--- /dev/null
+From b96a696fb2a8dd1ee4e6cfee48dcac270fc53287 Mon Sep 17 00:00:00 2001
+From: Sean Wang <sean.wang@mediatek.com>
+Date: Thu, 7 Dec 2017 14:43:24 +0800
+Subject: arm: dts: mt7623: fix card detection issue on bananapi-r2
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+commit b96a696fb2a8dd1ee4e6cfee48dcac270fc53287 upstream.
+
+Fix that bananapi-r2 booting from SD-card would fail since incorrect
+polarity is applied to the previous setup with GPIO_ACTIVE_HIGH.
+
+Cc: stable@vger.kernel.org
+Fixes: 0eed8d097612 ("arm: dts: mt7623: Add SD-card and EMMC to bananapi-r2")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Tested-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+@@ -204,7 +204,7 @@
+ bus-width = <4>;
+ max-frequency = <50000000>;
+ cap-sd-highspeed;
+- cd-gpios = <&pio 261 0>;
++ cd-gpios = <&pio 261 GPIO_ACTIVE_LOW>;
+ vmmc-supply = <&mt6323_vmch_reg>;
+ vqmmc-supply = <&mt6323_vio18_reg>;
+ };
--- /dev/null
+From e8bfa0422469cdfc86be3f525f621b1d44d2481b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 15 Jan 2018 17:37:08 +0100
+Subject: ARM: dts: nomadik: add interrupt-parent for clcd
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit e8bfa0422469cdfc86be3f525f621b1d44d2481b upstream.
+
+The clcd device is lacking an interrupt-parent property, which makes
+the interrupt unusable and shows up as a warning with the latest
+dtc version:
+
+arch/arm/boot/dts/ste-nomadik-s8815.dtb: Warning (interrupts_property): Missing interrupt-parent for /amba/clcd@10120000
+arch/arm/boot/dts/ste-nomadik-nhk15.dtb: Warning (interrupts_property): Missing interrupt-parent for /amba/clcd@10120000
+
+I looked up the old board files and found that this interrupt has
+the same irqchip as all the other on-chip device, it just needs one
+extra line.
+
+Fixes: 17470b7da11c ("ARM: dts: add the CLCD LCD display to the NHK15")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/ste-nomadik-stn8815.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+@@ -750,6 +750,7 @@
+ reg = <0x10120000 0x1000>;
+ interrupt-names = "combined";
+ interrupts = <14>;
++ interrupt-parent = <&vica>;
+ clocks = <&clcdclk>, <&hclkclcd>;
+ clock-names = "clcdclk", "apb_pclk";
+ status = "disabled";
--- /dev/null
+From 7ac1f59c09a61e6af6622df6809e003b0af07f3d Mon Sep 17 00:00:00 2001
+From: Patrice Chotard <patrice.chotard@st.com>
+Date: Wed, 10 Jan 2018 09:21:02 +0100
+Subject: ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
+
+From: Patrice Chotard <patrice.chotard@st.com>
+
+commit 7ac1f59c09a61e6af6622df6809e003b0af07f3d upstream.
+
+The GPIO polarity is missing in the hdmi,hpd-gpio property, this
+fixes the following DT warnings:
+
+arch/arm/boot/dts/stih410-b2120.dtb: Warning (gpios_property): hdmi,hpd-gpio property
+size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
+
+arch/arm/boot/dts/stih407-b2120.dtb: Warning (gpios_property): hdmi,hpd-gpio property
+size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
+
+arch/arm/boot/dts/stih410-b2260.dtb: Warning (gpios_property): hdmi,hpd-gpio property
+size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
+
+[arnd: marked Cc:stable since this warning shows up with the latest dtc
+ by default, and is more likely to actually cause problems than the
+ other patches from this series]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/stih407.dtsi | 3 ++-
+ arch/arm/boot/dts/stih410.dtsi | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/stih407.dtsi
++++ b/arch/arm/boot/dts/stih407.dtsi
+@@ -8,6 +8,7 @@
+ */
+ #include "stih407-clock.dtsi"
+ #include "stih407-family.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ / {
+ soc {
+ sti-display-subsystem {
+@@ -122,7 +123,7 @@
+ <&clk_s_d2_quadfs 0>,
+ <&clk_s_d2_quadfs 1>;
+
+- hdmi,hpd-gpio = <&pio5 3>;
++ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
+ reset-names = "hdmi";
+ resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
+ ddc = <&hdmiddc>;
+--- a/arch/arm/boot/dts/stih410.dtsi
++++ b/arch/arm/boot/dts/stih410.dtsi
+@@ -9,6 +9,7 @@
+ #include "stih410-clock.dtsi"
+ #include "stih407-family.dtsi"
+ #include "stih410-pinctrl.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ / {
+ aliases {
+ bdisp0 = &bdisp0;
+@@ -213,7 +214,7 @@
+ <&clk_s_d2_quadfs 0>,
+ <&clk_s_d2_quadfs 1>;
+
+- hdmi,hpd-gpio = <&pio5 3>;
++ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
+ reset-names = "hdmi";
+ resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
+ ddc = <&hdmiddc>;
--- /dev/null
+From ca32e0c4bf9ca4b87089c5a5ce945e5f2ec890da Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 10 Jan 2018 17:22:00 +0100
+Subject: ARM: lpc3250: fix uda1380 gpio numbers
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit ca32e0c4bf9ca4b87089c5a5ce945e5f2ec890da upstream.
+
+dtc warns about obviously incorrect GPIO numbers for the audio codec
+on both lpc32xx boards:
+
+arch/arm/boot/dts/lpc3250-phy3250.dtb: Warning (gpios_property): reset-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
+arch/arm/boot/dts/lpc3250-phy3250.dtb: Warning (gpios_property): power-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
+arch/arm/boot/dts/lpc3250-ea3250.dtb: Warning (gpios_property): reset-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
+arch/arm/boot/dts/lpc3250-ea3250.dtb: Warning (gpios_property): power-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
+
+It looks like the nodes are written for a different binding that combines
+the GPIO number into a single number rather than a bank/number pair.
+I found the right numbers on stackexchange.com, so this patch fixes
+the warning and has a reasonable chance of getting things to actually
+work.
+
+Cc: stable@vger.kernel.org
+Link: https://unix.stackexchange.com/questions/59497/alsa-asoc-how-to-correctly-load-devices-drivers/62217#62217
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/lpc3250-ea3250.dts | 4 ++--
+ arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/lpc3250-ea3250.dts
++++ b/arch/arm/boot/dts/lpc3250-ea3250.dts
+@@ -156,8 +156,8 @@
+ uda1380: uda1380@18 {
+ compatible = "nxp,uda1380";
+ reg = <0x18>;
+- power-gpio = <&gpio 0x59 0>;
+- reset-gpio = <&gpio 0x51 0>;
++ power-gpio = <&gpio 3 10 0>;
++ reset-gpio = <&gpio 3 2 0>;
+ dac-clk = "wspll";
+ };
+
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -81,8 +81,8 @@
+ uda1380: uda1380@18 {
+ compatible = "nxp,uda1380";
+ reg = <0x18>;
+- power-gpio = <&gpio 0x59 0>;
+- reset-gpio = <&gpio 0x51 0>;
++ power-gpio = <&gpio 3 10 0>;
++ reset-gpio = <&gpio 3 2 0>;
+ dac-clk = "wspll";
+ };
+
--- /dev/null
+From cdd10409914184c7eee5ae3e11beb890c9c16c61 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 11 Jan 2018 11:28:52 +0530
+Subject: arm: spear13xx: Fix dmas cells
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit cdd10409914184c7eee5ae3e11beb890c9c16c61 upstream.
