject_stp_links_msk)
 		hisi_sas_terminate_stp_reject(hisi_hba);
@@ -2016,6 +2021,7 @@ int hisi_sas_alloc(struct hisi_hba *hisi
 	struct device *dev = hisi_hba->dev;
 	int i, s, max_command_entries = hisi_hba->hw->max_command_entries;
 
+	sema_init(&hisi_hba->sem, 1);
 	spin_lock_init(&hisi_hba->lock);
 	for (i = 0; i < hisi_hba->n_phy; i++) {
 		hisi_sas_phy_init(hisi_hba, i);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c linux-libre-4.18.12-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c
--- linux-libre-4.18.11-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c	2018-10-03 19:59:28.000000000 -0400
@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_R
 static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2;
 static int fast_fail = 1;
 static int client_reserve = 1;
-static char partition_name[97] = "UNKNOWN";
+static char partition_name[96] = "UNKNOWN";
 static unsigned int partition_number = -1;
 static LIST_HEAD(ibmvscsi_head);
 
@@ -262,7 +262,7 @@ static void gather_partition_info(void)
 
 	ppartition_name = of_get_property(of_root, "ibm,partition-name", NULL);
 	if (ppartition_name)
-		strncpy(partition_name, ppartition_name,
+		strlcpy(partition_name, ppartition_name,
 				sizeof(partition_name));
 	p_number_ptr = of_get_property(of_root, "ibm,partition-no", NULL);
 	if (p_number_ptr)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/scsi/megaraid/megaraid_sas_base.c linux-libre-4.18.12-gnu/drivers/scsi/megaraid/megaraid_sas_base.c
--- linux-libre-4.18.11-gnu/drivers/scsi/megaraid/megaraid_sas_base.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/scsi/megaraid/megaraid_sas_base.c	2018-10-03 19:59:28.000000000 -0400
@@ -6789,6 +6789,9 @@ megasas_resume(struct pci_dev *pdev)
 			goto fail_init_mfi;
 	}
 
+	if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
+		goto fail_init_mfi;
+
 	tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet,
 		     (unsigned long)instance);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/siox/siox-core.c linux-libre-4.18.12-gnu/drivers/siox/siox-core.c
--- linux-libre-4.18.11-gnu/drivers/siox/siox-core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/siox/siox-core.c	2018-10-03 19:59:28.000000000 -0400
@@ -715,17 +715,17 @@ int siox_master_register(struct siox_mas
 
 	dev_set_name(&smaster->dev, "siox-%d", smaster->busno);
 
+	mutex_init(&smaster->lock);
+	INIT_LIST_HEAD(&smaster->devices);
+
 	smaster->last_poll = jiffies;
-	smaster->poll_thread = kthread_create(siox_poll_thread, smaster,
-					      "siox-%d", smaster->busno);
+	smaster->poll_thread = kthread_run(siox_poll_thread, smaster,
+					   "siox-%d", smaster->busno);
 	if (IS_ERR(smaster->poll_thread)) {
 		smaster->active = 0;
 		return PTR_ERR(smaster->poll_thread);
 	}
 
-	mutex_init(&smaster->lock);
-	INIT_LIST_HEAD(&smaster->devices);
-
 	ret = device_add(&smaster->dev);
 	if (ret)
 		kthread_stop(smaster->poll_thread);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/spi/spi-orion.c linux-libre-4.18.12-gnu/drivers/spi/spi-orion.c
--- linux-libre-4.18.11-gnu/drivers/spi/spi-orion.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/spi/spi-orion.c	2018-10-03 19:59:28.000000000 -0400
@@ -20,6 +20,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
+#include <linux/of_gpio.h>
 #include <linux/clk.h>
 #include <linux/sizes.h>
 #include <linux/gpio.h>
@@ -681,9 +682,9 @@ static int orion_spi_probe(struct platfo
 		goto out_rel_axi_clk;
 	}
 
-	/* Scan all SPI devices of this controller for direct mapped devices */
 	for_each_available_child_of_node(pdev->dev.of_node, np) {
 		u32 cs;
+		int cs_gpio;
 
 		/* Get chip-select number from the "reg" property */
 		status = of_property_read_u32(np, "reg", &cs);
@@ -695,6 +696,44 @@ static int orion_spi_probe(struct platfo
 		}
 
 		/*
+		 * Initialize the CS GPIO:
+		 * - properly request the actual GPIO signal
+		 * - de-assert the logical signal so that all GPIO CS lines
+		 *   are inactive when probing for slaves
+		 * - find an unused physical CS which will be driven for any
+		 *   slave which uses a CS GPIO
+		 */
+		cs_gpio = of_get_named_gpio(pdev->dev.of_node, "cs-gpios", cs);
+		if (cs_gpio > 0) {
+			char *gpio_name;
+			int cs_flags;
+
+			if (spi->unused_hw_gpio == -1) {
+				dev_info(&pdev->dev,
+					"Selected unused HW CS#%d for any GPIO CSes\n",
+					cs);
+				spi->unused_hw_gpio = cs;
+			}
+
+			gpio_name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+					"%s-CS%d", dev_name(&pdev->dev), cs);
+			if (!gpio_name) {
+				status = -ENOMEM;
+				goto out_rel_axi_clk;
+			}
+
+			cs_flags = of_property_read_bool(np, "spi-cs-high") ?
+				GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH;
+			status = devm_gpio_request_one(&pdev->dev, cs_gpio,
+					cs_flags, gpio_name);
+			if (status) {
+				dev_err(&pdev->dev,
+					"Can't request GPIO for CS %d\n", cs);
+				goto out_rel_axi_clk;
+			}
+		}
+
+		/*
 		 * Check if an address is configured for this SPI device. If
 		 * not, the MBus mapping via the 'ranges' property in the 'soc'
 		 * node is not configured and this device should not use the
@@ -740,44 +779,8 @@ static int orion_spi_probe(struct platfo
 	if (status < 0)
 		goto out_rel_pm;
 
-	if (master->cs_gpios) {
-		int i;
-		for (i = 0; i < master->num_chipselect; ++i) {
-			char *gpio_name;
-
-			if (!gpio_is_valid(master->cs_gpios[i])) {
-				continue;
-			}
-
-			gpio_name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
-					"%s-CS%d", dev_name(&pdev->dev), i);
-			if (!gpio_name) {
-				status = -ENOMEM;
-				goto out_rel_master;
-			}
-
-			status = devm_gpio_request(&pdev->dev,
-					master->cs_gpios[i], gpio_name);
-			if (status) {
-				dev_err(&pdev->dev,
-					"Can't request GPIO for CS %d\n",
-					master->cs_gpios[i]);
-				goto out_rel_master;
-			}
-			if (spi->unused_hw_gpio == -1) {
-				dev_info(&pdev->dev,
-					"Selected unused HW CS#%d for any GPIO CSes\n",
-					i);
-				spi->unused_hw_gpio = i;
-			}
-		}
-	}
-
-
 	return status;
 
-out_rel_master:
-	spi_unregister_master(master);
 out_rel_pm:
 	pm_runtime_disable(&pdev->dev);
 out_rel_axi_clk:
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/spi/spi-rspi.c linux-libre-4.18.12-gnu/drivers/spi/spi-rspi.c
--- linux-libre-4.18.11-gnu/drivers/spi/spi-rspi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/spi/spi-rspi.c	2018-10-03 19:59:28.000000000 -0400
@@ -598,11 +598,13 @@ static int rspi_dma_transfer(struct rspi
 
 	ret = wait_event_interruptible_timeout(rspi->wait,
 					       rspi->dma_callbacked, HZ);
-	if (ret > 0 && rspi->dma_callbacked)
+	if (ret > 0 && rspi->dma_callbacked) {
 		ret = 0;
-	else if (!ret) {
-		dev_err(&rspi->master->dev, "DMA timeout\n");
-		ret = -ETIMEDOUT;
+	} else {
+		if (!ret) {
+			dev_err(&rspi->master->dev, "DMA timeout\n");
+			ret = -ETIMEDOUT;
+		}
 		if (tx)
 			dmaengine_terminate_all(rspi->master->dma_tx);
 		if (rx)
@@ -1350,12 +1352,36 @@ static const struct platform_device_id s
 
 MODULE_DEVICE_TABLE(platform, spi_driver_ids);
 
+#ifdef CONFIG_PM_SLEEP
+static int rspi_suspend(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct rspi_data *rspi = platform_get_drvdata(pdev);
+
+	return spi_master_suspend(rspi->master);
+}
+
+static int rspi_resume(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct rspi_data *rspi = platform_get_drvdata(pdev);
+
+	return spi_master_resume(rspi->master);
+}
+
+static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume);
+#define DEV_PM_OPS	&rspi_pm_ops
+#else
+#define DEV_PM_OPS	NULL
+#endif /* CONFIG_PM_SLEEP */
+
 static struct platform_driver rspi_driver = {
 	.probe =	rspi_probe,
 	.remove =	rspi_remove,
 	.id_table =	spi_driver_ids,
 	.driver		= {
 		.name = "renesas_spi",
+		.pm = DEV_PM_OPS,
 		.of_match_table = of_match_ptr(rspi_of_match),
 	},
 };
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/spi/spi-sh-msiof.c linux-libre-4.18.12-gnu/drivers/spi/spi-sh-msiof.c
--- linux-libre-4.18.11-gnu/drivers/spi/spi-sh-msiof.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/spi/spi-sh-msiof.c	2018-10-03 19:59:28.000000000 -0400
@@ -396,7 +396,8 @@ static void sh_msiof_spi_set_mode_regs(s
 
 static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
 {
-	sh_msiof_write(p, STR, sh_msiof_read(p, STR));
+	sh_msiof_write(p, STR,
+		       sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ));
 }
 
 static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
@@ -1421,12 +1422,37 @@ static const struct platform_device_id s
 };
 MODULE_DEVICE_TABLE(platform, spi_driver_ids);
 
+#ifdef CONFIG_PM_SLEEP
+static int sh_msiof_spi_suspend(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+
+	return spi_master_suspend(p->master);
+}
+
+static int sh_msiof_spi_resume(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+
+	return spi_master_resume(p->master);
+}
+
+static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend,
+			 sh_msiof_spi_resume);
+#define DEV_PM_OPS	&sh_msiof_spi_pm_ops
+#else
+#define DEV_PM_OPS	NULL
+#endif /* CONFIG_PM_SLEEP */
+
 static struct platform_driver sh_msiof_spi_drv = {
 	.probe		= sh_msiof_spi_probe,
 	.remove		= sh_msiof_spi_remove,
 	.id_table	= spi_driver_ids,
 	.driver		= {
 		.name		= "spi_sh_msiof",
+		.pm		= DEV_PM_OPS,
 		.of_match_table = of_match_ptr(sh_msiof_match),
 	},
 };
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/spi/spi-tegra20-slink.c linux-libre-4.18.12-gnu/drivers/spi/spi-tegra20-slink.c
--- linux-libre-4.18.11-gnu/drivers/spi/spi-tegra20-slink.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/spi/spi-tegra20-slink.c	2018-10-03 19:59:28.000000000 -0400
@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct plat
 		goto exit_free_master;
 	}
 
+	/* disabled clock may cause interrupt storm upon request */
+	tspi->clk = devm_clk_get(&pdev->dev, NULL);
+	if (IS_ERR(tspi->clk)) {
+		ret = PTR_ERR(tspi->clk);
+		dev_err(&pdev->dev, "Can not get clock %d\n", ret);
+		goto exit_free_master;
+	}
+	ret = clk_prepare(tspi->clk);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Clock prepare failed %d\n", ret);
+		goto exit_free_master;
+	}
+	ret = clk_enable(tspi->clk);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
+		goto exit_free_master;
+	}
+
 	spi_irq = platform_get_irq(pdev, 0);
 	tspi->irq = spi_irq;
 	ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct plat
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
 					tspi->irq);
-		goto exit_free_master;
-	}
-
-	tspi->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(tspi->clk)) {
-		dev_err(&pdev->dev, "can not get clock\n");
-		ret = PTR_ERR(tspi->clk);
-		goto exit_free_irq;
+		goto exit_clk_disable;
 	}
 
 	tspi->rst = devm_reset_control_get_exclusive(&pdev->dev, "spi");
@@ -1138,6 +1149,8 @@ exit_rx_dma_free:
 	tegra_slink_deinit_dma_param(tspi, true);
 exit_free_irq:
 	free_irq(spi_irq, tspi);
+exit_clk_disable:
+	clk_disable(tspi->clk);
 exit_free_master:
 	spi_master_put(master);
 	return ret;
@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct pla
 
 	free_irq(tspi->irq, tspi);
 
