4.13.6-300.fc27.gnu

45 files changed, 4447 insertions, 188 deletions

diff --git a/freed-ora/current/f27/HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch b/freed-ora/current/f27/HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch
deleted file mode 100644
index d7d626972..000000000
--- a/freed-ora/current/f27/HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From patchwork Sun Jul 23 01:15:09 2017
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: HID: rmi: Make sure the HID device is opened on resume
-From: Lyude <lyude@redhat.com>
-X-Patchwork-Id: 9858267
-Message-Id: <20170723011509.23651-1-lyude@redhat.com>
-To: linux-input@vger.kernel.org
-Cc: Lyude <lyude@redhat.com>, Andrew Duggan <aduggan@synaptics.com>,
- stable@vger.kernel.org, Jiri Kosina <jikos@kernel.org>,
- Benjamin Tissoires <benjamin.tissoires@redhat.com>,
- linux-kernel@vger.kernel.org
-Date: Sat, 22 Jul 2017 21:15:09 -0400
-
-So it looks like that suspend/resume has actually always been broken on
-hid-rmi. The fact it worked was a rather silly coincidence that was
-relying on the HID device to already be opened upon resume. This means
-that so long as anything was reading the /dev/input/eventX node for for
-an RMI device, it would suspend and resume correctly. As well, if
-nothing happened to be keeping the HID device away it would shut off,
-then the RMI driver would get confused on resume when it stopped
-responding and explode.
-
-So, call hid_hw_open() in rmi_post_resume() so we make sure that the
-device is alive before we try talking to it.
-
-This fixes RMI device suspend/resume over HID.
-
-Signed-off-by: Lyude <lyude@redhat.com>
-Cc: Andrew Duggan <aduggan@synaptics.com>
-Cc: stable@vger.kernel.org
----
- drivers/hid/hid-rmi.c | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
-index 5b40c2614599..e7d124f9a27f 100644
---- a/drivers/hid/hid-rmi.c
-+++ b/drivers/hid/hid-rmi.c
-@@ -431,22 +431,29 @@ static int rmi_post_resume(struct hid_device *hdev)
- {
- 	struct rmi_data *data = hid_get_drvdata(hdev);
- 	struct rmi_device *rmi_dev = data->xport.rmi_dev;
--	int ret;
-+	int ret = 0;
- 
- 	if (!(data->device_flags & RMI_DEVICE))
- 		return 0;
- 
--	ret = rmi_reset_attn_mode(hdev);
-+	/* Make sure the HID device is ready to receive events */
-+	ret = hid_hw_open(hdev);
- 	if (ret)
- 		return ret;
- 
-+	ret = rmi_reset_attn_mode(hdev);
-+	if (ret)
-+		goto out;
-+
- 	ret = rmi_driver_resume(rmi_dev, false);
- 	if (ret) {
- 		hid_warn(hdev, "Failed to resume device: %d\n", ret);
--		return ret;
-+		goto out;
- 	}
- 
--	return 0;
-+out:
-+	hid_hw_close(hdev);
-+	return ret;
- }
- #endif /* CONFIG_PM */
- 
diff --git a/freed-ora/current/f27/Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch b/freed-ora/current/f27/Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch
new file mode 100644
index 000000000..81e858fd0
--- /dev/null
+++ b/freed-ora/current/f27/Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch
@@ -0,0 +1,51 @@
+From patchwork Thu Sep 28 20:07:19 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: Input: synaptics - Disable kernel tracking on SMBus devices
+From: Andrew Duggan <aduggan@synaptics.com>
+X-Patchwork-Id: 9976729
+Message-Id: <1506629239-5940-1-git-send-email-aduggan@synaptics.com>
+To: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
+Cc: Andrew Duggan <aduggan@synaptics.com>,
+ Dmitry Torokhov <dmitry.torokhov@gmail.com>,
+ Benjamin Tissoires <benjamin.tissoires@redhat.com>,
+ =?UTF-8?q?Kamil=20P=C3=A1ral?= <kparal@redhat.com>
+Date: Thu, 28 Sep 2017 13:07:19 -0700
+
+In certain situations kernel tracking seems to be getting confused
+and incorrectly reporting the slot of a contact. On example is when
+the user does a three finger click or tap and then places two fingers
+on the touchpad in the same area. The kernel tracking code seems to
+continue to think that there are three contacts on the touchpad and
+incorrectly alternates the slot of one of the contacts. The result that
+is the input subsystem reports a stream of button press and release
+events as the reported slot changes.
+
+Kernel tracking was originally enabled to prevent cursor jumps, but it
+is unclear how much of an issue kernel jumps actually are. This patch
+simply disabled kernel tracking for now.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1482640
+
+Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
+Tested-by: Kamil Páral <kparal@redhat.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+---
+ drivers/input/mouse/synaptics.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 5af0b7d..ee5466a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1709,8 +1709,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
+ 		.sensor_pdata = {
+ 			.sensor_type = rmi_sensor_touchpad,
+ 			.axis_align.flip_y = true,
+-			/* to prevent cursors jumps: */
+-			.kernel_tracking = true,
++			.kernel_tracking = false,
+ 			.topbuttonpad = topbuttonpad,
+ 		},
+ 		.f30_data = {
diff --git a/freed-ora/current/f27/KEYS-don-t-let-add_key-update-an-uninstantiated-key.patch b/freed-ora/current/f27/KEYS-don-t-let-add_key-update-an-uninstantiated-key.patch
new file mode 100644
index 000000000..af7478ee5
--- /dev/null
+++ b/freed-ora/current/f27/KEYS-don-t-let-add_key-update-an-uninstantiated-key.patch
@@ -0,0 +1,130 @@
+From 7289bfaee2a42bdb56eecab0625907c045d080ba Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Wed, 27 Sep 2017 12:50:41 -0700
+Subject: [PATCH] KEYS: don't let add_key() update an uninstantiated key
+
+Currently, add_key() will, when passed a key that already exists, call
+the key's ->update() method.  But this is heavily broken in the case
+where the key is uninstantiated because it doesn't call
+__key_instantiate_and_link().  Consequently, it doesn't do most of the
+things that are supposed to happen when the key is instantiated, such as
+setting KEY_FLAG_INSTANTIATED, clearing KEY_FLAG_USER_CONSTRUCT and
+awakening tasks waiting on it, and incrementing key->user->nikeys.
+
+It also never takes key_construction_mutex, which means that
+->instantiate() can run concurrently with ->update() on the same key.
+In the case of the "user" and "logon" key types this causes a memory
+leak, at best.  Maybe even worse, the ->update() methods of the
+"encrypted" and "trusted" key types actually just dereference a NULL
+pointer when passed an uninstantiated key.
+
+Therefore, change find_key_to_update() to return NULL if the found key
+is uninstantiated, so that add_key() replaces the key rather than
+instantiating it.  This seems to be better than fixing __key_update() to
+call __key_instantiate_and_link(), since given all the bugs noted above
+as well as that the existing behavior was undocumented and
+keyctl_instantiate() is supposed to be used instead, I doubt anyone was
+relying on the existing behavior.
+
+This patch only affects *uninstantiated* keys.  For now we still allow a
+negatively instantiated key to be updated (thereby positively
+instantiating it), although that's broken too (the next patch fixes it)
+and I'm not sure that anyone actually uses that functionality either.
+
+Here is a simple reproducer for the bug using the "encrypted" key type
+(requires CONFIG_ENCRYPTED_KEYS=y), though as noted above the bug
+pertained to more than just the "encrypted" key type:
+
+    #include <stdlib.h>
+    #include <unistd.h>
+    #include <keyutils.h>
+
+    int main(void)
+    {
+        int ringid = keyctl_join_session_keyring(NULL);
+
+        if (fork()) {
+            for (;;) {
+                const char payload[] = "update user:foo 32";
+
+                usleep(rand() % 10000);
+                add_key("encrypted", "desc", payload, sizeof(payload), ringid);
+                keyctl_clear(ringid);
+            }
+        } else {
+            for (;;)
+                request_key("encrypted", "desc", "callout_info", ringid);
+        }
+    }
+
+It causes:
+
+    BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+    IP: encrypted_update+0xb0/0x170
+    PGD 7a178067 P4D 7a178067 PUD 77269067 PMD 0
+    PREEMPT SMP
+    CPU: 0 PID: 340 Comm: reproduce Tainted: G      D         4.14.0-rc1-00025-g428490e38b2e #796
+    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+    task: ffff8a467a39a340 task.stack: ffffb15c40770000
+    RIP: 0010:encrypted_update+0xb0/0x170
+    RSP: 0018:ffffb15c40773de8 EFLAGS: 00010246
+    RAX: 0000000000000000 RBX: ffff8a467a275b00 RCX: 0000000000000000
+    RDX: 0000000000000005 RSI: ffff8a467a275b14 RDI: ffffffffb742f303
+    RBP: ffffb15c40773e20 R08: 0000000000000000 R09: ffff8a467a275b17
+    R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000
+    R13: 0000000000000000 R14: ffff8a4677057180 R15: ffff8a467a275b0f
+    FS:  00007f5d7fb08700(0000) GS:ffff8a467f200000(0000) knlGS:0000000000000000
+    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    CR2: 0000000000000018 CR3: 0000000077262005 CR4: 00000000001606f0
+    Call Trace:
+     key_create_or_update+0x2bc/0x460
+     SyS_add_key+0x10c/0x1d0
+     entry_SYSCALL_64_fastpath+0x1f/0xbe
+    RIP: 0033:0x7f5d7f211259
+    RSP: 002b:00007ffed03904c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
+    RAX: ffffffffffffffda RBX: 000000003b2a7955 RCX: 00007f5d7f211259
+    RDX: 00000000004009e4 RSI: 00000000004009ff RDI: 0000000000400a04
+    RBP: 0000000068db8bad R08: 000000003b2a7955 R09: 0000000000000004
+    R10: 000000000000001a R11: 0000000000000246 R12: 0000000000400868
+    R13: 00007ffed03905d0 R14: 0000000000000000 R15: 0000000000000000
+    Code: 77 28 e8 64 34 1f 00 45 31 c0 31 c9 48 8d 55 c8 48 89 df 48 8d 75 d0 e8 ff f9 ff ff 85 c0 41 89 c4 0f 88 84 00 00 00 4c 8b 7d c8 <49> 8b 75 18 4c 89 ff e8 24 f8 ff ff 85 c0 41 89 c4 78 6d 49 8b
+    RIP: encrypted_update+0xb0/0x170 RSP: ffffb15c40773de8
+    CR2: 0000000000000018
+
+Cc: <stable@vger.kernel.org>    [v2.6.12+]
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+---
+ security/keys/keyring.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 4fa82a8a9c0e..129a4175760b 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1056,8 +1056,8 @@ EXPORT_SYMBOL(keyring_restrict);
+  * caller must also hold a lock on the keyring semaphore.
+  *
+  * Returns a pointer to the found key with usage count incremented if
+- * successful and returns NULL if not found.  Revoked and invalidated keys are
+- * skipped over.
++ * successful and returns NULL if not found.  Revoked, invalidated, and
++ * uninstantiated keys are skipped over.  (But negative keys are not!)
+  *
+  * If successful, the possession indicator is propagated from the keyring ref
+  * to the returned key reference.
+@@ -1084,8 +1084,10 @@ key_ref_t find_key_to_update(key_ref_t keyring_ref,
+ 
+ found:
+ 	key = keyring_ptr_to_key(object);
+-	if (key->flags & ((1 << KEY_FLAG_INVALIDATED) |
+-			  (1 << KEY_FLAG_REVOKED))) {
++	if ((key->flags & ((1 << KEY_FLAG_INVALIDATED) |
++			   (1 << KEY_FLAG_REVOKED) |
++			   (1 << KEY_FLAG_INSTANTIATED))) !=
++	    (1 << KEY_FLAG_INSTANTIATED)) {
+ 		kleave(" = NULL [x]");
+ 		return NULL;
+ 	}
+-- 
+2.13.6
+
diff --git a/freed-ora/current/f27/KEYS-fix-race-between-updating-and-finding-negative-.patch b/freed-ora/current/f27/KEYS-fix-race-between-updating-and-finding-negative-.patch
new file mode 100644
index 000000000..e72cdaf4a
--- /dev/null
+++ b/freed-ora/current/f27/KEYS-fix-race-between-updating-and-finding-negative-.patch
@@ -0,0 +1,258 @@
+From 4b244721c11c2f66052ceadd8ef6c48a53290e10 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Wed, 27 Sep 2017 12:50:42 -0700
+Subject: [PATCH] KEYS: fix race between updating and finding negative key
+
+In keyring_search_iterator() and in wait_for_key_construction(), we
+check whether the key has been negatively instantiated, and if so return
+the key's ->reject_error.
+
+However, no lock is held during this, and ->reject_error is in union
+with ->payload.  And it's impossible for KEY_FLAG_NEGATIVE to be updated
+atomically with respect to ->reject_error and ->payload.
+
+Most problematically, when a negative key is positively instantiated via
+__key_update() (via sys_add_key()), ->payload is initialized first, then
+KEY_FLAG_NEGATIVE is cleared.  But that means that ->reject_error can be
+observed to have a bogus value, having been overwritten with ->payload,
+while the key still appears to be "negative".  Clearing
+KEY_FLAG_NEGATIVE first wouldn't work either, since then anyone who
+accesses the payload under rcu_read_lock() rather than the key semaphore
+might observe an uninitialized ->payload.  Nor can we just always take
+the key's semaphore when checking whether the key is negative, since
+keyring searches happen under rcu_read_lock().
+
+Therefore, fix the bug by moving ->reject_error into the high bits of
+->flags so that we can read and write it atomically with respect to
+KEY_FLAG_NEGATIVE and KEY_FLAG_INSTANTIATED.
+
+This will also allow KEY_FLAG_NEGATIVE to be removed, since tests for
+KEY_FLAG_NEGATIVE can be replaced with tests for nonzero reject_error.
+But for ease of backporting this fix, that is left for a later patch.
+
+This fixes a kernel crash caused by the following program:
+
+    #include <stdlib.h>
+    #include <unistd.h>
+    #include <keyutils.h>
+
+    int main(void)
+    {
+        int ringid = keyctl_join_session_keyring(NULL);
+
+        if (fork()) {
+            for (;;) {
+                usleep(rand() % 4096);
+                add_key("user", "desc", "x", 1, ringid);
+                keyctl_clear(ringid);
+            }
+        } else {
+            for (;;)
+                request_key("user", "desc", "", ringid);
+        }
+    }
+
+Here is the crash:
+
+    BUG: unable to handle kernel paging request at fffffffffd39a6b0
+    IP: __key_link_begin+0x0/0x100
+    PGD 7a0a067 P4D 7a0a067 PUD 7a0c067 PMD 0
+    Oops: 0000 [#1] SMP
+    CPU: 1 PID: 165 Comm: keyctl_negate_r Not tainted 4.14.0-rc1 #377
+    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014
+    task: ffff9791fd809140 task.stack: ffffacba402bc000
+    RIP: 0010:__key_link_begin+0x0/0x100
+    RSP: 0018:ffffacba402bfdc8 EFLAGS: 00010282
+    RAX: ffff9791fd809140 RBX: fffffffffd39a620 RCX: 0000000000000008
+    RDX: ffffacba402bfdd0 RSI: fffffffffd39a6a0 RDI: ffff9791fd810600
+    RBP: ffffacba402bfdf8 R08: 0000000000000063 R09: ffffffff94845620
+    R10: 8080808080808080 R11: 0000000000000004 R12: ffff9791fd810600
+    R13: ffff9791fd39a940 R14: fffffffffd39a6a0 R15: 0000000000000000
+    FS:  00007fbf14a90740(0000) GS:ffff9791ffd00000(0000) knlGS:0000000000000000
+    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    CR2: fffffffffd39a6b0 CR3: 000000003b910003 CR4: 00000000003606e0
+    Call Trace:
+     ? key_link+0x28/0xb0
+     ? search_process_keyrings+0x13/0x100
+     request_key_and_link+0xcb/0x550
+     ? keyring_instantiate+0x110/0x110
+     ? key_default_cmp+0x20/0x20
+     SyS_request_key+0xc0/0x160
+     ? exit_to_usermode_loop+0x5e/0x80
+     entry_SYSCALL_64_fastpath+0x1a/0xa5
+    RIP: 0033:0x7fbf14190bb9
+    RSP: 002b:00007ffd8e4fe6c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9
+    RAX: ffffffffffffffda RBX: 0000000036cc28fb RCX: 00007fbf14190bb9
+    RDX: 000055748b56ca4a RSI: 000055748b56ca46 RDI: 000055748b56ca4b
+    RBP: 000055748b56ca4a R08: 0000000000000001 R09: 0000000000000001
+    R10: 0000000036cc28fb R11: 0000000000000246 R12: 000055748b56c8b0
+    R13: 00007ffd8e4fe7d0 R14: 0000000000000000 R15: 0000000000000000
+    Code: c5 0f 85 69 ff ff ff 48 c7 c3 82 ff ff ff eb ab 45 31 ed e9 18 ff ff ff 85 c0 75 8d eb d2 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <48> 83 7e 10 00 0f 84 c5 00 00 00 55 48 89 e5 41 57 41 56 41 55
+    RIP: __key_link_begin+0x0/0x100 RSP: ffffacba402bfdc8
+    CR2: fffffffffd39a6b0
+
+Fixes: 146aa8b1453b ("KEYS: Merge the type-specific data with the payload data")
+Cc: <stable@vger.kernel.org>	[v4.4+]
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+---
+ include/linux/key.h         | 12 +++++++++++-
+ security/keys/key.c         | 26 +++++++++++++++++++-------
+ security/keys/keyctl.c      |  3 +++
+ security/keys/keyring.c     |  4 ++--
+ security/keys/request_key.c | 11 +++++++----
+ 5 files changed, 42 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/key.h b/include/linux/key.h
+index e315e16b6ff8..b7b590d7c480 100644
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -189,6 +189,17 @@ struct key {
+ #define KEY_FLAG_KEEP		10	/* set if key should not be removed */
+ #define KEY_FLAG_UID_KEYRING	11	/* set if key is a user or user session keyring */
+ 
++	/*
++	 * If the key is negatively instantiated, then bits 20-31 hold the error
++	 * code which should be returned when someone tries to use the key
++	 * (unless they allow negative keys).  The error code is stored as a
++	 * positive number, so it must be negated before being returned.
++	 *
++	 * Note that a key can go from negative to positive but not vice versa.
++	 */
++#define KEY_FLAGS_REJECT_ERROR_SHIFT	20
++#define KEY_FLAGS_REJECT_ERROR_MASK	0xFFF00000
++
+ 	/* the key type and key description string
+ 	 * - the desc is used to match a key against search criteria
+ 	 * - it should be a printable string
+@@ -213,7 +224,6 @@ struct key {
+ 			struct list_head name_link;
+ 			struct assoc_array keys;
+ 		};
+-		int reject_error;
+ 	};
+ 
+ 	/* This is set on a keyring to restrict the addition of a link to a key
+diff --git a/security/keys/key.c b/security/keys/key.c
+index eb914a838840..786158d3442e 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -401,6 +401,20 @@ int key_payload_reserve(struct key *key, size_t datalen)
+ }
+ EXPORT_SYMBOL(key_payload_reserve);
+ 
++static void mark_key_instantiated(struct key *key, unsigned int reject_error)
++{
++	unsigned long old, new;
++
++	do {
++		old = READ_ONCE(key->flags);
++		new = (old & ~((1 << KEY_FLAG_NEGATIVE) |
++			       KEY_FLAGS_REJECT_ERROR_MASK)) |
++		      (1 << KEY_FLAG_INSTANTIATED) |
++		      (reject_error ? (1 << KEY_FLAG_NEGATIVE) : 0) |
++		      (reject_error << KEY_FLAGS_REJECT_ERROR_SHIFT);
++	} while (cmpxchg_release(&key->flags, old, new) != old);
++}
++
+ /*
+  * Instantiate a key and link it into the target keyring atomically.  Must be
+  * called with the target keyring's semaphore writelocked.  The target key's
+@@ -431,7 +445,7 @@ static int __key_instantiate_and_link(struct key *key,
+ 		if (ret == 0) {
+ 			/* mark the key as being instantiated */
+ 			atomic_inc(&key->user->nikeys);
+-			set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
++			mark_key_instantiated(key, 0);
+ 
+ 			if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
+ 				awaken = 1;
+@@ -580,10 +594,8 @@ int key_reject_and_link(struct key *key,
+ 	if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+ 		/* mark the key as being negatively instantiated */
+ 		atomic_inc(&key->user->nikeys);
+-		key->reject_error = -error;
+-		smp_wmb();
+-		set_bit(KEY_FLAG_NEGATIVE, &key->flags);
+-		set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
++		mark_key_instantiated(key, error);
++
+ 		now = current_kernel_time();
+ 		key->expiry = now.tv_sec + timeout;
+ 		key_schedule_gc(key->expiry + key_gc_delay);
+@@ -753,7 +765,7 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
+ 	ret = key->type->update(key, prep);
+ 	if (ret == 0)
+ 		/* updating a negative key instantiates it */
+-		clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
++		mark_key_instantiated(key, 0);
+ 
+ 	up_write(&key->sem);
+ 
+@@ -987,7 +999,7 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
+ 	ret = key->type->update(key, &prep);
+ 	if (ret == 0)
+ 		/* updating a negative key instantiates it */
+-		clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
++		mark_key_instantiated(key, 0);
+ 
+ 	up_write(&key->sem);
+ 
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 365ff85d7e27..19a09e121089 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1223,6 +1223,9 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
+ 	    error == ERESTART_RESTARTBLOCK)
+ 		return -EINVAL;
+ 
++	BUILD_BUG_ON(MAX_ERRNO > (KEY_FLAGS_REJECT_ERROR_MASK >>
++				  KEY_FLAGS_REJECT_ERROR_SHIFT));
++
+ 	/* the appropriate instantiation authorisation key must have been
+ 	 * assumed before calling this */
+ 	ret = -EPERM;
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 129a4175760b..e54ad0ed7aa4 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -598,8 +598,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
+ 	if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+ 		/* we set a different error code if we pass a negative key */
+ 		if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
+-			smp_rmb();
+-			ctx->result = ERR_PTR(key->reject_error);
++			ctx->result = ERR_PTR(-(int)(kflags >>
++						KEY_FLAGS_REJECT_ERROR_SHIFT));
+ 			kleave(" = %d [neg]", ctx->skipped_ret);
+ 			goto skipped;
+ 		}
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 63e63a42db3c..0aab68344837 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -590,15 +590,18 @@ struct key *request_key_and_link(struct key_type *type,
+ int wait_for_key_construction(struct key *key, bool intr)
+ {
+ 	int ret;
++	unsigned long flags;
+ 
+ 	ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,
+ 			  intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+ 	if (ret)
+ 		return -ERESTARTSYS;
+-	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+-		smp_rmb();
+-		return key->reject_error;
+-	}
++
++	/* Pairs with RELEASE in mark_key_instantiated() */
++	flags = smp_load_acquire(&key->flags);
++	if (flags & (1 << KEY_FLAG_NEGATIVE))
++		return -(int)(flags >> KEY_FLAGS_REJECT_ERROR_SHIFT);
++
+ 	return key_validate(key);
+ }
+ EXPORT_SYMBOL(wait_for_key_construction);
+-- 
+2.13.6
+
diff --git a/freed-ora/current/f27/PCI-aspm-deal-with-missing-root-ports-in-link-state-handling.patch b/freed-ora/current/f27/PCI-aspm-deal-with-missing-root-ports-in-link-state-handling.patch
new file mode 100644
index 000000000..03b011561
--- /dev/null
+++ b/freed-ora/current/f27/PCI-aspm-deal-with-missing-root-ports-in-link-state-handling.patch
@@ -0,0 +1,55 @@
+From patchwork Mon Oct  2 14:08:40 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: PCI: aspm: deal with missing root ports in link state handling