+
+The "dmas" cells for the designware DMA controller need to have only 3
+properties apart from the phandle: request line, src master and
+destination master. But the commit 6e8887f60f60 updated it incorrectly
+while moving from platform code to DT. Fix it.
+
+Cc: stable@vger.kernel.org # v3.10+
+Fixes: 6e8887f60f60 ("ARM: SPEAr13xx: Pass generic DW DMAC platform data from DT")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/dma/snps-dma.txt | 2 +-
+ arch/arm/boot/dts/spear1340.dtsi | 4 ++--
+ arch/arm/boot/dts/spear13xx.dtsi | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/Documentation/devicetree/bindings/dma/snps-dma.txt
++++ b/Documentation/devicetree/bindings/dma/snps-dma.txt
+@@ -64,6 +64,6 @@ Example:
+ reg = <0xe0000000 0x1000>;
+ interrupts = <0 35 0x4>;
+ dmas = <&dmahost 12 0 1>,
+- <&dmahost 13 0 1 0>;
++ <&dmahost 13 1 0>;
+ dma-names = "rx", "rx";
+ };
+--- a/arch/arm/boot/dts/spear1340.dtsi
++++ b/arch/arm/boot/dts/spear1340.dtsi
+@@ -142,8 +142,8 @@
+ reg = <0xb4100000 0x1000>;
+ interrupts = <0 105 0x4>;
+ status = "disabled";
+- dmas = <&dwdma0 0x600 0 0 1>, /* 0xC << 11 */
+- <&dwdma0 0x680 0 1 0>; /* 0xD << 7 */
++ dmas = <&dwdma0 12 0 1>,
++ <&dwdma0 13 1 0>;
+ dma-names = "tx", "rx";
+ };
+
+--- a/arch/arm/boot/dts/spear13xx.dtsi
++++ b/arch/arm/boot/dts/spear13xx.dtsi
+@@ -100,7 +100,7 @@
+ reg = <0xb2800000 0x1000>;
+ interrupts = <0 29 0x4>;
+ status = "disabled";
+- dmas = <&dwdma0 0 0 0 0>;
++ dmas = <&dwdma0 0 0 0>;
+ dma-names = "data";
+ };
+
+@@ -290,8 +290,8 @@
+ #size-cells = <0>;
+ interrupts = <0 31 0x4>;
+ status = "disabled";
+- dmas = <&dwdma0 0x2000 0 0 0>, /* 0x4 << 11 */
+- <&dwdma0 0x0280 0 0 0>; /* 0x5 << 7 */
++ dmas = <&dwdma0 4 0 0>,
++ <&dwdma0 5 0 0>;
+ dma-names = "tx", "rx";
+ };
+
--- /dev/null
+From f8975cb1b8a36d0839b6365235778dd9df1d04ca Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 11 Jan 2018 11:28:53 +0530
+Subject: arm: spear13xx: Fix spics gpio controller's warning
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit f8975cb1b8a36d0839b6365235778dd9df1d04ca upstream.
+
+This fixes the following warning by also sending the flags argument for
+gpio controllers:
+
+Property 'cs-gpios', cell 6 is not a phandle reference in
+/ahb/apb/spi@e0100000
+
+Fixes: 8113ba917dfa ("ARM: SPEAr: DT: Update device nodes")
+Cc: stable@vger.kernel.org # v3.8+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/spear1310-evb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/spear1310-evb.dts
++++ b/arch/arm/boot/dts/spear1310-evb.dts
+@@ -349,7 +349,7 @@
+ spi0: spi@e0100000 {
+ status = "okay";
+ num-cs = <3>;
+- cs-gpios = <&gpio1 7 0>, <&spics 0>, <&spics 1>;
++ cs-gpios = <&gpio1 7 0>, <&spics 0 0>, <&spics 1 0>;
+
+ stmpe610@0 {
+ compatible = "st,stmpe610";
--- /dev/null
+From 6ffb5b4f248fe53e0361b8cbc2a523b432566442 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 11 Jan 2018 11:28:51 +0530
+Subject: arm: spear600: Add missing interrupt-parent of rtc
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 6ffb5b4f248fe53e0361b8cbc2a523b432566442 upstream.
+
+The interrupt-parent of rtc was missing, add it.
+
+Fixes: 8113ba917dfa ("ARM: SPEAr: DT: Update device nodes")
+Cc: stable@vger.kernel.org # v3.8+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/spear600.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/spear600.dtsi
++++ b/arch/arm/boot/dts/spear600.dtsi
+@@ -194,6 +194,7 @@
+ rtc: rtc@fc900000 {
+ compatible = "st,spear600-rtc";
+ reg = <0xfc900000 0x1000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <10>;
+ status = "disabled";
+ };
--- /dev/null
+From 566bd8902e7fa20bd412ed753e09e89c1c96939c Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 30 Nov 2017 21:27:32 -0800
+Subject: arm64: dts: msm8916: Correct ipc references for smsm
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 566bd8902e7fa20bd412ed753e09e89c1c96939c upstream.
+
+SMSM is not symmetrical, the incoming bits from WCNSS are available at
+index 6, but the outgoing host id for WCNSS is 3. Further more, upstream
+references the base of APCS (in contrast to downstream), so the register
+offset of 8 must be included.
+
+Fixes: 1fb47e0a9ba4 ("arm64: dts: qcom: msm8916: Add smsm and smp2p nodes")
+Cc: stable@vger.kernel.org
+Reported-by: Ramon Fried <rfried@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1435,8 +1435,8 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- qcom,ipc-1 = <&apcs 0 13>;
+- qcom,ipc-6 = <&apcs 0 19>;
++ qcom,ipc-1 = <&apcs 8 13>;
++ qcom,ipc-3 = <&apcs 8 19>;
+
+ apps_smsm: apps@0 {
+ reg = <0>;
--- /dev/null
+From 3fa4680b860bf48b437d6a2c039789c4abe202ae Mon Sep 17 00:00:00 2001
+From: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
+Date: Fri, 12 Jan 2018 12:43:53 +0530
+Subject: cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
+
+From: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
+
+commit 3fa4680b860bf48b437d6a2c039789c4abe202ae upstream.
+
+Some OpenPOWER boxes can have same pstate values for nominal and
+pmin pstates. In these boxes the current code will not initialize
+'powernv_pstate_info.min' variable and result in erroneous CPU
+frequency reporting. This patch fixes this problem.
