MVEBZ default upstream patches, config ajdustement, remove deprecated patches, adjusted build targets

config/boards/clearfogbase.conf

@@ -8,6 +8,6 @@ MODULES_NEXT="mv_cesa"
 BUILD_DESKTOP="no"
 #
 KERNEL_TARGET="default,next,dev"
-CLI_TARGET="stretch,xenial:default,next"
+CLI_TARGET="stretch,bionic:default,next"
 #
-CLI_BETA_TARGET=""
+CLI_BETA_TARGET=""

config/boards/clearfogpro.conf

@@ -8,6 +8,6 @@ MODULES_NEXT="#mv88e6xxx_drv mv_cesa"
 BUILD_DESKTOP="no"
 #
 KERNEL_TARGET="default,next,dev"
-CLI_TARGET="stretch,xenial:default,next"
+CLI_TARGET="stretch,bionic:default,next"
 #
-CLI_BETA_TARGET=""
+CLI_BETA_TARGET=""

config/kernel/linux-mvebu-default.config

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm 4.4.128 Kernel Configuration
+# Linux/arm 4.4.150 Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_ARM_HAS_SG_CHAIN=y
@@ -157,6 +157,7 @@ CONFIG_RD_LZMA=y
 CONFIG_RD_XZ=y
 CONFIG_RD_LZO=y
 CONFIG_RD_LZ4=y
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SYSCTL=y
 CONFIG_ANON_INODES=y
@@ -2772,7 +2773,6 @@ CONFIG_SPI_SPIDEV=m
 #
 CONFIG_PPS=m
 # CONFIG_PPS_DEBUG is not set
-# CONFIG_NTP_PPS is not set
 
 #
 # PPS clients support

config/kernel/linux-mvebu-next.config

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm 4.14.57 Kernel Configuration
+# Linux/arm 4.14.66 Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_ARM_HAS_SG_CHAIN=y

patch/kernel/mvebu-default/04-patch-4.4.134-135.patch

@@ -0,0 +1,24 @@
+diff --git a/Makefile b/Makefile
+index 119dbcb4f311..9b14a5a224c5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 134
++SUBLEVEL = 135
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index fa79e8118b9b..4b7c81f88abf 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -366,6 +366,7 @@ static int vti_tunnel_init(struct net_device *dev)
+ 	memcpy(dev->dev_addr, &iph->saddr, 4);
+ 	memcpy(dev->broadcast, &iph->daddr, 4);
+ 
++	dev->mtu		= ETH_DATA_LEN;
+ 	dev->flags		= IFF_NOARP;
+ 	dev->addr_len		= 4;
+ 	dev->features		|= NETIF_F_LLTX;