+	clk_disable(tspi->clk);
+
 	if (tspi->tx_dma_chan)
 		tegra_slink_deinit_dma_param(tspi, false);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/android/ashmem.c linux-libre-4.18.12-gnu/drivers/staging/android/ashmem.c
--- linux-libre-4.18.11-gnu/drivers/staging/android/ashmem.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/android/ashmem.c	2018-10-03 19:59:28.000000000 -0400
@@ -366,6 +366,12 @@ static int ashmem_mmap(struct file *file
 		goto out;
 	}
 
+	/* requested mapping size larger than object size */
+	if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/* requested protection bits must match our allowed protection mask */
 	if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
 		     calc_vm_prot_bits(PROT_MASK, 0))) {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/media/imx/imx-ic-prpencvf.c linux-libre-4.18.12-gnu/drivers/staging/media/imx/imx-ic-prpencvf.c
--- linux-libre-4.18.11-gnu/drivers/staging/media/imx/imx-ic-prpencvf.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/media/imx/imx-ic-prpencvf.c	2018-10-03 19:59:28.000000000 -0400
@@ -210,6 +210,7 @@ static void prp_vb2_buf_done(struct prp_
 
 	done = priv->active_vb2_buf[priv->ipu_buf_num];
 	if (done) {
+		done->vbuf.field = vdev->fmt.fmt.pix.field;
 		vb = &done->vbuf.vb2_buf;
 		vb->timestamp = ktime_get_ns();
 		vb2_buffer_done(vb, priv->nfb4eof ?
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/media/imx/imx-media-csi.c linux-libre-4.18.12-gnu/drivers/staging/media/imx/imx-media-csi.c
--- linux-libre-4.18.11-gnu/drivers/staging/media/imx/imx-media-csi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/media/imx/imx-media-csi.c	2018-10-03 19:59:28.000000000 -0400
@@ -236,6 +236,7 @@ static void csi_vb2_buf_done(struct csi_
 
 	done = priv->active_vb2_buf[priv->ipu_buf_num];
 	if (done) {
+		done->vbuf.field = vdev->fmt.fmt.pix.field;
 		vb = &done->vbuf.vb2_buf;
 		vb->timestamp = ktime_get_ns();
 		vb2_buffer_done(vb, priv->nfb4eof ?
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/mt7621-dts/gbpc1.dts linux-libre-4.18.12-gnu/drivers/staging/mt7621-dts/gbpc1.dts
--- linux-libre-4.18.11-gnu/drivers/staging/mt7621-dts/gbpc1.dts	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/mt7621-dts/gbpc1.dts	2018-10-03 19:59:28.000000000 -0400
@@ -113,6 +113,8 @@
 };
 
 &pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
 	status = "okay";
 };
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/mt7621-dts/mt7621.dtsi linux-libre-4.18.12-gnu/drivers/staging/mt7621-dts/mt7621.dtsi
--- linux-libre-4.18.11-gnu/drivers/staging/mt7621-dts/mt7621.dtsi	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/mt7621-dts/mt7621.dtsi	2018-10-03 19:59:28.000000000 -0400
@@ -447,31 +447,28 @@
 		clocks = <&clkctrl 24 &clkctrl 25 &clkctrl 26>;
 		clock-names = "pcie0", "pcie1", "pcie2";
 
-		pcie0 {
+		pcie@0,0 {
 			reg = <0x0000 0 0 0 0>;
-
 			#address-cells = <3>;
 			#size-cells = <2>;
-
-			device_type = "pci";
+			ranges;
+			bus-range = <0x00 0xff>;
 		};
 
-		pcie1 {
+		pcie@1,0 {
 			reg = <0x0800 0 0 0 0>;
-
 			#address-cells = <3>;
 			#size-cells = <2>;
-
-			device_type = "pci";
+			ranges;
+			bus-range = <0x00 0xff>;
 		};
 
-		pcie2 {
+		pcie@2,0 {
 			reg = <0x1000 0 0 0 0>;
-
 			#address-cells = <3>;
 			#size-cells = <2>;
-
-			device_type = "pci";
+			ranges;
+			bus-range = <0x00 0xff>;
 		};
 	};
 };
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/mt7621-eth/mtk_eth_soc.c linux-libre-4.18.12-gnu/drivers/staging/mt7621-eth/mtk_eth_soc.c
--- linux-libre-4.18.11-gnu/drivers/staging/mt7621-eth/mtk_eth_soc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/mt7621-eth/mtk_eth_soc.c	2018-10-03 19:59:28.000000000 -0400
@@ -2012,8 +2012,10 @@ static int mtk_add_mac(struct mtk_eth *e
 		mac->hw_stats = devm_kzalloc(eth->dev,
 					     sizeof(*mac->hw_stats),
 					     GFP_KERNEL);
-		if (!mac->hw_stats)
-			return -ENOMEM;
+		if (!mac->hw_stats) {
+			err = -ENOMEM;
+			goto free_netdev;
+		}
 		spin_lock_init(&mac->hw_stats->stats_lock);
 		mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 	}
@@ -2037,7 +2039,8 @@ static int mtk_add_mac(struct mtk_eth *e
 	err = register_netdev(eth->netdev[id]);
 	if (err) {
 		dev_err(eth->dev, "error bringing up device\n");
-		return err;
+		err = -ENOMEM;
+		goto free_netdev;
 	}
 	eth->netdev[id]->irq = eth->irq;
 	netif_info(eth, probe, eth->netdev[id],
@@ -2045,6 +2048,10 @@ static int mtk_add_mac(struct mtk_eth *e
 		   eth->netdev[id]->base_addr, eth->netdev[id]->irq);
 
 	return 0;
+
+free_netdev:
+	free_netdev(eth->netdev[id]);
+	return err;
 }
 
 static int mtk_probe(struct platform_device *pdev)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/pi433/pi433_if.c linux-libre-4.18.12-gnu/drivers/staging/pi433/pi433_if.c
--- linux-libre-4.18.11-gnu/drivers/staging/pi433/pi433_if.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/pi433/pi433_if.c	2018-10-03 19:59:28.000000000 -0400
@@ -880,6 +880,7 @@ pi433_ioctl(struct file *filp, unsigned
 	int			retval = 0;
 	struct pi433_instance	*instance;
 	struct pi433_device	*device;
+	struct pi433_tx_cfg	tx_cfg;
 	void __user *argp = (void __user *)arg;
 
 	/* Check type and command number */
@@ -902,9 +903,11 @@ pi433_ioctl(struct file *filp, unsigned
 			return -EFAULT;
 		break;
 	case PI433_IOC_WR_TX_CFG:
-		if (copy_from_user(&instance->tx_cfg, argp,
-				   sizeof(struct pi433_tx_cfg)))
+		if (copy_from_user(&tx_cfg, argp, sizeof(struct pi433_tx_cfg)))
 			return -EFAULT;
+		mutex_lock(&device->tx_fifo_lock);
+		memcpy(&instance->tx_cfg, &tx_cfg, sizeof(struct pi433_tx_cfg));
+		mutex_unlock(&device->tx_fifo_lock);
 		break;
 	case PI433_IOC_RD_RX_CFG:
 		if (copy_to_user(argp, &device->rx_cfg,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/staging/rts5208/sd.c linux-libre-4.18.12-gnu/drivers/staging/rts5208/sd.c
--- linux-libre-4.18.11-gnu/drivers/staging/rts5208/sd.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/staging/rts5208/sd.c	2018-10-03 19:59:28.000000000 -0400
@@ -4996,7 +4996,7 @@ int sd_execute_write_data(struct scsi_cm
 			goto sd_execute_write_cmd_failed;
 		}
 
-		rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
+		retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
 		if (retval != STATUS_SUCCESS) {
 			rtsx_trace(chip);
 			goto sd_execute_write_cmd_failed;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/target/iscsi/iscsi_target_tpg.c linux-libre-4.18.12-gnu/drivers/target/iscsi/iscsi_target_tpg.c
--- linux-libre-4.18.11-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2018-10-03 19:59:28.000000000 -0400
@@ -636,8 +636,7 @@ int iscsit_ta_authentication(struct iscs
 		none = strstr(buf1, NONE);
 		if (none)
 			goto out;
-		strncat(buf1, ",", strlen(","));
-		strncat(buf1, NONE, strlen(NONE));
+		strlcat(buf1, "," NONE, sizeof(buf1));
 		if (iscsi_update_param_value(param, buf1) < 0)
 			return -EINVAL;
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/target/target_core_device.c linux-libre-4.18.12-gnu/drivers/target/target_core_device.c
--- linux-libre-4.18.11-gnu/drivers/target/target_core_device.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/target/target_core_device.c	2018-10-03 19:59:28.000000000 -0400
@@ -904,14 +904,20 @@ struct se_device *target_find_device(int
 EXPORT_SYMBOL(target_find_device);
 
 struct devices_idr_iter {
+	struct config_item *prev_item;
 	int (*fn)(struct se_device *dev, void *data);
 	void *data;
 };
 
 static int target_devices_idr_iter(int id, void *p, void *data)
+	 __must_hold(&device_mutex)
 {
 	struct devices_idr_iter *iter = data;
 	struct se_device *dev = p;
+	int ret;
+
+	config_item_put(iter->prev_item);
+	iter->prev_item = NULL;
 
 	/*
 	 * We add the device early to the idr, so it can be used
@@ -922,7 +928,15 @@ static int target_devices_idr_iter(int i
 	if (!(dev->dev_flags & DF_CONFIGURED))
 		return 0;
 
-	return iter->fn(dev, iter->data);
+	iter->prev_item = config_item_get_unless_zero(&dev->dev_group.cg_item);
+	if (!iter->prev_item)
+		return 0;
+	mutex_unlock(&device_mutex);
+
+	ret = iter->fn(dev, iter->data);
+
+	mutex_lock(&device_mutex);
+	return ret;
 }
 
 /**
@@ -936,15 +950,13 @@ static int target_devices_idr_iter(int i
 int target_for_each_device(int (*fn)(struct se_device *dev, void *data),
 			   void *data)
 {
-	struct devices_idr_iter iter;
+	struct devices_idr_iter iter = { .fn = fn, .data = data };
 	int ret;
 
-	iter.fn = fn;
-	iter.data = data;
-
 	mutex_lock(&device_mutex);
 	ret = idr_for_each(&devices_idr, target_devices_idr_iter, &iter);
 	mutex_unlock(&device_mutex);
+	config_item_put(iter.prev_item);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/thermal/imx_thermal.c linux-libre-4.18.12-gnu/drivers/thermal/imx_thermal.c
--- linux-libre-4.18.11-gnu/drivers/thermal/imx_thermal.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/thermal/imx_thermal.c	2018-10-03 19:59:28.000000000 -0400
@@ -604,7 +604,10 @@ static int imx_init_from_nvmem_cells(str
 	ret = nvmem_cell_read_u32(&pdev->dev, "calib", &val);
 	if (ret)
 		return ret;
-	imx_init_calib(pdev, val);
+
+	ret = imx_init_calib(pdev, val);
+	if (ret)
+		return ret;
 
 	ret = nvmem_cell_read_u32(&pdev->dev, "temp_grade", &val);
 	if (ret)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/thermal/of-thermal.c linux-libre-4.18.12-gnu/drivers/thermal/of-thermal.c
--- linux-libre-4.18.11-gnu/drivers/thermal/of-thermal.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/thermal/of-thermal.c	2018-10-03 19:59:28.000000000 -0400
@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct th
 
 	mutex_lock(&tz->lock);
 