+
+Fixes: 09ca4c9b5958 (cpufreq: powernv: Replacing pstate_id with frequency table index)
+Reported-by: Alvin Wang <wangat@tw.ibm.com>
+Signed-off-by: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: 4.8+ <stable@vger.kernel.org> # 4.8+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernv-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -288,9 +288,9 @@ next:
+
+ if (id == pstate_max)
+ powernv_pstate_info.max = i;
+- else if (id == pstate_nominal)
++ if (id == pstate_nominal)
+ powernv_pstate_info.nominal = i;
+- else if (id == pstate_min)
++ if (id == pstate_min)
+ powernv_pstate_info.min = i;
+
+ if (powernv_pstate_info.wof_enabled && id == pstate_turbo) {
--- /dev/null
+From 5bffee867df7494ecd32c1e6ec4e8fc934c521b7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <ckoenig.leichtzumerken@gmail.com>
+Date: Mon, 22 Jan 2018 21:00:03 +0100
+Subject: dma-buf: fix reservation_object_wait_timeout_rcu once more v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <ckoenig.leichtzumerken@gmail.com>
+
+commit 5bffee867df7494ecd32c1e6ec4e8fc934c521b7 upstream.
+
+We need to set shared_count even if we already have a fence to wait for.
+
+v2: init i to -1 as well
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180122200003.6665-1-christian.koenig@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/reservation.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -455,13 +455,15 @@ long reservation_object_wait_timeout_rcu
+ unsigned long timeout)
+ {
+ struct dma_fence *fence;
+- unsigned seq, shared_count, i = 0;
++ unsigned seq, shared_count;
+ long ret = timeout ? timeout : 1;
++ int i;
+
+ retry:
+ shared_count = 0;
+ seq = read_seqcount_begin(&obj->seq);
+ rcu_read_lock();
++ i = -1;
+
+ fence = rcu_dereference(obj->fence_excl);
+ if (fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
+@@ -477,14 +479,14 @@ retry:
+ fence = NULL;
+ }
+
+- if (!fence && wait_all) {
++ if (wait_all) {
+ struct reservation_object_list *fobj =
+ rcu_dereference(obj->fence);
+
+ if (fobj)
+ shared_count = fobj->shared_count;
+
+- for (i = 0; i < shared_count; ++i) {
++ for (i = 0; !fence && i < shared_count; ++i) {
+ struct dma_fence *lfence = rcu_dereference(fobj->shared[i]);
+
+ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
--- /dev/null
+From a64e7a79dd6030479caad603c8d78e6c9c14904f Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Fri, 12 Jan 2018 13:08:37 -0800
+Subject: mwifiex: resolve reset vs. remove()/shutdown() deadlocks
+
+From: Brian Norris <briannorris@chromium.org>
+
+commit a64e7a79dd6030479caad603c8d78e6c9c14904f upstream.
+
+Commit b014e96d1abb ("PCI: Protect pci_error_handlers->reset_notify()
+usage with device_lock()") resolves races between driver reset and
+removal, but it introduces some new deadlock problems. If we see a
+timeout while we've already started suspending, removing, or shutting
+down the driver, we might see:
+
+(a) a worker thread, running mwifiex_pcie_work() ->
+ mwifiex_pcie_card_reset_work() -> pci_reset_function()
+(b) a removal thread, running mwifiex_pcie_remove() ->
+ mwifiex_free_adapter() -> mwifiex_unregister() ->
+ mwifiex_cleanup_pcie() -> cancel_work_sync(&card->work)
+
+Unfortunately, mwifiex_pcie_remove() already holds the device lock that
+pci_reset_function() is now requesting, and so we see a deadlock.
+
+It's necessary to cancel and synchronize our outstanding work before
+tearing down the driver, so we can't have this work wait indefinitely
+for the lock.
+
+It's reasonable to only "try" to reset here, since this will mostly
+happen for cases where it's already difficult to reset the firmware
+anyway (e.g., while we're suspending or powering off the system). And if
+reset *really* needs to happen, we can always try again later.
+
+Fixes: b014e96d1abb ("PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()")
+Cc: <stable@vger.kernel.org>
+Cc: Xinming Hu <huxm@marvell.com>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/marvell/mwifiex/pcie.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -2781,7 +2781,10 @@ static void mwifiex_pcie_card_reset_work
+ {
+ struct pcie_service_card *card = adapter->card;
+
+- pci_reset_function(card->dev);
++ /* We can't afford to wait here; remove() might be waiting on us. If we
++ * can't grab the device lock, maybe we'll get another chance later.
++ */
++ pci_try_reset_function(card->dev);
+ }
+
+ static void mwifiex_pcie_work(struct work_struct *work)
--- /dev/null
+From ff26cc10aec128c3f86b5611fd5f59c71d49c0e3 Mon Sep 17 00:00:00 2001
+From: Gang He <ghe@suse.com>
+Date: Wed, 31 Jan 2018 16:14:48 -0800
+Subject: ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
+
+From: Gang He <ghe@suse.com>
+
+commit ff26cc10aec128c3f86b5611fd5f59c71d49c0e3 upstream.
+
+If we can't get inode lock immediately in the function
+ocfs2_inode_lock_with_page() when reading a page, we should not return
+directly here, since this will lead to a softlockup problem when the
+kernel is configured with CONFIG_PREEMPT is not set. The method is to
+get a blocking lock and immediately unlock before returning, this can
+avoid CPU resource waste due to lots of retries, and benefits fairness
+in getting lock among multiple nodes, increase efficiency in case
+modifying the same file frequently from multiple nodes.
+
+The softlockup crash (when set /proc/sys/kernel/softlockup_panic to 1)
+looks like:
+
+ Kernel panic - not syncing: softlockup: hung tasks
+ CPU: 0 PID: 885 Comm: multi_mmap Tainted: G L 4.12.14-6.1-default #1
+ Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
+ Call Trace:
+ <IRQ>
+ dump_stack+0x5c/0x82
+ panic+0xd5/0x21e
+ watchdog_timer_fn+0x208/0x210
+ __hrtimer_run_queues+0xcc/0x200
+ hrtimer_interrupt+0xa6/0x1f0
+ smp_apic_timer_interrupt+0x34/0x50
+ apic_timer_interrupt+0x96/0xa0
+ </IRQ>
+ RIP: 0010:unlock_page+0x17/0x30
+ RSP: 0000:ffffaf154080bc88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
+ RAX: dead000000000100 RBX: fffff21e009f5300 RCX: 0000000000000004
+ RDX: dead0000000000ff RSI: 0000000000000202 RDI: fffff21e009f5300
+ RBP: 0000000000000000 R08: 0000000000000000 R09: ffffaf154080bb00
+ R10: ffffaf154080bc30 R11: 0000000000000040 R12: ffff993749a39518
+ R13: 0000000000000000 R14: fffff21e009f5300 R15: fffff21e009f5300
+ ocfs2_inode_lock_with_page+0x25/0x30 [ocfs2]
+ ocfs2_readpage+0x41/0x2d0 [ocfs2]
+ filemap_fault+0x12b/0x5c0
+ ocfs2_fault+0x29/0xb0 [ocfs2]
+ __do_fault+0x1a/0xa0
+ __handle_mm_fault+0xbe8/0x1090
+ handle_mm_fault+0xaa/0x1f0
+ __do_page_fault+0x235/0x4b0
+ trace_do_page_fault+0x3c/0x110
+ async_page_fault+0x28/0x30
+ RIP: 0033:0x7fa75ded638e
+ RSP: 002b:00007ffd6657db18 EFLAGS: 00010287
+ RAX: 000055c7662fb700 RBX: 0000000000000001 RCX: 000055c7662fb700
+ RDX: 0000000000001770 RSI: 00007fa75e909000 RDI: 000055c7662fb700
+ RBP: 0000000000000003 R08: 000000000000000e R09: 0000000000000000
+ R10: 0000000000000483 R11: 00007fa75ded61b0 R12: 00007fa75e90a770
+ R13: 000000000000000e R14: 0000000000001770 R15: 0000000000000000
+
+About performance improvement, we can see the testing time is reduced,
+and CPU utilization decreases, the detailed data is as follows. I ran
+multi_mmap test case in ocfs2-test package in a three nodes cluster.