patch/kernel/mvebu-default/04-patch-4.4.136-137.patch

@@ -0,0 +1,625 @@
+diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt
+index 0fe1c6e0dbcd..bfc6b3e68cc4 100644
+--- a/Documentation/networking/netdev-FAQ.txt
++++ b/Documentation/networking/netdev-FAQ.txt
+@@ -168,6 +168,15 @@ A: No.  See above answer.  In short, if you think it really belongs in
+    dash marker line as described in Documentation/SubmittingPatches to
+    temporarily embed that information into the patch that you send.
+ 
++Q: Are all networking bug fixes backported to all stable releases?
++
++A: Due to capacity, Dave could only take care of the backports for the last
++   2 stable releases. For earlier stable releases, each stable branch maintainer
++   is supposed to take care of them. If you find any patch is missing from an
++   earlier stable branch, please notify stable@vger.kernel.org with either a
++   commit ID or a formal patch backported, and CC Dave and other relevant
++   networking developers.
++
+ Q: Someone said that the comment style and coding convention is different
+    for the networking content.  Is this true?
+ 
+diff --git a/Makefile b/Makefile
+index a05a7a005715..44efd1252ab8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 136
++SUBLEVEL = 137
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index a0d9ac6b6cc9..e759100e41a7 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -26,6 +26,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/freezer.h>
+ #include <linux/major.h>
++#include <linux/of.h>
+ #include "tpm.h"
+ #include "tpm_eventlog.h"
+ 
+@@ -324,8 +325,20 @@ static void tpm1_chip_unregister(struct tpm_chip *chip)
+  */
+ int tpm_chip_register(struct tpm_chip *chip)
+ {
++#ifdef CONFIG_OF
++	struct device_node *np;
++#endif
+ 	int rc;
+ 
++#ifdef CONFIG_OF
++	np = of_find_node_by_name(NULL, "vtpm");
++	if (np) {
++		if (of_property_read_bool(np, "powered-while-suspended"))
++			chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED;
++	}
++	of_node_put(np);
++#endif
++
+ 	rc = tpm1_chip_register(chip);
+ 	if (rc)
+ 		return rc;
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 36afc1a21699..95a40ec854ad 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -787,6 +787,10 @@ int tpm_do_selftest(struct tpm_chip *chip)
+ 	loops = jiffies_to_msecs(duration) / delay_msec;
+ 
+ 	rc = tpm_continue_selftest(chip);
++	if (rc == TPM_ERR_INVALID_POSTINIT) {
++		chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED;
++		dev_info(&chip->dev, "TPM not ready (%d)\n", rc);
++	}
+ 	/* This may fail if there was no TPM driver during a suspend/resume
+ 	 * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST)
+ 	 */
+@@ -931,6 +935,9 @@ int tpm_pm_suspend(struct device *dev)
+ 	if (chip == NULL)
+ 		return -ENODEV;
+ 
++	if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED)
++		return 0;
++
+ 	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+ 		tpm2_shutdown(chip, TPM2_SU_STATE);
+ 		return 0;
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 772d99b3a8e4..36e1abda00f9 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -168,6 +168,7 @@ struct tpm_vendor_specific {
+ enum tpm_chip_flags {
+ 	TPM_CHIP_FLAG_REGISTERED	= BIT(0),
+ 	TPM_CHIP_FLAG_TPM2		= BIT(1),
++	TPM_CHIP_FLAG_ALWAYS_POWERED	= BIT(5),
+ };
+ 
+ struct tpm_chip {
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 6b5625e66119..88ceac091454 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -209,6 +209,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor)
+ 		return -ENOMEM;
+ 
+ 	filp->private_data = priv;
++	filp->f_mode |= FMODE_UNSIGNED_OFFSET;
+ 	priv->filp = filp;
+ 	priv->uid = current_euid();
+ 	priv->pid = get_pid(task_pid(current));
+diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c
+index d91dd580e978..37aaea88a6ad 100644
+--- a/drivers/isdn/hardware/eicon/diva.c
++++ b/drivers/isdn/hardware/eicon/diva.c
+@@ -387,10 +387,10 @@ void divasa_xdi_driver_unload(void)
+ **  Receive and process command from user mode utility
+ */
+ void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
+-			    int length,
++			    int length, void *mptr,
+ 			    divas_xdi_copy_from_user_fn_t cp_fn)
+ {
+-	diva_xdi_um_cfg_cmd_t msg;
++	diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
+ 	diva_os_xdi_adapter_t *a = NULL;
+ 	diva_os_spin_lock_magic_t old_irql;
+ 	struct list_head *tmp;
+@@ -400,21 +400,21 @@ void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
+ 			 length, sizeof(diva_xdi_um_cfg_cmd_t)))
+ 			return NULL;
+ 	}
+-	if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) {
++	if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) {
+ 		DBG_ERR(("A: A(?) open, write error"))
+ 			return NULL;
+ 	}
+ 	diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter");
+ 	list_for_each(tmp, &adapter_queue) {
+ 		a = list_entry(tmp, diva_os_xdi_adapter_t, link);
+-		if (a->controller == (int)msg.adapter)
++		if (a->controller == (int)msg->adapter)
+ 			break;
+ 		a = NULL;
+ 	}
+ 	diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter");
+ 
+ 	if (!a) {
+-		DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter))