-	if (mode == THERMAL_DEVICE_ENABLED)
+	if (mode == THERMAL_DEVICE_ENABLED) {
 		tz->polling_delay = data->polling_delay;
-	else
+		tz->passive_delay = data->passive_delay;
+	} else {
 		tz->polling_delay = 0;
+		tz->passive_delay = 0;
+	}
 
 	mutex_unlock(&tz->lock);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/8250/serial_cs.c linux-libre-4.18.12-gnu/drivers/tty/serial/8250/serial_cs.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/8250/serial_cs.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/8250/serial_cs.c	2018-10-03 19:59:28.000000000 -0400
@@ -638,8 +638,10 @@ static int serial_config(struct pcmcia_d
 	    (link->has_func_id) &&
 	    (link->socket->pcmcia_pfc == 0) &&
 	    ((link->func_id == CISTPL_FUNCID_MULTI) ||
-	     (link->func_id == CISTPL_FUNCID_SERIAL)))
-		pcmcia_loop_config(link, serial_check_for_multi, info);
+	     (link->func_id == CISTPL_FUNCID_SERIAL))) {
+		if (pcmcia_loop_config(link, serial_check_for_multi, info))
+			goto failed;
+	}
 
 	/*
 	 * Apply any multi-port quirk.
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-libre-4.18.12-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c	2018-10-03 19:59:28.000000000 -0400
@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, str
 	/* Get the address of the host memory buffer.
 	 */
 	bdp = pinfo->rx_cur;
-	while (bdp->cbd_sc & BD_SC_EMPTY)
-		;
+	if (bdp->cbd_sc & BD_SC_EMPTY)
+		return NO_POLL_CHAR;
 
 	/* If the buffer address is in the CPM DPRAM, don't
 	 * convert it.
@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart
 		poll_chars = 0;
 	}
 	if (poll_chars <= 0) {
-		poll_chars = poll_wait_key(poll_buf, pinfo);
+		int ret = poll_wait_key(poll_buf, pinfo);
+
+		if (ret == NO_POLL_CHAR)
+			return ret;
+		poll_chars = ret;
 		pollp = poll_buf;
 	}
 	poll_chars--;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/fsl_lpuart.c linux-libre-4.18.12-gnu/drivers/tty/serial/fsl_lpuart.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/fsl_lpuart.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/fsl_lpuart.c	2018-10-03 19:59:28.000000000 -0400
@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(st
 	struct circ_buf *ring = &sport->rx_ring;
 	int ret, nent;
 	int bits, baud;
-	struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
+	struct tty_port *port = &sport->port.state->port;
+	struct tty_struct *tty = port->tty;
 	struct ktermios *termios = &tty->termios;
 
 	baud = tty_get_baud_rate(tty);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/imx.c linux-libre-4.18.12-gnu/drivers/tty/serial/imx.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/imx.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/imx.c	2018-10-03 19:59:28.000000000 -0400
@@ -2350,6 +2350,14 @@ static int imx_uart_probe(struct platfor
 				ret);
 			return ret;
 		}
+
+		ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
+				       dev_name(&pdev->dev), sport);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to request rts irq: %d\n",
+				ret);
+			return ret;
+		}
 	} else {
 		ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
 				       dev_name(&pdev->dev), sport);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/mvebu-uart.c linux-libre-4.18.12-gnu/drivers/tty/serial/mvebu-uart.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/mvebu-uart.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/mvebu-uart.c	2018-10-03 19:59:28.000000000 -0400
@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struc
 		termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
 		termios->c_cflag &= CREAD | CBAUD;
 		termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
+		termios->c_cflag |= CS8;
 	}
 
 	spin_unlock_irqrestore(&port->lock, flags);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/pxa.c linux-libre-4.18.12-gnu/drivers/tty/serial/pxa.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/pxa.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/pxa.c	2018-10-03 19:59:28.000000000 -0400
@@ -887,7 +887,8 @@ static int serial_pxa_probe(struct platf
 		goto err_clk;
 	if (sport->port.line >= ARRAY_SIZE(serial_pxa_ports)) {
 		dev_err(&dev->dev, "serial%d out of range\n", sport->port.line);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_clk;
 	}
 	snprintf(sport->name, PXA_NAME_LEN - 1, "UART%d", sport->port.line + 1);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/tty/serial/sh-sci.c linux-libre-4.18.12-gnu/drivers/tty/serial/sh-sci.c
--- linux-libre-4.18.11-gnu/drivers/tty/serial/sh-sci.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/tty/serial/sh-sci.c	2018-10-03 19:59:28.000000000 -0400
@@ -2099,6 +2099,8 @@ static void sci_shutdown(struct uart_por
 	}
 #endif
 
+	if (s->rx_trigger > 1 && s->rx_fifo_timeout > 0)
+		del_timer_sync(&s->rx_fifo_timer);
 	sci_free_irq(s);
 	sci_free_dma(port);
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/class/cdc-wdm.c linux-libre-4.18.12-gnu/drivers/usb/class/cdc-wdm.c
--- linux-libre-4.18.11-gnu/drivers/usb/class/cdc-wdm.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/class/cdc-wdm.c	2018-10-03 19:59:28.000000000 -0400
@@ -458,7 +458,7 @@ static int service_outstanding_interrupt
 
 	set_bit(WDM_RESPONDING, &desc->flags);
 	spin_unlock_irq(&desc->iuspin);
-	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
 		dev_err(&desc->intf->dev,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/common/roles.c linux-libre-4.18.12-gnu/drivers/usb/common/roles.c
--- linux-libre-4.18.11-gnu/drivers/usb/common/roles.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/common/roles.c	2018-10-03 19:59:28.000000000 -0400
@@ -109,8 +109,15 @@ static void *usb_role_switch_match(struc
  */
 struct usb_role_switch *usb_role_switch_get(struct device *dev)
 {
-	return device_connection_find_match(dev, "usb-role-switch", NULL,
-					    usb_role_switch_match);
+	struct usb_role_switch *sw;
+
+	sw = device_connection_find_match(dev, "usb-role-switch", NULL,
+					  usb_role_switch_match);
+
+	if (!IS_ERR_OR_NULL(sw))
+		WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+
+	return sw;
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_get);
 
@@ -122,8 +129,10 @@ EXPORT_SYMBOL_GPL(usb_role_switch_get);
  */
 void usb_role_switch_put(struct usb_role_switch *sw)
 {
-	if (!IS_ERR_OR_NULL(sw))
+	if (!IS_ERR_OR_NULL(sw)) {
 		put_device(&sw->dev);
+		module_put(sw->dev.parent->driver->owner);
+	}
 }
 EXPORT_SYMBOL_GPL(usb_role_switch_put);
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/core/devio.c linux-libre-4.18.12-gnu/drivers/usb/core/devio.c
--- linux-libre-4.18.11-gnu/drivers/usb/core/devio.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/core/devio.c	2018-10-03 19:59:28.000000000 -0400
@@ -1433,10 +1433,13 @@ static int proc_do_submiturb(struct usb_
 	struct async *as = NULL;
 	struct usb_ctrlrequest *dr = NULL;
 	unsigned int u, totlen, isofrmlen;
-	int i, ret, is_in, num_sgs = 0, ifnum = -1;
+	int i, ret, num_sgs = 0, ifnum = -1;
 	int number_of_packets = 0;
 	unsigned int stream_id = 0;
 	void *buf;
+	bool is_in;
+	bool allow_short = false;
+	bool allow_zero = false;
 	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
 				USBDEVFS_URB_BULK_CONTINUATION |
 				USBDEVFS_URB_NO_FSBR |
@@ -1470,6 +1473,8 @@ static int proc_do_submiturb(struct usb_
 	u = 0;
 	switch (uurb->type) {
 	case USBDEVFS_URB_TYPE_CONTROL:
+		if (is_in)
+			allow_short = true;
 		if (!usb_endpoint_xfer_control(&ep->desc))
 			return -EINVAL;
 		/* min 8 byte setup packet */
@@ -1510,6 +1515,10 @@ static int proc_do_submiturb(struct usb_
 		break;
 
 	case USBDEVFS_URB_TYPE_BULK:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		switch (usb_endpoint_type(&ep->desc)) {
 		case USB_ENDPOINT_XFER_CONTROL:
 		case USB_ENDPOINT_XFER_ISOC:
@@ -1530,6 +1539,10 @@ static int proc_do_submiturb(struct usb_
 		if (!usb_endpoint_xfer_int(&ep->desc))
 			return -EINVAL;
  interrupt_urb:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		break;
 
 	case USBDEVFS_URB_TYPE_ISO:
@@ -1675,14 +1688,19 @@ static int proc_do_submiturb(struct usb_
 	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
 	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
 		u |= URB_ISO_ASAP;
-	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
 		u |= URB_SHORT_NOT_OK;
-	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
 		u |= URB_ZERO_PACKET;
 	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
 		u |= URB_NO_INTERRUPT;
 	as->urb->transfer_flags = u;
 
+	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
+	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
+
 	as->urb->transfer_buffer_length = uurb->buffer_length;
 	as->urb->setup_packet = (unsigned char *)dr;
 	dr = NULL;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/core/driver.c linux-libre-4.18.12-gnu/drivers/usb/core/driver.c
--- linux-libre-4.18.11-gnu/drivers/usb/core/driver.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/core/driver.c	2018-10-03 19:59:28.000000000 -0400
@@ -512,7 +512,6 @@ int usb_driver_claim_interface(struct us
 	struct device *dev;
 	struct usb_device *udev;
 	int retval = 0;
-	int lpm_disable_error = -ENODEV;
 
 	if (!iface)
 		return -ENODEV;
@@ -533,16 +532,6 @@ int usb_driver_claim_interface(struct us
 
 	iface->condition = USB_INTERFACE_BOUND;
 
-	/* See the comment about disabling LPM in usb_probe_interface(). */
-	if (driver->disable_hub_initiated_lpm) {
-		lpm_disable_error = usb_unlocked_disable_lpm(udev);
-		if (lpm_disable_error) {
-			dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n",
-				__func__, driver->name);
-			return -ENOMEM;
-		}
-	}
-
 	/* Claimed interfaces are initially inactive (suspended) and
 	 * runtime-PM-enabled, but only if the driver has autosuspend
 	 * support.  Otherwise they are marked active, to prevent the
@@ -561,9 +550,20 @@ int usb_driver_claim_interface(struct us
 	if (device_is_registered(dev))
 		retval = device_bind_driver(dev);
 
-	/* Attempt to re-enable USB3 LPM, if the disable was successful. */
-	if (!lpm_disable_error)
-		usb_unlocked_enable_lpm(udev);
+	if (retval) {
+		dev->driver = NULL;
+		usb_set_intfdata(iface, NULL);
+		iface->needs_remote_wakeup = 0;
+		iface->condition = USB_INTERFACE_UNBOUND;
+
+		/*
+		 * Unbound interfaces are always runtime-PM-disabled
+		 * and runtime-PM-suspended
+		 */
+		if (driver->supports_autosuspend)
+			pm_runtime_disable(dev);
+		pm_runtime_set_suspended(dev);
+	}
 
 	return retval;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/core/quirks.c linux-libre-4.18.12-gnu/drivers/usb/core/quirks.c
--- linux-libre-4.18.11-gnu/drivers/usb/core/quirks.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/core/quirks.c	2018-10-03 19:59:28.000000000 -0400
@@ -58,6 +58,7 @@ static int quirks_param_set(const char *
 	quirk_list = kcalloc(quirk_count, sizeof(struct quirk_entry),
 			     GFP_KERNEL);
 	if (!quirk_list) {
+		quirk_count = 0;
 		mutex_unlock(&quirk_mutex);
 		return -ENOMEM;
 	}
@@ -154,7 +155,7 @@ static struct kparam_string quirks_param
 	.string = quirks_param,
 };
 