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+X-Patchwork-Id: 9980861
+Message-Id: <20171002140840.7767-1-ard.biesheuvel@linaro.org>
+To: linux-pci@vger.kernel.org, bhelgaas@google.com
+Cc: graeme.gregory@linaro.org, leif.lindholm@linaro.org,
+ daniel.thompson@Linaro.org, Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon,  2 Oct 2017 15:08:40 +0100
+
+Even though it is unconventional, some PCIe host implementations omit
+the root ports entirely, and simply consist of a host bridge (which
+is not modeled as a device in the PCI hierarchy) and a link.
+
+When the downstream device is an endpoint, our current code does not
+seem to mind this unusual configuration. However, when PCIe switches
+are involved, the ASPM code assumes that any downstream switch port
+has a parent, and blindly derefences the bus->parent->self field of
+the pci_dev struct to chain the downstream link state to the link
+state of the root port. Given that the root port is missing, the link
+is not modeled at all, and nor is the link state, and attempting to
+access it results in a NULL pointer dereference and a crash.
+
+So let's avoid this by allowing the link state chain to terminate at
+the downstream port if no root port exists.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ drivers/pci/pcie/aspm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 1dfa10cc566b..0bea8498b5a5 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -802,10 +802,14 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
+ 
+ 	/*
+ 	 * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
+-	 * hierarchies.
++	 * hierarchies.  Note that some PCIe host implementations omit
++	 * the root ports entirely, in which case a downstream port on
++	 * a switch may become the root of the link state chain for all
++	 * its subordinate endpoints.
+ 	 */
+ 	if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT ||
+-	    pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) {
++	    pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE ||
++	    !pdev->bus->parent->self) {
+ 		link->root = link;
+ 	} else {
+ 		struct pcie_link_state *parent;
diff --git a/freed-ora/current/f27/ahci-don-t-ignore-result-code-of-ahci_reset_controller.patch b/freed-ora/current/f27/ahci-don-t-ignore-result-code-of-ahci_reset_controller.patch
new file mode 100644
index 000000000..771ca7950
--- /dev/null
+++ b/freed-ora/current/f27/ahci-don-t-ignore-result-code-of-ahci_reset_controller.patch
@@ -0,0 +1,77 @@
+From patchwork Mon Oct  2 18:31:24 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: ahci: don't ignore result code of ahci_reset_controller()
+X-Patchwork-Submitter: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+X-Patchwork-Id: 820637
+X-Patchwork-Delegate: davem@davemloft.net
+Message-Id: <20171002183124.17003-1-ard.biesheuvel@linaro.org>
+To: linux-ide@vger.kernel.org, tj@kernel.org
+Cc: graeme.gregory@linaro.org, leif.lindholm@linaro.org,
+ daniel.thompson@Linaro.org, Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon,  2 Oct 2017 19:31:24 +0100
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+List-Id: <linux-ide.vger.kernel.org>
+
+ahci_pci_reset_controller() calls ahci_reset_controller(), which may
+fail, but ignores the result code and always returns success. This
+may result in failures like below
+
+  ahci 0000:02:00.0: version 3.0
+  ahci 0000:02:00.0: enabling device (0000 -> 0003)
+  ahci 0000:02:00.0: SSS flag set, parallel bus scan disabled
+  ahci 0000:02:00.0: controller reset failed (0xffffffff)
+  ahci 0000:02:00.0: failed to stop engine (-5)
+    ... repeated many times ...
+  ahci 0000:02:00.0: failed to stop engine (-5)
+  Unable to handle kernel paging request at virtual address ffff0000093f9018
+    ...
+  PC is at ahci_stop_engine+0x5c/0xd8 [libahci]
+  LR is at ahci_deinit_port.constprop.12+0x1c/0xc0 [libahci]
+    ...
+  [<ffff000000a17014>] ahci_stop_engine+0x5c/0xd8 [libahci]
+  [<ffff000000a196b4>] ahci_deinit_port.constprop.12+0x1c/0xc0 [libahci]
+  [<ffff000000a197d8>] ahci_init_controller+0x80/0x168 [libahci]
+  [<ffff000000a260f8>] ahci_pci_init_controller+0x60/0x68 [ahci]
+  [<ffff000000a26f94>] ahci_init_one+0x75c/0xd88 [ahci]
+  [<ffff000008430324>] local_pci_probe+0x3c/0xb8
+  [<ffff000008431728>] pci_device_probe+0x138/0x170
+  [<ffff000008585e54>] driver_probe_device+0x2dc/0x458
+  [<ffff0000085860e4>] __driver_attach+0x114/0x118
+  [<ffff000008583ca8>] bus_for_each_dev+0x60/0xa0
+  [<ffff000008585638>] driver_attach+0x20/0x28
+  [<ffff0000085850b0>] bus_add_driver+0x1f0/0x2a8
+  [<ffff000008586ae0>] driver_register+0x60/0xf8
+  [<ffff00000842f9b4>] __pci_register_driver+0x3c/0x48
+  [<ffff000000a3001c>] ahci_pci_driver_init+0x1c/0x1000 [ahci]
+  [<ffff000008083918>] do_one_initcall+0x38/0x120
+
+where an obvious hardware level failure results in an unnecessary 15 second
+delay and a subsequent crash.
+
+So record the result code of ahci_reset_controller() and relay it, rather
+than ignoring it.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ drivers/ata/ahci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 5a5fd0b404eb..649e799df9c1 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -621,8 +621,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ static int ahci_pci_reset_controller(struct ata_host *host)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(host->dev);
++	int rc;
+ 
+-	ahci_reset_controller(host);
++	rc = ahci_reset_controller(host);
++	if (rc)
++		return rc;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+ 		struct ahci_host_priv *hpriv = host->private_data;
diff --git a/freed-ora/current/f27/arm64-cavium-fixes.patch b/freed-ora/current/f27/arm64-cavium-fixes.patch
new file mode 100644
index 000000000..a898bb779
--- /dev/null
+++ b/freed-ora/current/f27/arm64-cavium-fixes.patch
@@ -0,0 +1,455 @@
+From c03847b4a603846903ee72a5e1baab03e0591423 Mon Sep 17 00:00:00 2001
+From: Ashok Kumar Sekar <asekar@redhat.com>
+Date: Fri, 23 Sep 2016 04:16:19 -0700
+Subject: [PATCH 1/8] PCI: Vulcan: AHCI PCI bar fix for Broadcom Vulcan early
+ silicon
+
+PCI BAR 5 is not setup correctly for the on-board AHCI
+controller on Broadcom's Vulcan processor. Added a quirk to fix BAR 5
+by using BAR 4's resources which are populated correctly but NOT used
+by the AHCI controller actually.
+
+Signed-off-by: Ashok Kumar Sekar <asekar@redhat.com>
+Signed-off-by: Jayachandran C <jchandra@broadcom.com>
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/pci/quirks.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index dc624fb34e72..94b7bdf63b19 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3994,6 +3994,30 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9084,
+ 				quirk_bridge_cavm_thrx2_pcie_root);
+ 
+ /*
++ * PCI BAR 5 is not setup correctly for the on-board AHCI controller
++ * on Broadcom's Vulcan processor. Added a quirk to fix BAR 5 by
++ * using BAR 4's resources which are populated correctly and NOT
++ * actually used by the AHCI controller.
++ */
++static void quirk_fix_vulcan_ahci_bars(struct pci_dev *dev)
++{
++	struct resource *r =  &dev->resource[4];
++
++	if (!(r->flags & IORESOURCE_MEM) || (r->start == 0))
++		return;
++
++	/* Set BAR5 resource to BAR4 */
++	dev->resource[5] = *r;
++
++	/* Update BAR5 in pci config space */
++	pci_write_config_dword(dev, PCI_BASE_ADDRESS_5, r->start);
++
++	/* Clear BAR4's resource */
++	memset(r, 0, sizeof(*r));
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9027, quirk_fix_vulcan_ahci_bars);
++
++/*
+  * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
+  * class code.  Fix it.
+  */
+-- 
+2.11.0
+
+From c84892e4b6b671fda7e499a0bb0787bd026de015 Mon Sep 17 00:00:00 2001
+From: Jayachandran C <jnair@caviumnetworks.com>
+Date: Fri, 10 Mar 2017 10:04:52 +0000
+Subject: [PATCH 2/8] ahci: thunderx2: Fix for errata that affects stop engine
+
+Apply workaround for this errata:
+  Synopsis: Resetting PxCMD.ST may hang the SATA device
+
+  Description: An internal ping-pong buffer state is not reset
+  correctly for an PxCMD.ST=0 command for a SATA channel. This
+  may cause the SATA interface to hang when a PxCMD.ST=0 command
+  is received.
+
+  Workaround: A SATA_BIU_CORE_ENABLE.sw_init_bsi must be asserted
+  by the driver whenever the PxCMD.ST needs to be de-asserted. This
+  will reset both the ports. So, it may not always work in a 2
+  channel SATA system.
+
+  Resolution: Fix in B0.
+
+Add the code to ahci_stop_engine() to do this. It is not easy to
+stop the other "port" since it is associated with a different AHCI
+interface. Please note that with this fix, SATA reset does not
+hang any more, but it can cause failures on the other interface
+if that is in active use.
+
+Unfortunately, we have nothing other the the CPU ID to check if the
+SATA block has this issue.
+
+Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
+[added check to restict to pci devs on the soc only]
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/ata/libahci.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 3e286d86ab42..9116bba1b07d 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -669,6 +669,23 @@ int ahci_stop_engine(struct ata_port *ap)
+ 	tmp &= ~PORT_CMD_START;
+ 	writel(tmp, port_mmio + PORT_CMD);
+ 
++#ifdef CONFIG_ARM64
++	/* Rev Ax of Cavium CN99XX needs a hack for port stop */
++	if (dev_is_pci(ap->host->dev) &&
++	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&
++	    to_pci_dev(ap->host->dev)->device == 0x9027 &&
++	    MIDR_IS_CPU_MODEL_RANGE(read_cpuid_id(),
++			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),
++			MIDR_CPU_VAR_REV(0, 0),
++			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {
++		tmp = readl(hpriv->mmio + 0x8000);
++		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);
++		udelay(1);
++		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);
++		dev_warn(ap->host->dev, "CN99XX stop engine fix applied!\n");
++	}
++#endif
++
+ 	/* wait for engine to stop. This could be as long as 500 msec */
+ 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
+ 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
+-- 
+2.11.0
+
+From 98a39621952f6a13c5198e79f1c080ea6fc1d092 Mon Sep 17 00:00:00 2001
+From: Jayachandran C <jnair@caviumnetworks.com>
+Date: Sun, 22 Feb 1998 18:42:42 -0800
+Subject: [PATCH 3/8] ahci: thunderx2: stop engine fix update
+
+The current reset fix fails during continuous reboot test. The failure
+happens when both the on-board SATA slots are used and when one of the
+controllers are reset.
+
+The latest ThunderX2 firmware (3.1) enables hardware error interrupts and
+when the reset fix fails, we get a hang with the print:
+[   14.839308] sd 1:0:0:0: [sdb] 468862128 512-byte logical blocks: (240 GB/224 GiB)
+[   14.846796] sd 1:0:0:0: [sdb] 4096-byte physical blocks
+[   14.852036] sd 1:0:0:0: [sdb] Write Protect is off
+[   14.856843] sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
+[   14.866022] ata2.00: Enabling discard_zeroes_data
+
+        *** NBU BAR Error 0x1e25c ***
+         AddrLo 0x1d80180 AddrHi 0x0
+
+To fix this issue, update the SATA reset fix to increase the delays between register writes.
+
+Signed-off-by: Jayachandran C <jnair@caviumnetworks.com>
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/ata/libahci.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 9116bba1b07d..1d3e614bad2b 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -679,10 +679,11 @@ int ahci_stop_engine(struct ata_port *ap)
+ 			MIDR_CPU_VAR_REV(0, 0),
+ 			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {
+ 		tmp = readl(hpriv->mmio + 0x8000);
++		udelay(100);
+ 		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);
+-		udelay(1);
++		udelay(100);
+ 		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);
+-		dev_warn(ap->host->dev, "CN99XX stop engine fix applied!\n");
++		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");
+ 	}
+ #endif
+ 
+-- 
+2.11.0
+
+From 33c107d2a2b570cd5246262108ad07cc102e9fcd Mon Sep 17 00:00:00 2001
+From: Robert Richter <rrichter@cavium.com>
+Date: Thu, 16 Mar 2017 18:01:59 +0100
+Subject: [PATCH 4/8] iommu/arm-smmu, ACPI: Enable Cavium SMMU-v2
+
+In next IORT spec release there will be a definition of a Cavium
+specific model. Until then, enable the Cavium SMMU using cpu id
+registers. All versions of Cavium's SMMUv2 implementation must be
+enabled.
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/iommu/arm-smmu.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index d42cad5a3d52..37aee96ccc0e 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -53,6 +53,8 @@
+ 
+ #include <linux/amba/bus.h>
+ 
++#include <asm/cputype.h>
++
+ #include "io-pgtable.h"
+ #include "arm-smmu-regs.h"
+ 
+@@ -1871,6 +1873,24 @@ static const struct of_device_id arm_smmu_of_match[] = {
+ MODULE_DEVICE_TABLE(of, arm_smmu_of_match);
+ 
+ #ifdef CONFIG_ACPI
++
++static int acpi_smmu_enable_cavium(struct arm_smmu_device *smmu, int ret)
++{
++	u32 cpu_model;
++
++	if (!IS_ENABLED(CONFIG_ARM64))
++		return ret;
++
++	cpu_model = read_cpuid_id() & MIDR_CPU_MODEL_MASK;
++	if (cpu_model != MIDR_THUNDERX)
++		return ret;
++
++	smmu->version = ARM_SMMU_V2;
++	smmu->model = CAVIUM_SMMUV2;
++
++	return 0;
++}
++
+ static int acpi_smmu_get_data(u32 model, struct arm_smmu_device *smmu)
+ {
+ 	int ret = 0;
+@@ -1901,7 +1921,7 @@ static int acpi_smmu_get_data(u32 model, struct arm_smmu_device *smmu)
+ 		ret = -ENODEV;
+ 	}
+ 
+-	return ret;
++	return acpi_smmu_enable_cavium(smmu, ret);
+ }
+ 
+ static int arm_smmu_device_acpi_probe(struct platform_device *pdev,
+-- 
+2.11.0
+
+From 5523edb06c95d7ac9e81d94366e71d929c08ebd4 Mon Sep 17 00:00:00 2001
+From: Robert Richter <rrichter@cavium.com>
+Date: Wed, 12 Apr 2017 15:06:03 +0200
+Subject: [PATCH 5/8] iommu: Print a message with the default domain type
+ created
+
+There are several ways the bypass mode can be enabled. With commit
+
+ fccb4e3b8ab0 iommu: Allow default domain type to be set on the kernel command line
+
+there is the option to switch into bypass mode. And, depending on
+devicetree options, bypass mode can be also enabled. This makes it
+hard to determine if direct mapping is enabled. Print message with the
+default domain type case.
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/iommu/iommu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 3f6ea160afed..7aaafaca6baf 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -599,7 +599,9 @@ int iommu_group_add_device(struct iommu_group *group, struct device *dev)
+ 
+ 	trace_add_device_to_group(group->id, dev);
+ 
+-	pr_info("Adding device %s to group %d\n", dev_name(dev), group->id);
++	pr_info("Adding device %s to group %d, default domain type %d\n",
++		dev_name(dev), group->id,
++		group->default_domain ? group->default_domain->type : -1);
+ 
+ 	return 0;
+ 
+-- 
+2.11.0
+
+From 71e0ad5ab606077c24a96d69f4bfed58d7ef16c7 Mon Sep 17 00:00:00 2001
+From: Robert Richter <rrichter@cavium.com>
+Date: Thu, 4 May 2017 17:48:48 +0200
+Subject: [PATCH 6/8] iommu, aarch64: Set bypass mode per default
+
+We see a performance degradation if smmu is enabled in non-bypass mode.
+This is a problem in the kernel's implememntation. Until that is solved,
+enable smmu in bypass mode per default.
+
+We have tested that SMMU passthrough mode doesn't effect VFIO on both
+CN88xx and CN99xx and haven't found any issues.
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/iommu/iommu.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 7aaafaca6baf..24de0b934221 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -36,7 +36,12 @@
+ 
+ static struct kset *iommu_group_kset;
+ static DEFINE_IDA(iommu_group_ida);
++
++#ifdef CONFIG_ARM64
++static unsigned int iommu_def_domain_type = IOMMU_DOMAIN_IDENTITY;
++#else
+ static unsigned int iommu_def_domain_type = IOMMU_DOMAIN_DMA;
++#endif
+ 
+ struct iommu_callback_data {
+ 	const struct iommu_ops *ops;
+-- 
+2.11.0
+
+From 27f103963f926d6a7a8adaad1ee227fd3b51f591 Mon Sep 17 00:00:00 2001
+From: Robert Richter <rrichter@cavium.com>
+Date: Wed, 12 Apr 2017 10:31:15 +0200
+Subject: [PATCH 7/8] iommu/arm-smmu, ACPI: Enable Cavium SMMU-v3
+
+In next IORT spec release there will be a definition of a Cavium
+specific model. Until then, enable the Cavium SMMU using cpu id
+registers. Early silicon versions (A1) of Cavium's CN99xx SMMUv3
+implementation must be enabled. For later silicon versions (B0) the
+iort change will be in place.
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ drivers/acpi/arm64/iort.c   | 16 ++++++++++++++--
+ drivers/iommu/arm-smmu-v3.c | 19 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index a3215ee671c1..b603af92eec2 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -26,6 +26,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ 
++#include <asm/cputype.h>
++
+ #define IORT_TYPE_MASK(type)	(1 << (type))
+ #define IORT_MSI_TYPE		(1 << ACPI_IORT_NODE_ITS_GROUP)
+ #define IORT_IOMMU_TYPE		((1 << ACPI_IORT_NODE_SMMU) |	\
+@@ -824,13 +826,22 @@ static int __init arm_smmu_v3_count_resources(struct acpi_iort_node *node)
+ 	return num_res;
+ }
+ 
++static bool is_cavium_cn99xx_smmu_v3(void)
++{
++	u32 cpu_model = read_cpuid_id() & MIDR_CPU_MODEL_MASK;
++
++	return cpu_model == MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM,
++					   BRCM_CPU_PART_VULCAN);
++}
++
+ static bool arm_smmu_v3_is_combined_irq(struct acpi_iort_smmu_v3 *smmu)
+ {
+ 	/*
+ 	 * Cavium ThunderX2 implementation doesn't not support unique
+ 	 * irq line. Use single irq line for all the SMMUv3 interrupts.
+ 	 */
+-	if (smmu->model != ACPI_IORT_SMMU_V3_CAVIUM_CN99XX)
++	if (smmu->model != ACPI_IORT_SMMU_V3_CAVIUM_CN99XX
++	    && !is_cavium_cn99xx_smmu_v3())
+ 		return false;
+ 
+ 	/*
+@@ -848,7 +859,8 @@ static unsigned long arm_smmu_v3_resource_size(struct acpi_iort_smmu_v3 *smmu)
+ 	 * Override the size, for Cavium ThunderX2 implementation
+ 	 * which doesn't support the page 1 SMMU register space.
+ 	 */
+-	if (smmu->model == ACPI_IORT_SMMU_V3_CAVIUM_CN99XX)
++	if (smmu->model == ACPI_IORT_SMMU_V3_CAVIUM_CN99XX
++	    || is_cavium_cn99xx_smmu_v3())
+ 		return SZ_64K;
+ 
+ 	return SZ_128K;
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 568c400eeaed..d147cb5c7309 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -39,6 +39,8 @@
+ 
+ #include <linux/amba/bus.h>
+ 
++#include <asm/cputype.h>
++
+ #include "io-pgtable.h"
+ 
+ /* MMIO registers */
+@@ -2659,6 +2661,21 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu)
+ }
+ 
+ #ifdef CONFIG_ACPI
++
++static void acpi_smmu_enable_cavium(struct arm_smmu_device *smmu)
++{
++	u32 cpu_model;
++
++	if (!IS_ENABLED(CONFIG_ARM64))
++		return;
++
++	cpu_model = read_cpuid_id() & MIDR_CPU_MODEL_MASK;
++	if (cpu_model != MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN))
++		return;
++
++	smmu->options |= ARM_SMMU_OPT_PAGE0_REGS_ONLY;
++}
++
+ static void acpi_smmu_get_options(u32 model, struct arm_smmu_device *smmu)
+ {
+ 	switch (model) {
+@@ -2670,6 +2687,8 @@ static void acpi_smmu_get_options(u32 model, struct arm_smmu_device *smmu)
+ 		break;
+ 	}
+ 
++	acpi_smmu_enable_cavium(smmu);
++
+ 	dev_notice(smmu->dev, "option mask 0x%x\n", smmu->options);
+ }
+ 
+-- 
+2.11.0
+
+From ff677cc625b52b93351dd73d7881251067f0e976 Mon Sep 17 00:00:00 2001
+From: Radha Mohan Chintakuntla <rchintakuntla@cavium.com>
+Date: Wed, 20 Aug 2014 15:10:58 -0700
+Subject: [PATCH 8/8] arm64: gicv3: its: Increase FORCE_MAX_ZONEORDER for
+ Cavium ThunderX
+
+In case of ARCH_THUNDER, there is a need to allocate the GICv3 ITS table
+which is bigger than the allowed max order. So we are forcing it only in
+case of 4KB page size.
+
+Signed-off-by: Radha Mohan Chintakuntla <rchintakuntla@cavium.com>
+[rric: use ARM64_4K_PAGES since we have now ARM64_16K_PAGES, change order]
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 2c3e2d693d76..023867378f45 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -784,6 +784,7 @@ config FORCE_MAX_ZONEORDER
+ 	default "14" if (ARM64_64K_PAGES && TRANSPARENT_HUGEPAGE)
+ 	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)
+ 	default "12" if (ARM64_16K_PAGES && TRANSPARENT_HUGEPAGE)
++	default "13" if (ARM64_4K_PAGES && ARCH_THUNDER)
+ 	default "11"
+ 	help
+ 	  The kernel memory allocator divides physically contiguous memory
+-- 
+2.11.0
+
diff --git a/freed-ora/current/f27/arm64-socionext-96b-enablement.patch b/freed-ora/current/f27/arm64-socionext-96b-enablement.patch
new file mode 100644
index 000000000..8eb99ea42
--- /dev/null
+++ b/freed-ora/current/f27/arm64-socionext-96b-enablement.patch
@@ -0,0 +1,2898 @@
+From 58be18a7bbf9dca67f4260ac172a44baa59d0ee9 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon, 21 Aug 2017 10:47:48 +0100
+Subject: arm64: acpi/gtdt: validate CNTFRQ after having enabled the frame
+
+The ACPI GTDT code validates the CNTFRQ field of each MMIO timer
+frame against the CNTFRQ system register of the current CPU, to
+ensure that they are equal, which is mandated by the architecture.
+
+However, reading the CNTFRQ field of a frame is not possible until
+the RFRQ bit in the frame's CNTACRn register is set, and doing so
+before that willl produce the following error:
+
+  arch_timer: [Firmware Bug]: CNTFRQ mismatch: frame @ 0x00000000e0be0000: (0x00000000), CPU: (0x0ee6b280)
+  arch_timer: Disabling MMIO timers due to CNTFRQ mismatch
+  arch_timer: Failed to initialize memory-mapped timer.
+
+The reason is that the CNTFRQ field is RES0 if access is not enabled.
+
+So move the validation of CNTFRQ into the loop that iterates over the
+timers to find the best frame, but defer it until after we have selected
+the best frame, which should also have enabled the RFRQ bit.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ drivers/clocksource/arm_arch_timer.c | 38 ++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index fd4b7f6..14e2419 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -1268,10 +1268,6 @@ arch_timer_mem_find_best_frame(struct arch_timer_mem *timer_mem)
+ 
+ 	iounmap(cntctlbase);
+ 
+-	if (!best_frame)
+-		pr_err("Unable to find a suitable frame in timer @ %pa\n",
+-			&timer_mem->cntctlbase);
+-
+ 	return best_frame;
+ }
+ 