++		DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter))
+ 			}
+ 
+ 	return (a);
+@@ -436,8 +436,10 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle)
+ 
+ int
+ diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
+-	       int length, divas_xdi_copy_from_user_fn_t cp_fn)
++	       int length, void *mptr,
++	       divas_xdi_copy_from_user_fn_t cp_fn)
+ {
++	diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
+ 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
+ 	void *data;
+ 
+@@ -458,7 +460,13 @@ diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
+ 			return (-2);
+ 	}
+ 
+-	length = (*cp_fn) (os_handle, data, src, length);
++	if (msg) {
++		*(diva_xdi_um_cfg_cmd_t *)data = *msg;
++		length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg),
++				   src + sizeof(*msg), length - sizeof(*msg));
++	} else {
++		length = (*cp_fn) (os_handle, data, src, length);
++	}
+ 	if (length > 0) {
+ 		if ((*(a->interface.cmd_proc))
+ 		    (a, (diva_xdi_um_cfg_cmd_t *) data, length)) {
+diff --git a/drivers/isdn/hardware/eicon/diva.h b/drivers/isdn/hardware/eicon/diva.h
+index e979085d1b89..a0a607c0c32e 100644
+--- a/drivers/isdn/hardware/eicon/diva.h
++++ b/drivers/isdn/hardware/eicon/diva.h
+@@ -19,10 +19,11 @@ int diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
+ 		  int max_length, divas_xdi_copy_to_user_fn_t cp_fn);
+ 
+ int diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
+-		   int length, divas_xdi_copy_from_user_fn_t cp_fn);
++		   int length, void *msg,
++		   divas_xdi_copy_from_user_fn_t cp_fn);
+ 
+ void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
+-			    int length,
++			    int length, void *msg,
+ 			    divas_xdi_copy_from_user_fn_t cp_fn);
+ 
+ void diva_xdi_close_adapter(void *adapter, void *os_handle);
+diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
+index a2e0ed6c9a4d..91bd2ba0bdd8 100644
+--- a/drivers/isdn/hardware/eicon/divasmain.c
++++ b/drivers/isdn/hardware/eicon/divasmain.c
+@@ -591,19 +591,22 @@ static int divas_release(struct inode *inode, struct file *file)
+ static ssize_t divas_write(struct file *file, const char __user *buf,
+ 			   size_t count, loff_t *ppos)
+ {
++	diva_xdi_um_cfg_cmd_t msg;
+ 	int ret = -EINVAL;
+ 
+ 	if (!file->private_data) {
+ 		file->private_data = diva_xdi_open_adapter(file, buf,
+-							   count,
++							   count, &msg,
+ 							   xdi_copy_from_user);
+-	}
+-	if (!file->private_data) {
+-		return (-ENODEV);
++		if (!file->private_data)
++			return (-ENODEV);
++		ret = diva_xdi_write(file->private_data, file,
++				     buf, count, &msg, xdi_copy_from_user);
++	} else {
++		ret = diva_xdi_write(file->private_data, file,
++				     buf, count, NULL, xdi_copy_from_user);
+ 	}
+ 
+-	ret = diva_xdi_write(file->private_data, file,
+-			     buf, count, xdi_copy_from_user);
+ 	switch (ret) {
+ 	case -1:		/* Message should be removed from rx mailbox first */
+ 		ret = -EBUSY;
+@@ -622,11 +625,12 @@ static ssize_t divas_write(struct file *file, const char __user *buf,
+ static ssize_t divas_read(struct file *file, char __user *buf,
+ 			  size_t count, loff_t *ppos)
+ {
++	diva_xdi_um_cfg_cmd_t msg;
+ 	int ret = -EINVAL;
+ 
+ 	if (!file->private_data) {
+ 		file->private_data = diva_xdi_open_adapter(file, buf,
+-							   count,
++							   count, &msg,
+ 							   xdi_copy_from_user);
+ 	}
+ 	if (!file->private_data) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+index d946bba43726..87534c6efd66 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+@@ -594,7 +594,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params,
+ 	 * slots for the highest priority.
+ 	 */
+ 	REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS :
+-		   NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
++		   NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
+ 	/* Mapping between the CREDIT_WEIGHT registers and actual client
+ 	 * numbers
+ 	 */
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 0e3b2ebf87f1..029fa5bee520 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -2543,11 +2543,11 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	pci_set_master(pdev);
+ 
+ 	/* Query PCI controller on system for DMA addressing
+-	 * limitation for the device.  Try 64-bit first, and
++	 * limitation for the device.  Try 47-bit first, and
+ 	 * fail to 32-bit.
+ 	 */
+ 
+-	err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
++	err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47));
+ 	if (err) {
+ 		err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+ 		if (err) {
+@@ -2561,10 +2561,10 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 			goto err_out_release_regions;
+ 		}
+ 	} else {
+-		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
++		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47));
+ 		if (err) {
+ 			dev_err(dev, "Unable to obtain %u-bit DMA "
+-				"for consistent allocations, aborting\n", 64);
++				"for consistent allocations, aborting\n", 47);
+ 			goto err_out_release_regions;
+ 		}
+ 		using_dac = 1;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