-module_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
+device_param_cb(quirks, &quirks_param_ops, &quirks_param_string, 0644);
 MODULE_PARM_DESC(quirks, "Add/modify USB quirks by specifying quirks=vendorID:productID:quirks");
 
 /* Lists of quirky USB devices, split in device quirks and interface quirks.
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/core/usb.c linux-libre-4.18.12-gnu/drivers/usb/core/usb.c
--- linux-libre-4.18.11-gnu/drivers/usb/core/usb.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/core/usb.c	2018-10-03 19:59:28.000000000 -0400
@@ -228,6 +228,8 @@ struct usb_host_interface *usb_find_alt_
 	struct usb_interface_cache *intf_cache = NULL;
 	int i;
 
+	if (!config)
+		return NULL;
 	for (i = 0; i < config->desc.bNumInterfaces; i++) {
 		if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
 				== iface_num) {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/musb/musb_dsps.c linux-libre-4.18.12-gnu/drivers/usb/musb/musb_dsps.c
--- linux-libre-4.18.11-gnu/drivers/usb/musb/musb_dsps.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/musb/musb_dsps.c	2018-10-03 19:59:28.000000000 -0400
@@ -658,16 +658,6 @@ dsps_dma_controller_create(struct musb *
 	return controller;
 }
 
-static void dsps_dma_controller_destroy(struct dma_controller *c)
-{
-	struct musb *musb = c->musb;
-	struct dsps_glue *glue = dev_get_drvdata(musb->controller->parent);
-	void __iomem *usbss_base = glue->usbss_base;
-
-	musb_writel(usbss_base, USBSS_IRQ_CLEARR, USBSS_IRQ_PD_COMP);
-	cppi41_dma_controller_destroy(c);
-}
-
 #ifdef CONFIG_PM_SLEEP
 static void dsps_dma_controller_suspend(struct dsps_glue *glue)
 {
@@ -697,7 +687,7 @@ static struct musb_platform_ops dsps_ops
 
 #ifdef CONFIG_USB_TI_CPPI41_DMA
 	.dma_init	= dsps_dma_controller_create,
-	.dma_exit	= dsps_dma_controller_destroy,
+	.dma_exit	= cppi41_dma_controller_destroy,
 #endif
 	.enable		= dsps_musb_enable,
 	.disable	= dsps_musb_disable,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/serial/kobil_sct.c linux-libre-4.18.12-gnu/drivers/usb/serial/kobil_sct.c
--- linux-libre-4.18.11-gnu/drivers/usb/serial/kobil_sct.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/serial/kobil_sct.c	2018-10-03 19:59:28.000000000 -0400
@@ -393,12 +393,20 @@ static int kobil_tiocmget(struct tty_str
 			  transfer_buffer_length,
 			  KOBIL_TIMEOUT);
 
-	dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n",
-		__func__, result, transfer_buffer[0]);
+	dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n",
+			result);
+	if (result < 1) {
+		if (result >= 0)
+			result = -EIO;
+		goto out_free;
+	}
+
+	dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]);
 
 	result = 0;
 	if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
 		result = TIOCM_DSR;
+out_free:
 	kfree(transfer_buffer);
 	return result;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/usb/wusbcore/security.c linux-libre-4.18.12-gnu/drivers/usb/wusbcore/security.c
--- linux-libre-4.18.11-gnu/drivers/usb/wusbcore/security.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/usb/wusbcore/security.c	2018-10-03 19:59:28.000000000 -0400
@@ -217,7 +217,7 @@ int wusb_dev_sec_add(struct wusbhc *wusb
 
 	result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
 				    0, secd, sizeof(*secd));
-	if (result < sizeof(*secd)) {
+	if (result < (int)sizeof(*secd)) {
 		dev_err(dev, "Can't read security descriptor or "
 			"not enough data: %d\n", result);
 		goto out;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/uwb/hwa-rc.c linux-libre-4.18.12-gnu/drivers/uwb/hwa-rc.c
--- linux-libre-4.18.11-gnu/drivers/uwb/hwa-rc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/uwb/hwa-rc.c	2018-10-03 19:59:28.000000000 -0400
@@ -873,6 +873,7 @@ error_get_version:
 error_rc_add:
 	usb_put_intf(iface);
 	usb_put_dev(hwarc->usb_dev);
+	kfree(hwarc);
 error_alloc:
 	uwb_rc_put(uwb_rc);
 error_rc_alloc:
diff -druNp --no-dereference linux-libre-4.18.11-gnu/drivers/vhost/net.c linux-libre-4.18.12-gnu/drivers/vhost/net.c
--- linux-libre-4.18.11-gnu/drivers/vhost/net.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/drivers/vhost/net.c	2018-10-03 19:59:28.000000000 -0400
@@ -396,13 +396,10 @@ static inline unsigned long busy_clock(v
 	return local_clock() >> 10;
 }
 
-static bool vhost_can_busy_poll(struct vhost_dev *dev,
-				unsigned long endtime)
+static bool vhost_can_busy_poll(unsigned long endtime)
 {
-	return likely(!need_resched()) &&
-	       likely(!time_after(busy_clock(), endtime)) &&
-	       likely(!signal_pending(current)) &&
-	       !vhost_has_work(dev);
+	return likely(!need_resched() && !time_after(busy_clock(), endtime) &&
+		      !signal_pending(current));
 }
 
 static void vhost_net_disable_vq(struct vhost_net *n,
@@ -434,7 +431,8 @@ static int vhost_net_enable_vq(struct vh
 static int vhost_net_tx_get_vq_desc(struct vhost_net *net,
 				    struct vhost_virtqueue *vq,
 				    struct iovec iov[], unsigned int iov_size,
-				    unsigned int *out_num, unsigned int *in_num)
+				    unsigned int *out_num, unsigned int *in_num,
+				    bool *busyloop_intr)
 {
 	unsigned long uninitialized_var(endtime);
 	int r = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
@@ -443,9 +441,15 @@ static int vhost_net_tx_get_vq_desc(stru
 	if (r == vq->num && vq->busyloop_timeout) {
 		preempt_disable();
 		endtime = busy_clock() + vq->busyloop_timeout;
-		while (vhost_can_busy_poll(vq->dev, endtime) &&
-		       vhost_vq_avail_empty(vq->dev, vq))
+		while (vhost_can_busy_poll(endtime)) {
+			if (vhost_has_work(vq->dev)) {
+				*busyloop_intr = true;
+				break;
+			}
+			if (!vhost_vq_avail_empty(vq->dev, vq))
+				break;
 			cpu_relax();
+		}
 		preempt_enable();
 		r = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
 				      out_num, in_num, NULL, NULL);
@@ -501,20 +505,24 @@ static void handle_tx(struct vhost_net *
 	zcopy = nvq->ubufs;
 
 	for (;;) {
+		bool busyloop_intr;
+
 		/* Release DMAs done buffers first */
 		if (zcopy)
 			vhost_zerocopy_signal_used(net, vq);
 
-
+		busyloop_intr = false;
 		head = vhost_net_tx_get_vq_desc(net, vq, vq->iov,
 						ARRAY_SIZE(vq->iov),
-						&out, &in);
+						&out, &in, &busyloop_intr);
 		/* On error, stop handling until the next kick. */
 		if (unlikely(head < 0))
 			break;
 		/* Nothing new?  Wait for eventfd to tell us they refilled. */
 		if (head == vq->num) {
-			if (unlikely(vhost_enable_notify(&net->dev, vq))) {
+			if (unlikely(busyloop_intr)) {
+				vhost_poll_queue(&vq->poll);
+			} else if (unlikely(vhost_enable_notify(&net->dev, vq))) {
 				vhost_disable_notify(&net->dev, vq);
 				continue;
 			}
@@ -663,7 +671,8 @@ static int vhost_net_rx_peek_head_len(st
 		preempt_disable();
 		endtime = busy_clock() + vq->busyloop_timeout;
 
-		while (vhost_can_busy_poll(&net->dev, endtime) &&
+		while (vhost_can_busy_poll(endtime) &&
+		       !vhost_has_work(&net->dev) &&
 		       !sk_has_rx_data(sk) &&
 		       vhost_vq_avail_empty(&net->dev, vq))
 			cpu_relax();
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/dax.c linux-libre-4.18.12-gnu/fs/dax.c
--- linux-libre-4.18.11-gnu/fs/dax.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/dax.c	2018-10-03 19:59:28.000000000 -0400
@@ -1007,21 +1007,12 @@ static vm_fault_t dax_load_hole(struct a
 {
 	struct inode *inode = mapping->host;
 	unsigned long vaddr = vmf->address;
-	vm_fault_t ret = VM_FAULT_NOPAGE;
-	struct page *zero_page;
-	pfn_t pfn;
-
-	zero_page = ZERO_PAGE(0);
-	if (unlikely(!zero_page)) {
-		ret = VM_FAULT_OOM;
-		goto out;
-	}
+	pfn_t pfn = pfn_to_pfn_t(my_zero_pfn(vaddr));
+	vm_fault_t ret;
 
-	pfn = page_to_pfn_t(zero_page);
 	dax_insert_mapping_entry(mapping, vmf, entry, pfn, RADIX_DAX_ZERO_PAGE,
 			false);
 	ret = vmf_insert_mixed(vmf->vma, vaddr, pfn);
-out:
 	trace_dax_load_hole(inode, vmf, ret);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/ext2/inode.c linux-libre-4.18.12-gnu/fs/ext2/inode.c
--- linux-libre-4.18.11-gnu/fs/ext2/inode.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/ext2/inode.c	2018-10-03 19:59:28.000000000 -0400
@@ -1448,6 +1448,7 @@ struct inode *ext2_iget (struct super_bl
 	}
 	inode->i_blocks = le32_to_cpu(raw_inode->i_blocks);
 	ei->i_flags = le32_to_cpu(raw_inode->i_flags);
+	ext2_set_inode_flags(inode);
 	ei->i_faddr = le32_to_cpu(raw_inode->i_faddr);
 	ei->i_frag_no = raw_inode->i_frag;
 	ei->i_frag_size = raw_inode->i_fsize;
@@ -1517,7 +1518,6 @@ struct inode *ext2_iget (struct super_bl
 			   new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
 	}
 	brelse (bh);
-	ext2_set_inode_flags(inode);
 	unlock_new_inode(inode);
 	return inode;
 	
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/iomap.c linux-libre-4.18.12-gnu/fs/iomap.c
--- linux-libre-4.18.11-gnu/fs/iomap.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/iomap.c	2018-10-03 19:59:28.000000000 -0400
@@ -811,6 +811,7 @@ struct iomap_dio {
 	atomic_t		ref;
 	unsigned		flags;
 	int			error;
+	bool			wait_for_completion;
 
 	union {
 		/* used during submission and for synchronous completion: */
@@ -914,9 +915,8 @@ static void iomap_dio_bio_end_io(struct
 		iomap_dio_set_error(dio, blk_status_to_errno(bio->bi_status));
 
 	if (atomic_dec_and_test(&dio->ref)) {
-		if (is_sync_kiocb(dio->iocb)) {
+		if (dio->wait_for_completion) {
 			struct task_struct *waiter = dio->submit.waiter;
-
 			WRITE_ONCE(dio->submit.waiter, NULL);
 			wake_up_process(waiter);
 		} else if (dio->flags & IOMAP_DIO_WRITE) {
@@ -1131,13 +1131,12 @@ iomap_dio_rw(struct kiocb *iocb, struct
 	dio->end_io = end_io;
 	dio->error = 0;
 	dio->flags = 0;
+	dio->wait_for_completion = is_sync_kiocb(iocb);
 
 	dio->submit.iter = iter;
-	if (is_sync_kiocb(iocb)) {
-		dio->submit.waiter = current;
-		dio->submit.cookie = BLK_QC_T_NONE;
-		dio->submit.last_queue = NULL;
-	}
+	dio->submit.waiter = current;
+	dio->submit.cookie = BLK_QC_T_NONE;
+	dio->submit.last_queue = NULL;
 
 	if (iov_iter_rw(iter) == READ) {
 		if (pos >= dio->i_size)
@@ -1187,7 +1186,7 @@ iomap_dio_rw(struct kiocb *iocb, struct
 		dio_warn_stale_pagecache(iocb->ki_filp);
 	ret = 0;
 