+
+Before applying this patch:
+ PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
+ 2754 ocfs2te+ 20 0 170248 6980 4856 D 80.73 0.341 0:18.71 multi_mmap
+ 1505 root rt 0 222236 123060 97224 S 2.658 6.015 0:01.44 corosync
+ 5 root 20 0 0 0 0 S 1.329 0.000 0:00.19 kworker/u8:0
+ 95 root 20 0 0 0 0 S 1.329 0.000 0:00.25 kworker/u8:1
+ 2728 root 20 0 0 0 0 S 0.997 0.000 0:00.24 jbd2/sda1-33
+ 2721 root 20 0 0 0 0 S 0.664 0.000 0:00.07 ocfs2dc-3C8CFD4
+ 2750 ocfs2te+ 20 0 142976 4652 3532 S 0.664 0.227 0:00.28 mpirun
+
+ ocfs2test@tb-node2:~>multiple_run.sh -i ens3 -k ~/linux-4.4.21-69.tar.gz -o ~/ocfs2mullog -C hacluster -s pcmk -n tb-node2,tb-node1,tb-node3 -d /dev/sda1 -b 4096 -c 32768 -t multi_mmap /mnt/shared
+ Tests with "-b 4096 -C 32768"
+ Thu Dec 28 14:44:52 CST 2017
+ multi_mmap..................................................Passed.
+ Runtime 783 seconds.
+
+After apply this patch:
+
+ PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
+ 2508 ocfs2te+ 20 0 170248 6804 4680 R 54.00 0.333 0:55.37 multi_mmap
+ 155 root 20 0 0 0 0 S 2.667 0.000 0:01.20 kworker/u8:3
+ 95 root 20 0 0 0 0 S 2.000 0.000 0:01.58 kworker/u8:1
+ 2504 ocfs2te+ 20 0 142976 4604 3480 R 1.667 0.225 0:01.65 mpirun
+ 5 root 20 0 0 0 0 S 1.000 0.000 0:01.36 kworker/u8:0
+ 2482 root 20 0 0 0 0 S 1.000 0.000 0:00.86 jbd2/sda1-33
+ 299 root 0 -20 0 0 0 S 0.333 0.000 0:00.13 kworker/2:1H
+ 335 root 0 -20 0 0 0 S 0.333 0.000 0:00.17 kworker/1:1H
+ 535 root 20 0 12140 7268 1456 S 0.333 0.355 0:00.34 haveged
+ 1282 root rt 0 222284 123108 97224 S 0.333 6.017 0:01.33 corosync
+
+ ocfs2test@tb-node2:~>multiple_run.sh -i ens3 -k ~/linux-4.4.21-69.tar.gz -o ~/ocfs2mullog -C hacluster -s pcmk -n tb-node2,tb-node1,tb-node3 -d /dev/sda1 -b 4096 -c 32768 -t multi_mmap /mnt/shared
+ Tests with "-b 4096 -C 32768"
+ Thu Dec 28 15:04:12 CST 2017
+ multi_mmap..................................................Passed.
+ Runtime 487 seconds.
+
+Link: http://lkml.kernel.org/r/1514447305-30814-1-git-send-email-ghe@suse.com
+Fixes: 1cce4df04f37 ("ocfs2: do not lock/unlock() inode DLM lock")
+Signed-off-by: Gang He <ghe@suse.com>
+Reviewed-by: Eric Ren <zren@suse.com>
+Acked-by: alex chen <alex.chen@huawei.com>
+Acked-by: piaojun <piaojun@huawei.com>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ocfs2/dlmglue.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -2486,6 +2486,15 @@ int ocfs2_inode_lock_with_page(struct in
+ ret = ocfs2_inode_lock_full(inode, ret_bh, ex, OCFS2_LOCK_NONBLOCK);
+ if (ret == -EAGAIN) {
+ unlock_page(page);
++ /*
++ * If we can't get inode lock immediately, we should not return
++ * directly here, since this will lead to a softlockup problem.
++ * The method is to get a blocking lock and immediately unlock
++ * before returning, this can avoid CPU resource waste due to
++ * lots of retries, and benefits fairness in getting lock.
++ */
++ if (ocfs2_inode_lock(inode, ret_bh, ex) == 0)
++ ocfs2_inode_unlock(inode, ex);
+ ret = AOP_TRUNCATED_PAGE;
+ }
+
--- /dev/null
+From d1bf2d30728f310f72296b54f0651ecdb09cbb12 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Sun, 5 Nov 2017 21:27:41 -0800
+Subject: PM / devfreq: Propagate error from devfreq_add_device()
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit d1bf2d30728f310f72296b54f0651ecdb09cbb12 upstream.
+
+Propagate the error of devfreq_add_device() in devm_devfreq_add_device()
+rather than statically returning ENOMEM. This makes it slightly faster
+to pinpoint the cause of a returned error.
+
+Fixes: 8cd84092d35e ("PM / devfreq: Add resource-managed function for devfreq device")
+Cc: stable@vger.kernel.org
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/devfreq/devfreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -737,7 +737,7 @@ struct devfreq *devm_devfreq_add_device(
+ devfreq = devfreq_add_device(dev, profile, governor_name, data);
+ if (IS_ERR(devfreq)) {
+ devres_free(ptr);
+- return ERR_PTR(-ENOMEM);
++ return devfreq;
+ }
+
+ *ptr = devfreq;
--- /dev/null
+From 384dfd627f1ee67d028e6f14c6e9bf5a1e2a7a24 Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Date: Tue, 28 Nov 2017 13:39:43 -0600
+Subject: powerpc/kernel: Block interrupts when updating TIDR
+
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit 384dfd627f1ee67d028e6f14c6e9bf5a1e2a7a24 upstream.
+
+clear_thread_tidr() is called in interrupt context as a part of delayed
+put of the task structure (i.e as a part of timer interrupt). To prevent
+a deadlock, block interrupts when holding vas_thread_id_lock to set/
+clear TIDR for a task.