+index 62f1a3433a62..d6d87dd8a28f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -386,11 +386,11 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+ 	struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+ 	struct mlx4_qp *qp;
+ 
+-	spin_lock(&qp_table->lock);
++	spin_lock_irq(&qp_table->lock);
+ 
+ 	qp = __mlx4_qp_lookup(dev, qpn);
+ 
+-	spin_unlock(&qp_table->lock);
++	spin_unlock_irq(&qp_table->lock);
+ 	return qp;
+ }
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index 7ccdb46c6764..21e0af2620ee 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -43,7 +43,7 @@
+ #define ILT_CFG_REG(cli, reg)	PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET
+ 
+ /* ILT entry structure */
+-#define ILT_ENTRY_PHY_ADDR_MASK		0x000FFFFFFFFFFFULL
++#define ILT_ENTRY_PHY_ADDR_MASK		(~0ULL >> 12)
+ #define ILT_ENTRY_PHY_ADDR_SHIFT	0
+ #define ILT_ENTRY_VALID_MASK		0x1ULL
+ #define ILT_ENTRY_VALID_SHIFT		52
+diff --git a/drivers/net/phy/bcm-cygnus.c b/drivers/net/phy/bcm-cygnus.c
+index 49bbc6826883..9a7dca2bb618 100644
+--- a/drivers/net/phy/bcm-cygnus.c
++++ b/drivers/net/phy/bcm-cygnus.c
+@@ -61,17 +61,17 @@ static int bcm_cygnus_afe_config(struct phy_device *phydev)
+ 		return rc;
+ 
+ 	/* make rcal=100, since rdb default is 000 */
+-	rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10);
++	rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10);
+ 	if (rc < 0)
+ 		return rc;
+ 
+ 	/* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */
+-	rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10);
++	rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10);
+ 	if (rc < 0)
+ 		return rc;
+ 
+ 	/* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */
+-	rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00);
++	rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h
+index b2091c88b44d..ce16b26d49ff 100644
+--- a/drivers/net/phy/bcm-phy-lib.h
++++ b/drivers/net/phy/bcm-phy-lib.h
+@@ -14,11 +14,18 @@
+ #ifndef _LINUX_BCM_PHY_LIB_H
+ #define _LINUX_BCM_PHY_LIB_H
+ 
++#include <linux/brcmphy.h>
+ #include <linux/phy.h>
+ 
+ int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val);
+ int bcm_phy_read_exp(struct phy_device *phydev, u16 reg);
+ 
++static inline int bcm_phy_write_exp_sel(struct phy_device *phydev,
++					u16 reg, u16 val)
++{
++	return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val);
++}
++
+ int bcm_phy_write_misc(struct phy_device *phydev,
+ 		       u16 reg, u16 chl, u16 value);
+ int bcm_phy_read_misc(struct phy_device *phydev,
+diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
+index 03d4809a9126..bffa70e46202 100644
+--- a/drivers/net/phy/bcm7xxx.c
++++ b/drivers/net/phy/bcm7xxx.c
+@@ -48,10 +48,10 @@
+ static void r_rc_cal_reset(struct phy_device *phydev)
+ {
+ 	/* Reset R_CAL/RC_CAL Engine */
+-	bcm_phy_write_exp(phydev, 0x00b0, 0x0010);
++	bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010);
+ 
+ 	/* Disable Reset R_AL/RC_CAL Engine */
+-	bcm_phy_write_exp(phydev, 0x00b0, 0x0000);
++	bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000);
+ }
+ 
+ static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev)
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index e74709e4b5dd..49174837c2ba 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -983,7 +983,8 @@ static void team_port_disable(struct team *team,
+ static void ___team_compute_features(struct team *team)
+ {
+ 	struct team_port *port;
+-	u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
++	netdev_features_t vlan_features = TEAM_VLAN_FEATURES &
++					  NETIF_F_ALL_FOR_ALL;
+ 	unsigned short max_hard_header_len = ETH_HLEN;
+ 	unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
+ 					IFF_XMIT_DST_RELEASE_PERM;
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index 96a5028621c8..8edbccf06b7b 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -593,7 +593,7 @@ static const struct driver_info cdc_mbim_info_zlp = {
+  */
+ static const struct driver_info cdc_mbim_info_ndp_to_end = {
+ 	.description = "CDC MBIM",
+-	.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
++	.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
+ 	.bind = cdc_mbim_bind,
+ 	.unbind = cdc_mbim_unbind,
+ 	.manage_power = cdc_mbim_manage_power,
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+index 83e5aa6a9f28..ad35e760ed3f 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+@@ -6167,7 +6167,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+ 		  req->alpha2[0], req->alpha2[1]);
+ 
+ 	/* ignore non-ISO3166 country codes */
+-	for (i = 0; i < sizeof(req->alpha2); i++)
++	for (i = 0; i < 2; i++)
+ 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+ 			brcmf_err("not a ISO3166 code\n");
+ 			return;
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index f52c72a1a06f..73b725f965eb 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -3323,8 +3323,6 @@ maybe_sleep:
+ 		 */
+ 		if (iclog->ic_state & XLOG_STATE_IOERROR)
+ 			return -EIO;
+-		if (log_flushed)
+-			*log_flushed = 1;
+ 	} else {
+ 
+ no_sleep:
+@@ -3432,8 +3430,6 @@ try_again:
+ 
+ 				xlog_wait(&iclog->ic_prev->ic_write_wait,
+ 							&log->l_icloglock);
+-				if (log_flushed)
+-					*log_flushed = 1;