-	if (iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
+	if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
 	    !inode->i_sb->s_dio_done_wq) {
 		ret = sb_init_dio_done_wq(inode->i_sb);
 		if (ret < 0)
@@ -1202,8 +1201,10 @@ iomap_dio_rw(struct kiocb *iocb, struct
 				iomap_dio_actor);
 		if (ret <= 0) {
 			/* magic error code to fall back to buffered I/O */
-			if (ret == -ENOTBLK)
+			if (ret == -ENOTBLK) {
+				dio->wait_for_completion = true;
 				ret = 0;
+			}
 			break;
 		}
 		pos += ret;
@@ -1224,7 +1225,7 @@ iomap_dio_rw(struct kiocb *iocb, struct
 		dio->flags &= ~IOMAP_DIO_NEED_SYNC;
 
 	if (!atomic_dec_and_test(&dio->ref)) {
-		if (!is_sync_kiocb(iocb))
+		if (!dio->wait_for_completion)
 			return -EIOCBQUEUED;
 
 		for (;;) {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/isofs/inode.c linux-libre-4.18.12-gnu/fs/isofs/inode.c
--- linux-libre-4.18.11-gnu/fs/isofs/inode.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/isofs/inode.c	2018-10-03 19:59:28.000000000 -0400
@@ -24,6 +24,7 @@
 #include <linux/mpage.h>
 #include <linux/user_namespace.h>
 #include <linux/seq_file.h>
+#include <linux/blkdev.h>
 
 #include "isofs.h"
 #include "zisofs.h"
@@ -653,6 +654,12 @@ static int isofs_fill_super(struct super
 	/*
 	 * What if bugger tells us to go beyond page size?
 	 */
+	if (bdev_logical_block_size(s->s_bdev) > 2048) {
+		printk(KERN_WARNING
+		       "ISOFS: unsupported/invalid hardware sector size %d\n",
+			bdev_logical_block_size(s->s_bdev));
+		goto out_freesbi;
+	}
 	opt.blocksize = sb_min_blocksize(s, opt.blocksize);
 
 	sbi->s_high_sierra = 0; /* default is iso9660 */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/locks.c linux-libre-4.18.12-gnu/fs/locks.c
--- linux-libre-4.18.11-gnu/fs/locks.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/locks.c	2018-10-03 19:59:28.000000000 -0400
@@ -2072,6 +2072,13 @@ static pid_t locks_translate_pid(struct
 		return -1;
 	if (IS_REMOTELCK(fl))
 		return fl->fl_pid;
+	/*
+	 * If the flock owner process is dead and its pid has been already
+	 * freed, the translation below won't work, but we still want to show
+	 * flock owner pid number in init pidns.
+	 */
+	if (ns == &init_pid_ns)
+		return (pid_t)fl->fl_pid;
 
 	rcu_read_lock();
 	pid = find_pid_ns(fl->fl_pid, &init_pid_ns);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/fs/nfsd/nfs4proc.c linux-libre-4.18.12-gnu/fs/nfsd/nfs4proc.c
--- linux-libre-4.18.11-gnu/fs/nfsd/nfs4proc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/fs/nfsd/nfs4proc.c	2018-10-03 19:59:28.000000000 -0400
@@ -1726,6 +1726,7 @@ nfsd4_proc_compound(struct svc_rqst *rqs
 	if (status) {
 		op = &args->ops[0];
 		op->status = status;
+		resp->opcnt = 1;
 		goto encode_op;
 	}
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/arm-smccc.h linux-libre-4.18.12-gnu/include/linux/arm-smccc.h
--- linux-libre-4.18.11-gnu/include/linux/arm-smccc.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/arm-smccc.h	2018-10-03 19:59:28.000000000 -0400
@@ -199,47 +199,57 @@ asmlinkage void __arm_smccc_hvc(unsigned
 
 #define __declare_arg_0(a0, res)					\
 	struct arm_smccc_res   *___res = res;				\
-	register u32           r0 asm("r0") = a0;			\
+	register unsigned long r0 asm("r0") = (u32)a0;			\
 	register unsigned long r1 asm("r1");				\
 	register unsigned long r2 asm("r2");				\
 	register unsigned long r3 asm("r3")
 
 #define __declare_arg_1(a0, a1, res)					\
+	typeof(a1) __a1 = a1;						\
 	struct arm_smccc_res   *___res = res;				\
-	register u32           r0 asm("r0") = a0;			\
-	register typeof(a1)    r1 asm("r1") = a1;			\
+	register unsigned long r0 asm("r0") = (u32)a0;			\
+	register unsigned long r1 asm("r1") = __a1;			\
 	register unsigned long r2 asm("r2");				\
 	register unsigned long r3 asm("r3")
 
 #define __declare_arg_2(a0, a1, a2, res)				\
+	typeof(a1) __a1 = a1;						\
+	typeof(a2) __a2 = a2;						\
 	struct arm_smccc_res   *___res = res;				\
-	register u32           r0 asm("r0") = a0;			\
-	register typeof(a1)    r1 asm("r1") = a1;			\
-	register typeof(a2)    r2 asm("r2") = a2;			\
+	register unsigned long r0 asm("r0") = (u32)a0;			\
+	register unsigned long r1 asm("r1") = __a1;			\
+	register unsigned long r2 asm("r2") = __a2;			\
 	register unsigned long r3 asm("r3")
 
 #define __declare_arg_3(a0, a1, a2, a3, res)				\
+	typeof(a1) __a1 = a1;						\
+	typeof(a2) __a2 = a2;						\
+	typeof(a3) __a3 = a3;						\
 	struct arm_smccc_res   *___res = res;				\
-	register u32           r0 asm("r0") = a0;			\
-	register typeof(a1)    r1 asm("r1") = a1;			\
-	register typeof(a2)    r2 asm("r2") = a2;			\
-	register typeof(a3)    r3 asm("r3") = a3
+	register unsigned long r0 asm("r0") = (u32)a0;			\
+	register unsigned long r1 asm("r1") = __a1;			\
+	register unsigned long r2 asm("r2") = __a2;			\
+	register unsigned long r3 asm("r3") = __a3
 
 #define __declare_arg_4(a0, a1, a2, a3, a4, res)			\
+	typeof(a4) __a4 = a4;						\
 	__declare_arg_3(a0, a1, a2, a3, res);				\
-	register typeof(a4) r4 asm("r4") = a4
+	register unsigned long r4 asm("r4") = __a4
 
 #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res)			\
+	typeof(a5) __a5 = a5;						\
 	__declare_arg_4(a0, a1, a2, a3, a4, res);			\
-	register typeof(a5) r5 asm("r5") = a5
+	register unsigned long r5 asm("r5") = __a5
 
 #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res)		\
+	typeof(a6) __a6 = a6;						\
 	__declare_arg_5(a0, a1, a2, a3, a4, a5, res);			\
-	register typeof(a6) r6 asm("r6") = a6
+	register unsigned long r6 asm("r6") = __a6
 
 #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res)		\
+	typeof(a7) __a7 = a7;						\
 	__declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res);		\
-	register typeof(a7) r7 asm("r7") = a7
+	register unsigned long r7 asm("r7") = __a7
 
 #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
 #define __declare_args(count, ...)  ___declare_args(count, __VA_ARGS__)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/bitfield.h linux-libre-4.18.12-gnu/include/linux/bitfield.h
--- linux-libre-4.18.11-gnu/include/linux/bitfield.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/bitfield.h	2018-10-03 19:59:28.000000000 -0400
@@ -104,7 +104,7 @@
 		(typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask));	\
 	})
 
-extern void __compiletime_warning("value doesn't fit into mask")
+extern void __compiletime_error("value doesn't fit into mask")
 __field_overflow(void);
 extern void __compiletime_error("bad bitfield mask")
 __bad_mask(void);
@@ -121,8 +121,8 @@ static __always_inline u64 field_mask(u6
 #define ____MAKE_OP(type,base,to,from)					\
 static __always_inline __##type type##_encode_bits(base v, base field)	\
 {									\
-        if (__builtin_constant_p(v) &&	(v & ~field_multiplier(field)))	\
-			    __field_overflow();				\
+	if (__builtin_constant_p(v) && (v & ~field_mask(field)))	\
+		__field_overflow();					\
 	return to((v & field_mask(field)) * field_multiplier(field));	\
 }									\
 static __always_inline __##type type##_replace_bits(__##type old,	\
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/platform_data/ina2xx.h linux-libre-4.18.12-gnu/include/linux/platform_data/ina2xx.h
--- linux-libre-4.18.11-gnu/include/linux/platform_data/ina2xx.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/platform_data/ina2xx.h	2018-10-03 19:59:28.000000000 -0400
@@ -1,7 +1,7 @@
 /*
  * Driver for Texas Instruments INA219, INA226 power monitor chips
  *
- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
+ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/posix-timers.h linux-libre-4.18.12-gnu/include/linux/posix-timers.h
--- linux-libre-4.18.11-gnu/include/linux/posix-timers.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/posix-timers.h	2018-10-03 19:59:28.000000000 -0400
@@ -95,8 +95,8 @@ struct k_itimer {
 	clockid_t		it_clock;
 	timer_t			it_id;
 	int			it_active;
-	int			it_overrun;
-	int			it_overrun_last;
+	s64			it_overrun;
+	s64			it_overrun_last;
 	int			it_requeue_pending;
 	int			it_sigev_notify;
 	ktime_t			it_interval;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/power_supply.h linux-libre-4.18.12-gnu/include/linux/power_supply.h
--- linux-libre-4.18.11-gnu/include/linux/power_supply.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/power_supply.h	2018-10-03 19:59:28.000000000 -0400
@@ -269,6 +269,7 @@ struct power_supply {
 	spinlock_t changed_lock;
 	bool changed;
 	bool initialized;
+	bool removing;
 	atomic_t use_cnt;
 #ifdef CONFIG_THERMAL
 	struct thermal_zone_device *tzd;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/regulator/machine.h linux-libre-4.18.12-gnu/include/linux/regulator/machine.h
--- linux-libre-4.18.11-gnu/include/linux/regulator/machine.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/regulator/machine.h	2018-10-03 19:59:28.000000000 -0400
@@ -48,9 +48,9 @@ struct regulator;
  * DISABLE_IN_SUSPEND	- turn off regulator in suspend states
  * ENABLE_IN_SUSPEND	- keep regulator on in suspend states
  */
-#define DO_NOTHING_IN_SUSPEND	(-1)
-#define DISABLE_IN_SUSPEND	0
-#define ENABLE_IN_SUSPEND	1
+#define DO_NOTHING_IN_SUSPEND	0
+#define DISABLE_IN_SUSPEND	1
+#define ENABLE_IN_SUSPEND	2
 
 /* Regulator active discharge flags */
 enum regulator_active_discharge {
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/linux/uio.h linux-libre-4.18.12-gnu/include/linux/uio.h
--- linux-libre-4.18.11-gnu/include/linux/uio.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/linux/uio.h	2018-10-03 19:59:28.000000000 -0400
@@ -172,7 +172,7 @@ size_t copy_from_iter_flushcache(void *a
 static __always_inline __must_check
 size_t copy_to_iter_mcsafe(void *addr, size_t bytes, struct iov_iter *i)
 {
-	if (unlikely(!check_copy_size(addr, bytes, false)))
+	if (unlikely(!check_copy_size(addr, bytes, true)))
 		return 0;
 	else
 		return _copy_to_iter_mcsafe(addr, bytes, i);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/media/v4l2-fh.h linux-libre-4.18.12-gnu/include/media/v4l2-fh.h
--- linux-libre-4.18.11-gnu/include/media/v4l2-fh.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/media/v4l2-fh.h	2018-10-03 19:59:28.000000000 -0400
@@ -38,10 +38,13 @@ struct v4l2_ctrl_handler;
  * @prio: priority of the file handler, as defined by &enum v4l2_priority
  *
  * @wait: event' s wait queue
+ * @subscribe_lock: serialise changes to the subscribed list; guarantee that
+ *		    the add and del event callbacks are orderly called
  * @subscribed: list of subscribed events
  * @available: list of events waiting to be dequeued
  * @navailable: number of available events at @available list
  * @sequence: event sequence number
+ *
  * @m2m_ctx: pointer to &struct v4l2_m2m_ctx
  */
 struct v4l2_fh {
@@ -52,6 +55,7 @@ struct v4l2_fh {
 