+
+Fixes: ec233ede4c86 ("powerpc: Add support for setting SPRN_TIDR")
+Cc: stable@vger.kernel.org # v4.15+
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1509,14 +1509,15 @@ static int assign_thread_tidr(void)
+ {
+ int index;
+ int err;
++ unsigned long flags;
+
+ again:
+ if (!ida_pre_get(&vas_thread_ida, GFP_KERNEL))
+ return -ENOMEM;
+
+- spin_lock(&vas_thread_id_lock);
++ spin_lock_irqsave(&vas_thread_id_lock, flags);
+ err = ida_get_new_above(&vas_thread_ida, 1, &index);
+- spin_unlock(&vas_thread_id_lock);
++ spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+
+ if (err == -EAGAIN)
+ goto again;
+@@ -1524,9 +1525,9 @@ again:
+ return err;
+
+ if (index > MAX_THREAD_CONTEXT) {
+- spin_lock(&vas_thread_id_lock);
++ spin_lock_irqsave(&vas_thread_id_lock, flags);
+ ida_remove(&vas_thread_ida, index);
+- spin_unlock(&vas_thread_id_lock);
++ spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+ return -ENOMEM;
+ }
+
+@@ -1535,9 +1536,11 @@ again:
+
+ static void free_thread_tidr(int id)
+ {
+- spin_lock(&vas_thread_id_lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&vas_thread_id_lock, flags);
+ ida_remove(&vas_thread_ida, id);
+- spin_unlock(&vas_thread_id_lock);
++ spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+ }
+
+ /*
--- /dev/null
+From 62e984ddfd6b056d399e24113f5e6a7145e579d8 Mon Sep 17 00:00:00 2001
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Thu, 1 Feb 2018 16:09:44 +1100
+Subject: powerpc/mm: Flush radix process translations when setting MMU type
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+commit 62e984ddfd6b056d399e24113f5e6a7145e579d8 upstream.
+
+Radix guests do normally invalidate process-scoped translations when a
+new pid is allocated but migrated guests do not invalidate these so
+migrated guests crash sometime, especially easy to reproduce with
+migration happening within first 10 seconds after the guest boot start
+on the same machine.
+
+This adds the "Invalidate process-scoped translations" flush to fix
+radix guests migration.
+
+Fixes: 2ee13be34b13 ("KVM: PPC: Book3S HV: Update kvmppc_set_arch_compat() for ISA v3.00")
+Cc: stable@vger.kernel.org # v4.10+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Tested-by: Laurent Vivier <lvivier@redhat.com>
+Tested-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/pgtable_64.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/mm/pgtable_64.c
++++ b/arch/powerpc/mm/pgtable_64.c
+@@ -483,6 +483,8 @@ void mmu_partition_table_set_entry(unsig
+ if (old & PATB_HR) {
+ asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
+ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++ asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
++ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+ trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
+ } else {
+ asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
--- /dev/null
+From 1d9a090783bef19fe8cdec878620d22f05191316 Mon Sep 17 00:00:00 2001
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Date: Fri, 26 Jan 2018 13:41:59 -0600
+Subject: powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+commit 1d9a090783bef19fe8cdec878620d22f05191316 upstream.
+
+When DLPAR removing a CPU, the unmapping of the cpu from a node in
+unmap_cpu_from_node() should also invalidate the CPUs entry in the
+numa_cpu_lookup_table. There is not a guarantee that on a subsequent
+DLPAR add of the CPU the associativity will be the same and thus
+could be in a different node. Invalidating the entry in the
+numa_cpu_lookup_table causes the associativity to be read from the
+device tree at the time of the add.
+
+The current behavior of not invalidating the CPUs entry in the
+numa_cpu_lookup_table can result in scenarios where the the topology
+layout of CPUs in the partition does not match the device tree
+or the topology reported by the HMC.
+
+This bug looks like it was introduced in 2004 in the commit titled
+"ppc64: cpu hotplug notifier for numa", which is 6b15e4e87e32 in the
+linux-fullhist tree. Hence tag it for all stable releases.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/topology.h | 5 +++++
+ arch/powerpc/mm/numa.c | 5 -----
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 ++
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -44,6 +44,11 @@ extern int sysfs_add_device_to_node(stru
+ extern void sysfs_remove_device_from_node(struct device *dev, int nid);
+ extern int numa_update_cpu_topology(bool cpus_locked);
+
++static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node)
++{
++ numa_cpu_lookup_table[cpu] = node;
++}
++
+ static inline int early_cpu_to_node(int cpu)
+ {
+ int nid;
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -142,11 +142,6 @@ static void reset_numa_cpu_lookup_table(
+ numa_cpu_lookup_table[cpu] = -1;
+ }
+
+-static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+-{
+- numa_cpu_lookup_table[cpu] = node;
+-}
+-
+ static void map_cpu_to_node(int cpu, int node)
+ {
+ update_numa_cpu_lookup_table(cpu, node);
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -36,6 +36,7 @@
+ #include <asm/xics.h>
+ #include <asm/xive.h>
+ #include <asm/plpar_wrappers.h>
++#include <asm/topology.h>
+
+ #include "pseries.h"
+ #include "offline_states.h"
+@@ -331,6 +332,7 @@ static void pseries_remove_processor(str
+ BUG_ON(cpu_online(cpu));
+ set_cpu_present(cpu, false);
+ set_hard_smp_processor_id(cpu, -1);
++ update_numa_cpu_lookup_table(cpu, -1);
+ break;
+ }
+ if (cpu >= nr_cpu_ids)
--- /dev/null
+From 8d81296cfcce89013a714feb8d25004a156f8181 Mon Sep 17 00:00:00 2001
+From: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
+Date: Thu, 30 Nov 2017 14:35:54 +0530
+Subject: powerpc/radix: Remove trace_tlbie call from radix__flush_tlb_all
+
+From: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
+
+commit 8d81296cfcce89013a714feb8d25004a156f8181 upstream.
+
+radix__flush_tlb_all() is called only in kexec path in real mode and any
+tracepoints at this stage will make kexec to fail if enabled.
+
+To verify enable tlbie trace before kexec.
+
+$ echo 1 > /sys/kernel/debug/tracing/events/powerpc/tlbie/enable
+== kexec into new kernel and kexec fails.
+
+Fix this by not calling trace_tlbie from radix__flush_tlb_all().
+
+Fixes: 0428491cba92 ("powerpc/mm: Trace tlbie(l) instructions")
+Cc: stable@vger.kernel.org # v4.13+
+Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
+Acked-by: Balbir Singh <bsingharora@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/tlb-radix.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -600,14 +600,12 @@ void radix__flush_tlb_all(void)
+ */
+ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ : : "r"(rb), "i"(r), "i"(1), "i"(ric), "r"(rs) : "memory");
+- trace_tlbie(0, 0, rb, rs, ric, prs, r);
+ /*
+ * now flush host entires by passing PRS = 0 and LPID == 0
+ */
+ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(0) : "memory");
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+- trace_tlbie(0, 0, rb, 0, ric, prs, r);
+ }
+
+ void radix__flush_tlb_pte_p9_dd1(unsigned long old_pte, struct mm_struct *mm,
--- /dev/null
+From b00b62898631b756c3e123542bbb0487aa343dd9 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Thu, 8 Feb 2018 19:18:38 +1000
+Subject: powerpc/vas: Don't set uses_vas for kernel windows
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+commit b00b62898631b756c3e123542bbb0487aa343dd9 upstream.