+ 				already_slept = 1;
+ 				goto try_again;
+ 			}
+@@ -3467,9 +3463,6 @@ try_again:
+ 			 */
+ 			if (iclog->ic_state & XLOG_STATE_IOERROR)
+ 				return -EIO;
+-
+-			if (log_flushed)
+-				*log_flushed = 1;
+ 		} else {		/* just return */
+ 			spin_unlock(&log->l_icloglock);
+ 		}
+diff --git a/mm/mmap.c b/mm/mmap.c
+index cc84b97ca250..39f5fbd07486 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1275,6 +1275,35 @@ static inline int mlock_future_check(struct mm_struct *mm,
+ 	return 0;
+ }
+ 
++static inline u64 file_mmap_size_max(struct file *file, struct inode *inode)
++{
++	if (S_ISREG(inode->i_mode))
++		return MAX_LFS_FILESIZE;
++
++	if (S_ISBLK(inode->i_mode))
++		return MAX_LFS_FILESIZE;
++
++	/* Special "we do even unsigned file positions" case */
++	if (file->f_mode & FMODE_UNSIGNED_OFFSET)
++		return 0;
++
++	/* Yes, random drivers might want more. But I'm tired of buggy drivers */
++	return ULONG_MAX;
++}
++
++static inline bool file_mmap_ok(struct file *file, struct inode *inode,
++				unsigned long pgoff, unsigned long len)
++{
++	u64 maxsize = file_mmap_size_max(file, inode);
++
++	if (maxsize && len > maxsize)
++		return false;
++	maxsize -= len;
++	if (pgoff > maxsize >> PAGE_SHIFT)
++		return false;
++	return true;
++}
++
+ /*
+  * The caller must hold down_write(&current->mm->mmap_sem).
+  */
+@@ -1340,6 +1369,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
+ 	if (file) {
+ 		struct inode *inode = file_inode(file);
+ 
++		if (!file_mmap_ok(file, inode, pgoff, len))
++			return -EOVERFLOW;
++
+ 		switch (flags & MAP_TYPE) {
+ 		case MAP_SHARED:
+ 			if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 5b3d611d8b5f..2017ffa5197a 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1691,6 +1691,10 @@ static int do_setlink(const struct sk_buff *skb,
+ 	const struct net_device_ops *ops = dev->netdev_ops;
+ 	int err;
+ 
++	err = validate_linkmsg(dev, tb);
++	if (err < 0)
++		return err;
++
+ 	if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]) {
+ 		struct net *net = rtnl_link_get_net(dev_net(dev), tb);
+ 		if (IS_ERR(net)) {
+@@ -1982,10 +1986,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		goto errout;
+ 	}
+ 
+-	err = validate_linkmsg(dev, tb);
+-	if (err < 0)
+-		goto errout;
+-
+ 	err = do_setlink(skb, dev, ifm, tb, ifname, 0);
+ errout:
+ 	return err;
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index ff3b058cf58c..936dab12f99f 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -280,9 +280,7 @@ int dccp_disconnect(struct sock *sk, int flags)
+ 
+ 	dccp_clear_xmit_timers(sk);
+ 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+-	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ 	dp->dccps_hc_rx_ccid = NULL;
+-	dp->dccps_hc_tx_ccid = NULL;
+ 
+ 	__skb_queue_purge(&sk->sk_receive_queue);
+ 	__skb_queue_purge(&sk->sk_write_queue);
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 44abc52bae13..9d144cbd4e62 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -979,6 +979,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
+ 			if (val == TCP_CA_UNSPEC)
+ 				return -EINVAL;
+ 		} else {
++			if (nla_len(nla) != sizeof(u32))
++				return false;
+ 			val = nla_get_u32(nla);
+ 		}
+ 		if (type == RTAX_ADVMSS && val > 65535 - 40)
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 1b93ea766916..ce9a7fbb7c5f 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -493,8 +493,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+ 	int err;
+ 	int copied;
+ 
+-	WARN_ON_ONCE(sk->sk_family == AF_INET6);
+-
+ 	err = -EAGAIN;
+ 	skb = sock_dequeue_err_skb(sk);
+ 	if (!skb)
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index e5846d1f9b55..9b92960f024d 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1787,7 +1787,8 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
+ 		ret = 0;
+ 		if (!ip6mr_new_table(net, v))
+ 			ret = -ENOMEM;
+-		raw6_sk(sk)->ip6mr_table = v;
++		else
++			raw6_sk(sk)->ip6mr_table = v;
+ 		rtnl_unlock();
+ 		return ret;
+ 	}
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 392d4e2c0a24..3a63f33698d3 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2779,7 +2779,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 		if (unlikely(offset < 0))
+ 			goto out_free;
+ 	} else if (reserve) {
+-		skb_push(skb, reserve);
++		skb_reserve(skb, -reserve);
+ 	}
+ 
+ 	/* Returns -EFAULT on error */
+@@ -4198,7 +4198,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 			goto out;
+ 		if (po->tp_version >= TPACKET_V3 &&
+ 		    req->tp_block_size <=
+-			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
++		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
+ 			goto out;
+ 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+ 					po->tp_reserve))
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index dd243d2abd87..138d7f100f7e 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -743,7 +743,7 @@ int conf_write(const char *name)
+ 	struct menu *menu;
+ 	const char *basename;
+ 	const char *str;
+-	char dirname[PATH_MAX+1], tmpname[PATH_MAX+1], newname[PATH_MAX+1];
++	char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8];
+ 	char *env;
+ 
+ 	dirname[0] = 0;