 	/* Events */
 	wait_queue_head_t	wait;
+	struct mutex		subscribe_lock;
 	struct list_head	subscribed;
 	struct list_head	available;
 	unsigned int		navailable;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/include/rdma/opa_addr.h linux-libre-4.18.12-gnu/include/rdma/opa_addr.h
--- linux-libre-4.18.11-gnu/include/rdma/opa_addr.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/include/rdma/opa_addr.h	2018-10-03 19:59:28.000000000 -0400
@@ -120,7 +120,7 @@ static inline bool rdma_is_valid_unicast
 	if (attr->type == RDMA_AH_ATTR_TYPE_IB) {
 		if (!rdma_ah_get_dlid(attr) ||
 		    rdma_ah_get_dlid(attr) >=
-		    be32_to_cpu(IB_MULTICAST_LID_BASE))
+		    be16_to_cpu(IB_MULTICAST_LID_BASE))
 			return false;
 	} else if (attr->type == RDMA_AH_ATTR_TYPE_OPA) {
 		if (!rdma_ah_get_dlid(attr) ||
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/bpf/sockmap.c linux-libre-4.18.12-gnu/kernel/bpf/sockmap.c
--- linux-libre-4.18.11-gnu/kernel/bpf/sockmap.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/bpf/sockmap.c	2018-10-03 19:59:28.000000000 -0400
@@ -1430,12 +1430,15 @@ out:
 static void smap_write_space(struct sock *sk)
 {
 	struct smap_psock *psock;
+	void (*write_space)(struct sock *sk);
 
 	rcu_read_lock();
 	psock = smap_psock_sk(sk);
 	if (likely(psock && test_bit(SMAP_TX_RUNNING, &psock->state)))
 		schedule_work(&psock->tx_work);
+	write_space = psock->save_write_space;
 	rcu_read_unlock();
+	write_space(sk);
 }
 
 static void smap_stop_sock(struct smap_psock *psock, struct sock *sk)
@@ -2143,7 +2146,9 @@ static struct bpf_map *sock_hash_alloc(u
 		return ERR_PTR(-EPERM);
 
 	/* check sanity of attributes */
-	if (attr->max_entries == 0 || attr->value_size != 4 ||
+	if (attr->max_entries == 0 ||
+	    attr->key_size == 0 ||
+	    attr->value_size != 4 ||
 	    attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
 		return ERR_PTR(-EINVAL);
 
@@ -2270,8 +2275,10 @@ static struct htab_elem *alloc_sock_hash
 	}
 	l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
 			     htab->map.numa_node);
-	if (!l_new)
+	if (!l_new) {
+		atomic_dec(&htab->count);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memcpy(l_new->key, key, key_size);
 	l_new->sk = sk;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/events/hw_breakpoint.c linux-libre-4.18.12-gnu/kernel/events/hw_breakpoint.c
--- linux-libre-4.18.11-gnu/kernel/events/hw_breakpoint.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/events/hw_breakpoint.c	2018-10-03 19:59:28.000000000 -0400
@@ -400,16 +400,35 @@ int dbg_release_bp_slot(struct perf_even
 	return 0;
 }
 
-static int validate_hw_breakpoint(struct perf_event *bp)
+#ifndef hw_breakpoint_arch_parse
+int hw_breakpoint_arch_parse(struct perf_event *bp,
+			     const struct perf_event_attr *attr,
+			     struct arch_hw_breakpoint *hw)
 {
-	int ret;
+	int err;
 
-	ret = arch_validate_hwbkpt_settings(bp);
-	if (ret)
-		return ret;
+	err = arch_validate_hwbkpt_settings(bp);
+	if (err)
+		return err;
+
+	*hw = bp->hw.info;
+
+	return 0;
+}
+#endif
+
+static int hw_breakpoint_parse(struct perf_event *bp,
+			       const struct perf_event_attr *attr,
+			       struct arch_hw_breakpoint *hw)
+{
+	int err;
+
+	err = hw_breakpoint_arch_parse(bp, attr, hw);
+	if (err)
+		return err;
 
 	if (arch_check_bp_in_kernelspace(bp)) {
-		if (bp->attr.exclude_kernel)
+		if (attr->exclude_kernel)
 			return -EINVAL;
 		/*
 		 * Don't let unprivileged users set a breakpoint in the trap
@@ -424,19 +443,22 @@ static int validate_hw_breakpoint(struct
 
 int register_perf_hw_breakpoint(struct perf_event *bp)
 {
-	int ret;
-
-	ret = reserve_bp_slot(bp);
-	if (ret)
-		return ret;
+	struct arch_hw_breakpoint hw;
+	int err;
 
-	ret = validate_hw_breakpoint(bp);
+	err = reserve_bp_slot(bp);
+	if (err)
+		return err;
 
-	/* if arch_validate_hwbkpt_settings() fails then release bp slot */
-	if (ret)
+	err = hw_breakpoint_parse(bp, &bp->attr, &hw);
+	if (err) {
 		release_bp_slot(bp);
+		return err;
+	}
 
-	return ret;
+	bp->hw.info = hw;
+
+	return 0;
 }
 
 /**
@@ -464,6 +486,7 @@ modify_user_hw_breakpoint_check(struct p
 	u64 old_len  = bp->attr.bp_len;
 	int old_type = bp->attr.bp_type;
 	bool modify  = attr->bp_type != old_type;
+	struct arch_hw_breakpoint hw;
 	int err = 0;
 
 	bp->attr.bp_addr = attr->bp_addr;
@@ -473,7 +496,7 @@ modify_user_hw_breakpoint_check(struct p
 	if (check && memcmp(&bp->attr, attr, sizeof(*attr)))
 		return -EINVAL;
 
-	err = validate_hw_breakpoint(bp);
+	err = hw_breakpoint_parse(bp, attr, &hw);
 	if (!err && modify)
 		err = modify_bp_slot(bp, old_type);
 
@@ -484,7 +507,9 @@ modify_user_hw_breakpoint_check(struct p
 		return err;
 	}
 
+	bp->hw.info = hw;
 	bp->attr.disabled = attr->disabled;
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/module.c linux-libre-4.18.12-gnu/kernel/module.c
--- linux-libre-4.18.11-gnu/kernel/module.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/module.c	2018-10-03 19:59:28.000000000 -0400
@@ -4067,7 +4067,7 @@ static unsigned long mod_find_symname(st
 
 	for (i = 0; i < kallsyms->num_symtab; i++)
 		if (strcmp(name, symname(kallsyms, i)) == 0 &&
-		    kallsyms->symtab[i].st_info != 'U')
+		    kallsyms->symtab[i].st_shndx != SHN_UNDEF)
 			return kallsyms->symtab[i].st_value;
 	return 0;
 }
@@ -4113,6 +4113,10 @@ int module_kallsyms_on_each_symbol(int (
 		if (mod->state == MODULE_STATE_UNFORMED)
 			continue;
 		for (i = 0; i < kallsyms->num_symtab; i++) {
+
+			if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
+				continue;
+
 			ret = fn(data, symname(kallsyms, i),
 				 mod, kallsyms->symtab[i].st_value);
 			if (ret != 0)
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/time/alarmtimer.c linux-libre-4.18.12-gnu/kernel/time/alarmtimer.c
--- linux-libre-4.18.11-gnu/kernel/time/alarmtimer.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/time/alarmtimer.c	2018-10-03 19:59:28.000000000 -0400
@@ -581,11 +581,11 @@ static void alarm_timer_rearm(struct k_i
  * @timr:	Pointer to the posixtimer data struct
  * @now:	Current time to forward the timer against
  */
-static int alarm_timer_forward(struct k_itimer *timr, ktime_t now)
+static s64 alarm_timer_forward(struct k_itimer *timr, ktime_t now)
 {
 	struct alarm *alarm = &timr->it.alarm.alarmtimer;
 
-	return (int) alarm_forward(alarm, timr->it_interval, now);
+	return alarm_forward(alarm, timr->it_interval, now);
 }
 
 /**
@@ -808,7 +808,8 @@ static int alarm_timer_nsleep(const cloc
 	/* Convert (if necessary) to absolute time */
 	if (flags != TIMER_ABSTIME) {
 		ktime_t now = alarm_bases[type].gettime();
-		exp = ktime_add(now, exp);
+
+		exp = ktime_add_safe(now, exp);
 	}
 
 	ret = alarmtimer_do_nsleep(&alarm, exp, type);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/time/posix-cpu-timers.c linux-libre-4.18.12-gnu/kernel/time/posix-cpu-timers.c
--- linux-libre-4.18.11-gnu/kernel/time/posix-cpu-timers.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/time/posix-cpu-timers.c	2018-10-03 19:59:28.000000000 -0400
@@ -85,7 +85,7 @@ static void bump_cpu_timer(struct k_itim
 			continue;
 
 		timer->it.cpu.expires += incr;
-		timer->it_overrun += 1 << i;
+		timer->it_overrun += 1LL << i;
 		delta -= incr;
 	}
 }
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/time/posix-timers.c linux-libre-4.18.12-gnu/kernel/time/posix-timers.c
--- linux-libre-4.18.11-gnu/kernel/time/posix-timers.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/time/posix-timers.c	2018-10-03 19:59:28.000000000 -0400
@@ -283,6 +283,17 @@ static __init int init_posix_timers(void
 }
 __initcall(init_posix_timers);
 
+/*
+ * The siginfo si_overrun field and the return value of timer_getoverrun(2)
+ * are of type int. Clamp the overrun value to INT_MAX
+ */
+static inline int timer_overrun_to_int(struct k_itimer *timr, int baseval)
+{
+	s64 sum = timr->it_overrun_last + (s64)baseval;
+
+	return sum > (s64)INT_MAX ? INT_MAX : (int)sum;
+}
+
 static void common_hrtimer_rearm(struct k_itimer *timr)
 {
 	struct hrtimer *timer = &timr->it.real.timer;
@@ -290,9 +301,8 @@ static void common_hrtimer_rearm(struct
 	if (!timr->it_interval)
 		return;
 
-	timr->it_overrun += (unsigned int) hrtimer_forward(timer,
-						timer->base->get_time(),
-						timr->it_interval);
+	timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
+					    timr->it_interval);
 	hrtimer_restart(timer);
 }
 
@@ -321,10 +331,10 @@ void posixtimer_rearm(struct siginfo *in
 
 		timr->it_active = 1;
 		timr->it_overrun_last = timr->it_overrun;
-		timr->it_overrun = -1;
+		timr->it_overrun = -1LL;
 		++timr->it_requeue_pending;
 
-		info->si_overrun += timr->it_overrun_last;
+		info->si_overrun = timer_overrun_to_int(timr, info->si_overrun);
 	}
 
 	unlock_timer(timr, flags);
@@ -418,9 +428,8 @@ static enum hrtimer_restart posix_timer_
 					now = ktime_add(now, kj);
 			}
 #endif
-			timr->it_overrun += (unsigned int)
-				hrtimer_forward(timer, now,
-						timr->it_interval);
+			timr->it_overrun += hrtimer_forward(timer, now,
+							    timr->it_interval);
 			ret = HRTIMER_RESTART;
 			++timr->it_requeue_pending;
 			timr->it_active = 1;
@@ -524,7 +533,7 @@ static int do_timer_create(clockid_t whi
 	new_timer->it_id = (timer_t) new_timer_id;
 	new_timer->it_clock = which_clock;
 	new_timer->kclock = kc;
-	new_timer->it_overrun = -1;
+	new_timer->it_overrun = -1LL;
 
 	if (event) {
 		rcu_read_lock();
@@ -645,11 +654,11 @@ static ktime_t common_hrtimer_remaining(
 	return __hrtimer_expires_remaining_adjusted(timer, now);
 }
 