+@@ -1372,6 +1368,8 @@ static int __init arch_timer_mem_of_init(struct device_node *np)
+ 
+ 	frame = arch_timer_mem_find_best_frame(timer_mem);
+ 	if (!frame) {
++		pr_err("Unable to find a suitable frame in timer @ %pa\n",
++			&timer_mem->cntctlbase);
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -1420,7 +1418,7 @@ arch_timer_mem_verify_cntfrq(struct arch_timer_mem *timer_mem)
+ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ {
+ 	struct arch_timer_mem *timers, *timer;
+-	struct arch_timer_mem_frame *frame;
++	struct arch_timer_mem_frame *frame, *best_frame = NULL;
+ 	int timer_count, i, ret = 0;
+ 
+ 	timers = kcalloc(platform_timer_count, sizeof(*timers),
+@@ -1432,14 +1430,6 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ 	if (ret || !timer_count)
+ 		goto out;
+ 
+-	for (i = 0; i < timer_count; i++) {
+-		ret = arch_timer_mem_verify_cntfrq(&timers[i]);
+-		if (ret) {
+-			pr_err("Disabling MMIO timers due to CNTFRQ mismatch\n");
+-			goto out;
+-		}
+-	}
+-
+ 	/*
+ 	 * While unlikely, it's theoretically possible that none of the frames
+ 	 * in a timer expose the combination of feature we want.
+@@ -1448,12 +1438,26 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ 		timer = &timers[i];
+ 
+ 		frame = arch_timer_mem_find_best_frame(timer);
+-		if (frame)
+-			break;
++		if (!best_frame)
++			best_frame = frame;
++
++		ret = arch_timer_mem_verify_cntfrq(timer);
++		if (ret) {
++			pr_err("Disabling MMIO timers due to CNTFRQ mismatch\n");
++			goto out;
++		}
++
++		if (!best_frame) /* implies !frame */
++			/*
++			 * Only complain about missing suitable frames if we
++			 * haven't already found one in a previous iteration.
++			 */
++			pr_err("Unable to find a suitable frame in timer @ %pa\n",
++				&timer->cntctlbase);
+ 	}
+ 
+-	if (frame)
+-		ret = arch_timer_mem_frame_register(frame);
++	if (best_frame)
++		ret = arch_timer_mem_frame_register(best_frame);
+ out:
+ 	kfree(timers);
+ 	return ret;
+-- 
+cgit v1.1
+
+From 26e7bb47b0fb03a01be1e391a08c7375b45335a2 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon, 21 Aug 2017 20:29:05 +0100
+Subject: pci: designware: add driver for DWC controller in ECAM shift mode
+
+Some implementations of the Synopsys Designware PCIe controller implement
+a so-called ECAM shift mode, which allows a static memory window to be
+configured that covers the configuration space of the entire bus range.
+
+If the firmware performs all the low level configuration that is required
+to expose this controller in a fully ECAM compatible manner, we can
+simply describe it as "pci-host-ecam-generic" and be done with it.
+However, it appears that in some cases (one of which is the Armada 80x0),
+the IP is synthesized with an ATU window size that does not allow the
+first bus to be mapped in a way that prevents the device on the
+downstream port from appearing more than once.
+
+So implement a driver that relies on the firmware to perform all low
+level initialization, and drives the controller in ECAM mode, but
+overrides the config space accessors to take the above quirk into
+account.
+
+Note that, unlike most drivers for this IP, this driver does not expose
+a fake bridge device at B/D/F 00:00.0. There is no point in doing so,
+given that this is not a true bridge, and does not require any windows
+to be configured in order for the downstream device to operate correctly.
+Omitting it also prevents the PCI resource allocation routines from
+handing out BAR space to it unnecessarily.
+
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Jingoo Han <jingoohan1@gmail.com>
+Cc: Joao Pinto <Joao.Pinto@synopsys.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ drivers/pci/dwc/Kconfig                | 11 +++++
+ drivers/pci/dwc/Makefile               |  1 +
+ drivers/pci/dwc/pcie-designware-ecam.c | 77 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 89 insertions(+)
+ create mode 100644 drivers/pci/dwc/pcie-designware-ecam.c
+
+diff --git a/drivers/pci/dwc/Kconfig b/drivers/pci/dwc/Kconfig
+index 22ec82f..19856b1 100644
+--- a/drivers/pci/dwc/Kconfig
++++ b/drivers/pci/dwc/Kconfig
+@@ -169,4 +169,15 @@ config PCIE_KIRIN
+ 	  Say Y here if you want PCIe controller support
+ 	  on HiSilicon Kirin series SoCs.
+ 
++config PCIE_DW_HOST_ECAM
++	bool "Synopsys DesignWare PCIe controller in ECAM mode"
++	depends on OF && PCI
++	select PCI_HOST_COMMON
++	select IRQ_DOMAIN
++	help
++	  Add support for Synopsys DesignWare PCIe controllers configured
++	  by the firmware into ECAM shift mode. In some cases, these are
++	  fully ECAM compliant, in which case the pci-host-generic driver
++	  may be used instead.
++
+ endmenu
+diff --git a/drivers/pci/dwc/Makefile b/drivers/pci/dwc/Makefile
+index c61be97..7d5a23e 100644
+--- a/drivers/pci/dwc/Makefile
++++ b/drivers/pci/dwc/Makefile
+@@ -1,5 +1,6 @@
+ obj-$(CONFIG_PCIE_DW) += pcie-designware.o
+ obj-$(CONFIG_PCIE_DW_HOST) += pcie-designware-host.o
++obj-$(CONFIG_PCIE_DW_HOST_ECAM) += pcie-designware-ecam.o
+ obj-$(CONFIG_PCIE_DW_EP) += pcie-designware-ep.o
+ obj-$(CONFIG_PCIE_DW_PLAT) += pcie-designware-plat.o
+ ifneq ($(filter y,$(CONFIG_PCI_DRA7XX_HOST) $(CONFIG_PCI_DRA7XX_EP)),)
+diff --git a/drivers/pci/dwc/pcie-designware-ecam.c b/drivers/pci/dwc/pcie-designware-ecam.c
+new file mode 100644
+index 0000000..ede627d
+--- /dev/null
++++ b/drivers/pci/dwc/pcie-designware-ecam.c
+@@ -0,0 +1,77 @@
++/*
++ * Driver for mostly ECAM compatible Synopsys dw PCIe controllers
++ * configured by the firmware into RC mode
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * Copyright (C) 2014 ARM Limited
++ * Copyright (C) 2017 Linaro Limited
++ *
++ * Authors: Will Deacon <will.deacon@arm.com>
++ *          Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/of_address.h>
++#include <linux/of_pci.h>
++#include <linux/pci-ecam.h>
++#include <linux/platform_device.h>
++
++static int pci_dw_ecam_config_read(struct pci_bus *bus, u32 devfn, int where,
++				   int size, u32 *val)
++{
++	struct pci_config_window *cfg = bus->sysdata;
++
++	/*
++	 * The Synopsys dw PCIe controller in RC mode will not filter type 0
++	 * config TLPs sent to devices 1 and up on its downstream port,
++	 * resulting in devices appearing multiple times on bus 0 unless we
++	 * filter them here.
++	 */
++	if (bus->number == cfg->busr.start && PCI_SLOT(devfn) > 0) {
++		*val = 0xffffffff;
++		return PCIBIOS_DEVICE_NOT_FOUND;
++	}
++	return pci_generic_config_read(bus, devfn, where, size, val);
++}
++
++static int pci_dw_ecam_config_write(struct pci_bus *bus, u32 devfn, int where,
++				    int size, u32 val)
++{
++	struct pci_config_window *cfg = bus->sysdata;
++
++	if (bus->number == cfg->busr.start && PCI_SLOT(devfn) > 0)
++		return PCIBIOS_DEVICE_NOT_FOUND;
++
++	return pci_generic_config_write(bus, devfn, where, size, val);
++}
++
++static struct pci_ecam_ops pci_dw_ecam_bus_ops = {
++	.pci_ops.map_bus		= pci_ecam_map_bus,
++	.pci_ops.read			= pci_dw_ecam_config_read,
++	.pci_ops.write			= pci_dw_ecam_config_write,
++	.bus_shift			= 20,
++};
++
++static const struct of_device_id pci_dw_ecam_of_match[] = {
++	{ .compatible = "marvell,armada8k-pcie-ecam" },
++	{ .compatible = "socionext,synquacer-pcie-ecam" },
++	{ .compatible = "snps,dw-pcie-ecam" },
++	{ },
++};
++
++static int pci_dw_ecam_probe(struct platform_device *pdev)
++{
++	return pci_host_common_probe(pdev, &pci_dw_ecam_bus_ops);
++}
++
++static struct platform_driver pci_dw_ecam_driver = {
++	.driver.name			= "pcie-designware-ecam",
++	.driver.of_match_table		= pci_dw_ecam_of_match,
++	.driver.suppress_bind_attrs	= true,
++	.probe				= pci_dw_ecam_probe,
++};
++builtin_platform_driver(pci_dw_ecam_driver);
+-- 
+cgit v1.1
+
+From e3dff048a10f16aa0fd32438442ce39558bbdbef Mon Sep 17 00:00:00 2001
+From: Jassi Brar <jaswinder.singh@linaro.org>
+Date: Tue, 29 Aug 2017 22:45:59 +0530
+Subject: net: socionext: Add Synquacer NetSec driver
+
+This driver adds support for Socionext "netsec" IP Gigabit
+Ethernet + PHY IP used in the Synquacer SC2A11 SoC.
+
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ drivers/net/ethernet/Kconfig                       |   1 +
+ drivers/net/ethernet/Makefile                      |   1 +
+ drivers/net/ethernet/socionext/Kconfig             |  29 +
+ drivers/net/ethernet/socionext/Makefile            |   1 +
+ drivers/net/ethernet/socionext/netsec/Makefile     |   6 +
+ drivers/net/ethernet/socionext/netsec/netsec.h     | 408 ++++++++++++++
+ .../socionext/netsec/netsec_desc_ring_access.c     | 623 +++++++++++++++++++++
+ .../net/ethernet/socionext/netsec/netsec_ethtool.c |  78 +++
+ .../ethernet/socionext/netsec/netsec_gmac_access.c | 330 +++++++++++
+ .../net/ethernet/socionext/netsec/netsec_netdev.c  | 540 ++++++++++++++++++
+ .../ethernet/socionext/netsec/netsec_platform.c    | 435 ++++++++++++++
+ 11 files changed, 2452 insertions(+)
+ create mode 100644 drivers/net/ethernet/socionext/Kconfig
+ create mode 100644 drivers/net/ethernet/socionext/Makefile
+ create mode 100644 drivers/net/ethernet/socionext/netsec/Makefile
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec.h
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec_desc_ring_access.c
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec_ethtool.c
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec_gmac_access.c
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec_netdev.c
+ create mode 100644 drivers/net/ethernet/socionext/netsec/netsec_platform.c
+
+diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
+index c604213..d50519e 100644
+--- a/drivers/net/ethernet/Kconfig
++++ b/drivers/net/ethernet/Kconfig
+@@ -170,6 +170,7 @@ source "drivers/net/ethernet/sis/Kconfig"
+ source "drivers/net/ethernet/sfc/Kconfig"
+ source "drivers/net/ethernet/sgi/Kconfig"
+ source "drivers/net/ethernet/smsc/Kconfig"
++source "drivers/net/ethernet/socionext/Kconfig"
+ source "drivers/net/ethernet/stmicro/Kconfig"
+ source "drivers/net/ethernet/sun/Kconfig"
+ source "drivers/net/ethernet/tehuti/Kconfig"
+diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
+index a0a03d4..6ae1bb9 100644
+--- a/drivers/net/ethernet/Makefile
++++ b/drivers/net/ethernet/Makefile
+@@ -81,6 +81,7 @@ obj-$(CONFIG_SFC) += sfc/
+ obj-$(CONFIG_SFC_FALCON) += sfc/falcon/
+ obj-$(CONFIG_NET_VENDOR_SGI) += sgi/
+ obj-$(CONFIG_NET_VENDOR_SMSC) += smsc/
++obj-$(CONFIG_NET_VENDOR_SNI) += socionext/
+ obj-$(CONFIG_NET_VENDOR_STMICRO) += stmicro/
+ obj-$(CONFIG_NET_VENDOR_SUN) += sun/
+ obj-$(CONFIG_NET_VENDOR_TEHUTI) += tehuti/
+diff --git a/drivers/net/ethernet/socionext/Kconfig b/drivers/net/ethernet/socionext/Kconfig
+new file mode 100644
+index 0000000..a6dc195
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/Kconfig
+@@ -0,0 +1,29 @@
++#
++# Socionext Network device configuration
++#
++
++config NET_VENDOR_SNI
++	bool "Socionext devices"
++	default y
++	---help---
++	  If you have a network (Ethernet) card belonging to this class, say Y.
++
++	  Note that the answer to this question doesn't directly affect the
++	  the questions about Socionext cards. If you say Y, you will be asked
++	  for your specific card in the following questions.
++
++if NET_VENDOR_SNI
++
++config SNI_NETSEC
++	tristate "NETSEC Driver Support"
++	depends on OF
++	select PHYLIB
++	select MII
++help
++	  Enable to add support for the SocioNext NetSec Gigabit Ethernet
++	  controller + PHY, as found on the Synquacer SC2A11 SoC
++
++	  To compile this driver as a module, choose M here: the module will be
++	  called netsec.  If unsure, say N.
++
++endif # NET_VENDOR_SNI
+diff --git a/drivers/net/ethernet/socionext/Makefile b/drivers/net/ethernet/socionext/Makefile
+new file mode 100644
+index 0000000..9555899
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/Makefile
+@@ -0,0 +1 @@
++obj-$(CONFIG_SNI_NETSEC) += netsec/
+diff --git a/drivers/net/ethernet/socionext/netsec/Makefile b/drivers/net/ethernet/socionext/netsec/Makefile
+new file mode 100644
+index 0000000..18884ed
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/Makefile
+@@ -0,0 +1,6 @@
++obj-$(CONFIG_SNI_NETSEC) := netsec.o
++netsec-objs := netsec_desc_ring_access.o \
++		netsec_netdev.o \
++		netsec_ethtool.o \
++		netsec_platform.o \
++		netsec_gmac_access.o
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec.h b/drivers/net/ethernet/socionext/netsec/netsec.h
+new file mode 100644
+index 0000000..3b97661
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec.h
+@@ -0,0 +1,408 @@
++/**
++ * netsec.h
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++#ifndef NETSEC_INTERNAL_H
++#define NETSEC_INTERNAL_H
++
++#include <linux/netdevice.h>
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/phy.h>
++#include <linux/ethtool.h>
++#include <linux/of_address.h>
++#include <linux/of_mdio.h>
++#include <linux/etherdevice.h>
++#include <net/sock.h>
++
++#define NETSEC_FLOW_CONTROL_START_THRESHOLD	36
++#define NETSEC_FLOW_CONTROL_STOP_THRESHOLD	48
++
++#define NETSEC_CLK_MHZ				1000000
++
++#define NETSEC_RX_PKT_BUF_LEN			1522
++#define NETSEC_RX_JUMBO_PKT_BUF_LEN		9022
++
++#define NETSEC_NETDEV_TX_PKT_SCAT_NUM_MAX	19
++
++#define DESC_NUM				128
++
++#define NETSEC_TX_SHIFT_OWN_FIELD		31
++#define NETSEC_TX_SHIFT_LD_FIELD		30
++#define NETSEC_TX_SHIFT_DRID_FIELD		24
++#define NETSEC_TX_SHIFT_PT_FIELD		21
++#define NETSEC_TX_SHIFT_TDRID_FIELD		16
++#define NETSEC_TX_SHIFT_CC_FIELD		15
++#define NETSEC_TX_SHIFT_FS_FIELD		9
++#define NETSEC_TX_LAST				8
++#define NETSEC_TX_SHIFT_CO			7
++#define NETSEC_TX_SHIFT_SO			6
++#define NETSEC_TX_SHIFT_TRS_FIELD		4
++
++#define NETSEC_RX_PKT_OWN_FIELD			31
++#define NETSEC_RX_PKT_LD_FIELD			30
++#define NETSEC_RX_PKT_SDRID_FIELD		24
++#define NETSEC_RX_PKT_FR_FIELD			23
++#define NETSEC_RX_PKT_ER_FIELD			21
++#define NETSEC_RX_PKT_ERR_FIELD			16
++#define NETSEC_RX_PKT_TDRID_FIELD		12
++#define NETSEC_RX_PKT_FS_FIELD			9
++#define NETSEC_RX_PKT_LS_FIELD			8
++#define NETSEC_RX_PKT_CO_FIELD			6
++
++#define NETSEC_RX_PKT_ERR_MASK			3
++
++#define NETSEC_MAX_TX_PKT_LEN			1518
++#define NETSEC_MAX_TX_JUMBO_PKT_LEN		9018
++
++enum netsec_rings {
++	NETSEC_RING_TX,
++	NETSEC_RING_RX
++};
++
++#define NETSEC_RING_GMAC			15
++#define NETSEC_RING_MAX				1
++
++#define NETSEC_TCP_SEG_LEN_MAX			1460
++#define NETSEC_TCP_JUMBO_SEG_LEN_MAX		8960
++
++#define NETSEC_RX_CKSUM_NOTAVAIL		0
++#define NETSEC_RX_CKSUM_OK			1
++#define NETSEC_RX_CKSUM_NG			2
++
++#define NETSEC_TOP_IRQ_REG_CODE_LOAD_END	BIT(20)
++#define NETSEC_IRQ_TRANSITION_COMPLETE		BIT(4)
++#define NETSEC_IRQ_RX				BIT(1)
++#define NETSEC_IRQ_TX				BIT(0)
++
++#define NETSEC_IRQ_EMPTY			BIT(17)
++#define NETSEC_IRQ_ERR				BIT(16)
++#define NETSEC_IRQ_PKT_CNT			BIT(15)
++#define NETSEC_IRQ_TIMEUP			BIT(14)
++#define NETSEC_IRQ_RCV				(NETSEC_IRQ_PKT_CNT | \
++						 NETSEC_IRQ_TIMEUP)
++
++#define NETSEC_IRQ_TX_DONE			BIT(15)
++#define NETSEC_IRQ_SND				(NETSEC_IRQ_TX_DONE | \
++						 NETSEC_IRQ_TIMEUP)
++
++#define NETSEC_MODE_TRANS_COMP_IRQ_N2T		BIT(20)
++#define NETSEC_MODE_TRANS_COMP_IRQ_T2N		BIT(19)
++
++#define NETSEC_DESC_MIN				2
++#define NETSEC_DESC_MAX				2047
++#define NETSEC_INT_PKTCNT_MAX			2047
++
++#define NETSEC_FLOW_START_TH_MAX		95
++#define NETSEC_FLOW_STOP_TH_MAX			95
++#define NETSEC_FLOW_PAUSE_TIME_MIN		5
++
++#define NETSEC_CLK_EN_REG_DOM_ALL		0x3f
++
++#define NETSEC_REG_TOP_STATUS			0x80
++#define NETSEC_REG_TOP_INTEN			0x81
++#define NETSEC_REG_INTEN_SET			0x8d
++#define NETSEC_REG_INTEN_CLR			0x8e
++#define NETSEC_REG_NRM_TX_STATUS		0x100
++#define NETSEC_REG_NRM_TX_INTEN			0x101
++#define NETSEC_REG_NRM_TX_INTEN_SET		0x10a
++#define NETSEC_REG_NRM_TX_INTEN_CLR		0x10b
++#define NETSEC_REG_NRM_RX_STATUS		0x110
++#define NETSEC_REG_NRM_RX_INTEN			0x111
++#define NETSEC_REG_NRM_RX_INTEN_SET		0x11a
++#define NETSEC_REG_NRM_RX_INTEN_CLR		0x11b
++#define NETSEC_REG_RESERVED_RX_DESC_START	0x122
++#define NETSEC_REG_RESERVED_TX_DESC_START	0x132
++#define NETSEC_REG_CLK_EN			0x40
++#define NETSEC_REG_SOFT_RST			0x41
++#define NETSEC_REG_PKT_CMD_BUF			0x34
++#define NETSEC_REG_PKT_CTRL			0x50
++#define NETSEC_REG_COM_INIT			0x48
++#define NETSEC_REG_DMA_TMR_CTRL			0x83
++#define NETSEC_REG_F_TAIKI_MC_VER		0x8b
++#define NETSEC_REG_F_TAIKI_VER			0x8c
++#define NETSEC_REG_DMA_HM_CTRL			0x85
++#define NETSEC_REG_DMA_MH_CTRL			0x88
++#define NETSEC_REG_ADDR_DIS_CORE		0x86
++#define NETSEC_REG_DMAC_HM_CMD_BUF		0x84
++#define NETSEC_REG_DMAC_MH_CMD_BUF		0x87
++#define NETSEC_REG_NRM_TX_PKTCNT		0x104
++#define NETSEC_REG_NRM_TX_DONE_TXINT_PKTCNT	0x106
++#define NETSEC_REG_NRM_RX_RXINT_PKTCNT		0x116
++#define NETSEC_REG_NRM_TX_TXINT_TMR		0x108
++#define NETSEC_REG_NRM_RX_RXINT_TMR		0x118
++#define NETSEC_REG_NRM_TX_DONE_PKTCNT		0x105
++#define NETSEC_REG_NRM_RX_PKTCNT		0x115
++#define NETSEC_REG_NRM_TX_TMR			0x107
++#define NETSEC_REG_NRM_RX_TMR			0x117
++#define NETSEC_REG_NRM_TX_DESC_START_UP		0x10d
++#define NETSEC_REG_NRM_TX_DESC_START_LW		0x102
++#define NETSEC_REG_NRM_RX_DESC_START_UP		0x11d
++#define NETSEC_REG_NRM_RX_DESC_START_LW		0x112
++#define NETSEC_REG_NRM_TX_CONFIG		0x10c
++#define NETSEC_REG_NRM_RX_CONFIG		0x11c
++#define MAC_REG_DATA				0x470
++#define MAC_REG_CMD				0x471
++#define MAC_REG_FLOW_TH				0x473
++#define MAC_REG_INTF_SEL			0x475
++#define MAC_REG_DESC_INIT			0x47f
++#define MAC_REG_DESC_SOFT_RST			0x481
++#define NETSEC_REG_MODE_TRANS_COMP_STATUS	0x140
++#define GMAC_REG_MCR				0x0000
++#define GMAC_REG_MFFR				0x0004
++#define GMAC_REG_GAR				0x0010
++#define GMAC_REG_GDR				0x0014
++#define GMAC_REG_FCR				0x0018
++#define GMAC_REG_BMR				0x1000
++#define GMAC_REG_RDLAR				0x100c
++#define GMAC_REG_TDLAR				0x1010
++#define GMAC_REG_OMR				0x1018
++
++#define NETSEC_PKT_CTRL_REG_MODE_NRM		BIT(28)
++#define NETSEC_PKT_CTRL_REG_EN_JUMBO		BIT(27)
++#define NETSEC_PKT_CTRL_REG_LOG_CHKSUM_ER	BIT(3)
++#define NETSEC_PKT_CTRL_REG_LOG_HD_INCOMPLETE	BIT(2)
++#define NETSEC_PKT_CTRL_REG_LOG_HD_ER		BIT(1)
++#define NETSEC_PKT_CTRL_REG_DRP_NO_MATCH	BIT(0)
++
++#define NETSEC_CLK_EN_REG_DOM_G			BIT(5)
++#define NETSEC_CLK_EN_REG_DOM_C			BIT(1)
++#define NETSEC_CLK_EN_REG_DOM_D			BIT(0)
++
++#define NETSEC_COM_INIT_REG_DB			BIT(2)
++#define NETSEC_COM_INIT_REG_CLS			BIT(1)
++#define NETSEC_COM_INIT_REG_ALL			(NETSEC_COM_INIT_REG_CLS | \
++						 NETSEC_COM_INIT_REG_DB)
++
++#define NETSEC_SOFT_RST_REG_RESET		0
++#define NETSEC_SOFT_RST_REG_RUN			BIT(31)
++
++#define NETSEC_DMA_CTRL_REG_STOP		1
++#define MH_CTRL__MODE_TRANS			BIT(20)
++
++#define NETSEC_GMAC_CMD_ST_READ			0
++#define NETSEC_GMAC_CMD_ST_WRITE		BIT(28)
++#define NETSEC_GMAC_CMD_ST_BUSY			BIT(31)
++
++#define NETSEC_GMAC_BMR_REG_COMMON		0x00412080
++#define NETSEC_GMAC_BMR_REG_RESET		0x00020181
++#define NETSEC_GMAC_BMR_REG_SWR			0x00000001
++
++#define NETSEC_GMAC_OMR_REG_ST			BIT(13)
++#define NETSEC_GMAC_OMR_REG_SR			BIT(1)
++
++#define NETSEC_GMAC_MCR_REG_IBN			BIT(30)
++#define NETSEC_GMAC_MCR_REG_CST			BIT(25)
++#define NETSEC_GMAC_MCR_REG_JE			BIT(20)
++#define NETSEC_MCR_PS				BIT(15)
++#define NETSEC_GMAC_MCR_REG_FES			BIT(14)
++#define NETSEC_GMAC_MCR_REG_FULL_DUPLEX_COMMON	0x0000280c
++#define NETSEC_GMAC_MCR_REG_HALF_DUPLEX_COMMON	0x0001a00c
++
++#define NETSEC_FCR_RFE				BIT(2)
++#define NETSEC_FCR_TFE				BIT(1)
++
++#define NETSEC_GMAC_GAR_REG_GW			BIT(1)
++#define NETSEC_GMAC_GAR_REG_GB			BIT(0)
++
++#define NETSEC_GMAC_GAR_REG_SHIFT_PA		11
++#define NETSEC_GMAC_GAR_REG_SHIFT_GR		6
++#define GMAC_REG_SHIFT_CR_GAR			2
++
++#define NETSEC_GMAC_GAR_REG_CR_25_35_MHZ	2
++#define NETSEC_GMAC_GAR_REG_CR_35_60_MHZ	3
++#define NETSEC_GMAC_GAR_REG_CR_60_100_MHZ	0
++#define NETSEC_GMAC_GAR_REG_CR_100_150_MHZ	1
++#define NETSEC_GMAC_GAR_REG_CR_150_250_MHZ	4
++#define NETSEC_GMAC_GAR_REG_CR_250_300_MHZ	5
++
++#define NETSEC_GMAC_RDLAR_REG_COMMON		0x18000
++#define NETSEC_GMAC_TDLAR_REG_COMMON		0x1c000
++
++#define NETSEC_REG_NETSEC_VER_F_TAIKI		0x50000
++
++#define NETSEC_REG_DESC_RING_CONFIG_CFG_UP	BIT(31)
++#define NETSEC_REG_DESC_RING_CONFIG_CH_RST	BIT(30)
++#define NETSEC_REG_DESC_TMR_MODE		4
++#define NETSEC_REG_DESC_ENDIAN			0
++
++#define NETSEC_MAC_DESC_SOFT_RST_SOFT_RST	1
++#define NETSEC_MAC_DESC_INIT_REG_INIT		1
++
++#define NETSEC_EEPROM_MAC_ADDRESS		0x00
++#define NETSEC_EEPROM_HM_ME_ADDRESS_H		0x08
++#define NETSEC_EEPROM_HM_ME_ADDRESS_L		0x0C
++#define NETSEC_EEPROM_HM_ME_SIZE		0x10
++#define NETSEC_EEPROM_MH_ME_ADDRESS_H		0x14
++#define NETSEC_EEPROM_MH_ME_ADDRESS_L		0x18
++#define NETSEC_EEPROM_MH_ME_SIZE		0x1C
++#define NETSEC_EEPROM_PKT_ME_ADDRESS		0x20
++#define NETSEC_EEPROM_PKT_ME_SIZE		0x24
++
++/* this is used to interpret a register layout */
++struct netsec_pkt_ctrlaram {
++	u8 log_chksum_er_flag:1;
++	u8 log_hd_imcomplete_flag:1;
++	u8 log_hd_er_flag:1;
++};
++
++struct netsec_param {
++	struct netsec_pkt_ctrlaram pkt_ctrlaram;
++	bool use_jumbo_pkt_flag;
++};
++
++struct netsec_mac_mode {
++	u16 flow_start_th;
++	u16 flow_stop_th;
++	u16 pause_time;
++	bool flow_ctrl_enable_flag;
++};
++
++struct netsec_desc_ring {
++	spinlock_t spinlock_desc; /* protect descriptor access */
++	phys_addr_t desc_phys;
++	struct netsec_frag_info *frag;
++	struct sk_buff **priv;
++	void *ring_vaddr;
++	enum netsec_rings id;
++	int len;
++	u16 tx_done_num;
++	u16 rx_num;
++	u16 head;
++	u16 tail;
++	bool running;
++	bool full;
++};
++
++struct netsec_frag_info {
++	dma_addr_t dma_addr;
++	void *addr;
++	u16 len;
++};
++
++struct netsec_priv {
++	struct netsec_desc_ring desc_ring[NETSEC_RING_MAX + 1];
++	struct ethtool_coalesce et_coalesce;
++	struct netsec_mac_mode mac_mode;
++	struct netsec_param param;
++	struct napi_struct napi;
++	phy_interface_t phy_interface;
++	spinlock_t tx_queue_lock; /* protect transmit queue */
++	struct netsec_frag_info tx_info[MAX_SKB_FRAGS];
++	struct net_device *ndev;
++	struct device_node *phy_np;
++	struct phy_device *phydev;
++	struct mii_bus *mii_bus;
++	void __iomem *ioaddr;
++	const void *eeprom_base;
++	struct device *dev;
++	struct clk *clk[3];
++	u32 rx_pkt_buf_len;
++	u32 msg_enable;
++	u32 freq;
++	int actual_link_speed;
++	int clock_count;
++	bool rx_cksum_offload_flag;
++	bool actual_duplex;
++	bool irq_registered;
++};
++
++struct netsec_tx_de {
++	u32 attr;
++	u32 data_buf_addr_up;
++	u32 data_buf_addr_lw;
++	u32 buf_len_info;
++};
++
++struct netsec_rx_de {
++	u32 attr;
++	u32 data_buf_addr_up;