patch/kernel/mvebu-default/04-patch-4.4.141-142.patch

@@ -0,0 +1,186 @@
+diff --git a/Makefile b/Makefile
+index 3fc39e41dbde..75d6176c8786 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 141
++SUBLEVEL = 142
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 814276d0eed1..736e2843139b 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -686,13 +686,14 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+ 		c->x86_capability[CPUID_1_EDX] = edx;
+ 	}
+ 
++	/* Thermal and Power Management Leaf: level 0x00000006 (eax) */
++	if (c->cpuid_level >= 0x00000006)
++		c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
++
+ 	/* Additional Intel-defined flags: level 0x00000007 */
+ 	if (c->cpuid_level >= 0x00000007) {
+ 		cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx);
+-
+ 		c->x86_capability[CPUID_7_0_EBX] = ebx;
+-
+-		c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
+ 		c->x86_capability[CPUID_7_ECX] = ecx;
+ 	}
+ 
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 1db6d73c8dd2..31a981d6229d 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -7,6 +7,7 @@ quote   := "
+ squote  := '
+ empty   :=
+ space   := $(empty) $(empty)
++pound   := \#
+ 
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -236,11 +237,11 @@ endif
+ 
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+ 
+ # Find any prerequisites that is newer than target or that does not exist.
+ # PHONY targets skipped in both cases.
+diff --git a/tools/arch/x86/include/asm/unistd_32.h b/tools/arch/x86/include/asm/unistd_32.h
+new file mode 100644
+index 000000000000..cf33ab09273d
+--- /dev/null
++++ b/tools/arch/x86/include/asm/unistd_32.h
+@@ -0,0 +1,9 @@
++#ifndef __NR_perf_event_open
++# define __NR_perf_event_open 336
++#endif
++#ifndef __NR_futex
++# define __NR_futex 240
++#endif
++#ifndef __NR_gettid
++# define __NR_gettid 224
++#endif
+diff --git a/tools/arch/x86/include/asm/unistd_64.h b/tools/arch/x86/include/asm/unistd_64.h
+new file mode 100644
+index 000000000000..2c9835695b56
+--- /dev/null
++++ b/tools/arch/x86/include/asm/unistd_64.h
+@@ -0,0 +1,9 @@
++#ifndef __NR_perf_event_open
++# define __NR_perf_event_open 298
++#endif
++#ifndef __NR_futex
++# define __NR_futex 202
++#endif
++#ifndef __NR_gettid
++# define __NR_gettid 186
++#endif
+diff --git a/tools/build/Build.include b/tools/build/Build.include
+index 1c570528baf7..0340d8a51dab 100644
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -12,6 +12,7 @@
+ # Convenient variables
+ comma   := ,
+ squote  := '
++pound   := \#
+ 
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\
+ ###
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+ 
+ ###
+ # Find any prerequisites that is newer than target or that does not exist.
+diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
+index de89ec574361..b92c952b01ef 100644
+--- a/tools/perf/config/Makefile
++++ b/tools/perf/config/Makefile
+@@ -200,6 +200,7 @@ CFLAGS += -I$(src-perf)/arch/$(ARCH)/include
+ CFLAGS += -I$(srctree)/tools/include/
+ CFLAGS += -I$(srctree)/arch/$(ARCH)/include/uapi
+ CFLAGS += -I$(srctree)/arch/$(ARCH)/include
++CFLAGS += -I$(srctree)/tools/arch/$(ARCH)/include
+ CFLAGS += -I$(srctree)/include/uapi
+ CFLAGS += -I$(srctree)/include
+ 
+diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
+index 83a25cef82fd..5cee8a3d0455 100644
+--- a/tools/perf/perf-sys.h
++++ b/tools/perf/perf-sys.h
+@@ -11,29 +11,11 @@
+ #if defined(__i386__)
+ #define cpu_relax()	asm volatile("rep; nop" ::: "memory");
+ #define CPUINFO_PROC	{"model name"}
+-#ifndef __NR_perf_event_open
+-# define __NR_perf_event_open 336
+-#endif
+-#ifndef __NR_futex
+-# define __NR_futex 240
+-#endif
+-#ifndef __NR_gettid
+-# define __NR_gettid 224
+-#endif
+ #endif
+ 
+ #if defined(__x86_64__)
+ #define cpu_relax()	asm volatile("rep; nop" ::: "memory");
+ #define CPUINFO_PROC	{"model name"}
+-#ifndef __NR_perf_event_open
+-# define __NR_perf_event_open 298
+-#endif
+-#ifndef __NR_futex
+-# define __NR_futex 202
+-#endif
+-#ifndef __NR_gettid
+-# define __NR_gettid 186
+-#endif
+ #endif
+ 
+ #ifdef __powerpc__
+diff --git a/tools/perf/util/include/asm/unistd_32.h b/tools/perf/util/include/asm/unistd_32.h
+deleted file mode 100644
+index 8b137891791f..000000000000
+--- a/tools/perf/util/include/asm/unistd_32.h
++++ /dev/null
+@@ -1 +0,0 @@
+-
+diff --git a/tools/perf/util/include/asm/unistd_64.h b/tools/perf/util/include/asm/unistd_64.h
+deleted file mode 100644
+index 8b137891791f..000000000000
+--- a/tools/perf/util/include/asm/unistd_64.h
++++ /dev/null
+@@ -1 +0,0 @@
+-
+diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
+index 19edc1a7a232..7ea4438b801d 100644
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -92,3 +92,5 @@ ifneq ($(silent),1)
+ 	QUIET_INSTALL  = @printf '  INSTALL  %s\n' $1;
+   endif
+ endif
++
++pound := \#