-static int common_hrtimer_forward(struct k_itimer *timr, ktime_t now)
+static s64 common_hrtimer_forward(struct k_itimer *timr, ktime_t now)
 {
 	struct hrtimer *timer = &timr->it.real.timer;
 
-	return (int)hrtimer_forward(timer, now, timr->it_interval);
+	return hrtimer_forward(timer, now, timr->it_interval);
 }
 
 /*
@@ -789,7 +798,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_
 	if (!timr)
 		return -EINVAL;
 
-	overrun = timr->it_overrun_last;
+	overrun = timer_overrun_to_int(timr, 0);
 	unlock_timer(timr, flags);
 
 	return overrun;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/kernel/time/posix-timers.h linux-libre-4.18.12-gnu/kernel/time/posix-timers.h
--- linux-libre-4.18.11-gnu/kernel/time/posix-timers.h	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/kernel/time/posix-timers.h	2018-10-03 19:59:28.000000000 -0400
@@ -19,7 +19,7 @@ struct k_clock {
 	void	(*timer_get)(struct k_itimer *timr,
 			     struct itimerspec64 *cur_setting);
 	void	(*timer_rearm)(struct k_itimer *timr);
-	int	(*timer_forward)(struct k_itimer *timr, ktime_t now);
+	s64	(*timer_forward)(struct k_itimer *timr, ktime_t now);
 	ktime_t	(*timer_remaining)(struct k_itimer *timr, ktime_t now);
 	int	(*timer_try_to_cancel)(struct k_itimer *timr);
 	void	(*timer_arm)(struct k_itimer *timr, ktime_t expires,
diff -druNp --no-dereference linux-libre-4.18.11-gnu/lib/klist.c linux-libre-4.18.12-gnu/lib/klist.c
--- linux-libre-4.18.11-gnu/lib/klist.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/lib/klist.c	2018-10-03 19:59:28.000000000 -0400
@@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct kli
 	void (*put)(struct klist_node *) = i->i_klist->put;
 	struct klist_node *last = i->i_cur;
 	struct klist_node *prev;
+	unsigned long flags;
 
-	spin_lock(&i->i_klist->k_lock);
+	spin_lock_irqsave(&i->i_klist->k_lock, flags);
 
 	if (last) {
 		prev = to_klist_node(last->n_node.prev);
@@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct kli
 		prev = to_klist_node(prev->n_node.prev);
 	}
 
-	spin_unlock(&i->i_klist->k_lock);
+	spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
 
 	if (put && last)
 		put(last);
@@ -377,8 +378,9 @@ struct klist_node *klist_next(struct kli
 	void (*put)(struct klist_node *) = i->i_klist->put;
 	struct klist_node *last = i->i_cur;
 	struct klist_node *next;
+	unsigned long flags;
 
-	spin_lock(&i->i_klist->k_lock);
+	spin_lock_irqsave(&i->i_klist->k_lock, flags);
 
 	if (last) {
 		next = to_klist_node(last->n_node.next);
@@ -397,7 +399,7 @@ struct klist_node *klist_next(struct kli
 		next = to_klist_node(next->n_node.next);
 	}
 
-	spin_unlock(&i->i_klist->k_lock);
+	spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
 
 	if (put && last)
 		put(last);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/Makefile linux-libre-4.18.12-gnu/Makefile
--- linux-libre-4.18.11-gnu/Makefile	2018-09-29 08:26:25.000000000 -0400
+++ linux-libre-4.18.12-gnu/Makefile	2018-10-03 21:06:51.000000000 -0400
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 18
-SUBLEVEL = 11
+SUBLEVEL = 12
 EXTRAVERSION = -gnu
 NAME = Merciless Moray
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/net/6lowpan/iphc.c linux-libre-4.18.12-gnu/net/6lowpan/iphc.c
--- linux-libre-4.18.11-gnu/net/6lowpan/iphc.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/net/6lowpan/iphc.c	2018-10-03 19:59:28.000000000 -0400
@@ -770,6 +770,7 @@ int lowpan_header_decompress(struct sk_b
 		hdr.hop_limit, &hdr.daddr);
 
 	skb_push(skb, sizeof(hdr));
+	skb_reset_mac_header(skb);
 	skb_reset_network_header(skb);
 	skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/net/ipv4/tcp_bbr.c linux-libre-4.18.12-gnu/net/ipv4/tcp_bbr.c
--- linux-libre-4.18.11-gnu/net/ipv4/tcp_bbr.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/net/ipv4/tcp_bbr.c	2018-10-03 19:59:28.000000000 -0400
@@ -95,11 +95,10 @@ struct bbr {
 	u32     mode:3,		     /* current bbr_mode in state machine */
 		prev_ca_state:3,     /* CA state on previous ACK */
 		packet_conservation:1,  /* use packet conservation? */
-		restore_cwnd:1,	     /* decided to revert cwnd to old value */
 		round_start:1,	     /* start of packet-timed tx->ack round? */
 		idle_restart:1,	     /* restarting after idle? */
 		probe_rtt_round_done:1,  /* a BBR_PROBE_RTT round at 4 pkts? */
-		unused:12,
+		unused:13,
 		lt_is_sampling:1,    /* taking long-term ("LT") samples now? */
 		lt_rtt_cnt:7,	     /* round trips in long-term interval */
 		lt_use_bw:1;	     /* use lt_bw as our bw estimate? */
@@ -175,6 +174,8 @@ static const u32 bbr_lt_bw_diff = 4000 /
 /* If we estimate we're policed, use lt_bw for this many round trips: */
 static const u32 bbr_lt_bw_max_rtts = 48;
 
+static void bbr_check_probe_rtt_done(struct sock *sk);
+
 /* Do we estimate that STARTUP filled the pipe? */
 static bool bbr_full_bw_reached(const struct sock *sk)
 {
@@ -305,6 +306,8 @@ static void bbr_cwnd_event(struct sock *
 		 */
 		if (bbr->mode == BBR_PROBE_BW)
 			bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT);
+		else if (bbr->mode == BBR_PROBE_RTT)
+			bbr_check_probe_rtt_done(sk);
 	}
 }
 
@@ -392,17 +395,11 @@ static bool bbr_set_cwnd_to_recover_or_r
 		cwnd = tcp_packets_in_flight(tp) + acked;
 	} else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) {
 		/* Exiting loss recovery; restore cwnd saved before recovery. */
-		bbr->restore_cwnd = 1;
+		cwnd = max(cwnd, bbr->prior_cwnd);
 		bbr->packet_conservation = 0;
 	}
 	bbr->prev_ca_state = state;
 
-	if (bbr->restore_cwnd) {
-		/* Restore cwnd after exiting loss recovery or PROBE_RTT. */
-		cwnd = max(cwnd, bbr->prior_cwnd);
-		bbr->restore_cwnd = 0;
-	}
-
 	if (bbr->packet_conservation) {
 		*new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked);
 		return true;	/* yes, using packet conservation */
@@ -744,6 +741,20 @@ static void bbr_check_drain(struct sock
 		bbr_reset_probe_bw_mode(sk);  /* we estimate queue is drained */
 }
 
+static void bbr_check_probe_rtt_done(struct sock *sk)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct bbr *bbr = inet_csk_ca(sk);
+
+	if (!(bbr->probe_rtt_done_stamp &&
+	      after(tcp_jiffies32, bbr->probe_rtt_done_stamp)))
+		return;
+
+	bbr->min_rtt_stamp = tcp_jiffies32;  /* wait a while until PROBE_RTT */
+	tp->snd_cwnd = max(tp->snd_cwnd, bbr->prior_cwnd);
+	bbr_reset_mode(sk);
+}
+
 /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and
  * periodically drain the bottleneck queue, to converge to measure the true
  * min_rtt (unloaded propagation delay). This allows the flows to keep queues
@@ -802,12 +813,8 @@ static void bbr_update_min_rtt(struct so
 		} else if (bbr->probe_rtt_done_stamp) {
 			if (bbr->round_start)
 				bbr->probe_rtt_round_done = 1;
-			if (bbr->probe_rtt_round_done &&
-			    after(tcp_jiffies32, bbr->probe_rtt_done_stamp)) {
-				bbr->min_rtt_stamp = tcp_jiffies32;
-				bbr->restore_cwnd = 1;  /* snap to prior_cwnd */
-				bbr_reset_mode(sk);
-			}
+			if (bbr->probe_rtt_round_done)
+				bbr_check_probe_rtt_done(sk);
 		}
 	}
 	/* Restart after idle ends only once we process a new S/ACK for data */
@@ -858,7 +865,6 @@ static void bbr_init(struct sock *sk)
 	bbr->has_seen_rtt = 0;
 	bbr_init_pacing_rate_from_rtt(sk);
 
-	bbr->restore_cwnd = 0;
 	bbr->round_start = 0;
 	bbr->idle_restart = 0;
 	bbr->full_bw_reached = 0;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/net/ncsi/ncsi-netlink.c linux-libre-4.18.12-gnu/net/ncsi/ncsi-netlink.c
--- linux-libre-4.18.11-gnu/net/ncsi/ncsi-netlink.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/net/ncsi/ncsi-netlink.c	2018-10-03 19:59:28.000000000 -0400
@@ -100,7 +100,7 @@ static int ncsi_write_package_info(struc
 	bool found;
 	int rc;
 
-	if (id > ndp->package_num) {
+	if (id > ndp->package_num - 1) {
 		netdev_info(ndp->ndev.dev, "NCSI: No package with id %u\n", id);
 		return -ENODEV;
 	}
@@ -240,7 +240,7 @@ static int ncsi_pkg_info_all_nl(struct s
 		return 0; /* done */
 
 	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
-			  &ncsi_genl_family, 0,  NCSI_CMD_PKG_INFO);
+			  &ncsi_genl_family, NLM_F_MULTI,  NCSI_CMD_PKG_INFO);
 	if (!hdr) {
 		rc = -EMSGSIZE;
 		goto err;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/net/tls/tls_main.c linux-libre-4.18.12-gnu/net/tls/tls_main.c
--- linux-libre-4.18.11-gnu/net/tls/tls_main.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/net/tls/tls_main.c	2018-10-03 19:59:28.000000000 -0400
@@ -222,9 +222,14 @@ static void tls_write_space(struct sock
 {
 	struct tls_context *ctx = tls_get_ctx(sk);
 
-	/* We are already sending pages, ignore notification */
-	if (ctx->in_tcp_sendpages)
+	/* If in_tcp_sendpages call lower protocol write space handler
+	 * to ensure we wake up any waiting operations there. For example
+	 * if do_tcp_sendpages where to call sk_wait_event.
+	 */
+	if (ctx->in_tcp_sendpages) {
+		ctx->sk_write_space(sk);
 		return;
+	}
 
 	if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
 		gfp_t sk_allocation = sk->sk_allocation;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/aoa/core/gpio-feature.c linux-libre-4.18.12-gnu/sound/aoa/core/gpio-feature.c
--- linux-libre-4.18.11-gnu/sound/aoa/core/gpio-feature.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/aoa/core/gpio-feature.c	2018-10-03 19:59:28.000000000 -0400
@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char
 	}
 
 	reg = of_get_property(np, "reg", NULL);
-	if (!reg)
+	if (!reg) {
+		of_node_put(np);
 		return NULL;
+	}
 