++	u32 data_buf_addr_lw;
++	u32 buf_len_info;
++};
++
++struct netsec_tx_pkt_ctrl {
++	u16 tcp_seg_len;
++	bool tcp_seg_offload_flag;
++	bool cksum_offload_flag;
++};
++
++struct netsec_rx_pkt_info {
++	int rx_cksum_result;
++	int err_code;
++	bool is_fragmented;
++	bool err_flag;
++};
++
++struct netsec_skb_cb {
++	bool is_rx;
++};
++
++static inline void netsec_writel(struct netsec_priv *priv,
++				 u32 reg_addr, u32 val)
++{
++	writel_relaxed(val, priv->ioaddr + (reg_addr << 2));
++}
++
++static inline u32 netsec_readl(struct netsec_priv *priv, u32 reg_addr)
++{
++	return readl_relaxed(priv->ioaddr + (reg_addr << 2));
++}
++
++static inline void netsec_mark_skb_type(struct sk_buff *skb, bool is_rx)
++{
++	struct netsec_skb_cb *cb = (struct netsec_skb_cb *)skb->cb;
++
++	cb->is_rx = is_rx;
++}
++
++static inline bool skb_is_rx(struct sk_buff *skb)
++{
++	struct netsec_skb_cb *cb = (struct netsec_skb_cb *)skb->cb;
++
++	return cb->is_rx;
++}
++
++extern const struct net_device_ops netsec_netdev_ops;
++extern const struct ethtool_ops netsec_ethtool_ops;
++
++int netsec_start_gmac(struct netsec_priv *priv);
++int netsec_stop_gmac(struct netsec_priv *priv);
++int netsec_mii_register(struct netsec_priv *priv);
++void netsec_mii_unregister(struct netsec_priv *priv);
++int netsec_start_desc_ring(struct netsec_priv *priv, enum netsec_rings id);
++void netsec_stop_desc_ring(struct netsec_priv *priv, enum netsec_rings id);
++u16 netsec_get_rx_num(struct netsec_priv *priv);
++u16 netsec_get_tx_avail_num(struct netsec_priv *priv);
++int netsec_clean_tx_desc_ring(struct netsec_priv *priv);
++int netsec_clean_rx_desc_ring(struct netsec_priv *priv);
++int netsec_set_tx_pkt_data(struct netsec_priv *priv,
++			   const struct netsec_tx_pkt_ctrl *tx_ctrl,
++			   u8 count_frags, const struct netsec_frag_info *info,
++			   struct sk_buff *skb);
++int netsec_get_rx_pkt_data(struct netsec_priv *priv,
++			   struct netsec_rx_pkt_info *rxpi,
++			   struct netsec_frag_info *frag, u16 *len,
++			   struct sk_buff **skb);
++void netsec_ring_irq_enable(struct netsec_priv *priv,
++			    enum netsec_rings id, u32 i);
++void netsec_ring_irq_disable(struct netsec_priv *priv,
++			     enum netsec_rings id, u32 i);
++int netsec_alloc_desc_ring(struct netsec_priv *priv, enum netsec_rings id);
++void netsec_free_desc_ring(struct netsec_priv *priv,
++			   struct netsec_desc_ring *desc);
++int netsec_setup_rx_desc(struct netsec_priv *priv,
++			 struct netsec_desc_ring *desc);
++int netsec_netdev_napi_poll(struct napi_struct *napi_p, int budget);
++
++#endif /* NETSEC_INTERNAL_H */
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec_desc_ring_access.c b/drivers/net/ethernet/socionext/netsec/netsec_desc_ring_access.c
+new file mode 100644
+index 0000000..a4e56cd
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec_desc_ring_access.c
+@@ -0,0 +1,623 @@
++/**
++ * drivers/net/ethernet/socionext/netsec/netsec_desc_ring_access.c
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++
++#include <linux/spinlock.h>
++#include <linux/dma-mapping.h>
++
++#include "netsec.h"
++
++static const u32 ads_irq_set[] = {
++	NETSEC_REG_NRM_TX_INTEN_SET,
++	NETSEC_REG_NRM_RX_INTEN_SET,
++};
++
++static const u32 desc_ring_irq_inten_clr_reg_addr[] = {
++	NETSEC_REG_NRM_TX_INTEN_CLR,
++	NETSEC_REG_NRM_RX_INTEN_CLR,
++};
++
++static const u32 int_tmr_reg_addr[] = {
++	NETSEC_REG_NRM_TX_TXINT_TMR,
++	NETSEC_REG_NRM_RX_RXINT_TMR,
++};
++
++static const u32 rx_pkt_cnt_reg_addr[] = {
++	0,
++	NETSEC_REG_NRM_RX_PKTCNT,
++};
++
++static const u32 tx_pkt_cnt_reg_addr[] = {
++	NETSEC_REG_NRM_TX_PKTCNT,
++	0,
++};
++
++static const u32 int_pkt_cnt_reg_addr[] = {
++	NETSEC_REG_NRM_TX_DONE_TXINT_PKTCNT,
++	NETSEC_REG_NRM_RX_RXINT_PKTCNT,
++};
++
++static const u32 tx_done_pkt_addr[] = {
++	NETSEC_REG_NRM_TX_DONE_PKTCNT,
++	0,
++};
++
++static const u32 netsec_desc_mask[] = {
++	[NETSEC_RING_TX] = NETSEC_GMAC_OMR_REG_ST,
++	[NETSEC_RING_RX] = NETSEC_GMAC_OMR_REG_SR
++};
++
++void netsec_ring_irq_enable(struct netsec_priv *priv,
++			    enum netsec_rings id, u32 irqf)
++{
++	netsec_writel(priv, ads_irq_set[id], irqf);
++}
++
++void netsec_ring_irq_disable(struct netsec_priv *priv,
++			     enum netsec_rings id, u32 irqf)
++{
++	netsec_writel(priv, desc_ring_irq_inten_clr_reg_addr[id], irqf);
++}
++
++static struct sk_buff *alloc_rx_pkt_buf(struct netsec_priv *priv,
++					struct netsec_frag_info *info)
++{
++	struct sk_buff *skb;
++
++	if (device_get_dma_attr(priv->dev) == DEV_DMA_COHERENT) {
++		skb = netdev_alloc_skb_ip_align(priv->ndev, info->len);
++	} else {
++		info->len = L1_CACHE_ALIGN(info->len);
++		skb = netdev_alloc_skb(priv->ndev, info->len);
++	}
++	if (!skb)
++		return NULL;
++
++	netsec_mark_skb_type(skb, NETSEC_RING_RX);
++	info->addr = skb->data;
++	info->dma_addr = dma_map_single(priv->dev, info->addr, info->len,
++					DMA_FROM_DEVICE);
++	if (dma_mapping_error(priv->dev, info->dma_addr)) {
++		dev_kfree_skb(skb);
++		return NULL;
++	}
++	return skb;
++}
++
++int netsec_alloc_desc_ring(struct netsec_priv *priv, enum netsec_rings id)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[id];
++	int ret = 0;
++
++	desc->id = id;
++	desc->len = sizeof(struct netsec_tx_de); /* rx and tx desc same size */
++
++	spin_lock_init(&desc->spinlock_desc);
++
++	desc->ring_vaddr = dma_zalloc_coherent(priv->dev, desc->len * DESC_NUM,
++					       &desc->desc_phys, GFP_KERNEL);
++	if (!desc->ring_vaddr) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	desc->frag = kcalloc(DESC_NUM, sizeof(*desc->frag), GFP_KERNEL);
++	if (!desc->frag) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	desc->priv = kcalloc(DESC_NUM, sizeof(struct sk_buff *), GFP_KERNEL);
++	if (!desc->priv) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	return 0;
++
++err:
++	netsec_free_desc_ring(priv, desc);
++
++	return ret;
++}
++
++static void netsec_uninit_pkt_desc_ring(struct netsec_priv *priv,
++					struct netsec_desc_ring *desc)
++{
++	struct netsec_frag_info *frag;
++	u32 status;
++	u16 idx;
++
++	for (idx = 0; idx < DESC_NUM; idx++) {
++		frag = &desc->frag[idx];
++		if (!frag->addr)
++			continue;
++
++		status = *(u32 *)(desc->ring_vaddr + desc->len * idx);
++
++		dma_unmap_single(priv->dev, frag->dma_addr, frag->len,
++				 skb_is_rx(desc->priv[idx]) ? DMA_FROM_DEVICE :
++							      DMA_TO_DEVICE);
++		if ((status >> NETSEC_TX_LAST) & 1)
++			dev_kfree_skb(desc->priv[idx]);
++	}
++
++	memset(desc->frag, 0, sizeof(struct netsec_frag_info) * DESC_NUM);
++	memset(desc->priv, 0, sizeof(struct sk_buff *) * DESC_NUM);
++	memset(desc->ring_vaddr, 0, desc->len * DESC_NUM);
++}
++
++void netsec_free_desc_ring(struct netsec_priv *priv,
++			   struct netsec_desc_ring *desc)
++{
++	if (desc->ring_vaddr && desc->frag && desc->priv)
++		netsec_uninit_pkt_desc_ring(priv, desc);
++
++	if (desc->ring_vaddr) {
++		dma_free_coherent(priv->dev, desc->len * DESC_NUM,
++				  desc->ring_vaddr, desc->desc_phys);
++		desc->ring_vaddr = NULL;
++	}
++	kfree(desc->frag);
++	desc->frag = NULL;
++	kfree(desc->priv);
++	desc->priv = NULL;
++}
++
++static void netsec_set_rx_de(struct netsec_priv *priv,
++			     struct netsec_desc_ring *desc, u16 idx,
++			     const struct netsec_frag_info *info,
++			     struct sk_buff *skb)
++{
++	struct netsec_rx_de *de = desc->ring_vaddr + desc->len * idx;
++	u32 attr = (1 << NETSEC_RX_PKT_OWN_FIELD) |
++		   (1 << NETSEC_RX_PKT_FS_FIELD) |
++		   (1 << NETSEC_RX_PKT_LS_FIELD);
++
++	if (idx == DESC_NUM - 1)
++		attr |= (1 << NETSEC_RX_PKT_LD_FIELD);
++
++	de->data_buf_addr_up = upper_32_bits(info->dma_addr);
++	de->data_buf_addr_lw = lower_32_bits(info->dma_addr);
++	de->buf_len_info = info->len;
++	/* desc->attr makes the descriptor live, so it must be physically
++	 * written last after the rest of the descriptor body is already there
++	 */
++	dma_wmb();
++	de->attr = attr;
++
++	desc->frag[idx].dma_addr = info->dma_addr;
++	desc->frag[idx].addr = info->addr;
++	desc->frag[idx].len = info->len;
++
++	desc->priv[idx] = skb;
++}
++
++int netsec_setup_rx_desc(struct netsec_priv *priv,
++			 struct netsec_desc_ring *desc)
++{
++	struct netsec_frag_info info;
++	struct sk_buff *skb;
++	int n;
++
++	info.len = priv->rx_pkt_buf_len;
++
++	for (n = 0; n < DESC_NUM; n++) {
++		skb = alloc_rx_pkt_buf(priv, &info);
++		if (!skb) {
++			netsec_uninit_pkt_desc_ring(priv, desc);
++			return -ENOMEM;
++		}
++		netsec_set_rx_de(priv, desc, n, &info, skb);
++	}
++
++	return 0;
++}
++
++static void netsec_set_tx_desc_entry(struct netsec_priv *priv,
++				     struct netsec_desc_ring *desc,
++				     const struct netsec_tx_pkt_ctrl *tx_ctrl,
++				     bool first_flag, bool last_flag,
++				     const struct netsec_frag_info *frag,
++				     struct sk_buff *skb)
++{
++	struct netsec_tx_de *tx_desc_entry;
++	int idx = desc->head;
++	u32 attr;
++
++	tx_desc_entry = desc->ring_vaddr + (desc->len * idx);
++
++	attr = (1 << NETSEC_TX_SHIFT_OWN_FIELD) |
++	       (desc->id << NETSEC_TX_SHIFT_DRID_FIELD) |
++	       (1 << NETSEC_TX_SHIFT_PT_FIELD) |
++	       (NETSEC_RING_GMAC << NETSEC_TX_SHIFT_TDRID_FIELD) |
++	       (first_flag << NETSEC_TX_SHIFT_FS_FIELD) |
++	       (last_flag << NETSEC_TX_LAST) |
++	       (tx_ctrl->cksum_offload_flag << NETSEC_TX_SHIFT_CO) |
++	       (tx_ctrl->tcp_seg_offload_flag << NETSEC_TX_SHIFT_SO) |
++	       (1 << NETSEC_TX_SHIFT_TRS_FIELD);
++	if (idx == DESC_NUM - 1)
++		attr |= (1 << NETSEC_TX_SHIFT_LD_FIELD);
++
++	tx_desc_entry->data_buf_addr_up = upper_32_bits(frag->dma_addr);
++	tx_desc_entry->data_buf_addr_lw = lower_32_bits(frag->dma_addr);
++	tx_desc_entry->buf_len_info = (tx_ctrl->tcp_seg_len << 16) | frag->len;
++	/* desc->attr makes the descriptor live, so it must be physically
++	 * written last after the rest of the descriptor body is already there
++	 */
++	dma_wmb();
++	tx_desc_entry->attr = attr;
++
++	desc->frag[idx] = *frag;
++	desc->priv[idx] = skb;
++}
++
++static void netsec_get_rx_de(struct netsec_priv *priv,
++			     struct netsec_desc_ring *desc, u16 idx,
++			     struct netsec_rx_pkt_info *rxpi,
++			     struct netsec_frag_info *frag, u16 *len,
++			     struct sk_buff **skb)
++{
++	struct netsec_rx_de de = {};
++
++	*rxpi = (struct netsec_rx_pkt_info){};
++	memcpy(&de, desc->ring_vaddr + desc->len * idx, desc->len);
++
++	dev_dbg(priv->dev, "%08x\n", *(u32 *)&de);
++	*len = de.buf_len_info >> 16;
++
++	rxpi->is_fragmented = (de.attr >> NETSEC_RX_PKT_FR_FIELD) & 1;
++	rxpi->err_flag = (de.attr >> NETSEC_RX_PKT_ER_FIELD) & 1;
++	rxpi->rx_cksum_result = (de.attr >> NETSEC_RX_PKT_CO_FIELD) & 3;
++	rxpi->err_code = (de.attr >> NETSEC_RX_PKT_ERR_FIELD) &
++							NETSEC_RX_PKT_ERR_MASK;
++	*frag = desc->frag[idx];
++	*skb = desc->priv[idx];
++}
++
++static void netsec_inc_desc_head_idx(struct netsec_priv *priv,
++				     struct netsec_desc_ring *desc, u16 inc)
++{
++	u32 sum;
++
++	sum = desc->head + inc;
++
++	if (sum >= DESC_NUM)
++		sum -= DESC_NUM;
++
++	desc->head = sum;
++	desc->full = desc->head == desc->tail;
++}
++
++static void netsec_inc_desc_tail_idx(struct netsec_priv *priv,
++				     struct netsec_desc_ring *desc)
++{
++	u32 sum;
++
++	sum = desc->tail + 1;
++
++	if (sum >= DESC_NUM)
++		sum -= DESC_NUM;
++
++	desc->tail = sum;
++	desc->full = false;
++}
++
++static u16 netsec_get_tx_avail_num_sub(struct netsec_priv *priv,
++				       const struct netsec_desc_ring *desc)
++{
++	if (desc->full)
++		return 0;
++
++	if (desc->tail > desc->head)
++		return desc->tail - desc->head;
++
++	return DESC_NUM + desc->tail - desc->head;
++}
++
++static u16 netsec_get_tx_done_num_sub(struct netsec_priv *priv,
++				      struct netsec_desc_ring *desc)
++{
++	desc->tx_done_num += netsec_readl(priv, tx_done_pkt_addr[desc->id]);
++
++	return desc->tx_done_num;
++}
++
++static int netsec_set_irq_coalesce_param(struct netsec_priv *priv,
++					 enum netsec_rings id)
++{
++	int max_frames, tmr;
++
++	switch (id) {
++	case NETSEC_RING_TX:
++		max_frames = priv->et_coalesce.tx_max_coalesced_frames;
++		tmr = priv->et_coalesce.tx_coalesce_usecs;
++		break;
++	case NETSEC_RING_RX:
++		max_frames = priv->et_coalesce.rx_max_coalesced_frames;
++		tmr = priv->et_coalesce.rx_coalesce_usecs;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	netsec_writel(priv, int_pkt_cnt_reg_addr[id], max_frames);
++	netsec_writel(priv, int_tmr_reg_addr[id], ((tmr != 0) << 31) | tmr);
++
++	return 0;
++}
++
++int netsec_start_desc_ring(struct netsec_priv *priv, enum netsec_rings id)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[id];
++	int ret = 0;
++
++	spin_lock_bh(&desc->spinlock_desc);
++
++	if (desc->running) {
++		ret = -EBUSY;
++		goto err;
++	}
++
++	switch (desc->id) {
++	case NETSEC_RING_RX:
++		netsec_writel(priv, ads_irq_set[id], NETSEC_IRQ_RCV);
++		break;
++	case NETSEC_RING_TX:
++		netsec_writel(priv, ads_irq_set[id], NETSEC_IRQ_EMPTY);
++		break;
++	}
++
++	netsec_set_irq_coalesce_param(priv, desc->id);
++	desc->running = true;
++
++err:
++	spin_unlock_bh(&desc->spinlock_desc);
++
++	return ret;
++}
++
++void netsec_stop_desc_ring(struct netsec_priv *priv, enum netsec_rings id)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[id];
++
++	spin_lock_bh(&desc->spinlock_desc);
++	if (desc->running)
++		netsec_writel(priv, desc_ring_irq_inten_clr_reg_addr[id],
++			      NETSEC_IRQ_RCV | NETSEC_IRQ_EMPTY |
++			      NETSEC_IRQ_SND);
++
++	desc->running = false;
++	spin_unlock_bh(&desc->spinlock_desc);
++}
++
++u16 netsec_get_rx_num(struct netsec_priv *priv)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[NETSEC_RING_RX];
++	u32 result;
++
++	spin_lock(&desc->spinlock_desc);
++	if (desc->running) {
++		result = netsec_readl(priv,
++				      rx_pkt_cnt_reg_addr[NETSEC_RING_RX]);
++		desc->rx_num += result;
++		if (result)
++			netsec_inc_desc_head_idx(priv, desc, result);
++	}
++	spin_unlock(&desc->spinlock_desc);
++
++	return desc->rx_num;
++}
++
++u16 netsec_get_tx_avail_num(struct netsec_priv *priv)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[NETSEC_RING_TX];
++	u16 result;
++
++	spin_lock(&desc->spinlock_desc);
++
++	if (!desc->running) {
++		netif_err(priv, drv, priv->ndev,
++			  "%s: not running tx desc\n", __func__);
++		result = 0;
++		goto err;
++	}
++
++	result = netsec_get_tx_avail_num_sub(priv, desc);
++
++err:
++	spin_unlock(&desc->spinlock_desc);
++
++	return result;
++}
++
++int netsec_clean_tx_desc_ring(struct netsec_priv *priv)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[NETSEC_RING_TX];
++	unsigned int pkts = 0, bytes = 0;
++	struct netsec_frag_info *frag;
++	struct netsec_tx_de *entry;
++	bool is_last;
++
++	spin_lock(&desc->spinlock_desc);
++
++	netsec_get_tx_done_num_sub(priv, desc);
++
++	while ((desc->tail != desc->head || desc->full) && desc->tx_done_num) {
++		frag = &desc->frag[desc->tail];
++		entry = desc->ring_vaddr + desc->len * desc->tail;
++		is_last = (entry->attr >> NETSEC_TX_LAST) & 1;
++
++		dma_unmap_single(priv->dev, frag->dma_addr, frag->len,
++				 DMA_TO_DEVICE);
++		if (is_last) {
++			pkts++;
++			bytes += desc->priv[desc->tail]->len;
++			dev_kfree_skb(desc->priv[desc->tail]);
++		}
++		*frag = (struct netsec_frag_info){};
++		netsec_inc_desc_tail_idx(priv, desc);
++
++		if (is_last)
++			desc->tx_done_num--;
++	}
++
++	spin_unlock(&desc->spinlock_desc);
++
++	priv->ndev->stats.tx_packets += pkts;
++	priv->ndev->stats.tx_bytes += bytes;
++
++	netdev_completed_queue(priv->ndev, pkts, bytes);
++
++	return 0;
++}
++
++int netsec_clean_rx_desc_ring(struct netsec_priv *priv)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[NETSEC_RING_RX];
++
++	spin_lock(&desc->spinlock_desc);
++
++	while (desc->full || (desc->tail != desc->head)) {
++		netsec_set_rx_de(priv, desc, desc->tail,
++				 &desc->frag[desc->tail],
++				 desc->priv[desc->tail]);
++		desc->rx_num--;
++		netsec_inc_desc_tail_idx(priv, desc);
++	}
++
++	spin_unlock(&desc->spinlock_desc);
++
++	return 0;
++}
++
++int netsec_set_tx_pkt_data(struct netsec_priv *priv,
++			   const struct netsec_tx_pkt_ctrl *tx_ctrl,
++			   u8 count_frags, const struct netsec_frag_info *info,
++			   struct sk_buff *skb)
++{
++	struct netsec_desc_ring *desc;
++	u32 sum_len = 0;
++	unsigned int i;
++	int ret = 0;
++
++	if (tx_ctrl->tcp_seg_offload_flag && !tx_ctrl->cksum_offload_flag)
++		return -EINVAL;
++
++	if (tx_ctrl->tcp_seg_offload_flag) {
++		if (tx_ctrl->tcp_seg_len == 0)
++			return -EINVAL;
++
++		if (priv->param.use_jumbo_pkt_flag) {
++			if (tx_ctrl->tcp_seg_len > NETSEC_TCP_JUMBO_SEG_LEN_MAX)
++				return -EINVAL;
++		} else {
++			if (tx_ctrl->tcp_seg_len > NETSEC_TCP_SEG_LEN_MAX)
++				return -EINVAL;
++		}
++	} else {
++		if (tx_ctrl->tcp_seg_len)
++			return -EINVAL;
++	}
++
++	if (!count_frags)
++		return -ERANGE;
++
++	for (i = 0; i < count_frags; i++) {
++		if ((info[i].len == 0) || (info[i].len > 0xffff)) {
++			netif_err(priv, drv, priv->ndev,
++				  "%s: bad info len\n", __func__);
++			return -EINVAL;
++		}
++		sum_len += info[i].len;
++	}
++
++	if (!tx_ctrl->tcp_seg_offload_flag) {
++		if (priv->param.use_jumbo_pkt_flag) {
++			if (sum_len > NETSEC_MAX_TX_JUMBO_PKT_LEN)
++				return -EINVAL;
++		} else {
++			if (sum_len > NETSEC_MAX_TX_PKT_LEN)
++				return -EINVAL;
++		}
++	}
++
++	desc = &priv->desc_ring[NETSEC_RING_TX];
++	spin_lock(&desc->spinlock_desc);
++
++	if (!desc->running) {
++		ret = -ENODEV;
++		goto end;
++	}
++
++	dma_rmb(); /* we need to see a consistent view of pending tx count */
++	if (count_frags > netsec_get_tx_avail_num_sub(priv, desc)) {
++		ret = -EBUSY;
++		goto end;
++	}
++
++	for (i = 0; i < count_frags; i++) {
++		netsec_set_tx_desc_entry(priv, desc, tx_ctrl, i == 0,
++					 i == count_frags - 1, &info[i], skb);
++		netsec_inc_desc_head_idx(priv, desc, 1);
++	}
++
++	dma_wmb(); /* ensure the descriptor is flushed */
++	netsec_writel(priv, tx_pkt_cnt_reg_addr[NETSEC_RING_TX], 1);
++
++end:
++	spin_unlock(&desc->spinlock_desc);
++
++	return ret;
++}
++
++int netsec_get_rx_pkt_data(struct netsec_priv *priv,
++			   struct netsec_rx_pkt_info *rxpi,
++			   struct netsec_frag_info *frag, u16 *len,
++			   struct sk_buff **skb)
++{
++	struct netsec_desc_ring *desc = &priv->desc_ring[NETSEC_RING_RX];
++	struct netsec_frag_info info;
++	struct sk_buff *tmp_skb;
++	int ret = 0;
++
++	spin_lock(&desc->spinlock_desc);
++
++	if (desc->rx_num == 0) {
++		dev_err(priv->dev, "%s 0 len rx\n", __func__);
++		ret = -EINVAL;
++		goto err;
++	}
++
++	info.len = priv->rx_pkt_buf_len;
++	dma_rmb(); /* we need to ensure we only see current data in descriptor */
++	tmp_skb = alloc_rx_pkt_buf(priv, &info);
++	if (!tmp_skb) {
++		netsec_set_rx_de(priv, desc, desc->tail,
++				 &desc->frag[desc->tail],
++				 desc->priv[desc->tail]);
++		ret = -ENOMEM;
++	} else {
++		netsec_get_rx_de(priv, desc, desc->tail, rxpi, frag, len, skb);
++		netsec_set_rx_de(priv, desc, desc->tail, &info, tmp_skb);
++	}
++
++	netsec_inc_desc_tail_idx(priv, desc);
++	desc->rx_num--;
++
++err:
++	spin_unlock(&desc->spinlock_desc);
++
++	return ret;
++}
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec_ethtool.c b/drivers/net/ethernet/socionext/netsec/netsec_ethtool.c
+new file mode 100644
+index 0000000..45830fe
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec_ethtool.c
+@@ -0,0 +1,78 @@
++/**
++ * drivers/net/ethernet/socionext/netsec/netsec_ethtool.c
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++
++#include "netsec.h"
++
++static void netsec_et_get_drvinfo(struct net_device *net_device,
++				  struct ethtool_drvinfo *info)
++{
++	strlcpy(info->driver, "netsec", sizeof(info->driver));
++	strlcpy(info->bus_info, dev_name(net_device->dev.parent),
++		sizeof(info->bus_info));
++}
++
++static int netsec_et_get_coalesce(struct net_device *net_device,
++				  struct ethtool_coalesce *et_coalesce)
++{
++	struct netsec_priv *priv = netdev_priv(net_device);
++
++	*et_coalesce = priv->et_coalesce;
++
++	return 0;
++}
++
++static int netsec_et_set_coalesce(struct net_device *net_device,
++				  struct ethtool_coalesce *et_coalesce)
++{
++	struct netsec_priv *priv = netdev_priv(net_device);
++
++	if (et_coalesce->rx_max_coalesced_frames > NETSEC_INT_PKTCNT_MAX)
++		return -EINVAL;
++	if (et_coalesce->tx_max_coalesced_frames > NETSEC_INT_PKTCNT_MAX)
++		return -EINVAL;
++	if (!et_coalesce->rx_max_coalesced_frames)
++		return -EINVAL;
++	if (!et_coalesce->tx_max_coalesced_frames)
++		return -EINVAL;
++
++	priv->et_coalesce = *et_coalesce;
++
++	return 0;
++}
++
++static u32 netsec_et_get_msglevel(struct net_device *dev)
++{
++	struct netsec_priv *priv = netdev_priv(dev);
++
++	return priv->msg_enable;
++}
++
++static void netsec_et_set_msglevel(struct net_device *dev, u32 datum)
++{
++	struct netsec_priv *priv = netdev_priv(dev);
++
++	priv->msg_enable = datum;
++}
++
++const struct ethtool_ops netsec_ethtool_ops = {
++	.get_drvinfo		= netsec_et_get_drvinfo,
++	.get_link_ksettings	= phy_ethtool_get_link_ksettings,
++	.set_link_ksettings	= phy_ethtool_set_link_ksettings,
++	.get_link		= ethtool_op_get_link,
++	.get_coalesce		= netsec_et_get_coalesce,
++	.set_coalesce		= netsec_et_set_coalesce,
++	.get_msglevel		= netsec_et_get_msglevel,
++	.set_msglevel		= netsec_et_set_msglevel,
++};
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec_gmac_access.c b/drivers/net/ethernet/socionext/netsec/netsec_gmac_access.c
+new file mode 100644
+index 0000000..94e9b7f
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec_gmac_access.c
+@@ -0,0 +1,330 @@
++/**
++ * drivers/net/ethernet/socionext/netsec/netsec_gmac_access.c
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++#include "netsec.h"
++
++#define TIMEOUT_SPINS_MAC		1000
++#define TIMEOUT_SECONDARY_MS_MAC	100
++
++static u32 netsec_clk_type(u32 freq)
++{
++	if (freq < 35 * NETSEC_CLK_MHZ)
++		return NETSEC_GMAC_GAR_REG_CR_25_35_MHZ;
++	if (freq < 60 * NETSEC_CLK_MHZ)
++		return NETSEC_GMAC_GAR_REG_CR_35_60_MHZ;
++	if (freq < 100 * NETSEC_CLK_MHZ)
++		return NETSEC_GMAC_GAR_REG_CR_60_100_MHZ;
++	if (freq < 150 * NETSEC_CLK_MHZ)
++		return NETSEC_GMAC_GAR_REG_CR_100_150_MHZ;
++	if (freq < 250 * NETSEC_CLK_MHZ)
++		return NETSEC_GMAC_GAR_REG_CR_150_250_MHZ;
++
++	return NETSEC_GMAC_GAR_REG_CR_250_300_MHZ;
++}
++
++static int netsec_wait_while_busy(struct netsec_priv *priv, u32 addr, u32 mask)