patch/kernel/mvebu-default/04-patch-4.4.146-147.patch

@@ -0,0 +1,254 @@
+diff --git a/Makefile b/Makefile
+index 030f5af05f4e..ee92a12e3a4b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 146
++SUBLEVEL = 147
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index d4d853680ae4..a4abf7dc9576 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -382,6 +382,7 @@ static int i2c_imx_dma_xfer(struct imx_i2c_struct *i2c_imx,
+ 		goto err_desc;
+ 	}
+ 
++	reinit_completion(&dma->cmd_complete);
+ 	txdesc->callback = i2c_imx_dma_callback;
+ 	txdesc->callback_param = i2c_imx;
+ 	if (dma_submit_error(dmaengine_submit(txdesc))) {
+@@ -631,7 +632,6 @@ static int i2c_imx_dma_write(struct imx_i2c_struct *i2c_imx,
+ 	 * The first byte must be transmitted by the CPU.
+ 	 */
+ 	imx_i2c_write_reg(msgs->addr << 1, i2c_imx, IMX_I2C_I2DR);
+-	reinit_completion(&i2c_imx->dma->cmd_complete);
+ 	time_left = wait_for_completion_timeout(
+ 				&i2c_imx->dma->cmd_complete,
+ 				msecs_to_jiffies(DMA_TIMEOUT));
+@@ -690,7 +690,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
+ 	if (result)
+ 		return result;
+ 
+-	reinit_completion(&i2c_imx->dma->cmd_complete);
+ 	time_left = wait_for_completion_timeout(
+ 				&i2c_imx->dma->cmd_complete,
+ 				msecs_to_jiffies(DMA_TIMEOUT));
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index a32ba753e413..afaf13474796 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -543,7 +543,7 @@ void acpi_pci_add_bus(struct pci_bus *bus)
+ 	union acpi_object *obj;
+ 	struct pci_host_bridge *bridge;
+ 
+-	if (acpi_pci_disabled || !bus->bridge)
++	if (acpi_pci_disabled || !bus->bridge || !ACPI_HANDLE(bus->bridge))
+ 		return;
+ 
+ 	acpi_pci_slot_enumerate(bus);
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index a9eb3cd453be..41a646696bab 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -325,11 +325,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
+ 
+ 	wait_for_completion(&tm_iocb->u.tmf.comp);
+ 
+-	rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ?
+-	    QLA_SUCCESS : QLA_FUNCTION_FAILED;
++	rval = tm_iocb->u.tmf.data;
+ 
+-	if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) {
+-		ql_dbg(ql_dbg_taskm, vha, 0x8030,
++	if (rval != QLA_SUCCESS) {
++		ql_log(ql_log_warn, vha, 0x8030,
+ 		    "TM IOCB failed (%x).\n", rval);
+ 	}
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 5cbf20ab94aa..18b19744398a 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4938,8 +4938,9 @@ qla2x00_do_dpc(void *data)
+ 			}
+ 		}
+ 
+-		if (test_and_clear_bit(ISP_ABORT_NEEDED,
+-						&base_vha->dpc_flags)) {
++		if (test_and_clear_bit
++		    (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
++		    !test_bit(UNLOADING, &base_vha->dpc_flags)) {
+ 
+ 			ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
+ 			    "ISP abort scheduled.\n");
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 49af3c50b263..3e4d8ac1974e 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2102,7 +2102,7 @@ static int ext4_check_descriptors(struct super_block *sb,
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
+ 	ext4_fsblk_t last_block;
+-	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
++	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0);
+ 	ext4_fsblk_t block_bitmap;
+ 	ext4_fsblk_t inode_bitmap;
+ 	ext4_fsblk_t inode_table;
+@@ -3777,13 +3777,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 			goto failed_mount2;
+ 		}
+ 	}
++	sbi->s_gdb_count = db_count;
+ 	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
+ 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
+ 		ret = -EFSCORRUPTED;
+ 		goto failed_mount2;
+ 	}
+ 
+-	sbi->s_gdb_count = db_count;
+ 	get_random_bytes(&sbi->s_next_generation, sizeof(u32));
+ 	spin_lock_init(&sbi->s_next_gen_lock);
+ 
+diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
+index 48b15a6e5558..40a26a542341 100644
+--- a/fs/jfs/xattr.c
++++ b/fs/jfs/xattr.c
+@@ -493,15 +493,17 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
+ 	if (size > PSIZE) {
+ 		/*
+ 		 * To keep the rest of the code simple.  Allocate a
+-		 * contiguous buffer to work with
++		 * contiguous buffer to work with. Make the buffer large
++		 * enough to make use of the whole extent.
+ 		 */
+-		ea_buf->xattr = kmalloc(size, GFP_KERNEL);
++		ea_buf->max_size = (size + sb->s_blocksize - 1) &
++		    ~(sb->s_blocksize - 1);
++
++		ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL);
+ 		if (ea_buf->xattr == NULL)
+ 			return -ENOMEM;
+ 
+ 		ea_buf->flag = EA_MALLOC;
+-		ea_buf->max_size = (size + sb->s_blocksize - 1) &
+-		    ~(sb->s_blocksize - 1);
+ 
+ 		if (ea_size == 0)
+ 			return 0;
+diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
+index 4acc552e9279..19d0778ec382 100644
+--- a/include/linux/ring_buffer.h
++++ b/include/linux/ring_buffer.h
+@@ -162,6 +162,7 @@ void ring_buffer_record_enable(struct ring_buffer *buffer);
+ void ring_buffer_record_off(struct ring_buffer *buffer);
+ void ring_buffer_record_on(struct ring_buffer *buffer);
+ int ring_buffer_record_is_on(struct ring_buffer *buffer);
++int ring_buffer_record_is_set_on(struct ring_buffer *buffer);
+ void ring_buffer_record_disable_cpu(struct ring_buffer *buffer, int cpu);
+ void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu);
+ 
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 5f55a8bf5264..0df2b44dac7c 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1012,6 +1012,13 @@ static int irq_setup_forced_threading(struct irqaction *new)
+ 	if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT))
+ 		return 0;
+ 
++	/*
++	 * No further action required for interrupts which are requested as
++	 * threaded interrupts already
++	 */
++	if (new->handler == irq_default_primary_handler)
++		return 0;
++
+ 	new->flags |= IRQF_ONESHOT;
+ 
+ 	/*
+@@ -1019,7 +1026,7 @@ static int irq_setup_forced_threading(struct irqaction *new)
+ 	 * thread handler. We force thread them as well by creating a
+ 	 * secondary action.
+ 	 */
+-	if (new->handler != irq_default_primary_handler && new->thread_fn) {
++	if (new->handler && new->thread_fn) {
+ 		/* Allocate the secondary action */
+ 		new->secondary = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
+ 		if (!new->secondary)
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index e5d228f7224c..5ad2e852e9f6 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -570,7 +570,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
+ 
+ static inline bool local_timer_softirq_pending(void)
+ {
+-	return local_softirq_pending() & TIMER_SOFTIRQ;
++	return local_softirq_pending() & BIT(TIMER_SOFTIRQ);
+ }
+ 
+ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts,
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index d9cd6191760b..fdaa88f38aec 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -3141,6 +3141,22 @@ int ring_buffer_record_is_on(struct ring_buffer *buffer)
+ 	return !atomic_read(&buffer->record_disabled);
+ }
+ 
++/**
++ * ring_buffer_record_is_set_on - return true if the ring buffer is set writable
++ * @buffer: The ring buffer to see if write is set enabled
++ *
++ * Returns true if the ring buffer is set writable by ring_buffer_record_on().
++ * Note that this does NOT mean it is in a writable state.
++ *
++ * It may return true when the ring buffer has been disabled by
++ * ring_buffer_record_disable(), as that is a temporary disabling of
++ * the ring buffer.
++ */
++int ring_buffer_record_is_set_on(struct ring_buffer *buffer)
++{
++	return !(atomic_read(&buffer->record_disabled) & RB_BUFFER_OFF);
++}
++
+ /**
+  * ring_buffer_record_disable_cpu - stop all writes into the cpu_buffer
+  * @buffer: The ring buffer to stop writes to.
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 8aef4e63ac57..1b980a8ef791 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1088,6 +1088,12 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ 
+ 	arch_spin_lock(&tr->max_lock);
+ 
++	/* Inherit the recordable setting from trace_buffer */
++	if (ring_buffer_record_is_set_on(tr->trace_buffer.buffer))
++		ring_buffer_record_on(tr->max_buffer.buffer);
++	else
++		ring_buffer_record_off(tr->max_buffer.buffer);
++
+ 	buf = tr->trace_buffer.buffer;
+ 	tr->trace_buffer.buffer = tr->max_buffer.buffer;
+ 	tr->max_buffer.buffer = buf;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 9708fff318d5..bf292010760a 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -986,6 +986,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ 			return err;
+ 	}
+ 
++	if (nlk->ngroups == 0)
++		groups = 0;
++	else if (nlk->ngroups < 8*sizeof(groups))
++		groups &= (1UL << nlk->ngroups) - 1;
++
+ 	bound = nlk->bound;
+ 	if (bound) {
+ 		/* Ensure nlk->portid is up-to-date. */