+
+cp_abort is only required for user windows, because kernel context
+must not be preempted between a copy/paste pair.
+
+Without this patch, the init task gets used_vas set when it runs the
+nx842_powernv_init initcall, which opens windows for kernel usage.
+
+used_vas is then never cleared anywhere, so it gets propagated into
+all other tasks. It's a property of the address space, so it should
+really be cleared when a new mm is created (or in dup_mmap if the
+mmaps are marked as VM_DONTCOPY). For now we seem to have no such
+driver, so leave that for another patch.
+
+Fixes: 6c8e6bb2a52d ("powerpc/vas: Add support for user receive window")
+Cc: stable@vger.kernel.org # v4.15+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/vas-window.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/powerpc/platforms/powernv/vas-window.c
++++ b/arch/powerpc/platforms/powernv/vas-window.c
+@@ -1063,16 +1063,16 @@ struct vas_window *vas_tx_win_open(int v
+ rc = PTR_ERR(txwin->paste_kaddr);
+ goto free_window;
+ }
++ } else {
++ /*
++ * A user mapping must ensure that context switch issues
++ * CP_ABORT for this thread.
++ */
++ rc = set_thread_uses_vas();
++ if (rc)
++ goto free_window;
+ }
+
+- /*
+- * Now that we have a send window, ensure context switch issues
+- * CP_ABORT for this thread.
+- */
+- rc = -EINVAL;
+- if (set_thread_uses_vas() < 0)
+- goto free_window;
+-
+ set_vinst_win(vinst, txwin);
+
+ return txwin;
--- /dev/null
+From 8e036c8d30a2cd9d8fc7442fbf6824e0a3e986e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Tue, 13 Feb 2018 09:47:12 +0100
+Subject: powerpc/xive: Use hw CPU ids when configuring the CPU queues
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+commit 8e036c8d30a2cd9d8fc7442fbf6824e0a3e986e7 upstream.
+
+The CPU event notification queues on sPAPR should be configured using
+a hardware CPU identifier.
+
+The problem did not show up on the Power Hypervisor because pHyp
+supports 8 threads per core which keeps CPU number contiguous. This is
+not the case on all sPAPR virtual machines, some use SMT=1.
+
+Also improve error logging by adding the CPU number.
+
+Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller")
+Cc: stable@vger.kernel.org # v4.14+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/sysdev/xive/spapr.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u3
+
+ rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
+ if (rc) {
+- pr_err("Error %lld getting queue info prio %d\n", rc, prio);
++ pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
++ target, prio);
+ rc = -EIO;
+ goto fail;
+ }
+@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u3
+ /* Configure and enable the queue in HW */
+ rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
+ if (rc) {
+- pr_err("Error %lld setting queue for prio %d\n", rc, prio);
++ pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
++ target, prio);
+ rc = -EIO;
+ } else {
+ q->qpage = qpage;
+@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsign
+ if (IS_ERR(qpage))
+ return PTR_ERR(qpage);
+
+- return xive_spapr_configure_queue(cpu, q, prio, qpage,
+- xive_queue_shift);
++ return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
++ q, prio, qpage, xive_queue_shift);
+ }
+
+ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
+@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(uns
+ struct xive_q *q = &xc->queue[prio];
+ unsigned int alloc_order;
+ long rc;
++ int hw_cpu = get_hard_smp_processor_id(cpu);
+
+- rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
++ rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
+ if (rc)
+- pr_err("Error %ld setting queue for prio %d\n", rc, prio);
++ pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
++ hw_cpu, prio);
+
+ alloc_order = xive_alloc_order(xive_queue_shift);
+ free_pages((unsigned long)q->qpage, alloc_order);
--- /dev/null
+From 6dd0d2d22aa363fec075cb2577ba273ac8462e94 Mon Sep 17 00:00:00 2001
+From: Eugene Syromiatnikov <esyr@redhat.com>
+Date: Mon, 15 Jan 2018 20:38:17 +0100
+Subject: s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
+
+From: Eugene Syromiatnikov <esyr@redhat.com>
+
+commit 6dd0d2d22aa363fec075cb2577ba273ac8462e94 upstream.
+
+For some reason, the implementation of some 16-bit ID system calls
+(namely, setuid16/setgid16 and setfsuid16/setfsgid16) used type cast
+instead of low2highgid/low2highuid macros for converting [GU]IDs, which
+led to incorrect handling of value of -1 (which ought to be considered
+invalid).
+
+Discovered by strace test suite.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/compat_linux.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/s390/kernel/compat_linux.c
++++ b/arch/s390/kernel/compat_linux.c
+@@ -110,7 +110,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setregid16,
+
+ COMPAT_SYSCALL_DEFINE1(s390_setgid16, u16, gid)
+ {
+- return sys_setgid((gid_t)gid);
++ return sys_setgid(low2highgid(gid));
+ }
+
+ COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid)
+@@ -120,7 +120,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setreuid16,
+
+ COMPAT_SYSCALL_DEFINE1(s390_setuid16, u16, uid)
+ {
+- return sys_setuid((uid_t)uid);
++ return sys_setuid(low2highuid(uid));
+ }
+
+ COMPAT_SYSCALL_DEFINE3(s390_setresuid16, u16, ruid, u16, euid, u16, suid)
+@@ -173,12 +173,12 @@ COMPAT_SYSCALL_DEFINE3(s390_getresgid16,
+
+ COMPAT_SYSCALL_DEFINE1(s390_setfsuid16, u16, uid)
+ {
+- return sys_setfsuid((uid_t)uid);
++ return sys_setfsuid(low2highuid(uid));
+ }
+
+ COMPAT_SYSCALL_DEFINE1(s390_setfsgid16, u16, gid)
+ {
+- return sys_setfsgid((gid_t)gid);
++ return sys_setfsgid(low2highgid(gid));
+ }
+
+ static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info)
rdma-rxe-fix-a-race-condition-related-to-the-qp-error-state.patch
rdma-rxe-fix-a-race-condition-in-rxe_requester.patch
rdma-rxe-fix-rxe_qp_cleanup.patch
+cpufreq-powernv-dont-assume-distinct-pstate-values-for-nominal-and-pmin.patch
+swiotlb-suppress-warning-when-__gfp_nowarn-is-set.patch
+pm-devfreq-propagate-error-from-devfreq_add_device.patch
+mwifiex-resolve-reset-vs.-remove-shutdown-deadlocks.patch
+ocfs2-try-a-blocking-lock-before-return-aop_truncated_page.patch
+trace_uprobe-display-correct-offset-in-uprobe_events.patch
+powerpc-radix-remove-trace_tlbie-call-from-radix__flush_tlb_all.patch
+powerpc-kernel-block-interrupts-when-updating-tidr.patch
+powerpc-vas-don-t-set-uses_vas-for-kernel-windows.patch
+powerpc-numa-invalidate-numa_cpu_lookup_table-on-cpu-remove.patch
+powerpc-mm-flush-radix-process-translations-when-setting-mmu-type.patch
+powerpc-xive-use-hw-cpu-ids-when-configuring-the-cpu-queues.patch
+dma-buf-fix-reservation_object_wait_timeout_rcu-once-more-v2.patch
+s390-fix-handling-of-1-in-set-fs-id16-syscalls.patch
+arm64-dts-msm8916-correct-ipc-references-for-smsm.patch
+arm-lpc3250-fix-uda1380-gpio-numbers.patch
+arm-dts-sti-add-gpio-polarity-for-hdmi-hpd-gpio-property.patch
+arm-dts-nomadik-add-interrupt-parent-for-clcd.patch
+arm-dts-mt7623-fix-card-detection-issue-on-bananapi-r2.patch
+arm-spear600-add-missing-interrupt-parent-of-rtc.patch
+arm-spear13xx-fix-dmas-cells.patch
+arm-spear13xx-fix-spics-gpio-controller-s-warning.patch
+x86-gpu-add-cfl-to-early-quirks.patch
+x86-kexec-make-kexec-mostly-work-in-5-level-paging-mode.patch
+x86-xen-init-gs-very-early-to-avoid-page-faults-with-stack-protector.patch
+x86-pm-make-apm-idle-driver-initialize-polling-state.patch
--- /dev/null
+From d0bc0c2a31c95002d37c3cc511ffdcab851b3256 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <ckoenig.leichtzumerken@gmail.com>
+Date: Thu, 4 Jan 2018 14:24:19 +0100
+Subject: swiotlb: suppress warning when __GFP_NOWARN is set
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <ckoenig.leichtzumerken@gmail.com>
+
+commit d0bc0c2a31c95002d37c3cc511ffdcab851b3256 upstream.