++{
++	u32 timeout = TIMEOUT_SPINS_MAC;
++
++	while (--timeout && netsec_readl(priv, addr) & mask)
++		cpu_relax();
++	if (timeout)
++		return 0;
++
++	timeout = TIMEOUT_SECONDARY_MS_MAC;
++	while (--timeout && netsec_readl(priv, addr) & mask)
++		usleep_range(1000, 2000);
++
++	if (timeout)
++		return 0;
++
++	netdev_WARN(priv->ndev, "%s: timeout\n", __func__);
++
++	return -ETIMEDOUT;
++}
++
++static int netsec_mac_write(struct netsec_priv *priv, u32 addr, u32 value)
++{
++	netsec_writel(priv, MAC_REG_DATA, value);
++	netsec_writel(priv, MAC_REG_CMD, addr | NETSEC_GMAC_CMD_ST_WRITE);
++	return netsec_wait_while_busy(priv,
++				      MAC_REG_CMD, NETSEC_GMAC_CMD_ST_BUSY);
++}
++
++static int netsec_mac_read(struct netsec_priv *priv, u32 addr, u32 *read)
++{
++	int ret;
++
++	netsec_writel(priv, MAC_REG_CMD, addr | NETSEC_GMAC_CMD_ST_READ);
++	ret = netsec_wait_while_busy(priv,
++				     MAC_REG_CMD, NETSEC_GMAC_CMD_ST_BUSY);
++	if (ret)
++		return ret;
++
++	*read = netsec_readl(priv, MAC_REG_DATA);
++
++	return 0;
++}
++
++static int netsec_mac_wait_while_busy(struct netsec_priv *priv,
++				      u32 addr, u32 mask)
++{
++	u32 timeout = TIMEOUT_SPINS_MAC;
++	int ret, data;
++
++	do {
++		ret = netsec_mac_read(priv, addr, &data);
++		if (ret)
++			break;
++		cpu_relax();
++	} while (--timeout && (data & mask));
++
++	if (timeout)
++		return 0;
++
++	timeout = TIMEOUT_SECONDARY_MS_MAC;
++	do {
++		usleep_range(1000, 2000);
++
++		ret = netsec_mac_read(priv, addr, &data);
++		if (ret)
++			break;
++		cpu_relax();
++	} while (--timeout && (data & mask));
++
++	if (timeout && !ret)
++		return 0;
++
++	netdev_WARN(priv->ndev, "%s: timeout\n", __func__);
++
++	return -ETIMEDOUT;
++}
++
++static int netsec_mac_update_to_phy_state(struct netsec_priv *priv)
++{
++	struct phy_device *phydev = priv->ndev->phydev;
++	u32 value = 0;
++
++	value = phydev->duplex ? NETSEC_GMAC_MCR_REG_FULL_DUPLEX_COMMON :
++				 NETSEC_GMAC_MCR_REG_HALF_DUPLEX_COMMON;
++
++	if (phydev->speed != SPEED_1000)
++		value |= NETSEC_MCR_PS;
++
++	if ((priv->phy_interface != PHY_INTERFACE_MODE_GMII) &&
++	    (phydev->speed == SPEED_100))
++		value |= NETSEC_GMAC_MCR_REG_FES;
++
++	value |= NETSEC_GMAC_MCR_REG_CST | NETSEC_GMAC_MCR_REG_JE;
++
++	if (priv->phy_interface == PHY_INTERFACE_MODE_RGMII)
++		value |= NETSEC_GMAC_MCR_REG_IBN;
++
++	if (netsec_mac_write(priv, GMAC_REG_MCR, value))
++		return -ETIMEDOUT;
++
++	priv->actual_link_speed = phydev->speed;
++	priv->actual_duplex = phydev->duplex;
++
++	return 0;
++}
++
++/* NB netsec_start_gmac() only called from adjust_link */
++
++int netsec_start_gmac(struct netsec_priv *priv)
++{
++	struct phy_device *phydev = priv->ndev->phydev;
++	u32 value = 0;
++	int ret;
++
++	if (priv->desc_ring[NETSEC_RING_TX].running &&
++	    priv->desc_ring[NETSEC_RING_RX].running)
++		return 0;
++
++	if (!priv->desc_ring[NETSEC_RING_RX].running &&
++	    !priv->desc_ring[NETSEC_RING_TX].running) {
++		if (phydev->speed != SPEED_1000)
++			value = (NETSEC_GMAC_MCR_REG_CST |
++				 NETSEC_GMAC_MCR_REG_HALF_DUPLEX_COMMON);
++
++		if (netsec_mac_write(priv, GMAC_REG_MCR, value))
++			return -ETIMEDOUT;
++		if (netsec_mac_write(priv, GMAC_REG_BMR,
++				     NETSEC_GMAC_BMR_REG_RESET))
++			return -ETIMEDOUT;
++
++		/* Wait soft reset */
++		usleep_range(1000, 5000);
++
++		ret = netsec_mac_read(priv, GMAC_REG_BMR, &value);
++		if (ret)
++			return ret;
++		if (value & NETSEC_GMAC_BMR_REG_SWR)
++			return -EAGAIN;
++
++		netsec_writel(priv, MAC_REG_DESC_SOFT_RST, 1);
++		if (netsec_wait_while_busy(priv, MAC_REG_DESC_SOFT_RST, 1))
++			return -ETIMEDOUT;
++
++		netsec_writel(priv, MAC_REG_DESC_INIT, 1);
++		if (netsec_wait_while_busy(priv, MAC_REG_DESC_INIT, 1))
++			return -ETIMEDOUT;
++
++		if (netsec_mac_write(priv, GMAC_REG_BMR,
++				     NETSEC_GMAC_BMR_REG_COMMON))
++			return -ETIMEDOUT;
++		if (netsec_mac_write(priv, GMAC_REG_RDLAR,
++				     NETSEC_GMAC_RDLAR_REG_COMMON))
++			return -ETIMEDOUT;
++		if (netsec_mac_write(priv, GMAC_REG_TDLAR,
++				     NETSEC_GMAC_TDLAR_REG_COMMON))
++			return -ETIMEDOUT;
++		if (netsec_mac_write(priv, GMAC_REG_MFFR, 0x80000001))
++			return -ETIMEDOUT;
++
++		ret = netsec_mac_update_to_phy_state(priv);
++		if (ret)
++			return ret;
++
++		if (priv->mac_mode.flow_ctrl_enable_flag) {
++			netsec_writel(priv, MAC_REG_FLOW_TH,
++				      (priv->mac_mode.flow_stop_th << 16) |
++				      priv->mac_mode.flow_start_th);
++			if (netsec_mac_write(priv, GMAC_REG_FCR,
++					     (priv->mac_mode.pause_time << 16) |
++					     NETSEC_FCR_RFE | NETSEC_FCR_TFE))
++				return -ETIMEDOUT;
++		}
++	}
++
++	ret = netsec_mac_read(priv, GMAC_REG_OMR, &value);
++	if (ret)
++		return ret;
++
++	if (!priv->desc_ring[NETSEC_RING_RX].running) {
++		value |= NETSEC_GMAC_OMR_REG_SR;
++		netsec_start_desc_ring(priv, NETSEC_RING_RX);
++	}
++	if (!priv->desc_ring[NETSEC_RING_TX].running) {
++		value |= NETSEC_GMAC_OMR_REG_ST;
++		netsec_start_desc_ring(priv, NETSEC_RING_TX);
++	}
++
++	if (netsec_mac_write(priv, GMAC_REG_OMR, value))
++		return -ETIMEDOUT;
++
++	netsec_writel(priv, NETSEC_REG_INTEN_SET,
++		      NETSEC_IRQ_TX | NETSEC_IRQ_RX);
++
++	return 0;
++}
++
++int netsec_stop_gmac(struct netsec_priv *priv)
++{
++	u32 value;
++	int ret;
++
++	ret = netsec_mac_read(priv, GMAC_REG_OMR, &value);
++	if (ret)
++		return ret;
++
++	if (priv->desc_ring[NETSEC_RING_RX].running) {
++		value &= ~NETSEC_GMAC_OMR_REG_SR;
++		netsec_stop_desc_ring(priv, NETSEC_RING_RX);
++	}
++	if (priv->desc_ring[NETSEC_RING_TX].running) {
++		value &= ~NETSEC_GMAC_OMR_REG_ST;
++		netsec_stop_desc_ring(priv, NETSEC_RING_TX);
++	}
++
++	priv->actual_link_speed = 0;
++	priv->actual_duplex = false;
++
++	return netsec_mac_write(priv, GMAC_REG_OMR, value);
++}
++
++static int netsec_phy_write(struct mii_bus *bus,
++			    int phy_addr, int reg, u16 val)
++{
++	struct netsec_priv *priv = bus->priv;
++
++	if (netsec_mac_write(priv, GMAC_REG_GDR, val))
++		return -ETIMEDOUT;
++	if (netsec_mac_write(priv, GMAC_REG_GAR,
++			     phy_addr << NETSEC_GMAC_GAR_REG_SHIFT_PA |
++			     reg << NETSEC_GMAC_GAR_REG_SHIFT_GR |
++			     NETSEC_GMAC_GAR_REG_GW | NETSEC_GMAC_GAR_REG_GB |
++			     (netsec_clk_type(priv->freq) <<
++			      GMAC_REG_SHIFT_CR_GAR)))
++		return -ETIMEDOUT;
++
++	return netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
++					  NETSEC_GMAC_GAR_REG_GB);
++}
++
++static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr)
++{
++	struct netsec_priv *priv = bus->priv;
++	u32 data;
++	int ret;
++
++	if (netsec_mac_write(priv, GMAC_REG_GAR, NETSEC_GMAC_GAR_REG_GB |
++			     phy_addr << NETSEC_GMAC_GAR_REG_SHIFT_PA |
++			     reg_addr << NETSEC_GMAC_GAR_REG_SHIFT_GR |
++			     (netsec_clk_type(priv->freq) <<
++			      GMAC_REG_SHIFT_CR_GAR)))
++		return -ETIMEDOUT;
++
++	ret = netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
++					 NETSEC_GMAC_GAR_REG_GB);
++	if (ret)
++		return ret;
++
++	ret = netsec_mac_read(priv, GMAC_REG_GDR, &data);
++	if (ret)
++		return ret;
++
++	return data;
++}
++
++int netsec_mii_register(struct netsec_priv *priv)
++{
++	struct mii_bus *bus = devm_mdiobus_alloc(priv->dev);
++	int ret;
++
++	if (!bus)
++		return -ENOMEM;
++
++	snprintf(bus->id, MII_BUS_ID_SIZE, "%s", dev_name(priv->dev));
++	bus->priv = priv;
++	bus->name = "SNI NETSEC MDIO";
++	bus->read = netsec_phy_read;
++	bus->write = netsec_phy_write;
++	bus->parent = priv->dev;
++	priv->mii_bus = bus;
++
++	if (dev_of_node(priv->dev)) {
++		ret = of_mdiobus_register(bus, dev_of_node(priv->dev));
++	} else {
++		/* Mask out all PHYs from auto probing. */
++		bus->phy_mask = ~0;
++		ret = mdiobus_register(bus);
++	}
++	return ret;
++}
++
++void netsec_mii_unregister(struct netsec_priv *priv)
++{
++	mdiobus_unregister(priv->mii_bus);
++}
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec_netdev.c b/drivers/net/ethernet/socionext/netsec/netsec_netdev.c
+new file mode 100644
+index 0000000..e99cf0e
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec_netdev.c
+@@ -0,0 +1,540 @@
++/**
++ * drivers/net/ethernet/socionext/netsec/netsec_netdev.c
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <linux/tcp.h>
++#include <net/tcp.h>
++#include <net/ip6_checksum.h>
++#include <linux/pm_runtime.h>
++
++#include "netsec.h"
++
++#define WAIT_FW_RDY_TIMEOUT 50
++
++static const u32 desc_ring_irq_status_reg_addr[] = {
++	NETSEC_REG_NRM_TX_STATUS,
++	NETSEC_REG_NRM_RX_STATUS,
++};
++
++static const u32 desc_ads[] = {
++	NETSEC_REG_NRM_TX_CONFIG,
++	NETSEC_REG_NRM_RX_CONFIG,
++};
++
++static const u32 netsec_desc_start_reg_addr_up[] = {
++	NETSEC_REG_NRM_TX_DESC_START_UP,
++	NETSEC_REG_NRM_RX_DESC_START_UP,
++};
++
++static const u32 netsec_desc_start_reg_addr_lw[] = {
++	NETSEC_REG_NRM_TX_DESC_START_LW,
++	NETSEC_REG_NRM_RX_DESC_START_LW,
++};
++
++static u32 netsec_calc_pkt_ctrl_reg_param(const struct netsec_pkt_ctrlaram
++					*pkt_ctrlaram_p)
++{
++	u32 param = NETSEC_PKT_CTRL_REG_MODE_NRM;
++
++	if (pkt_ctrlaram_p->log_chksum_er_flag)
++		param |= NETSEC_PKT_CTRL_REG_LOG_CHKSUM_ER;
++
++	if (pkt_ctrlaram_p->log_hd_imcomplete_flag)
++		param |= NETSEC_PKT_CTRL_REG_LOG_HD_INCOMPLETE;
++
++	if (pkt_ctrlaram_p->log_hd_er_flag)
++		param |= NETSEC_PKT_CTRL_REG_LOG_HD_ER;
++
++	return param;
++}
++
++static int netsec_netdev_load_ucode_region(struct netsec_priv *priv, u32 reg,
++					   u32 addr_h, u32 addr_l, u32 size)
++{
++	u64 base = (u64)addr_h << 32 | addr_l;
++	__le32 *ucode;
++	u32 i;
++
++	ucode = memremap(base, size * sizeof(u32), MEMREMAP_WT);
++	if (!ucode)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++)
++		netsec_writel(priv, reg, le32_to_cpu(ucode[i]));
++
++	memunmap(ucode);
++	return 0;
++}
++
++static int netsec_netdev_load_microcode(struct netsec_priv *priv)
++{
++	int err;
++
++	err = netsec_netdev_load_ucode_region(
++		priv, NETSEC_REG_DMAC_HM_CMD_BUF,
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_HM_ME_ADDRESS_H),
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_HM_ME_ADDRESS_L),
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_HM_ME_SIZE));
++	if (err)
++		return err;
++
++	err = netsec_netdev_load_ucode_region(
++		priv, NETSEC_REG_DMAC_MH_CMD_BUF,
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_MH_ME_ADDRESS_H),
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_MH_ME_ADDRESS_L),
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_MH_ME_SIZE));
++	if (err)
++		return err;
++
++	err = netsec_netdev_load_ucode_region(
++		priv, NETSEC_REG_PKT_CMD_BUF,
++		0,
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_PKT_ME_ADDRESS),
++		le32_to_cpup(priv->eeprom_base + NETSEC_EEPROM_PKT_ME_SIZE));
++	if (err)
++		return err;
++
++	return 0;
++}
++
++static int netsec_init_hardware(struct netsec_priv *priv)
++{
++	u32 value;
++	int err;
++
++	/* set desc_start addr */
++	netsec_writel(priv, netsec_desc_start_reg_addr_up[NETSEC_RING_RX],
++		      upper_32_bits(priv->desc_ring[NETSEC_RING_RX].desc_phys));
++	netsec_writel(priv, netsec_desc_start_reg_addr_lw[NETSEC_RING_RX],
++		      lower_32_bits(priv->desc_ring[NETSEC_RING_RX].desc_phys));
++
++	netsec_writel(priv, netsec_desc_start_reg_addr_up[NETSEC_RING_TX],
++		      upper_32_bits(priv->desc_ring[NETSEC_RING_TX].desc_phys));
++	netsec_writel(priv, netsec_desc_start_reg_addr_lw[NETSEC_RING_TX],
++		      lower_32_bits(priv->desc_ring[NETSEC_RING_TX].desc_phys));
++
++	/* set normal tx desc ring config */
++	netsec_writel(priv, desc_ads[NETSEC_RING_TX],
++		      1 << NETSEC_REG_DESC_ENDIAN);
++	netsec_writel(priv, desc_ads[NETSEC_RING_RX],
++		      1 << NETSEC_REG_DESC_ENDIAN);
++
++	err = netsec_netdev_load_microcode(priv);
++	if (err) {
++		netif_err(priv, probe, priv->ndev,
++			  "%s: failed to load microcode (%d)\n", __func__, err);
++		return err;
++	}
++
++	/* start DMA engines */
++	netsec_writel(priv, NETSEC_REG_DMA_TMR_CTRL, priv->freq / 1000000 - 1);
++	netsec_writel(priv, NETSEC_REG_ADDR_DIS_CORE, 0);
++
++	usleep_range(1000, 2000);
++
++	if (!(netsec_readl(priv, NETSEC_REG_TOP_STATUS) &
++	      NETSEC_TOP_IRQ_REG_CODE_LOAD_END)) {
++		netif_err(priv, drv, priv->ndev, "microengine start failed\n");
++		return -ENXIO;
++	}
++	netsec_writel(priv, NETSEC_REG_TOP_STATUS,
++		      NETSEC_TOP_IRQ_REG_CODE_LOAD_END);
++
++	value = netsec_calc_pkt_ctrl_reg_param(&priv->param.pkt_ctrlaram);
++
++	if (priv->param.use_jumbo_pkt_flag)
++		value |= NETSEC_PKT_CTRL_REG_EN_JUMBO;
++
++	/* change to normal mode */
++	netsec_writel(priv, NETSEC_REG_DMA_MH_CTRL, MH_CTRL__MODE_TRANS);
++	netsec_writel(priv, NETSEC_REG_PKT_CTRL, value);
++
++	while ((netsec_readl(priv, NETSEC_REG_MODE_TRANS_COMP_STATUS) &
++		NETSEC_MODE_TRANS_COMP_IRQ_T2N) == 0)
++		cpu_relax();
++
++	return 0;
++}
++
++static void netsec_ring_irq_clr(struct netsec_priv *priv,
++				unsigned int id, u32 value)
++{
++	netsec_writel(priv, desc_ring_irq_status_reg_addr[id],
++		      value & (NETSEC_IRQ_EMPTY | NETSEC_IRQ_ERR));
++}
++
++static void netsec_napi_tx_processing(struct netsec_priv *priv)
++{
++	netsec_ring_irq_clr(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++	netsec_clean_tx_desc_ring(priv);
++
++	if (netif_queue_stopped(priv->ndev) &&
++	    netsec_get_tx_avail_num(priv) >= NETSEC_NETDEV_TX_PKT_SCAT_NUM_MAX)
++		netif_wake_queue(priv->ndev);
++}
++
++int netsec_netdev_napi_poll(struct napi_struct *napi_p, int budget)
++{
++	struct netsec_priv *priv = container_of(napi_p, struct netsec_priv,
++						napi);
++	struct net_device *ndev = priv->ndev;
++	struct netsec_rx_pkt_info rx_info;
++	int ret, done = 0, rx_num = 0;
++	struct netsec_frag_info frag;
++	struct sk_buff *skb;
++	u16 len;
++
++	netsec_napi_tx_processing(priv);
++
++	while (done < budget) {
++		if (!rx_num) {
++			rx_num = netsec_get_rx_num(priv);
++			if (!rx_num)
++				break;
++		}
++		done++;
++		rx_num--;
++		ret = netsec_get_rx_pkt_data(priv, &rx_info, &frag, &len, &skb);
++		if (unlikely(ret == -ENOMEM)) {
++			netif_err(priv, drv, priv->ndev,
++				  "%s: rx fail %d\n", __func__, ret);
++			ndev->stats.rx_dropped++;
++			continue;
++		}
++		dma_unmap_single(priv->dev, frag.dma_addr, frag.len,
++				 DMA_FROM_DEVICE);
++		skb_put(skb, len);
++		skb->protocol = eth_type_trans(skb, priv->ndev);
++
++		if (priv->rx_cksum_offload_flag &&
++		    rx_info.rx_cksum_result == NETSEC_RX_CKSUM_OK)
++			skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++		if (napi_gro_receive(napi_p, skb) != GRO_DROP) {
++			ndev->stats.rx_packets++;
++			ndev->stats.rx_bytes += len;
++		}
++	}
++
++	if (done < budget && napi_complete_done(napi_p, done))
++		netsec_writel(priv, NETSEC_REG_INTEN_SET,
++			      NETSEC_IRQ_TX | NETSEC_IRQ_RX);
++	return done;
++}
++
++static netdev_tx_t netsec_netdev_start_xmit(struct sk_buff *skb,
++					    struct net_device *ndev)
++{
++	struct netsec_priv *priv = netdev_priv(ndev);
++	struct netsec_tx_pkt_ctrl tx_ctrl = {};
++	u16 pend_tx, tso_seg_len = 0;
++	skb_frag_t *frag;
++	int count_frags;
++	int ret, i;
++
++	netsec_ring_irq_clr(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++
++	count_frags = skb_shinfo(skb)->nr_frags + 1;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		if ((skb->protocol == htons(ETH_P_IP) &&
++		     ip_hdr(skb)->protocol == IPPROTO_TCP) ||
++		    (skb->protocol == htons(ETH_P_IPV6) &&
++		     ipv6_hdr(skb)->nexthdr == IPPROTO_TCP))
++			tx_ctrl.cksum_offload_flag = true;
++		else
++			skb_checksum_help(skb);
++	}
++
++	if (skb_is_gso(skb))
++		tso_seg_len = skb_shinfo(skb)->gso_size;
++
++	if (tso_seg_len > 0) {
++		if (skb->protocol == htons(ETH_P_IP)) {
++			ip_hdr(skb)->tot_len = 0;
++			tcp_hdr(skb)->check =
++				~tcp_v4_check(0, ip_hdr(skb)->saddr,
++					      ip_hdr(skb)->daddr, 0);
++		} else {
++			ipv6_hdr(skb)->payload_len = 0;
++			tcp_hdr(skb)->check =
++				~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
++						 &ipv6_hdr(skb)->daddr,
++						 0, IPPROTO_TCP, 0);
++		}
++
++		tx_ctrl.tcp_seg_offload_flag = true;
++		tx_ctrl.tcp_seg_len = tso_seg_len;
++	}
++
++	priv->tx_info[0].dma_addr = dma_map_single(priv->dev, skb->data,
++						   skb_headlen(skb),
++						   DMA_TO_DEVICE);
++	if (dma_mapping_error(priv->dev, priv->tx_info[0].dma_addr)) {
++		netif_err(priv, drv, priv->ndev,
++			  "%s: DMA mapping failed\n", __func__);
++		return NETDEV_TX_OK;
++	}
++	priv->tx_info[0].addr = skb->data;
++	priv->tx_info[0].len = skb_headlen(skb);
++
++	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
++		frag = &skb_shinfo(skb)->frags[i];
++		priv->tx_info[i + 1].dma_addr =
++			skb_frag_dma_map(priv->dev, frag, 0,
++					 skb_frag_size(frag), DMA_TO_DEVICE);
++		priv->tx_info[i + 1].addr = skb_frag_address(frag);
++		priv->tx_info[i + 1].len = frag->size;
++	}
++
++	netsec_mark_skb_type(skb, NETSEC_RING_TX);
++
++	ret = netsec_set_tx_pkt_data(priv, &tx_ctrl, count_frags,
++				     priv->tx_info, skb);
++	if (ret) {
++		netif_info(priv, drv, priv->ndev,
++			   "set tx pkt failed %d\n", ret);
++		for (i = 0; i < count_frags; i++)
++			dma_unmap_single(priv->dev, priv->tx_info[i].dma_addr,
++					 priv->tx_info[i].len, DMA_TO_DEVICE);
++		ndev->stats.tx_dropped++;
++
++		return NETDEV_TX_OK;
++	}
++
++	netdev_sent_queue(priv->ndev, skb->len);
++
++	spin_lock(&priv->tx_queue_lock);
++	pend_tx = netsec_get_tx_avail_num(priv);
++
++	if (pend_tx < NETSEC_NETDEV_TX_PKT_SCAT_NUM_MAX) {
++		netsec_ring_irq_enable(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++		netif_stop_queue(ndev);
++		goto err;
++	}
++	if (pend_tx <= DESC_NUM - 2) {
++		netsec_ring_irq_enable(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++		goto err;
++	}
++	netsec_ring_irq_disable(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++
++err:
++	spin_unlock(&priv->tx_queue_lock);
++
++	return NETDEV_TX_OK;
++}
++
++static int netsec_netdev_set_features(struct net_device *ndev,
++				      netdev_features_t features)
++{
++	struct netsec_priv *priv = netdev_priv(ndev);
++
++	priv->rx_cksum_offload_flag = !!(features & NETIF_F_RXCSUM);
++
++	return 0;
++}
++
++static void netsec_phy_adjust_link(struct net_device *ndev)
++{
++	struct netsec_priv *priv = netdev_priv(ndev);
++
++	if (priv->actual_link_speed == ndev->phydev->speed &&
++	    priv->actual_duplex == ndev->phydev->duplex)
++		return;
++
++	phy_print_status(ndev->phydev);
++
++	netsec_stop_gmac(priv);
++	netsec_start_gmac(priv);
++}
++
++static irqreturn_t netsec_irq_handler(int irq, void *dev_id)
++{
++	struct netsec_priv *priv = dev_id;
++	u32 status = netsec_readl(priv, NETSEC_REG_TOP_STATUS) &
++		     netsec_readl(priv, NETSEC_REG_TOP_INTEN);
++
++	if (!status)
++		return IRQ_NONE;
++
++	if (status & (NETSEC_IRQ_TX | NETSEC_IRQ_RX)) {
++		netsec_writel(priv, NETSEC_REG_INTEN_CLR,
++			      status & (NETSEC_IRQ_TX | NETSEC_IRQ_RX));
++		napi_schedule(&priv->napi);
++	}
++
++	return IRQ_HANDLED;
++}
++
++static void netsec_reset_hardware(struct netsec_priv *priv)
++{
++	/* stop DMA engines */
++	if (!netsec_readl(priv, NETSEC_REG_ADDR_DIS_CORE)) {
++		netsec_writel(priv, NETSEC_REG_DMA_HM_CTRL,
++			      NETSEC_DMA_CTRL_REG_STOP);
++		netsec_writel(priv, NETSEC_REG_DMA_MH_CTRL,
++			      NETSEC_DMA_CTRL_REG_STOP);
++
++		while (netsec_readl(priv, NETSEC_REG_DMA_HM_CTRL) &
++		       NETSEC_DMA_CTRL_REG_STOP)
++			cpu_relax();
++
++		while (netsec_readl(priv, NETSEC_REG_DMA_MH_CTRL) &
++		       NETSEC_DMA_CTRL_REG_STOP)
++			cpu_relax();
++	}
++
++	netsec_writel(priv, NETSEC_REG_SOFT_RST, NETSEC_SOFT_RST_REG_RESET);
++	netsec_writel(priv, NETSEC_REG_SOFT_RST, NETSEC_SOFT_RST_REG_RUN);
++	netsec_writel(priv, NETSEC_REG_COM_INIT, NETSEC_COM_INIT_REG_ALL);
++
++	while (netsec_readl(priv, NETSEC_REG_COM_INIT) != 0)
++		cpu_relax();
++}
++
++static int netsec_netdev_open(struct net_device *ndev)
++{
++	struct netsec_priv *priv = netdev_priv(ndev);
++	int ret, n;
++
++	pm_runtime_get_sync(priv->dev);
++
++	netsec_reset_hardware(priv);
++
++	for (n = 0; n <= NETSEC_RING_MAX; n++) {
++		ret = netsec_alloc_desc_ring(priv, n);
++		if (ret) {
++			netif_err(priv, probe, priv->ndev,
++				  "%s: alloc ring failed\n", __func__);
++			goto err;
++		}
++	}
++
++	ret = netsec_setup_rx_desc(priv, &priv->desc_ring[NETSEC_RING_RX]);
++	if (ret) {
++		netif_err(priv, probe, priv->ndev,
++			  "%s: fail setup ring\n", __func__);
++		goto err1;
++	}
++
++	ret = netsec_init_hardware(priv);
++	if (ret) {
++		netif_err(priv, probe, priv->ndev,
++			  "%s: netsec_init_hardware fail %d\n", __func__, ret);
++		goto err1;
++	}
++
++	ret = request_irq(priv->ndev->irq, netsec_irq_handler,
++			  IRQF_SHARED, "netsec", priv);
++	if (ret) {
++		netif_err(priv, drv, priv->ndev, "request_irq failed\n");
++		goto err1;
++	}
++	priv->irq_registered = true;
++
++	ret = netsec_clean_rx_desc_ring(priv);
++	if (ret) {
++		netif_err(priv, drv, priv->ndev,
++			  "%s: clean rx desc fail\n", __func__);
++		goto err2;
++	}
++
++	ret = netsec_clean_tx_desc_ring(priv);
++	if (ret) {
++		netif_err(priv, drv, priv->ndev,
++			  "%s: clean tx desc fail\n", __func__);
++		goto err2;
++	}
++
++	netsec_ring_irq_clr(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++
++	if (dev_of_node(priv->dev)) {
++		if (!of_phy_connect(priv->ndev, priv->phy_np,
++				    netsec_phy_adjust_link, 0,
++				    priv->phy_interface)) {
++			netif_err(priv, link, priv->ndev, "missing PHY\n");
++			goto err2;
++		}
++	} else {
++		ret = phy_connect_direct(priv->ndev, priv->phydev,
++					 netsec_phy_adjust_link,
++					 priv->phy_interface);
++		if (ret) {
++			netif_err(priv, link, priv->ndev,
++				  "phy_connect_direct() failed (%d)\n", ret);
++			goto err2;
++		}
++	}
++
++	phy_start_aneg(ndev->phydev);
++
++	netsec_ring_irq_disable(priv, NETSEC_RING_TX, NETSEC_IRQ_EMPTY);
++
++	netsec_start_gmac(priv);
++	napi_enable(&priv->napi);
++	netif_start_queue(ndev);
++
++	netsec_writel(priv, NETSEC_REG_INTEN_SET,
++		      NETSEC_IRQ_TX | NETSEC_IRQ_RX);
++
++	return 0;
++
++err2:
++	pm_runtime_put_sync(priv->dev);
++	free_irq(priv->ndev->irq, priv);
++	priv->irq_registered = false;
++err1:
++	for (n = 0; n <= NETSEC_RING_MAX; n++)
++		netsec_free_desc_ring(priv, &priv->desc_ring[n]);
++err:
++	pm_runtime_put_sync(priv->dev);
++
++	return ret;
++}
++
++static int netsec_netdev_stop(struct net_device *ndev)
++{