patch/kernel/mvebu-default/04-patch-4.4.149-150.patch

@@ -0,0 +1,36 @@
+diff --git a/Makefile b/Makefile
+index e7c46ece5f27..7789195c6a59 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 149
++SUBLEVEL = 150
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/x86/include/asm/pgtable-invert.h b/arch/x86/include/asm/pgtable-invert.h
+index 44b1203ece12..a0c1525f1b6f 100644
+--- a/arch/x86/include/asm/pgtable-invert.h
++++ b/arch/x86/include/asm/pgtable-invert.h
+@@ -4,9 +4,18 @@
+ 
+ #ifndef __ASSEMBLY__
+ 
++/*
++ * A clear pte value is special, and doesn't get inverted.
++ *
++ * Note that even users that only pass a pgprot_t (rather
++ * than a full pte) won't trigger the special zero case,
++ * because even PAGE_NONE has _PAGE_PROTNONE | _PAGE_ACCESSED
++ * set. So the all zero case really is limited to just the
++ * cleared page table entry case.
++ */
+ static inline bool __pte_needs_invert(u64 val)
+ {
+-	return !(val & _PAGE_PRESENT);
++	return val && !(val & _PAGE_PRESENT);
+ }
+ 
+ /* Get a mask to xor with the page table entry to get the correct pfn. */

patch/kernel/mvebu-next/linux-999-revert-softirq-let-ksoftirqd-do-its-job.patch

@@ -1,54 +0,0 @@
-From 3364d0056328b93fb10ab929ae99933af9e304ad Mon Sep 17 00:00:00 2001
-From: MilhouseVH <milhouseVH.github@nmacleod.com>
-Date: Thu, 4 Jan 2018 19:56:05 +0000
-Subject: [PATCH] Revert "softirq: Let ksoftirqd do its job"
-
-See: https://forum.libreelec.tv/thread/4235-dvb-issue-since-le-switched-to-kernel-4-9-x/?postID=75965#post75965
----
- kernel/softirq.c | 16 +---------------
- 1 file changed, 1 insertion(+), 15 deletions(-)
-
-diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 4e09821..58bb6f6 100644
---- a/kernel/softirq.c
-+++ b/kernel/softirq.c
-@@ -77,17 +77,6 @@ static void wakeup_softirqd(void)
- 		wake_up_process(tsk);
- }
- 
--/*
-- * If ksoftirqd is scheduled, we do not want to process pending softirqs
-- * right now. Let ksoftirqd handle this at its own rate, to get fairness.
-- */
--static bool ksoftirqd_running(void)
--{
--	struct task_struct *tsk = __this_cpu_read(ksoftirqd);
--
--	return tsk && (tsk->state == TASK_RUNNING);
--}
--
- /*
-  * preempt_count and SOFTIRQ_OFFSET usage:
-  * - preempt_count is changed by SOFTIRQ_OFFSET on entering or leaving
-@@ -324,7 +313,7 @@ asmlinkage __visible void do_softirq(void)
- 
- 	pending = local_softirq_pending();
- 
--	if (pending && !ksoftirqd_running())
-+	if (pending)
- 		do_softirq_own_stack();
- 
- 	local_irq_restore(flags);
-@@ -351,9 +340,6 @@ void irq_enter(void)
- 
- static inline void invoke_softirq(void)
- {
--	if (ksoftirqd_running())
--		return;
--
- 	if (!force_irqthreads) {
- #ifdef CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK
- 		/*
--- 
-2.14.1
-