+
+TTM tries to allocate coherent memory in chunks of 2MB first to improve
+TLB efficiency and falls back to allocating 4K pages if that fails.
+
+Suppress the warning when the 2MB allocations fails since there is a
+valid fall back path.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reported-by: Mike Galbraith <efault@gmx.de>
+Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=104082
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/swiotlb.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/lib/swiotlb.c
++++ b/lib/swiotlb.c
+@@ -586,7 +586,7 @@ phys_addr_t swiotlb_tbl_map_single(struc
+
+ not_found:
+ spin_unlock_irqrestore(&io_tlb_lock, flags);
+- if (printk_ratelimit())
++ if (!(attrs & DMA_ATTR_NO_WARN) && printk_ratelimit())
+ dev_warn(hwdev, "swiotlb buffer is full (sz: %zd bytes)\n", size);
+ return SWIOTLB_MAP_ERROR;
+ found:
+@@ -713,6 +713,7 @@ void *
+ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ dma_addr_t *dma_handle, gfp_t flags)
+ {
++ bool warn = !(flags & __GFP_NOWARN);
+ dma_addr_t dev_addr;
+ void *ret;
+ int order = get_order(size);
+@@ -738,8 +739,8 @@ swiotlb_alloc_coherent(struct device *hw
+ * GFP_DMA memory; fall back on map_single(), which
+ * will grab memory from the lowest available address range.
+ */
+- phys_addr_t paddr = map_single(hwdev, 0, size,
+- DMA_FROM_DEVICE, 0);
++ phys_addr_t paddr = map_single(hwdev, 0, size, DMA_FROM_DEVICE,
++ warn ? 0 : DMA_ATTR_NO_WARN);
+ if (paddr == SWIOTLB_MAP_ERROR)
+ goto err_warn;
+
+@@ -769,9 +770,11 @@ swiotlb_alloc_coherent(struct device *hw
+ return ret;
+
+ err_warn:
+- pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n",
+- dev_name(hwdev), size);
+- dump_stack();
++ if (warn && printk_ratelimit()) {
++ pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n",
++ dev_name(hwdev), size);
++ dump_stack();
++ }
+
+ return NULL;
+ }
--- /dev/null
+From 0e4d819d0893dc043ea7b7cb6baf4be1e310bd96 Mon Sep 17 00:00:00 2001
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Sat, 6 Jan 2018 11:12:46 +0530
+Subject: trace_uprobe: Display correct offset in uprobe_events
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+commit 0e4d819d0893dc043ea7b7cb6baf4be1e310bd96 upstream.
+
+Recently, how the pointers being printed with %p has been changed
+by commit ad67b74d2469 ("printk: hash addresses printed with %p").
+This is causing a regression while showing offset in the
+uprobe_events file. Instead of %p, use %px to display offset.
+
+Before patch:
+
+ # perf probe -vv -x /tmp/a.out main
+ Opening /sys/kernel/debug/tracing//uprobe_events write=1
+ Writing event: p:probe_a/main /tmp/a.out:0x58c
+
+ # cat /sys/kernel/debug/tracing/uprobe_events
+ p:probe_a/main /tmp/a.out:0x0000000049a0f352
+
+After patch:
+
+ # cat /sys/kernel/debug/tracing/uprobe_events
+ p:probe_a/main /tmp/a.out:0x000000000000058c
+
+Link: http://lkml.kernel.org/r/20180106054246.15375-1-ravi.bangoria@linux.vnet.ibm.com
+
+Cc: stable@vger.kernel.org
+Fixes: ad67b74d2469 ("printk: hash addresses printed with %p")
+Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_uprobe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -608,7 +608,7 @@ static int probes_seq_show(struct seq_fi
+
+ /* Don't print "0x (null)" when offset is 0 */
+ if (tu->offset) {
+- seq_printf(m, "0x%p", (void *)tu->offset);
++ seq_printf(m, "0x%px", (void *)tu->offset);
+ } else {
+ switch (sizeof(void *)) {
+ case 4:
--- /dev/null
+From 33aa69ed8aacd92dea12671e52eb3ca6ac2d7a49 Mon Sep 17 00:00:00 2001
+From: Lucas De Marchi <lucas.demarchi@intel.com>
+Date: Wed, 13 Dec 2017 12:04:25 -0800
+Subject: x86/gpu: add CFL to early quirks
+
+From: Lucas De Marchi <lucas.demarchi@intel.com>
+
+commit 33aa69ed8aacd92dea12671e52eb3ca6ac2d7a49 upstream.
+
+CFL was missing from intel_early_ids[]. The PCI ID needs to be there to
+allow the memory region to be stolen, otherwise we could have RAM being
+arbitrarily overwritten if for example we keep using the UEFI framebuffer,
+depending on how BIOS has set up the e820 map.
+
+Fixes: b056f8f3d6b9 ("drm/i915/cfl: Add Coffee Lake PCI IDs for S Skus.")