++	struct netsec_priv *priv = netdev_priv(ndev);
++	int n;
++
++	phy_stop(ndev->phydev);
++	phy_disconnect(ndev->phydev);
++
++	netif_stop_queue(priv->ndev);
++	napi_disable(&priv->napi);
++
++	netsec_writel(priv, NETSEC_REG_INTEN_CLR, ~0);
++	netsec_stop_gmac(priv);
++
++	pm_runtime_put_sync(priv->dev);
++
++	for (n = 0; n <= NETSEC_RING_MAX; n++)
++		netsec_free_desc_ring(priv, &priv->desc_ring[n]);
++
++	free_irq(priv->ndev->irq, priv);
++	priv->irq_registered = false;
++
++	return 0;
++}
++
++const struct net_device_ops netsec_netdev_ops = {
++	.ndo_open		= netsec_netdev_open,
++	.ndo_stop		= netsec_netdev_stop,
++	.ndo_start_xmit		= netsec_netdev_start_xmit,
++	.ndo_set_features	= netsec_netdev_set_features,
++	.ndo_set_mac_address    = eth_mac_addr,
++	.ndo_validate_addr	= eth_validate_addr,
++};
+diff --git a/drivers/net/ethernet/socionext/netsec/netsec_platform.c b/drivers/net/ethernet/socionext/netsec/netsec_platform.c
+new file mode 100644
+index 0000000..624f6a7
+--- /dev/null
++++ b/drivers/net/ethernet/socionext/netsec/netsec_platform.c
+@@ -0,0 +1,435 @@
++/**
++ * drivers/net/ethernet/socionext/netsec/netsec_platform.c
++ *
++ *  Copyright (C) 2013-2014 Fujitsu Semiconductor Limited.
++ *  Copyright (C) 2014-2017 Linaro Ltd. All rights reserved.
++ *     Andy Green <andy.green@linaro.org>
++ *     Jassi Brar <jaswinder.singh@linaro.org>
++ *     Ard Biesheuvel <ard.biesheuvel@linaro.org>
++ *
++ *  This program is free software; you can redistribute it and/or
++ *  modify it under the terms of the GNU General Public License
++ *  as published by the Free Software Foundation; either version 2
++ *  of the License, or (at your option) any later version.
++ */
++
++#include <linux/acpi.h>
++#include <linux/device.h>
++#include <linux/ctype.h>
++#include <linux/netdevice.h>
++#include <linux/types.h>
++#include <linux/bitops.h>
++#include <linux/dma-mapping.h>
++#include <linux/module.h>
++#include <linux/sizes.h>
++#include <linux/platform_device.h>
++#include <linux/clk.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/of_net.h>
++#include <linux/io.h>
++#include <linux/pm_runtime.h>
++
++#include "netsec.h"
++
++#define NETSEC_F_NETSEC_VER_MAJOR_NUM(x) (x & 0xffff0000)
++
++static int napi_weight = 64;
++static u16 pause_time = 256;
++
++static int netsec_of_probe(struct platform_device *pdev,
++			   struct netsec_priv *priv)
++{
++	int clk_count, ret, i;
++
++	priv->phy_np = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
++	if (!priv->phy_np) {
++		dev_err(&pdev->dev, "missing required property 'phy-handle'\n");
++		return -EINVAL;
++	}
++
++	/* we require named clocks if there is more than one */
++	clk_count = of_property_count_strings(pdev->dev.of_node, "clock-names");
++	if (clk_count > 1) {
++		if (clk_count > ARRAY_SIZE(priv->clk)) {
++			dev_err(&pdev->dev, "too many clocks specified (%d)\n",
++				clk_count);
++			return -EINVAL;
++		}
++
++		for (i = 0; i < clk_count; i++) {
++			const char *clk_name;
++
++			ret = of_property_read_string_index(pdev->dev.of_node,
++							    "clock-names", i,
++							    &clk_name);
++			if (ret) {
++				dev_err(&pdev->dev,
++					"failed to parse 'clock-names'\n");
++				return ret;
++			}
++			priv->clk[i] = devm_clk_get(&pdev->dev, clk_name);
++			if (!strcmp(clk_name, "phy_refclk")) {
++				priv->freq = clk_get_rate(priv->clk[i]);
++				dev_dbg(&pdev->dev,
++					"found PHY refclock #%d freq %u\n",
++					i, priv->freq);
++			}
++		}
++		priv->clock_count = clk_count;
++	} else {
++		priv->clk[0] = devm_clk_get(&pdev->dev, NULL);
++		if (IS_ERR(priv->clk)) {
++			dev_err(&pdev->dev,
++				"missing required property 'clocks'\n");
++			return PTR_ERR(priv->clk);
++		}
++		priv->freq = clk_get_rate(priv->clk[0]);
++		priv->clock_count = 1;
++	}
++	return 0;
++}
++
++static int netsec_acpi_probe(struct platform_device *pdev,
++			     struct netsec_priv *priv, u32 *phy_addr)
++{
++	int ret;
++
++	if (!IS_ENABLED(CONFIG_ACPI))
++		return -ENODEV;
++
++	ret = device_property_read_u32(&pdev->dev, "phy-channel", phy_addr);
++	if (ret) {
++		dev_err(&pdev->dev,
++			"missing required property 'phy-channel'\n");
++		return ret;
++	}
++
++	ret = device_property_read_u32(&pdev->dev,
++				       "socionext,phy-clock-frequency",
++				       &priv->freq);
++	if (ret)
++		dev_err(&pdev->dev,
++			"missing required property 'socionext,phy-clock-frequency'\n");
++	return ret;
++}
++
++static int netsec_probe(struct platform_device *pdev)
++{
++	struct net_device *ndev;
++	struct netsec_priv *priv;
++	struct resource *mmio_res, *eeprom_res, *irq_res;
++	u8 *mac, macbuf[ETH_ALEN];
++	u32 hw_ver, phy_addr;
++	int ret;
++
++	mmio_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!mmio_res) {
++		dev_err(&pdev->dev, "No MMIO resource found.\n");
++		return -ENODEV;
++	}
++
++	eeprom_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++	if (!eeprom_res) {
++		dev_info(&pdev->dev, "No EEPROM resource found.\n");
++		return -ENODEV;
++	}
++
++	irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++	if (!irq_res) {
++		dev_err(&pdev->dev, "No IRQ resource found.\n");
++		return -ENODEV;
++	}
++
++	ndev = alloc_etherdev(sizeof(*priv));
++	if (!ndev)
++		return -ENOMEM;
++
++	priv = netdev_priv(ndev);
++	priv->ndev = ndev;
++	SET_NETDEV_DEV(ndev, &pdev->dev);
++	platform_set_drvdata(pdev, priv);
++	priv->dev = &pdev->dev;
++
++	priv->msg_enable = NETIF_MSG_TX_ERR | NETIF_MSG_HW | NETIF_MSG_DRV |
++			   NETIF_MSG_LINK | NETIF_MSG_PROBE;
++
++	ndev->irq = irq_res->start;
++
++	priv->phy_interface = device_get_phy_mode(&pdev->dev);
++	if (priv->phy_interface < 0) {
++		dev_err(&pdev->dev, "missing required property 'phy-mode'\n");
++		ret = -ENODEV;
++		goto free_ndev;
++	}
++
++	priv->ioaddr = devm_ioremap(&pdev->dev, mmio_res->start,
++				    resource_size(mmio_res));
++	if (!priv->ioaddr) {
++		dev_err(&pdev->dev, "devm_ioremap() failed\n");
++		ret = -ENXIO;
++		goto free_ndev;
++	}
++
++	priv->eeprom_base = devm_memremap(&pdev->dev, eeprom_res->start,
++					  resource_size(eeprom_res),
++					  MEMREMAP_WT);
++	if (!priv->eeprom_base) {
++		dev_err(&pdev->dev, "devm_memremap() failed for EEPROM\n");
++		ret = -ENXIO;
++		goto free_ndev;
++	}
++
++	mac = device_get_mac_address(&pdev->dev, macbuf, sizeof(macbuf));
++	if (mac)
++		ether_addr_copy(ndev->dev_addr, mac);
++
++	if (priv->eeprom_base &&
++	    (!mac || !is_valid_ether_addr(ndev->dev_addr))) {
++		const u8 *macp = priv->eeprom_base + NETSEC_EEPROM_MAC_ADDRESS;
++
++		ndev->dev_addr[0] = macp[3];
++		ndev->dev_addr[1] = macp[2];
++		ndev->dev_addr[2] = macp[1];
++		ndev->dev_addr[3] = macp[0];
++		ndev->dev_addr[4] = macp[7];
++		ndev->dev_addr[5] = macp[6];
++	}
++
++	if (!is_valid_ether_addr(ndev->dev_addr)) {
++		dev_warn(&pdev->dev, "No MAC address found, using random\n");
++		eth_hw_addr_random(ndev);
++	}
++
++	if (dev_of_node(&pdev->dev))
++		ret = netsec_of_probe(pdev, priv);
++	else
++		ret = netsec_acpi_probe(pdev, priv, &phy_addr);
++	if (ret)
++		goto free_ndev;
++
++	if (!priv->freq) {
++		dev_err(&pdev->dev, "missing PHY reference clock frequency\n");
++		ret = -ENODEV;
++		goto free_ndev;
++	}
++
++	/* disable by default */
++	priv->et_coalesce.rx_coalesce_usecs = 0;
++	priv->et_coalesce.rx_max_coalesced_frames = 1;
++	priv->et_coalesce.tx_coalesce_usecs = 0;
++	priv->et_coalesce.tx_max_coalesced_frames = 1;
++
++	ret = device_property_read_u32(&pdev->dev, "max-frame-size",
++				       &ndev->max_mtu);
++	if (ret < 0)
++		ndev->max_mtu = ETH_DATA_LEN;
++
++	priv->rx_pkt_buf_len = ndev->max_mtu + 22;
++	priv->param.use_jumbo_pkt_flag = (ndev->max_mtu > ETH_DATA_LEN);
++
++	pm_runtime_enable(&pdev->dev);
++	/* runtime_pm coverage just for probe, open/close also cover it */
++	pm_runtime_get_sync(&pdev->dev);
++
++	hw_ver = netsec_readl(priv, NETSEC_REG_F_TAIKI_VER);
++	/* this driver only supports F_TAIKI style NETSEC */
++	if (NETSEC_F_NETSEC_VER_MAJOR_NUM(hw_ver) !=
++	    NETSEC_F_NETSEC_VER_MAJOR_NUM(NETSEC_REG_NETSEC_VER_F_TAIKI)) {
++		ret = -ENODEV;
++		goto pm_disable;
++	}
++
++	dev_info(&pdev->dev, "hardware revision %d.%d\n",
++		 hw_ver >> 16, hw_ver & 0xffff);
++
++	priv->mac_mode.flow_start_th = NETSEC_FLOW_CONTROL_START_THRESHOLD;
++	priv->mac_mode.flow_stop_th = NETSEC_FLOW_CONTROL_STOP_THRESHOLD;
++	priv->mac_mode.pause_time = pause_time;
++	priv->mac_mode.flow_ctrl_enable_flag = false;
++
++	netif_napi_add(ndev, &priv->napi, netsec_netdev_napi_poll, napi_weight);
++
++	ndev->netdev_ops = &netsec_netdev_ops;
++	ndev->ethtool_ops = &netsec_ethtool_ops;
++	ndev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
++			 NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_GSO |
++			 NETIF_F_HIGHDMA | NETIF_F_RXCSUM;
++	ndev->hw_features = ndev->features;
++
++	priv->rx_cksum_offload_flag = true;
++	spin_lock_init(&priv->tx_queue_lock);
++
++	ret = netsec_mii_register(priv);
++	if (ret) {
++		dev_err(&pdev->dev, "mii bus registration failed (%d)\n", ret);
++		goto pm_disable;
++	}
++
++	if (!dev_of_node(&pdev->dev)) { /* ACPI */
++		priv->phydev = get_phy_device(priv->mii_bus, phy_addr, false);
++		if (IS_ERR(priv->phydev)) {
++			dev_err(&pdev->dev, "get_phy_device() failed (%ld)\n",
++				PTR_ERR(priv->phydev));
++			ret = PTR_ERR(priv->phydev);
++			goto unregister_mii;
++		}
++
++		ret = phy_device_register(priv->phydev);
++		if (ret) {
++			dev_err(&pdev->dev,
++				"phy_device_register() failed (%d)\n", ret);
++			phy_device_free(priv->phydev);
++			goto unregister_mii;
++		}
++	}
++
++	/* disable all other interrupt sources */
++	netsec_writel(priv, NETSEC_REG_INTEN_CLR, ~0);
++	netsec_writel(priv, NETSEC_REG_INTEN_SET,
++		      NETSEC_IRQ_TX | NETSEC_IRQ_RX);
++
++	if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
++		dev_warn(&pdev->dev, "Failed to enable 64-bit DMA\n");
++
++	ret = register_netdev(ndev);
++	if (ret) {
++		netif_err(priv, probe, ndev, "register_netdev() failed\n");
++		goto unregister_mii;
++	}
++
++	pm_runtime_put_sync_suspend(&pdev->dev);
++
++	return 0;
++
++unregister_mii:
++	netsec_mii_unregister(priv);
++
++pm_disable:
++	pm_runtime_put_sync_suspend(&pdev->dev);
++	pm_runtime_disable(&pdev->dev);
++
++free_ndev:
++	free_netdev(ndev);
++
++	dev_err(&pdev->dev, "init failed\n");
++
++	return ret;
++}
++
++static int netsec_remove(struct platform_device *pdev)
++{
++	struct netsec_priv *priv = platform_get_drvdata(pdev);
++
++	unregister_netdev(priv->ndev);
++	if (!dev_of_node(&pdev->dev)) { /* ACPI */
++		phy_device_remove(priv->phydev);
++		phy_device_free(priv->phydev);
++	}
++	netsec_mii_unregister(priv);
++	pm_runtime_disable(&pdev->dev);
++	free_netdev(priv->ndev);
++
++	return 0;
++}
++
++#ifdef CONFIG_PM
++static int netsec_runtime_suspend(struct device *dev)
++{
++	struct netsec_priv *priv = dev_get_drvdata(dev);
++	int n;
++
++	netif_dbg(priv, drv, priv->ndev, "%s\n", __func__);
++
++	if (priv->irq_registered)
++		disable_irq(priv->ndev->irq);
++
++	netsec_writel(priv, NETSEC_REG_CLK_EN, 0);
++
++	for (n = priv->clock_count - 1; n >= 0; n--)
++		clk_disable_unprepare(priv->clk[n]);
++
++	return 0;
++}
++
++static int netsec_runtime_resume(struct device *dev)
++{
++	struct netsec_priv *priv = dev_get_drvdata(dev);
++	int n;
++
++	netif_dbg(priv, drv, priv->ndev, "%s\n", __func__);
++
++	/* first let the clocks back on */
++
++	for (n = 0; n < priv->clock_count; n++)
++		clk_prepare_enable(priv->clk[n]);
++
++	netsec_writel(priv, NETSEC_REG_CLK_EN, NETSEC_CLK_EN_REG_DOM_D |
++					       NETSEC_CLK_EN_REG_DOM_C |
++					       NETSEC_CLK_EN_REG_DOM_G);
++
++	if (priv->irq_registered)
++		enable_irq(priv->ndev->irq);
++
++	return 0;
++}
++
++static int netsec_pm_suspend(struct device *dev)
++{
++	struct netsec_priv *priv = dev_get_drvdata(dev);
++
++	netif_dbg(priv, drv, priv->ndev, "%s\n", __func__);
++
++	if (pm_runtime_status_suspended(dev))
++		return 0;
++
++	return netsec_runtime_suspend(dev);
++}
++
++static int netsec_pm_resume(struct device *dev)
++{
++	struct netsec_priv *priv = dev_get_drvdata(dev);
++
++	netif_dbg(priv, drv, priv->ndev, "%s\n", __func__);
++
++	if (pm_runtime_status_suspended(dev))
++		return 0;
++
++	return netsec_runtime_resume(dev);
++}
++#endif
++
++static const struct dev_pm_ops netsec_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(netsec_pm_suspend, netsec_pm_resume)
++	SET_RUNTIME_PM_OPS(netsec_runtime_suspend, netsec_runtime_resume, NULL)
++};
++
++static const struct of_device_id netsec_dt_ids[] = {
++	{ .compatible = "socionext,synquacer-netsec" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, netsec_dt_ids);
++
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id netsec_acpi_ids[] = {
++	{ "SCX0001" },
++	{ }
++};
++MODULE_DEVICE_TABLE(acpi, netsec_acpi_ids);
++#endif
++
++static struct platform_driver netsec_driver = {
++	.probe				= netsec_probe,
++	.remove				= netsec_remove,
++	.driver.name			= "netsec",
++	.driver.of_match_table		= netsec_dt_ids,
++	.driver.acpi_match_table	= ACPI_PTR(netsec_acpi_ids),
++	.driver.pm			= &netsec_pm_ops,
++};
++module_platform_driver(netsec_driver);
++
++MODULE_AUTHOR("Andy Green <andy.green@linaro.org>");
++MODULE_AUTHOR("Jassi Brar <jaswinder.singh@linaro.org>");
++MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
++MODULE_DESCRIPTION("NETSEC Ethernet driver");
++MODULE_LICENSE("GPL");
+-- 
+cgit v1.1
+
+From 31a61532e7b859a797d36595ec5ab7485a9b24d5 Mon Sep 17 00:00:00 2001
+From: Jassi Brar <jassisinghbrar@gmail.com>
+Date: Wed, 30 Aug 2017 15:55:52 +0530
+Subject: dt-bindings: net: Add DT bindings for Socionext Netsec
+
+This patch adds documentation for Device-Tree bindings for the
+Socionext NetSec Controller driver.
+
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ .../devicetree/bindings/net/socionext-netsec.txt   | 43 ++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/net/socionext-netsec.txt
+
+diff --git a/Documentation/devicetree/bindings/net/socionext-netsec.txt b/Documentation/devicetree/bindings/net/socionext-netsec.txt
+new file mode 100644
+index 0000000..4695969
+--- /dev/null
++++ b/Documentation/devicetree/bindings/net/socionext-netsec.txt
+@@ -0,0 +1,43 @@
++* Socionext NetSec Ethernet Controller IP
++
++Required properties:
++- compatible: Should be "socionext,synquacer-netsec"
++- reg: Address and length of the control register area, followed by the
++       address and length of the EEPROM holding the MAC address and
++       microengine firmware
++- interrupts: Should contain ethernet controller interrupt
++- clocks: phandle to the PHY reference clock, and any other clocks to be
++          switched by runtime_pm
++- clock-names: Required only if more than a single clock is listed in 'clocks'.
++               The PHY reference clock must be named 'phy_refclk'
++- phy-mode: See ethernet.txt file in the same directory
++- phy-handle: phandle to select child phy
++
++Optional properties: (See ethernet.txt file in the same directory)
++- local-mac-address
++- mac-address
++- max-speed
++- max-frame-size
++
++Required properties for the child phy:
++- reg: phy address
++
++Example:
++	eth0: netsec@522D0000 {
++		compatible = "socionext,synquacer-netsec";
++		reg = <0 0x522D0000 0x0 0x10000>, <0 0x10000000 0x0 0x10000>;
++		interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&clk_netsec>;
++		phy-mode = "rgmii";
++		max-speed = <1000>;
++		max-frame-size = <9000>;
++		phy-handle = <&ethphy0>;
++
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		ethphy0: ethernet-phy@1 {
++			compatible = "ethernet-phy-ieee802.3-c22";
++			reg = <1>;
++		};
++	};
+-- 
+cgit v1.1
+
diff --git a/freed-ora/current/f27/arm64-xgene-acpi-fix.patch b/freed-ora/current/f27/arm64-xgene-acpi-fix.patch
new file mode 100644
index 000000000..e0df833c0
--- /dev/null
+++ b/freed-ora/current/f27/arm64-xgene-acpi-fix.patch
@@ -0,0 +1,38 @@
+From bdb9458a3382ba745a66be5526d3899103c76eda Mon Sep 17 00:00:00 2001
+From: Loc Ho <lho@apm.com>
+Date: Fri, 21 Jul 2017 11:24:37 -0700
+Subject: ACPI: APEI: Enable APEI multiple GHES source to share a single
+ external IRQ
+
+X-Gene platforms describe multiple GHES error sources with the same
+hardware error notification type (external interrupt) and interrupt
+number.
+
+Change the GHES interrupt request to support sharing the same IRQ.
+
+This change includs contributions from Tuan Phan <tphan@apm.com>.
+
+Signed-off-by: Loc Ho <lho@apm.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+---
+ drivers/acpi/apei/ghes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index d661d45..eed09fc 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1157,7 +1157,8 @@ static int ghes_probe(struct platform_device *ghes_dev)
+ 			       generic->header.source_id);
+ 			goto err_edac_unreg;
+ 		}
+-		rc = request_irq(ghes->irq, ghes_irq_func, 0, "GHES IRQ", ghes);
++		rc = request_irq(ghes->irq, ghes_irq_func, IRQF_SHARED,
++				 "GHES IRQ", ghes);
+ 		if (rc) {
+ 			pr_err(GHES_PFX "Failed to register IRQ for generic hardware error source: %d\n",
+ 			       generic->header.source_id);
+-- 
+cgit v1.1
+
diff --git a/freed-ora/current/f27/baseconfig/CONFIG_NET_VENDOR_SNI b/freed-ora/current/f27/baseconfig/CONFIG_NET_VENDOR_SNI
new file mode 100644
index 000000000..4f301f9ba
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/CONFIG_NET_VENDOR_SNI
@@ -0,0 +1 @@
+# CONFIG_NET_VENDOR_SNI is not set
diff --git a/freed-ora/current/f27/baseconfig/CONFIG_PCIE_DW_HOST_ECAM b/freed-ora/current/f27/baseconfig/CONFIG_PCIE_DW_HOST_ECAM
new file mode 100644
index 000000000..c73d5c1aa
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/CONFIG_PCIE_DW_HOST_ECAM
@@ -0,0 +1 @@
+# CONFIG_PCIE_DW_HOST_ECAM is not set
diff --git a/freed-ora/current/f27/baseconfig/CONFIG_HW_RANDOM_OMAP b/freed-ora/current/f27/baseconfig/arm/CONFIG_HW_RANDOM_OMAP
index cf37a6e35..cf37a6e35 100644
--- a/freed-ora/current/f27/baseconfig/CONFIG_HW_RANDOM_OMAP
+++ b/freed-ora/current/f27/baseconfig/arm/CONFIG_HW_RANDOM_OMAP
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_NET_VENDOR_SNI b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_NET_VENDOR_SNI
new file mode 100644
index 000000000..bb77206de
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_NET_VENDOR_SNI
@@ -0,0 +1 @@
+CONFIG_NET_VENDOR_SNI=y
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_PCIE_DW_HOST_ECAM b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_PCIE_DW_HOST_ECAM
new file mode 100644
index 000000000..cdb6169bd
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_PCIE_DW_HOST_ECAM
@@ -0,0 +1 @@
+CONFIG_PCIE_DW_HOST_ECAM=y
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_BASE b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_BASE
index 097a2d3e7..20610a95a 100644
--- a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_BASE
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_BASE
@@ -1 +1 @@
-# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_RANDOMIZE_BASE=y
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_MODULE_REGION_FULL b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_MODULE_REGION_FULL
new file mode 100644
index 000000000..7645a371e
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RANDOMIZE_MODULE_REGION_FULL
@@ -0,0 +1 @@
+CONFIG_RANDOMIZE_MODULE_REGION_FULL=y
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RELOCATABLE b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RELOCATABLE
index ff7e13901..36808edb3 100644
--- a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RELOCATABLE
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_RELOCATABLE
@@ -1 +1 @@
-# CONFIG_RELOCATABLE is not set
+CONFIG_RELOCATABLE=y
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SNI_NETSEC b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SNI_NETSEC
new file mode 100644
index 000000000..c348519ff
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SNI_NETSEC
@@ -0,0 +1 @@
+CONFIG_SNI_NETSEC=m
diff --git a/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SOCIONEXT_SYNQUACER_PREITS b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SOCIONEXT_SYNQUACER_PREITS
new file mode 100644
index 000000000..ded5c358e
--- /dev/null
+++ b/freed-ora/current/f27/baseconfig/arm/arm64/CONFIG_SOCIONEXT_SYNQUACER_PREITS
@@ -0,0 +1 @@
+CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
diff --git a/freed-ora/current/f27/drm-cma-reduce-dmesg-logs.patch b/freed-ora/current/f27/drm-cma-reduce-dmesg-logs.patch
new file mode 100644
index 000000000..2e39d6e70
--- /dev/null
+++ b/freed-ora/current/f27/drm-cma-reduce-dmesg-logs.patch
@@ -0,0 +1,96 @@
+From patchwork Thu Oct  5 11:29:17 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [v2] drm/gem-cma-helper: Change the level of the allocation failure
+ message
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+X-Patchwork-Id: 180737
+Message-Id: <20171005112917.15949-1-boris.brezillon@free-electrons.com>
+To: David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>,
+ dri-devel@lists.freedesktop.org
+Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Thu,  5 Oct 2017 13:29:17 +0200
+
+drm_gem_cma_create() prints an error message when dma_alloc_wc() fails to
+allocate the amount of memory we requested. This can lead to annoying
+error messages when CMA is only one possible source of memory for the BO
+allocation. Turn this error message into a debug one.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+---
+Changes in v2:
+- Remove __must_check attribute
+---
+ drivers/gpu/drm/drm_gem_cma_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_gem_cma_helper.c b/drivers/gpu/drm/drm_gem_cma_helper.c
+index 373e33f22be4..020e7668dfab 100644
+--- a/drivers/gpu/drm/drm_gem_cma_helper.c
++++ b/drivers/gpu/drm/drm_gem_cma_helper.c
+@@ -112,7 +112,7 @@ struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm,
+ 	cma_obj->vaddr = dma_alloc_wc(drm->dev, size, &cma_obj->paddr,
+ 				      GFP_KERNEL | __GFP_NOWARN);
+ 	if (!cma_obj->vaddr) {
+-		dev_err(drm->dev, "failed to allocate buffer with size %zu\n",
++		dev_dbg(drm->dev, "failed to allocate buffer with size %zu\n",
+ 			size);
+ 		ret = -ENOMEM;
+ 		goto error;
+From patchwork Wed Oct  4 12:54:47 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: cma: Take __GFP_NOWARN into account in cma_alloc()