 	*gpioptr = *reg;
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/pci/hda/hda_intel.c linux-libre-4.18.12-gnu/sound/pci/hda/hda_intel.c
--- linux-libre-4.18.11-gnu/sound/pci/hda/hda_intel.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/pci/hda/hda_intel.c	2018-10-03 19:59:28.000000000 -0400
@@ -2535,7 +2535,8 @@ static const struct pci_device_id azx_id
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
 	/* AMD Raven */
 	{ PCI_DEVICE(0x1022, 0x15e3),
-	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+			 AZX_DCAPS_PM_RUNTIME },
 	/* ATI HDMI */
 	{ PCI_DEVICE(0x1002, 0x0002),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/soc/codecs/rt1305.c linux-libre-4.18.12-gnu/sound/soc/codecs/rt1305.c
--- linux-libre-4.18.11-gnu/sound/soc/codecs/rt1305.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/soc/codecs/rt1305.c	2018-10-03 19:59:28.000000000 -0400
@@ -1066,7 +1066,7 @@ static void rt1305_calibrate(struct rt13
 	pr_debug("Left_rhl = 0x%x rh=0x%x rl=0x%x\n", rhl, rh, rl);
 	pr_info("Left channel %d.%dohm\n", (r0ohm/10), (r0ohm%10));
 
-	r0l = 562949953421312;
+	r0l = 562949953421312ULL;
 	if (rhl != 0)
 		do_div(r0l, rhl);
 	pr_debug("Left_r0 = 0x%llx\n", r0l);
@@ -1083,7 +1083,7 @@ static void rt1305_calibrate(struct rt13
 	pr_debug("Right_rhl = 0x%x rh=0x%x rl=0x%x\n", rhl, rh, rl);
 	pr_info("Right channel %d.%dohm\n", (r0ohm/10), (r0ohm%10));
 
-	r0r = 562949953421312;
+	r0r = 562949953421312ULL;
 	if (rhl != 0)
 		do_div(r0r, rhl);
 	pr_debug("Right_r0 = 0x%llx\n", r0r);
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/soc/intel/boards/bytcr_rt5640.c linux-libre-4.18.12-gnu/sound/soc/intel/boards/bytcr_rt5640.c
--- linux-libre-4.18.11-gnu/sound/soc/intel/boards/bytcr_rt5640.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/soc/intel/boards/bytcr_rt5640.c	2018-10-03 19:59:28.000000000 -0400
@@ -404,7 +404,7 @@ static const struct dmi_system_id byt_rt
 		},
 		.driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
 					BYT_RT5640_JD_SRC_JD1_IN4P |
-					BYT_RT5640_OVCD_TH_2000UA |
+					BYT_RT5640_OVCD_TH_1500UA |
 					BYT_RT5640_OVCD_SF_0P75 |
 					BYT_RT5640_SSP0_AIF1 |
 					BYT_RT5640_MCLK_EN),
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/soc/qcom/qdsp6/q6afe.c linux-libre-4.18.12-gnu/sound/soc/qcom/qdsp6/q6afe.c
--- linux-libre-4.18.11-gnu/sound/soc/qcom/qdsp6/q6afe.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/soc/qcom/qdsp6/q6afe.c	2018-10-03 19:59:28.000000000 -0400
@@ -777,7 +777,7 @@ static int q6afe_callback(struct apr_dev
  */
 int q6afe_get_port_id(int index)
 {
-	if (index < 0 || index > AFE_PORT_MAX)
+	if (index < 0 || index >= AFE_PORT_MAX)
 		return -EINVAL;
 
 	return port_maps[index].port_id;
@@ -1014,7 +1014,7 @@ int q6afe_port_stop(struct q6afe_port *p
 
 	port_id = port->id;
 	index = port->token;
-	if (index < 0 || index > AFE_PORT_MAX) {
+	if (index < 0 || index >= AFE_PORT_MAX) {
 		dev_err(afe->dev, "AFE port index[%d] invalid!\n", index);
 		return -EINVAL;
 	}
@@ -1355,7 +1355,7 @@ struct q6afe_port *q6afe_port_get_from_i
 	unsigned long flags;
 	int cfg_type;
 
-	if (id < 0 || id > AFE_PORT_MAX) {
+	if (id < 0 || id >= AFE_PORT_MAX) {
 		dev_err(dev, "AFE port token[%d] invalid!\n", id);
 		return ERR_PTR(-EINVAL);
 	}
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/soc/sh/rcar/ssi.c linux-libre-4.18.12-gnu/sound/soc/sh/rcar/ssi.c
--- linux-libre-4.18.11-gnu/sound/soc/sh/rcar/ssi.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/soc/sh/rcar/ssi.c	2018-10-03 19:59:28.000000000 -0400
@@ -37,6 +37,7 @@
 #define	CHNL_4		(1 << 22)	/* Channels */
 #define	CHNL_6		(2 << 22)	/* Channels */
 #define	CHNL_8		(3 << 22)	/* Channels */
+#define DWL_MASK	(7 << 19)	/* Data Word Length mask */
 #define	DWL_8		(0 << 19)	/* Data Word Length */
 #define	DWL_16		(1 << 19)	/* Data Word Length */
 #define	DWL_18		(2 << 19)	/* Data Word Length */
@@ -353,21 +354,18 @@ static void rsnd_ssi_config_init(struct
 	struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
 	struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
 	struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
-	u32 cr_own;
-	u32 cr_mode;
-	u32 wsr;
+	u32 cr_own	= ssi->cr_own;
+	u32 cr_mode	= ssi->cr_mode;
+	u32 wsr		= ssi->wsr;
 	int is_tdm;
 
-	if (rsnd_ssi_is_parent(mod, io))
-		return;
-
 	is_tdm = rsnd_runtime_is_ssi_tdm(io);
 
 	/*
 	 * always use 32bit system word.
 	 * see also rsnd_ssi_master_clk_enable()
 	 */
-	cr_own = FORCE | SWL_32;
+	cr_own |= FORCE | SWL_32;
 
 	if (rdai->bit_clk_inv)
 		cr_own |= SCKP;
@@ -377,9 +375,18 @@ static void rsnd_ssi_config_init(struct
 		cr_own |= SDTA;
 	if (rdai->sys_delay)
 		cr_own |= DEL;
+
+	/*
+	 * We shouldn't exchange SWSP after running.
+	 * This means, parent needs to care it.
+	 */
+	if (rsnd_ssi_is_parent(mod, io))
+		goto init_end;
+
 	if (rsnd_io_is_play(io))
 		cr_own |= TRMD;
 
+	cr_own &= ~DWL_MASK;
 	switch (snd_pcm_format_width(runtime->format)) {
 	case 16:
 		cr_own |= DWL_16;
@@ -406,7 +413,7 @@ static void rsnd_ssi_config_init(struct
 		wsr	|= WS_MODE;
 		cr_own	|= CHNL_8;
 	}
-
+init_end:
 	ssi->cr_own	= cr_own;
 	ssi->cr_mode	= cr_mode;
 	ssi->wsr	= wsr;
@@ -465,15 +472,18 @@ static int rsnd_ssi_quit(struct rsnd_mod
 		return -EIO;
 	}
 
-	if (!rsnd_ssi_is_parent(mod, io))
-		ssi->cr_own	= 0;
-
 	rsnd_ssi_master_clk_stop(mod, io);
 
 	rsnd_mod_power_off(mod);
 
 	ssi->usrcnt--;
 
+	if (!ssi->usrcnt) {
+		ssi->cr_own	= 0;
+		ssi->cr_mode	= 0;
+		ssi->wsr	= 0;
+	}
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.18.11-gnu/sound/soc/soc-dapm.c linux-libre-4.18.12-gnu/sound/soc/soc-dapm.c
--- linux-libre-4.18.11-gnu/sound/soc/soc-dapm.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/sound/soc/soc-dapm.c	2018-10-03 19:59:28.000000000 -0400
@@ -4073,6 +4073,13 @@ int snd_soc_dapm_link_dai_widgets(struct
 			continue;
 		}
 
+		/* let users know there is no DAI to link */
+		if (!dai_w->priv) {
+			dev_dbg(card->dev, "dai widget %s has no DAI\n",
+				dai_w->name);
+			continue;
+		}
+
 		dai = dai_w->priv;
 
 		/* ...find all widgets with the same stream and link them */
diff -druNp --no-dereference linux-libre-4.18.11-gnu/tools/bpf/bpftool/map_perf_ring.c linux-libre-4.18.12-gnu/tools/bpf/bpftool/map_perf_ring.c
--- linux-libre-4.18.11-gnu/tools/bpf/bpftool/map_perf_ring.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/tools/bpf/bpftool/map_perf_ring.c	2018-10-03 19:59:28.000000000 -0400
@@ -194,8 +194,10 @@ int do_event_pipe(int argc, char **argv)
 	}
 
 	while (argc) {
-		if (argc < 2)
+		if (argc < 2) {
 			BAD_ARG();
+			goto err_close_map;
+		}
 
 		if (is_prefix(*argv, "cpu")) {
 			char *endptr;
@@ -221,6 +223,7 @@ int do_event_pipe(int argc, char **argv)
 			NEXT_ARG();
 		} else {
 			BAD_ARG();
+			goto err_close_map;
 		}
 
 		do_all = false;
diff -druNp --no-dereference linux-libre-4.18.11-gnu/tools/perf/tests/builtin-test.c linux-libre-4.18.12-gnu/tools/perf/tests/builtin-test.c
--- linux-libre-4.18.11-gnu/tools/perf/tests/builtin-test.c	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/tools/perf/tests/builtin-test.c	2018-10-03 19:59:28.000000000 -0400
@@ -385,7 +385,7 @@ static int test_and_print(struct test *t
 	if (!t->subtest.get_nr)
 		pr_debug("%s:", t->desc);
 	else
-		pr_debug("%s subtest %d:", t->desc, subtest);
+		pr_debug("%s subtest %d:", t->desc, subtest + 1);
 
 	switch (err) {
 	case TEST_OK:
diff -druNp --no-dereference linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
--- linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh	2018-10-03 19:59:28.000000000 -0400
@@ -74,12 +74,14 @@ test_vlan_match()
 
 test_gretap()
 {
-	test_vlan_match gt4 'vlan_id 555 vlan_ethtype ip' "mirror to gretap"
+	test_vlan_match gt4 'skip_hw vlan_id 555 vlan_ethtype ip' \
+			"mirror to gretap"
 }
 
 test_ip6gretap()
 {
-	test_vlan_match gt6 'vlan_id 555 vlan_ethtype ipv6' "mirror to ip6gretap"
+	test_vlan_match gt6 'skip_hw vlan_id 555 vlan_ethtype ip' \
+			"mirror to ip6gretap"
 }
 
 test_gretap_stp()
diff -druNp --no-dereference linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh
--- linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh	2018-10-03 19:59:28.000000000 -0400
@@ -62,7 +62,7 @@ full_test_span_gre_dir_vlan_ips()
 			  "$backward_type" "$ip1" "$ip2"
 
 	tc filter add dev $h3 ingress pref 77 prot 802.1q \
-		flower $vlan_match ip_proto 0x2f \
+		flower $vlan_match \
 		action pass
 	mirror_test v$h1 $ip1 $ip2 $h3 77 10
 	tc filter del dev $h3 ingress pref 77
diff -druNp --no-dereference linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
--- linux-libre-4.18.11-gnu/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh	2018-09-29 05:56:03.000000000 -0400
+++ linux-libre-4.18.12-gnu/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh	2018-10-03 19:59:28.000000000 -0400
@@ -79,12 +79,14 @@ test_vlan_match()
 
 test_gretap()
 {
-	test_vlan_match gt4 'vlan_id 555 vlan_ethtype ip' "mirror to gretap"
+	test_vlan_match gt4 'skip_hw vlan_id 555 vlan_ethtype ip' \
+			"mirror to gretap"
 }
 
 test_ip6gretap()
 {
-	test_vlan_match gt6 'vlan_id 555 vlan_ethtype ipv6' "mirror to ip6gretap"
+	test_vlan_match gt6 'skip_hw vlan_id 555 vlan_ethtype ip' \
+			"mirror to ip6gretap"
 }
 
 test_span_gre_forbidden_cpu()