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Anusha Srivatsa <anusha.srivatsa@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: David Airlie <airlied@linux.ie>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86@kernel.org
+Cc: <stable@vger.kernel.org> # v4.13+ 0890540e21cf drm/i915: add GT number to intel_device_info
+Cc: <stable@vger.kernel.org> # v4.13+ 41693fd52373 drm/i915/kbl: Change a KBL pci id to GT2 from GT1.5
+Cc: <stable@vger.kernel.org> # v4.13+
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171213200425.2954-1-lucas.demarchi@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/early-quirks.c | 1 +
+ include/drm/i915_pciids.h | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -527,6 +527,7 @@ static const struct pci_device_id intel_
+ INTEL_SKL_IDS(&gen9_early_ops),
+ INTEL_BXT_IDS(&gen9_early_ops),
+ INTEL_KBL_IDS(&gen9_early_ops),
++ INTEL_CFL_IDS(&gen9_early_ops),
+ INTEL_GLK_IDS(&gen9_early_ops),
+ INTEL_CNL_IDS(&gen9_early_ops),
+ };
+--- a/include/drm/i915_pciids.h
++++ b/include/drm/i915_pciids.h
+@@ -392,6 +392,12 @@
+ INTEL_VGA_DEVICE(0x3EA8, info), /* ULT GT3 */ \
+ INTEL_VGA_DEVICE(0x3EA5, info) /* ULT GT3 */
+
++#define INTEL_CFL_IDS(info) \
++ INTEL_CFL_S_GT1_IDS(info), \
++ INTEL_CFL_S_GT2_IDS(info), \
++ INTEL_CFL_H_GT2_IDS(info), \
++ INTEL_CFL_U_GT3_IDS(info)
++
+ /* CNL U 2+2 */
+ #define INTEL_CNL_U_GT2_IDS(info) \
+ INTEL_VGA_DEVICE(0x5A52, info), \
--- /dev/null
+From 5bf30316991d5bcda046343ee77d823cf16fdd03 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Mon, 29 Jan 2018 14:08:45 +0300
+Subject: x86/kexec: Make kexec (mostly) work in 5-level paging mode
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+commit 5bf30316991d5bcda046343ee77d823cf16fdd03 upstream.
+
+Currently kexec() will crash when switching into a 5-level paging
+enabled kernel.
+
+I missed that we need to change relocate_kernel() to set CR4.LA57
+flag if the kernel has 5-level paging enabled.
+
+I avoided using #ifdef CONFIG_X86_5LEVEL here and inferred if we need to
+enable 5-level paging from previous CR4 value. This way the code is
+ready for boot-time switching between paging modes.
+
+With this patch applied, in addition to kexec 4-to-4 which always worked,
+we can kexec 4-to-5 and 5-to-5 - while 5-to-4 will need more work.
+
+Reported-by: Baoquan He <bhe@redhat.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Tested-by: Baoquan He <bhe@redhat.com>
+Cc: <stable@vger.kernel.org> # v4.14+
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-mm@kvack.org
+Fixes: 77ef56e4f0fb ("x86: Enable 5-level paging support via CONFIG_X86_5LEVEL=y")
+Link: http://lkml.kernel.org/r/20180129110845.26633-1-kirill.shutemov@linux.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/relocate_kernel_64.S | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/relocate_kernel_64.S
++++ b/arch/x86/kernel/relocate_kernel_64.S
+@@ -68,6 +68,9 @@ relocate_kernel:
+ movq %cr4, %rax
+ movq %rax, CR4(%r11)
+
++ /* Save CR4. Required to enable the right paging mode later. */
++ movq %rax, %r13
++
+ /* zero out flags, and disable interrupts */
+ pushq $0
+ popfq
+@@ -126,8 +129,13 @@ identity_mapped:
+ /*
+ * Set cr4 to a known state:
+ * - physical address extension enabled
++ * - 5-level paging, if it was enabled before
+ */
+ movl $X86_CR4_PAE, %eax
++ testq $X86_CR4_LA57, %r13
++ jz 1f
++ orl $X86_CR4_LA57, %eax
++1:
+ movq %rax, %cr4
+
+ jmp 1f
--- /dev/null
+From f859422075165e32c00c8d75d63f300015cc07ae Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 6 Feb 2018 18:55:12 +0100
+Subject: x86: PM: Make APM idle driver initialize polling state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit f859422075165e32c00c8d75d63f300015cc07ae upstream.
+
+Update the APM driver overlooked by commit 1b39e3f813b4 (cpuidle: Make
+drivers initialize polling state) to initialize the polling state like
+the other cpuidle drivers modified by that commit to prevent cpuidle
+from crashing.
+
+Fixes: 1b39e3f813b4 (cpuidle: Make drivers initialize polling state)
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/apm_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/apm_32.c
++++ b/arch/x86/kernel/apm_32.c
+@@ -2389,6 +2389,7 @@ static int __init apm_init(void)
+ if (HZ != 100)
+ idle_period = (idle_period * HZ) / 100;
+ if (idle_threshold < 100) {
++ cpuidle_poll_state_init(&apm_idle_driver);
+ if (!cpuidle_register_driver(&apm_idle_driver))
+ if (cpuidle_register_device(&apm_cpuidle_device))
+ cpuidle_unregister_driver(&apm_idle_driver);
--- /dev/null
+From 4f277295e54c5b7340e48efea3fc5cc21a2872b7 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 1 Feb 2018 13:40:19 +0100
+Subject: x86/xen: init %gs very early to avoid page faults with stack protector
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 4f277295e54c5b7340e48efea3fc5cc21a2872b7 upstream.
+
+When running as Xen pv guest %gs is initialized some time after
+C code is started. Depending on stack protector usage this might be
+too late, resulting in page faults.
+
+So setup %gs and MSR_GS_BASE in assembly code already.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Tested-by: Chris Patterson <cjp256@gmail.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/xen-head.S | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/arch/x86/xen/xen-head.S
++++ b/arch/x86/xen/xen-head.S
+@@ -9,7 +9,9 @@
+
+ #include <asm/boot.h>
+ #include <asm/asm.h>
++#include <asm/msr.h>
+ #include <asm/page_types.h>
++#include <asm/percpu.h>
+ #include <asm/unwind_hints.h>
+
+ #include <xen/interface/elfnote.h>
+@@ -35,6 +37,20 @@ ENTRY(startup_xen)
+ mov %_ASM_SI, xen_start_info
+ mov $init_thread_union+THREAD_SIZE, %_ASM_SP
+
++#ifdef CONFIG_X86_64
++ /* Set up %gs.
++ *
++ * The base of %gs always points to the bottom of the irqstack
++ * union. If the stack protector canary is enabled, it is
++ * located at %gs:40. Note that, on SMP, the boot cpu uses
++ * init data section till per cpu areas are set up.
++ */
++ movl $MSR_GS_BASE,%ecx
++ movq $INIT_PER_CPU_VAR(irq_stack_union),%rax
++ cdq
++ wrmsr
++#endif
++
+ jmp xen_start_kernel
+ END(startup_xen)
+ __FINIT
projects / thirdparty / kernel / stable-queue.git / commitdiff