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+X-Patchwork-Id: 180554
+Message-Id: <20171004125447.15195-1-boris.brezillon@free-electrons.com>
+To: linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
+ Laura Abbott <labbott@redhat.com>
+Cc: Boris Brezillon <boris.brezillon@free-electrons.com>,
+ Jaewon Kim <jaewon31.kim@samsung.com>, dri-devel@lists.freedesktop.org
+Date: Wed,  4 Oct 2017 14:54:47 +0200
+
+cma_alloc() unconditionally prints an INFO message when the CMA
+allocation fails. Make this message conditional on the non-presence of
+__GFP_NOWARN in gfp_mask.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Acked-by: Laura Abbott <labbott@redhat.com>
+---
+Hello,
+
+This patch aims at removing INFO messages that are displayed when the
+VC4 driver tries to allocate buffer objects. From the driver perspective
+an allocation failure is acceptable, and the driver can possibly do
+something to make following allocation succeed (like flushing the VC4
+internal cache).
+
+Also, I don't understand why this message is only an INFO message, and
+not a WARN (pr_warn()). Please let me know if you have good reasons to
+keep it as an unconditional pr_info().
+
+Thanks,
+
+Boris
+---
+ mm/cma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/cma.c b/mm/cma.c
+index c0da318c020e..022e52bd8370 100644
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -460,7 +460,7 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
+ 
+ 	trace_cma_alloc(pfn, page, count, align);
+ 
+-	if (ret) {
++	if (ret && !(gfp_mask & __GFP_NOWARN)) {
+ 		pr_info("%s: alloc failed, req-size: %zu pages, ret: %d\n",
+ 			__func__, count, ret);
+ 		cma_debug_show_areas(cma);
diff --git a/freed-ora/current/f27/drm-i915-boost-GPU-clocks-if-we-miss-the-pageflip.patch b/freed-ora/current/f27/drm-i915-boost-GPU-clocks-if-we-miss-the-pageflip.patch
new file mode 100644
index 000000000..0bd0e7cef
--- /dev/null
+++ b/freed-ora/current/f27/drm-i915-boost-GPU-clocks-if-we-miss-the-pageflip.patch
@@ -0,0 +1,238 @@
+From 333e2a813cdfb86ff286ece6f13bec371aa03d7b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 17 Aug 2017 13:37:06 +0100
+Subject: [PATCH] drm/i915: Boost GPU clocks if we miss the pageflip's vblank
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If we miss the current vblank because the gpu was busy, that may cause a
+jitter as the frame rate temporarily drops. We try to limit the impact
+of this by then boosting the GPU clock to deliver the frame as quickly
+as possible. Originally done in commit 6ad790c0f5ac ("drm/i915: Boost GPU
+frequency if we detect outstanding pageflips") but was never forward
+ported to atomic and finally dropped in commit fd3a40242e87 ("drm/i915:
+Rip out legacy page_flip completion/irq handling").
+
+One of the most typical use-cases for this is a mostly idle desktop.
+Rendering one frame of the desktop's frontbuffer can easily be
+accomplished by the GPU running at low frequency, but often exceeds
+the time budget of the desktop compositor. The result is that animations
+such as opening the menu, doing a fullscreen switch, or even just trying
+to move a window around are slow and jerky. We need to respond within a
+frame to give the best impression of a smooth UX, as a compromise we
+instead respond if that first frame misses its goal. The result should
+be a near-imperceivable initial delay and a smooth animation even
+starting from idle. The cost, as ever, is that we spend more power than
+is strictly necessary as we overestimate the required GPU frequency and
+then try to ramp down.
+
+This of course is reactionary, too little, too late; nevertheless it is
+surprisingly effective.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102199
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170817123706.6777-1-chris@chris-wilson.co.uk
+Tested-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Radoslaw Szwichtenberg <radoslaw.szwichtenberg@intel.com>
+---
+ drivers/gpu/drm/i915/i915_gem.c      | 10 +++---
+ drivers/gpu/drm/i915/intel_display.c | 63 ++++++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/i915/intel_pm.c      | 14 ++++----
+ 3 files changed, 77 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 969bac8404f1..7d409b29d75a 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -355,6 +355,7 @@ i915_gem_object_wait_fence(struct dma_fence *fence,
+ 			   long timeout,
+ 			   struct intel_rps_client *rps)
+ {
++	unsigned long irq_flags;
+ 	struct drm_i915_gem_request *rq;
+ 
+ 	BUILD_BUG_ON(I915_WAIT_INTERRUPTIBLE != 0x1);
+@@ -410,9 +411,9 @@ i915_gem_object_wait_fence(struct dma_fence *fence,
+ 		 * Compensate by giving the synchronous client credit for
+ 		 * a waitboost next time.
+ 		 */
+-		spin_lock(&rq->i915->rps.client_lock);
++		spin_lock_irqsave(&rq->i915->rps.client_lock, irq_flags);
+ 		list_del_init(&rps->link);
+-		spin_unlock(&rq->i915->rps.client_lock);
++		spin_unlock_irqrestore(&rq->i915->rps.client_lock, irq_flags);
+ 	}
+ 
+ 	return timeout;
+@@ -5029,6 +5030,7 @@ void i915_gem_release(struct drm_device *dev, struct drm_file *file)
+ {
+ 	struct drm_i915_file_private *file_priv = file->driver_priv;
+ 	struct drm_i915_gem_request *request;
++	unsigned long flags;
+ 
+ 	/* Clean up our request list when the client is going away, so that
+ 	 * later retire_requests won't dereference our soon-to-be-gone
+@@ -5040,9 +5042,9 @@ void i915_gem_release(struct drm_device *dev, struct drm_file *file)
+ 	spin_unlock(&file_priv->mm.lock);
+ 
+ 	if (!list_empty(&file_priv->rps.link)) {
+-		spin_lock(&to_i915(dev)->rps.client_lock);
++		spin_lock_irqsave(&to_i915(dev)->rps.client_lock, flags);
+ 		list_del(&file_priv->rps.link);
+-		spin_unlock(&to_i915(dev)->rps.client_lock);
++		spin_unlock_irqrestore(&to_i915(dev)->rps.client_lock, flags);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 022125082649..875eb7aec2f1 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13301,6 +13301,58 @@ static const struct drm_crtc_funcs intel_crtc_funcs = {
+ 	.set_crc_source = intel_crtc_set_crc_source,
+ };
+ 
++struct wait_rps_boost {
++	struct wait_queue_entry wait;
++
++	struct drm_crtc *crtc;
++	struct drm_i915_gem_request *request;
++};
++
++static int do_rps_boost(struct wait_queue_entry *_wait,
++			unsigned mode, int sync, void *key)
++{
++	struct wait_rps_boost *wait = container_of(_wait, typeof(*wait), wait);
++	struct drm_i915_gem_request *rq = wait->request;
++
++	gen6_rps_boost(rq->i915, NULL, rq->emitted_jiffies);
++	i915_gem_request_put(rq);
++
++	drm_crtc_vblank_put(wait->crtc);
++
++	list_del(&wait->wait.entry);
++	kfree(wait);
++	return 1;
++}
++
++static void add_rps_boost_after_vblank(struct drm_crtc *crtc,
++				       struct dma_fence *fence)
++{
++	struct wait_rps_boost *wait;
++
++	if (!dma_fence_is_i915(fence))
++		return;
++
++	if (INTEL_GEN(to_i915(crtc->dev)) < 6)
++		return;
++
++	if (drm_crtc_vblank_get(crtc))
++		return;
++
++	wait = kmalloc(sizeof(*wait), GFP_KERNEL);
++	if (!wait) {
++		drm_crtc_vblank_put(crtc);
++		return;
++	}
++
++	wait->request = to_request(dma_fence_get(fence));
++	wait->crtc = crtc;
++
++	wait->wait.func = do_rps_boost;
++	wait->wait.flags = 0;
++
++	add_wait_queue(drm_crtc_vblank_waitqueue(crtc), &wait->wait);
++}
++
+ /**
+  * intel_prepare_plane_fb - Prepare fb for usage on plane
+  * @plane: drm plane to prepare for
+@@ -13392,6 +13444,8 @@ intel_prepare_plane_fb(struct drm_plane *plane,
+ 		return 0;
+ 
+ 	if (!new_state->fence) { /* implicit fencing */
++		struct dma_fence *fence;
++
+ 		ret = i915_sw_fence_await_reservation(&intel_state->commit_ready,
+ 						      obj->resv, NULL,
+ 						      false, I915_FENCE_TIMEOUT,
+@@ -13399,7 +13453,16 @@ intel_prepare_plane_fb(struct drm_plane *plane,
+ 		if (ret < 0)
+ 			return ret;
+ 
++		fence = reservation_object_get_excl_rcu(obj->resv);
++		if (fence) {
++			add_rps_boost_after_vblank(new_state->crtc, fence);
++			dma_fence_put(fence);
++		}
++
+ 		i915_gem_object_wait_priority(obj, 0, I915_PRIORITY_DISPLAY);
++
++	} else {
++		add_rps_boost_after_vblank(new_state->crtc, new_state->fence);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 40b224b44d1b..b0ee9c4d33f4 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -6108,6 +6108,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv)
+ 
+ void gen6_rps_idle(struct drm_i915_private *dev_priv)
+ {
++	unsigned long flags;
+ 	/* Flush our bottom-half so that it does not race with us
+ 	 * setting the idle frequency and so that it is bounded by
+ 	 * our rpm wakeref. And then disable the interrupts to stop any
+@@ -6127,16 +6128,17 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
+ 	}
+ 	mutex_unlock(&dev_priv->rps.hw_lock);
+ 
+-	spin_lock(&dev_priv->rps.client_lock);
++	spin_lock_irqsave(&dev_priv->rps.client_lock, flags);
+ 	while (!list_empty(&dev_priv->rps.clients))
+ 		list_del_init(dev_priv->rps.clients.next);
+-	spin_unlock(&dev_priv->rps.client_lock);
++	spin_unlock_irqrestore(&dev_priv->rps.client_lock, flags);
+ }
+ 
+ void gen6_rps_boost(struct drm_i915_private *dev_priv,
+ 		    struct intel_rps_client *rps,
+ 		    unsigned long submitted)
+ {
++	unsigned long flags;
+ 	/* This is intentionally racy! We peek at the state here, then
+ 	 * validate inside the RPS worker.
+ 	 */
+@@ -6151,14 +6153,14 @@ void gen6_rps_boost(struct drm_i915_private *dev_priv,
+ 	if (rps && time_after(jiffies, submitted + DRM_I915_THROTTLE_JIFFIES))
+ 		rps = NULL;
+ 
+-	spin_lock(&dev_priv->rps.client_lock);
++	spin_lock_irqsave(&dev_priv->rps.client_lock, flags);
+ 	if (rps == NULL || list_empty(&rps->link)) {
+-		spin_lock_irq(&dev_priv->irq_lock);
++		spin_lock(&dev_priv->irq_lock);
+ 		if (dev_priv->rps.interrupts_enabled) {
+ 			dev_priv->rps.client_boost = true;
+ 			schedule_work(&dev_priv->rps.work);
+ 		}
+-		spin_unlock_irq(&dev_priv->irq_lock);
++		spin_unlock(&dev_priv->irq_lock);
+ 
+ 		if (rps != NULL) {
+ 			list_add(&rps->link, &dev_priv->rps.clients);
+@@ -6166,7 +6168,7 @@ void gen6_rps_boost(struct drm_i915_private *dev_priv,
+ 		} else
+ 			dev_priv->rps.boosts++;
+ 	}
+-	spin_unlock(&dev_priv->rps.client_lock);
++	spin_unlock_irqrestore(&dev_priv->rps.client_lock, flags);
+ }
+ 
+ int intel_set_rps(struct drm_i915_private *dev_priv, u8 val)
diff --git a/freed-ora/current/f27/kernel-aarch64-debug.config b/freed-ora/current/f27/kernel-aarch64-debug.config
index 71ab73c45..5b3997744 100644
--- a/freed-ora/current/f27/kernel-aarch64-debug.config
+++ b/freed-ora/current/f27/kernel-aarch64-debug.config
@@ -3567,6 +3567,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+CONFIG_NET_VENDOR_SNI=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -3944,6 +3945,7 @@ CONFIG_PCIE_ARMADA_8K=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+CONFIG_PCIE_DW_HOST_ECAM=y
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
@@ -4261,7 +4263,8 @@ CONFIG_RADIO_WL1273=m
 CONFIG_RADIO_ZOLTRIX=m
 CONFIG_RAID_ATTRS=m
 # CONFIG_RANDOM32_SELFTEST is not set
-# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_RANDOMIZE_MODULE_REGION_FULL=y
 CONFIG_RAS_CEC=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_RASPBERRYPI_POWER=y
@@ -4362,8 +4365,8 @@ CONFIG_REISERFS_FS_SECURITY=y
 CONFIG_REISERFS_FS_XATTR=y
 CONFIG_REISERFS_PROC_INFO=y
 CONFIG_RELAY=y
-# CONFIG_RELOCATABLE is not set
 # CONFIG_RELOCATABLE_TEST is not set
+CONFIG_RELOCATABLE=y
 CONFIG_REMOTEPROC=m
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RESET_GPIO=y
@@ -5326,8 +5329,10 @@ CONFIG_SND_VIRMIDI=m
 CONFIG_SND_VIRTUOSO=m
 CONFIG_SND_VX222=m
 CONFIG_SND_YMFPCI=m
+CONFIG_SNI_NETSEC=m
 # CONFIG_SOC_BRCMSTB is not set
 # CONFIG_SOC_CAMERA is not set
+CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
 CONFIG_SOC_TEGRA_FLOWCTRL=y
 # CONFIG_SOC_TI is not set
 # CONFIG_SOC_ZTE is not set
diff --git a/freed-ora/current/f27/kernel-aarch64.config b/freed-ora/current/f27/kernel-aarch64.config
index 6bc3d9bce..6be434a02 100644
--- a/freed-ora/current/f27/kernel-aarch64.config
+++ b/freed-ora/current/f27/kernel-aarch64.config
@@ -3546,6 +3546,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+CONFIG_NET_VENDOR_SNI=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -3923,6 +3924,7 @@ CONFIG_PCIE_ARMADA_8K=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+CONFIG_PCIE_DW_HOST_ECAM=y
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
@@ -4239,7 +4241,8 @@ CONFIG_RADIO_WL1273=m
 CONFIG_RADIO_ZOLTRIX=m
 CONFIG_RAID_ATTRS=m
 # CONFIG_RANDOM32_SELFTEST is not set
-# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_RANDOMIZE_MODULE_REGION_FULL=y
 CONFIG_RAS_CEC=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_RASPBERRYPI_POWER=y
@@ -4340,8 +4343,8 @@ CONFIG_REISERFS_FS_SECURITY=y
 CONFIG_REISERFS_FS_XATTR=y
 CONFIG_REISERFS_PROC_INFO=y
 CONFIG_RELAY=y
-# CONFIG_RELOCATABLE is not set
 # CONFIG_RELOCATABLE_TEST is not set
+CONFIG_RELOCATABLE=y
 CONFIG_REMOTEPROC=m
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RESET_GPIO=y
@@ -5303,8 +5306,10 @@ CONFIG_SND_VIRMIDI=m
 CONFIG_SND_VIRTUOSO=m
 CONFIG_SND_VX222=m
 CONFIG_SND_YMFPCI=m
+CONFIG_SNI_NETSEC=m
 # CONFIG_SOC_BRCMSTB is not set
 # CONFIG_SOC_CAMERA is not set
+CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
 CONFIG_SOC_TEGRA_FLOWCTRL=y
 # CONFIG_SOC_TI is not set
 # CONFIG_SOC_ZTE is not set
diff --git a/freed-ora/current/f27/kernel-armv7hl-debug.config b/freed-ora/current/f27/kernel-armv7hl-debug.config
index 3759225e0..bf8fc1e67 100644
--- a/freed-ora/current/f27/kernel-armv7hl-debug.config
+++ b/freed-ora/current/f27/kernel-armv7hl-debug.config
@@ -3813,6 +3813,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -4233,6 +4234,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
diff --git a/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config b/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
index 80e870146..e4281887e 100644
--- a/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
+++ b/freed-ora/current/f27/kernel-armv7hl-lpae-debug.config
@@ -3639,6 +3639,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -4017,6 +4018,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
diff --git a/freed-ora/current/f27/kernel-armv7hl-lpae.config b/freed-ora/current/f27/kernel-armv7hl-lpae.config
index b89cc4337..3ef0b74e0 100644
--- a/freed-ora/current/f27/kernel-armv7hl-lpae.config
+++ b/freed-ora/current/f27/kernel-armv7hl-lpae.config
@@ -3618,6 +3618,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -3996,6 +3997,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
diff --git a/freed-ora/current/f27/kernel-armv7hl.config b/freed-ora/current/f27/kernel-armv7hl.config
index 708e0e779..79f3d5c0c 100644
--- a/freed-ora/current/f27/kernel-armv7hl.config
+++ b/freed-ora/current/f27/kernel-armv7hl.config
@@ -3792,6 +3792,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 # CONFIG_NET_VENDOR_SUN is not set
@@ -4212,6 +4213,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 CONFIG_PCIE_DW_HOST=y
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_DW=y
diff --git a/freed-ora/current/f27/kernel-i686-PAE.config b/freed-ora/current/f27/kernel-i686-PAE.config
index 1f287c8bd..53be68fae 100644
--- a/freed-ora/current/f27/kernel-i686-PAE.config
+++ b/freed-ora/current/f27/kernel-i686-PAE.config
@@ -1843,7 +1843,6 @@ CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_GEODE=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3431,6 +3430,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3813,6 +3813,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-i686-PAEdebug.config b/freed-ora/current/f27/kernel-i686-PAEdebug.config
index f49a6c283..c78c3de50 100644
--- a/freed-ora/current/f27/kernel-i686-PAEdebug.config
+++ b/freed-ora/current/f27/kernel-i686-PAEdebug.config
@@ -1861,7 +1861,6 @@ CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_GEODE=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3451,6 +3450,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3833,6 +3833,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-i686-debug.config b/freed-ora/current/f27/kernel-i686-debug.config
index f5ac2c164..182cc43cc 100644
--- a/freed-ora/current/f27/kernel-i686-debug.config
+++ b/freed-ora/current/f27/kernel-i686-debug.config
@@ -1861,7 +1861,6 @@ CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_GEODE=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3451,6 +3450,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3833,6 +3833,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-i686.config b/freed-ora/current/f27/kernel-i686.config
index 57c50de0e..75efea842 100644
--- a/freed-ora/current/f27/kernel-i686.config
+++ b/freed-ora/current/f27/kernel-i686.config
@@ -1843,7 +1843,6 @@ CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_GEODE=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3431,6 +3430,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3813,6 +3813,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-ppc64-debug.config b/freed-ora/current/f27/kernel-ppc64-debug.config
index 1a5e5c245..6260aeb18 100644
--- a/freed-ora/current/f27/kernel-ppc64-debug.config
+++ b/freed-ora/current/f27/kernel-ppc64-debug.config
@@ -1758,7 +1758,6 @@ CONFIG_HWLAT_TRACER=y
 CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_POWERNV=m
 CONFIG_HW_RANDOM_PSERIES=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
@@ -3278,6 +3277,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3636,6 +3636,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-ppc64.config b/freed-ora/current/f27/kernel-ppc64.config
index 2568593b1..7f093b40c 100644
--- a/freed-ora/current/f27/kernel-ppc64.config
+++ b/freed-ora/current/f27/kernel-ppc64.config
@@ -1740,7 +1740,6 @@ CONFIG_HWLAT_TRACER=y
 CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_POWERNV=m
 CONFIG_HW_RANDOM_PSERIES=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
@@ -3256,6 +3255,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3614,6 +3614,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-ppc64le-debug.config b/freed-ora/current/f27/kernel-ppc64le-debug.config
index 056cdcac1..c335135bb 100644
--- a/freed-ora/current/f27/kernel-ppc64le-debug.config
+++ b/freed-ora/current/f27/kernel-ppc64le-debug.config
@@ -1710,7 +1710,6 @@ CONFIG_HWLAT_TRACER=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_POWERNV=m
 CONFIG_HW_RANDOM_PSERIES=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
@@ -3222,6 +3221,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3578,6 +3578,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-ppc64le.config b/freed-ora/current/f27/kernel-ppc64le.config
index 287b6420b..faecfdd5a 100644
--- a/freed-ora/current/f27/kernel-ppc64le.config
+++ b/freed-ora/current/f27/kernel-ppc64le.config
@@ -1692,7 +1692,6 @@ CONFIG_HWLAT_TRACER=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_POWERNV=m
 CONFIG_HW_RANDOM_PSERIES=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
@@ -3200,6 +3199,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3556,6 +3556,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-s390x-debug.config b/freed-ora/current/f27/kernel-s390x-debug.config
index f3f8e811c..70dc58dde 100644
--- a/freed-ora/current/f27/kernel-s390x-debug.config
+++ b/freed-ora/current/f27/kernel-s390x-debug.config
@@ -1668,7 +1668,6 @@ CONFIG_HWLAT_TRACER=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 # CONFIG_HWMON is not set
 CONFIG_HWPOISON_INJECT=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_S390=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
@@ -3154,6 +3153,7 @@ CONFIG_NET_VENDOR_AQUANTIA=y
 # CONFIG_NET_VENDOR_SILAN is not set
 # CONFIG_NET_VENDOR_SIS is not set
 # CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
@@ -3506,6 +3506,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-s390x.config b/freed-ora/current/f27/kernel-s390x.config
index dbfa4dabc..65cb29663 100644
--- a/freed-ora/current/f27/kernel-s390x.config
+++ b/freed-ora/current/f27/kernel-s390x.config
@@ -1650,7 +1650,6 @@ CONFIG_HWLAT_TRACER=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 # CONFIG_HWMON is not set
 CONFIG_HWPOISON_INJECT=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_S390=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
@@ -3132,6 +3131,7 @@ CONFIG_NET_VENDOR_AQUANTIA=y
 # CONFIG_NET_VENDOR_SILAN is not set
 # CONFIG_NET_VENDOR_SIS is not set
 # CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SNI is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
@@ -3484,6 +3484,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-x86_64-debug.config b/freed-ora/current/f27/kernel-x86_64-debug.config
index 6f5394087..b6440f056 100644
--- a/freed-ora/current/f27/kernel-x86_64-debug.config
+++ b/freed-ora/current/f27/kernel-x86_64-debug.config
@@ -1897,7 +1897,6 @@ CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3488,6 +3487,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3876,6 +3876,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel-x86_64.config b/freed-ora/current/f27/kernel-x86_64.config
index 844ce7501..56e587454 100644
--- a/freed-ora/current/f27/kernel-x86_64.config
+++ b/freed-ora/current/f27/kernel-x86_64.config
@@ -1879,7 +1879,6 @@ CONFIG_HWMON=y
 CONFIG_HWPOISON_INJECT=m
 CONFIG_HW_RANDOM_AMD=m
 CONFIG_HW_RANDOM_INTEL=m
-CONFIG_HW_RANDOM_OMAP=m
 CONFIG_HW_RANDOM_TIMERIOMEM=m
 CONFIG_HW_RANDOM_TPM=m
 CONFIG_HW_RANDOM_VIA=m
@@ -3468,6 +3467,7 @@ CONFIG_NET_VENDOR_ROCKER=y
 CONFIG_NET_VENDOR_SILAN=y
 CONFIG_NET_VENDOR_SIS=y
 CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_NET_VENDOR_SNI is not set
 CONFIG_NET_VENDOR_SOLARFLARE=y
 CONFIG_NET_VENDOR_STMICRO=y
 CONFIG_NET_VENDOR_SUN=y
@@ -3856,6 +3856,7 @@ CONFIG_PCIEAER=y
 # CONFIG_PCIEASPM_DEBUG is not set
 CONFIG_PCIEASPM=y
 CONFIG_PCIE_DPC=y
+# CONFIG_PCIE_DW_HOST_ECAM is not set
 # CONFIG_PCIE_DW_PLAT is not set
 CONFIG_PCIE_ECRC=y
 # CONFIG_PCI_ENDPOINT is not set
diff --git a/freed-ora/current/f27/kernel.spec b/freed-ora/current/f27/kernel.spec
index d30519dc7..f2c4a4307 100644
--- a/freed-ora/current/f27/kernel.spec
+++ b/freed-ora/current/f27/kernel.spec
@@ -92,7 +92,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 5
+%define stable_update 6
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -623,6 +623,11 @@ Patch211: drm-i915-hush-check-crtc-state.patch
 
 # 300 - ARM patches
 
+# Reduces a number of primarily info logs to dmesg
+# https://patchwork.freedesktop.org/patch/180737/
+# https://patchwork.freedesktop.org/patch/180554/
+Patch300: drm-cma-reduce-dmesg-logs.patch
+
 # http://www.spinics.net/lists/linux-tegra/msg26029.html
 Patch301: usb-phy-tegra-Add-38.4MHz-clock-table-entry.patch
 
@@ -663,6 +668,9 @@ Patch313: qcom-Force-host-mode-for-USB-on-apq8016-sbc.patch
 # https://patchwork.kernel.org/patch/9850189/
 Patch314: qcom-msm-ci_hdrc_msm_probe-missing-of_node_get.patch
 
+# Hack until interconnect API lands upstream
+Patch315: qcom-clk-gpu-msm.patch
+
 # Fix USB on the RPi https://patchwork.kernel.org/patch/9879371/
 Patch321: bcm283x-dma-mapping-skip-USB-devices-when-configuring-DMA-during-probe.patch
 
@@ -678,6 +686,24 @@ Patch324: bcm283x-vc4-fixes.patch
 # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20170912&id=723288836628bc1c0855f3bb7b64b1803e4b9e4a
 Patch330: arm-of-restrict-dma-configuration.patch
 
+# Upstream ACPI fix
+Patch331: arm64-xgene-acpi-fix.patch
+
+# Generic fixes and enablement for Socionext SoC and 96board
+Patch332: ahci-don-t-ignore-result-code-of-ahci_reset_controller.patch
+
+# https://patchwork.kernel.org/patch/9980861/
+Patch333: PCI-aspm-deal-with-missing-root-ports-in-link-state-handling.patch
+
+# https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=synquacer-netsec
+Patch334: arm64-socionext-96b-enablement.patch
+
+# ThunderX fixes
+Patch335: arm64-cavium-fixes.patch
+
+# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c0d8832e78cbfd4a64b7112e34920af4b0b0e60e
+# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ae2e972dae3cea795e9f8f94eb1601213c2d49f0
+
 # 400 - IBM (ppc/s390x) patches
 
 # 500 - Temp fixes/CVEs etc
@@ -685,6 +711,10 @@ Patch330: arm-of-restrict-dma-configuration.patch
 # CVE-2017-7477 rhbz 1445207 1445208
 Patch502: CVE-2017-7477.patch
 
+# rhbz 1498016 1498017
+Patch503: KEYS-don-t-let-add_key-update-an-uninstantiated-key.patch
+Patch504: KEYS-fix-race-between-updating-and-finding-negative-.patch
+
 # 600 - Patches for improved Bay and Cherry Trail device support
 # Below patches are submitted upstream, awaiting review / merging
 Patch601: 0001-Input-gpio_keys-Allow-suppression-of-input-events-fo.patch
@@ -707,7 +737,6 @@ Patch619: pci-mark-amd-stoney-gpu-ats-as-broken.patch
 Patch622: qxl-fixes.patch
 
 # rhbz 1431375
-Patch623: HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch
 Patch624: input-rmi4-remove-the-need-for-artifical-IRQ.patch
 
 # rhbz 1432684
@@ -718,6 +747,12 @@ Patch628: 3-3-inet-fix-improper-empty-comparison.patch
 # rhbz 1497861
 Patch629: 0001-platform-x86-peaq-wmi-Add-DMI-check-before-binding-t.patch
 
+# rhbz 1482648
+Patch630: Input-synaptics---Disable-kernel-tracking-on-SMBus-devices.patch
+
+# Headed upstream
+Patch631: drm-i915-boost-GPU-clocks-if-we-miss-the-pageflip.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2368,12 +2403,37 @@ fi
 #
 #
 %changelog
+* Fri Oct 13 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.13.6-gnu.
+
+* Thu Oct 12 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.13.6-300
+- Linux v4.13.6
+- Fixes CVE-2017-1000255 (rhbz 1498067 1500335)
+
+* Thu Oct 12 2017 Peter Robinson <pbrobinson@fedoraproject.org>
+- Fixes for Cavium ThunderX plaforms
+
+* Wed Oct 11 2017 Jeremy Cline <jeremy@jcline.org>
+- Fix incorrect updates of uninstantiated keys crash the kernel (rhbz 1498016 1498017)
+
+* Tue Oct 10 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- Disable kernel tracking on SMBus devices (rhbz 1482648)
+
+* Mon Oct  9 2017 Peter Robinson <pbrobinson@fedoraproject.org>
+- Enable KASLR on aarch64
+
+* Fri Oct  6 2017 Peter Robinson <pbrobinson@fedoraproject.org>
+- ARM ACPI fix for x-gene RHBZ #1498117
+- Initial support for Socionext Synquacer platform
+- Fix for QCom GPU clock rate
+
 * Thu Oct  5 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.13.5-gnu.
 
 * Thu Oct 05 2017 Laura Abbott <labbott@fedoraproject.org> - 4.13.5-300
 - Linux v4.13.5
 - Fix for peaq_wmi nul spew (rhbz 1497861)
+- Fixes CVE-2017-14954 (rhbz 1497745 1497747)
 
 * Fri Sep 29 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.13.4-gnu.
diff --git a/freed-ora/current/f27/patch-4.13-gnu-4.13.5-gnu.xz.sign b/freed-ora/current/f27/patch-4.13-gnu-4.13.5-gnu.xz.sign
deleted file mode 100644
index 995a261b0..000000000
--- a/freed-ora/current/f27/patch-4.13-gnu-4.13.5-gnu.xz.sign
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWdadzAAKCRC8t8+Hfn1H
-pyVCAJ9lQmts+9NXyBOTKa2SD6SSf3qv7gCfWmDlKH/FdyL6ssFiXXcfqq8nZLI=
-=A5KW
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f27/patch-4.13-gnu-4.13.6-gnu.xz.sign b/freed-ora/current/f27/patch-4.13-gnu-4.13.6-gnu.xz.sign
new file mode 100644
index 000000000..8c03569c3
--- /dev/null
+++ b/freed-ora/current/f27/patch-4.13-gnu-4.13.6-gnu.xz.sign
@@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWeAThgAKCRC8t8+Hfn1H
+p2nMAKCOE+g9dOiE+VxT2210LlcFmnU04QCgnMfMIvQfYGJ8090BKIkYuR5dAB4=
+=uYEY
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f27/qcom-clk-gpu-msm.patch b/freed-ora/current/f27/qcom-clk-gpu-msm.patch
new file mode 100644
index 000000000..657995d47
--- /dev/null
+++ b/freed-ora/current/f27/qcom-clk-gpu-msm.patch
@@ -0,0 +1,27 @@
+From cf866c6ef2e421b5563ab34c04dd4b07be5aa013 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Sat, 7 Oct 2017 10:11:39 +0100
+Subject: [PATCH] hack for bus clk
+
+Turn it up to 11!
+---
+ drivers/gpu/drm/msm/msm_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 9f3dbc236ab3..75acdda496b5 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -93,6 +93,9 @@ static int enable_clk(struct msm_gpu *gpu)
+ {
+ 	int i;
+ 
++	if (gpu->grp_clks[4])
++		clk_set_rate(gpu->grp_clks[4], INT_MAX);
++
+ 	if (gpu->core_clk && gpu->fast_rate)
+ 		clk_set_rate(gpu->core_clk, gpu->fast_rate);
+ 
+-- 
+2.14.2
+
diff --git a/freed-ora/current/f27/qxl-fixes.patch b/freed-ora/current/f27/qxl-fixes.patch
index 0b39c6f01..c8bd4b9fb 100644
--- a/freed-ora/current/f27/qxl-fixes.patch
+++ b/freed-ora/current/f27/qxl-fixes.patch
@@ -1,90 +1,3 @@
-From c463b4ad6b2ac5a40c959e6c636eafc7edb1a63b Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 6 Sep 2017 11:31:51 +0200
-Subject: qxl: fix primary surface handling
-
-The atomic conversion of the qxl driver didn't got the primary surface
-handling completely right.  It works in the common simple cases, but
-fails for example when changing the display resolution using xrandr or
-in multihead setups.
-
-The rules are simple:  There is one primary surface.  Before defining a
-new one you have to destroy the old one.
-
-This patch makes qxl_primary_atomic_update() destroy the primary surface
-before defining a new one.  It fixes is_primary flag updates.  It adds
-is_primary checks so we don't try to update the primary surface in case
-it already has the state we want it being in.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- drivers/gpu/drm/qxl/qxl_display.c | 34 +++++++++++++++++++---------------
- 1 file changed, 19 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
-index 03fe182..7babdd8f 100644
---- a/drivers/gpu/drm/qxl/qxl_display.c
-+++ b/drivers/gpu/drm/qxl/qxl_display.c
-@@ -512,23 +512,25 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
- 	    .y2 = qfb->base.height
- 	};
- 
--	if (!old_state->fb) {
--		qxl_io_log(qdev,
--			   "create primary fb: %dx%d,%d,%d\n",
--			   bo->surf.width, bo->surf.height,
--			   bo->surf.stride, bo->surf.format);
-+	if (old_state->fb) {
-+		qfb_old = to_qxl_framebuffer(old_state->fb);
-+		bo_old = gem_to_qxl_bo(qfb_old->obj);
-+	} else {
-+		bo_old = NULL;
-+	}
- 
--		qxl_io_create_primary(qdev, 0, bo);
--		bo->is_primary = true;
-+	if (bo == bo_old)
- 		return;
- 
--	} else {
--		qfb_old = to_qxl_framebuffer(old_state->fb);
--		bo_old = gem_to_qxl_bo(qfb_old->obj);
-+	if (bo_old && bo_old->is_primary) {
-+		qxl_io_destroy_primary(qdev);
- 		bo_old->is_primary = false;
- 	}
- 
--	bo->is_primary = true;
-+	if (!bo->is_primary) {
-+		qxl_io_create_primary(qdev, 0, bo);
-+		bo->is_primary = true;
-+	}
- 	qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
- }
- 
-@@ -537,13 +539,15 @@ static void qxl_primary_atomic_disable(struct drm_plane *plane,
- {
- 	struct qxl_device *qdev = plane->dev->dev_private;
- 
--	if (old_state->fb)
--	{	struct qxl_framebuffer *qfb =
-+	if (old_state->fb) {
-+		struct qxl_framebuffer *qfb =
- 			to_qxl_framebuffer(old_state->fb);
- 		struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
- 
--		qxl_io_destroy_primary(qdev);
--		bo->is_primary = false;
-+		if (bo->is_primary) {
-+			qxl_io_destroy_primary(qdev);
-+			bo->is_primary = false;
-+		}
- 	}
- }
- 
--- 
-cgit v0.12
-
 From 05026e6e19b29104ddba4e8979e6c7af17944695 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 15 Sep 2017 12:46:15 +0200
diff --git a/freed-ora/current/f27/sources b/freed-ora/current/f27/sources
index 283334b0f..5e21b45cd 100644
--- a/freed-ora/current/f27/sources
+++ b/freed-ora/current/f27/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-libre-4.13-gnu.tar.xz) = 9ad6866c68f29f7e4f8b53d0b857f9b3c7f6abd0054460675c76f3100db34a77c2777d7f4191831008b532cb2ab6f686d8c4f457a4d005226c73f90937963518
 SHA512 (perf-man-4.13.tar.gz) = 9bcc2cd8e56ec583ed2d8e0b0c88e7a94035a1915e40b3177bb02d6c0f10ddd4df9b097b1f5af59efc624226b613e240ddba8ddc2156f3682f992d5455fc5c03
-SHA512 (patch-4.13-gnu-4.13.5-gnu.xz) = 2d6eddb52bf160cbaeec203e7b0a77f4230f7e1995f17524f6164a8eaacf19340663be1f23e38ea3b0eb2e2504b48eb2371d89419e15f2b7c9371a189c95710d
+SHA512 (patch-4.13-gnu-4.13.6-gnu.xz) = f5d706c9c494e64ab902da3487e3b1495c2ca2630c4a8a6303d32a8ffee61ddf98425790d6a0cb5ab471cddceaf0e026e4dfe6264729df1ffa18942bd8037b38